diff --git a/AddMSPApp/huntress.app.xml b/AddMSPApp/huntress.app.xml
index ad4f731a67ff8..7da78e3b95b1c 100644
--- a/AddMSPApp/huntress.app.xml
+++ b/AddMSPApp/huntress.app.xml
@@ -1,15 +1,15 @@
 <ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
   <Name>install.ps1</Name>
-  <UnencryptedContentSize>8859</UnencryptedContentSize>
+  <UnencryptedContentSize>17583</UnencryptedContentSize>
   <FileName>huntress.intunewin</FileName>
   <SetupFile>install.ps1</SetupFile>
   <EncryptionInfo>
-    <EncryptionKey>0wrFiLHex//63XQZEbX535qvhQE5+MiZmfPho1CMrT4=</EncryptionKey>
-    <MacKey>UOlXFsrh+Pq6ZZNmg2+gzuTCSDAxQNUDVkc6oR5SVAY=</MacKey>
-    <InitializationVector>x0cPnMjK6AZARRPhOfC5pg==</InitializationVector>
-    <Mac>z+N/v0mfq8T871kS07/QZ1Lgay2hRabSxwDWRKz3fG4=</Mac>
+    <EncryptionKey>m7JyMp35G+Kxi3slrppvQYJdgmgPJOkTHZGLHBCnFuY=</EncryptionKey>
+    <MacKey>DxBAhgMG5nEedy933yQgx2mzTJbyku/ax8HEMYFRMQE=</MacKey>
+    <InitializationVector>hdOmI6VtHXWZq1Xr2icByw==</InitializationVector>
+    <Mac>I6tLz8+o06fRsbbKpcE0J/PMA8/2l+B1jyHWarM8NUM=</Mac>
     <ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
-    <FileDigest>z8JuA/5iCrLM1cRkhL3di5eDysNsab62E812KGsrkbY=</FileDigest>
+    <FileDigest>1bcXqEVxloLAnoEW6rHcFW/wJE4TVVfrtSLq9TGV4Ho=</FileDigest>
     <FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
   </EncryptionInfo>
 </ApplicationInfo>
\ No newline at end of file
diff --git a/AddMSPApp/huntress.intunewin b/AddMSPApp/huntress.intunewin
index 12c077f561450..7920439a1ef2a 100644
Binary files a/AddMSPApp/huntress.intunewin and b/AddMSPApp/huntress.intunewin differ
diff --git a/Config/BaselineStandards/Entra (AAD) Standards/UsageLocation.json b/Config/BaselineStandards/Entra (AAD) Standards/UsageLocation.json
new file mode 100644
index 0000000000000..babe250df816b
--- /dev/null
+++ b/Config/BaselineStandards/Entra (AAD) Standards/UsageLocation.json	
@@ -0,0 +1,65 @@
+{
+  "name": "UsageLocation",
+  "label": "Usage location for all users",
+  "cat": "Entra (AAD) Standards",
+  "tag": [],
+  "impact": "Medium Impact",
+  "helpText": "Sets the Entra usage location (the two-letter country code that licensing and security tools such as Huntress ITDR depend on) on every member account. Optionally limit the sweep to members of named groups, skip members of named groups (users legitimately based in another country), or only fill in accounts that have no usage location yet.",
+  "executiveText": "Ensures every employee account records the country it is used from, which Microsoft requires before licences can be assigned and which security monitoring uses to recognise sign-ins from unexpected locations. Staff based in other countries are exempted through a group.",
+  "docsDescription": "Grades every member account against the configured usage location; guest accounts are ignored. Group names are resolved per tenant by display name and expanded to their transitive user members: include groups restrict the sweep to those members, exclude groups remove them from it. A configured group that does not exist in a tenant, or a failed membership lookup, reports No Data rather than sweeping the wrong accounts. With 'only set when blank' enabled, accounts that already carry any usage location are left as they are. Directory-synced accounts are included: usage location is cloud-managed and stays writable for them unless a custom sync rule maps it from on-premises.",
+  "impactColour": "warning",
+  "addedDate": "2026-09-16",
+  "powershellEquivalent": "Update-MgUser -UserId user@domain.com -UsageLocation 'US'",
+  "recommendedBy": [],
+  "requiredCapabilities": [],
+  "secureScoreImpact": 0,
+  "compare": "subset",
+  "variables": {
+    "usageLocation": {
+      "type": "CountryCodeSelect",
+      "label": "Usage location",
+      "required": true
+    },
+    "includeGroups": {
+      "type": "autoComplete",
+      "multiple": true,
+      "creatable": true,
+      "omitWhenBlank": true,
+      "label": "Only apply to members of these groups (display names; blank = all member accounts)"
+    },
+    "excludeGroups": {
+      "type": "autoComplete",
+      "multiple": true,
+      "creatable": true,
+      "omitWhenBlank": true,
+      "label": "Skip members of these groups (display names; users legitimately located elsewhere)"
+    },
+    "onlyWhenBlank": {
+      "type": "switch",
+      "label": "Only set accounts that have no usage location (never overwrite an existing value)",
+      "default": false
+    }
+  },
+  "expected": {
+    "offenders": []
+  },
+  "read": {
+    "cacheType": "Users"
+  },
+  "prepare": "Get-CIPPBaselineUsageLocationState",
+  "remediate": {
+    "executor": "GraphBulkSweep",
+    "refreshCache": [
+      "Users"
+    ],
+    "writes": [
+      {
+        "method": "PATCH",
+        "uri": "users/%id%",
+        "body": {
+          "usageLocation": "%usageLocation%"
+        }
+      }
+    ]
+  }
+}
diff --git a/Config/BaselineStandards/Intune Standards/DevicePrepProfile.json b/Config/BaselineStandards/Intune Standards/DevicePrepProfile.json
index df7e5f6b0bccf..a8efeb330d9e6 100644
--- a/Config/BaselineStandards/Intune Standards/DevicePrepProfile.json	
+++ b/Config/BaselineStandards/Intune Standards/DevicePrepProfile.json	
@@ -75,11 +75,11 @@
       "omitWhenBlank": true,
       "options": [
         {
-          "value": "0",
+          "value": "1",
           "label": "Standard user"
         },
         {
-          "value": "1",
+          "value": "0",
           "label": "Administrator"
         }
       ]
diff --git a/Config/BaselineStandards/SharePoint Standards/SPAnonymousLinkExpiration.json b/Config/BaselineStandards/SharePoint Standards/SPAnonymousLinkExpiration.json
new file mode 100644
index 0000000000000..bf6cf955af25e
--- /dev/null
+++ b/Config/BaselineStandards/SharePoint Standards/SPAnonymousLinkExpiration.json	
@@ -0,0 +1,83 @@
+{
+  "name": "SPAnonymousLinkExpiration",
+  "label": "Set expiration and permissions for Anyone (anonymous) sharing links",
+  "cat": "SharePoint Standards",
+  "tag": [
+    "CISA (MS.SPO.3.1v1)",
+    "CISA (MS.SPO.3.2v1)"
+  ],
+  "impact": "Medium Impact",
+  "helpText": "Requires every Anyone sharing link in SharePoint and OneDrive to expire after the configured number of days. Optionally restricts the permission Anyone links can grant on files and folders (View only, or View and edit). By default Anyone links never expire.",
+  "executiveText": "Ensures that files and folders shared with anyone via a link stop being reachable after a set period, so a link forwarded or leaked months ago no longer grants access. Optionally limits such links to read-only, preventing anonymous recipients from changing shared content. Together these reduce the exposure created by convenience sharing without disabling it.",
+  "docsDescription": "Sets the tenant-wide expiration for Anyone (anonymous) sharing links in SharePoint and OneDrive (SharePoint admin center > Policies > Sharing > Choose expiration and permissions options for Anyone links). Links created after the policy is applied expire at the end of the configured period. A tenant that does not require expiration reads -1 for this property (the SharePoint default), which this standard grades as drift. The optional permission variable additionally grades and sets the maximum permission Anyone links may grant on files and folders (View, or View and edit); leave it blank to grade expiration only. These settings only take effect for tenants whose sharing level permits Anyone links (see the sharingCapability standard).",
+  "impactColour": "warning",
+  "addedDate": "2026-09-14",
+  "powershellEquivalent": "Set-SPOTenant -RequireAnonymousLinksExpireInDays 30 -FileAnonymousLinkType View -FolderAnonymousLinkType View",
+  "recommendedBy": [
+    "CISA"
+  ],
+  "requiredCapabilities": [
+    "SHAREPOINTWAC",
+    "SHAREPOINTSTANDARD",
+    "SHAREPOINTENTERPRISE",
+    "SHAREPOINTENTERPRISE_EDU",
+    "ONEDRIVE_BASIC",
+    "ONEDRIVE_ENTERPRISE"
+  ],
+  "secureScoreImpact": 0,
+  "compare": "subset",
+  "variables": {
+    "days": {
+      "type": "number",
+      "label": "Days until Anyone links expire (1-730, default 30)",
+      "default": 30,
+      "validators": {
+        "min": {
+          "value": 1,
+          "message": "Minimum is 1 day"
+        },
+        "max": {
+          "value": 730,
+          "message": "SharePoint accepts at most 730 days"
+        }
+      }
+    },
+    "linkPermission": {
+      "type": "autoComplete",
+      "label": "Anyone link permission for files and folders (optional - blank grades expiration only)",
+      "options": [
+        {
+          "label": "View only",
+          "value": 1
+        },
+        {
+          "label": "View and edit",
+          "value": 2
+        }
+      ],
+      "omitWhenBlank": true
+    }
+  },
+  "expected": {
+    "RequireAnonymousLinksExpireInDays": "%days%",
+    "FileAnonymousLinkType": "%linkPermission%",
+    "FolderAnonymousLinkType": "%linkPermission%"
+  },
+  "read": {
+    "cacheType": "SPOTenant"
+  },
+  "writeTarget": "spoTenant",
+  "writeTargetProperties": {
+    "RequireAnonymousLinksExpireInDays": "%days%",
+    "FileAnonymousLinkType": "%linkPermission%",
+    "FolderAnonymousLinkType": "%linkPermission%"
+  },
+  "remediate": {
+    "executor": "SPOTenant",
+    "properties": {
+      "RequireAnonymousLinksExpireInDays": "%days%",
+      "FileAnonymousLinkType": "%linkPermission%",
+      "FolderAnonymousLinkType": "%linkPermission%"
+    }
+  }
+}
diff --git a/Config/BecHeuristics.json b/Config/BecHeuristics.json
new file mode 100644
index 0000000000000..c2098ccde98f8
--- /dev/null
+++ b/Config/BecHeuristics.json
@@ -0,0 +1,243 @@
+{
+  "window": {
+    "days": 7
+  },
+  "caps": {
+    "auditLogPages": 10,
+    "mailActivityPages": 10
+  },
+  "score": {
+    "thresholds": {
+      "high": 7,
+      "medium": 4
+    },
+    "newUsersThreshold": 5,
+    "weights": {
+      "NewRules": 3,
+      "InboxRuleChanges": 3,
+      "PermissionChangesTargetingUser": 2,
+      "PermissionChanges": 1,
+      "NewApps": 1,
+      "NewUsers": 1,
+      "SafelistChanges": 2,
+      "SuspiciousRules": 5,
+      "MaliciousApps": 5,
+      "ForeignSuccessfulSignIns": 3,
+      "ForeignActivity": 3,
+      "AnonymousLinks": 3,
+      "MassMail": 3,
+      "RecentMfaMethods": 2,
+      "RecentIntuneDevices": 2,
+      "FlaggedDelegations": 2,
+      "RiskyUserGrants": 3,
+      "CatalogUserGrants": 5,
+      "RiskyTransportRuleChanges": 4,
+      "FlaggedMailboxAddIns": 1,
+      "TyposquatSenders": 3,
+      "DefenderDetections": 3,
+      "FlaggedDirectoryAudits": 2,
+      "RecentRegisteredDevices": 2,
+      "ForeignNonInteractiveSignIns": 3,
+      "SuspiciousMailActivity": 2,
+      "RiskyUserHigh": 4,
+      "RiskyUserMedium": 2,
+      "RiskyUserLow": 1,
+      "ConfirmedCompromised": 5,
+      "AttackerIPs": 4,
+      "AttackerMailAccess": 3,
+      "AttackerFileAccess": 2,
+      "AttackerForms": 3,
+      "DelegatedMailboxAttackerAccess": 3,
+      "OtherAccountsReached": 3
+    }
+  },
+  "inboxRules": {
+    "suspiciousFolderPattern": "RSS",
+    "lowVisibilityFolderRegex": "(?i)(rss|archive|deleted|junk|conversation history|notes|sync issues)",
+    "sensitiveNameRegex": "(?i)(invoice|payment|security|alert|verify|microsoft|admin)",
+    "sensitiveKeywordRegex": "(?i)(invoice|payment|wire|remittance|bank|swift|iban|ach|routing|account number|beneficiary|payroll|password|credential|verif|urgent|confidential)"
+  },
+  "phishingSubjectPatterns": {
+    "Urgent action language": "(?i)urgent.{0,25}(action|response).{0,25}required",
+    "Account verification language": "(?i)(verify|validate).{0,25}(account|identity|password)",
+    "Account suspension language": "(?i)(suspend|disable|expire).{0,25}(account|mailbox|access)",
+    "Prize or lottery language": "(?i)\\b(winner|lottery|prize|gift card)\\b",
+    "Invoice or payment language": "(?i)\\b(invoice|payment|wire|remittance)\\b"
+  },
+  "phishingKeywordPattern": "(?i)\\b(urgent|verify|suspend(?:ed)?|password|credential|invoice|payment|wire|gift card|confidential)\\b",
+  "typosquat": {
+    "minDistance": 1,
+    "maxDistance": 2
+  },
+  "riskyScopes": {
+    "regex": "(?i)(\\.ReadWrite(\\.All)?$|\\.All$|Mail\\.|Files\\.|Directory\\.|RoleManagement\\.|offline_access)"
+  },
+  "transportRules": {
+    "operations": [
+      "New-TransportRule",
+      "Set-TransportRule",
+      "Enable-TransportRule",
+      "Disable-TransportRule",
+      "Remove-TransportRule"
+    ],
+    "riskyParameterRegex": "(?i)^(BlindCopyTo|RedirectMessageTo|CopyTo|AddToRecipients|AddManagerAsRecipientType|RouteMessageOutboundConnector|ModerateMessageByUser|ModerateMessageByManager)$",
+    "recentParameterRegex": "(?i)^(DeleteMessage|Quarantine|SetSCL|RemoveHeader|SetHeaderName)$",
+    "descriptionRegex": "(?i)(redirect|blind copy|bcc|delete|quarantine|set the spam confidence)"
+  },
+  "directoryAudit": {
+    "flaggedActivities": [
+      "User registered security info",
+      "User registered all required security info",
+      "User started security info registration",
+      "User changed default security info",
+      "User deleted security info",
+      "Admin registered security info",
+      "Update user",
+      "Reset password (by admin)",
+      "Change user password",
+      "Reset user password",
+      "Update StsRefreshTokenValidFrom Timestamp",
+      "Consent to application",
+      "Add OAuth2PermissionGrant",
+      "Add app role assignment to service principal",
+      "Add app role assignment grant to user",
+      "Add service principal",
+      "Add service principal credentials",
+      "Add delegated permission grant",
+      "Register device",
+      "Add device",
+      "Add registered owner to device",
+      "Add registered users to device",
+      "Invite external user",
+      "Add user",
+      "Add member to role",
+      "Add eligible member to role",
+      "Disable Strong Authentication",
+      "Update user attributes (StrongAuthentication)"
+    ]
+  },
+  "mailActivity": {
+    "userOperations": [
+      "MailItemsAccessed",
+      "HardDelete",
+      "SoftDelete",
+      "MoveToDeletedItems",
+      "Send",
+      "AttachmentAccess",
+      "Move",
+      "UpdateFolderPermissions",
+      "UpdateCalendarDelegation",
+      "SearchQueryInitiatedExchange",
+      "Set-Mailbox"
+    ],
+    "mailboxOwnerOperations": [
+      "SendAs",
+      "SendOnBehalf"
+    ],
+    "hardDeleteThreshold": 20
+  },
+  "sentMail": {
+    "repeatSubjectMessages": 5,
+    "repeatSubjectRecipients": 20,
+    "minRepeatedSubjectMessages": 3,
+    "burstMessages": 10,
+    "burstRecipients": 30,
+    "burstWindowMinutes": 10
+  },
+  "mailboxAddIns": {
+    "trustedProviderRegex": "(?i)^microsoft"
+  },
+  "delegations": {
+    "folderScopes": [
+      "Calendar",
+      "Inbox"
+    ]
+  },
+  "baseline": {
+    "days": 30,
+    "colleagueSample": 8
+  },
+  "ipVerdict": {
+    "thresholds": {
+      "likelyAttacker": 6,
+      "suspicious": 3,
+      "likelyUser": -3
+    },
+    "minBaselineSignIns": 10,
+    "regularShare": 0.05,
+    "regularDays": 3,
+    "knownAsnShare": 0.2,
+    "knownLocationShare": 0.1,
+    "serviceAsnRegex": "(?i)microsoft",
+    "scriptedUserAgentRegex": "(?i)(python|axios|curl|okhttp|go-http-client|node-fetch|powershell|libwww|java/|httpclient|postman)",
+    "weights": {
+      "flaggedAction": 4,
+      "flaggedActionExtraKind": 1,
+      "hostingOrProxy": 3,
+      "foreign": 2,
+      "newToUser": 2,
+      "newNetwork": 1,
+      "newLocation": 1,
+      "riskySignIn": 3,
+      "riskySignInLow": 1,
+      "scriptedClient": 3,
+      "widerAttack": 2,
+      "sharedSession": 3,
+      "blockListHint": 2,
+      "baselineRegular": -4,
+      "baselineSeen": -2,
+      "knownNetwork": -1,
+      "knownLocation": -1,
+      "compliantDevice": -2,
+      "colleagues": -2,
+      "trustedNamedLocation": -4,
+      "technicianAddress": -4,
+      "allowListHint": -1,
+      "onlyFailedSignIns": -3
+    },
+    "serviceAppIds": {
+      "2832473f-ec63-45fb-976f-5d45a7d4bb91": "Partner Customer Delegated Administration (GDAP)"
+    }
+  },
+  "attackerActivity": {
+    "fileOperations": [
+      "FileAccessed",
+      "FileDownloaded",
+      "FileSyncDownloadedFull",
+      "FilePreviewed",
+      "FileUploaded",
+      "FileModified",
+      "FileDeleted",
+      "FileRecycled",
+      "FileMoved",
+      "FileCopied",
+      "FileRenamed",
+      "SearchQueryPerformed"
+    ],
+    "linkUsageOperations": [
+      "AnonymousLinkUsed",
+      "CompanyLinkUsed",
+      "SecureLinkUsed",
+      "SharingInvitationAccepted"
+    ],
+    "formsResponseOperations": [
+      "CreateResponse",
+      "SubmitResponse",
+      "ViewRuntimeForm",
+      "UpdatePhishingStatus"
+    ],
+    "formsAttackerOperations": [
+      "CreateForm",
+      "EditForm",
+      "ShareForm",
+      "SendForm",
+      "AllowShareFormForCopy",
+      "AddFormCoauthor",
+      "ConnectToExcelWorkbook",
+      "ExportForm",
+      "ViewResponses",
+      "GetSummaryLink"
+    ],
+    "subjectLookbackDays": 90
+  }
+}
diff --git a/Config/CIPPDBCacheTypes.json b/Config/CIPPDBCacheTypes.json
index 08da042719e89..8802058bc35a0 100644
--- a/Config/CIPPDBCacheTypes.json
+++ b/Config/CIPPDBCacheTypes.json
@@ -149,6 +149,16 @@
     "friendlyName": "License Overview",
     "description": "License usage overview"
   },
+  {
+    "type": "ActiveUserDetail",
+    "friendlyName": "Active User Detail",
+    "description": "Per-user last-activity dates for Exchange, OneDrive, SharePoint, Teams and Viva Engage over 90 days"
+  },
+  {
+    "type": "M365AppUserDetail",
+    "friendlyName": "Microsoft 365 App Usage Detail",
+    "description": "Per-user Office app usage by platform (Windows, Mac, mobile, web) over 90 days"
+  },
   {
     "type": "MFAState",
     "friendlyName": "MFA State",
@@ -251,8 +261,8 @@
   },
   {
     "type": "ExoProtectionAlert",
-    "friendlyName": "Exchange Protection Alerts",
-    "description": "Microsoft 365 protection alert policies (Security & Compliance endpoint)"
+    "friendlyName": "Exchange Protection Alert Policies",
+    "description": "Microsoft 365 protection alert policy definitions (Security & Compliance endpoint) - the configured alert rules, NOT alerts that have fired"
   },
   {
     "type": "Mailboxes",
@@ -274,6 +284,11 @@
     "friendlyName": "Mailbox Usage",
     "description": "Exchange Online mailbox usage statistics"
   },
+  {
+    "type": "MailTrafficSummary",
+    "friendlyName": "Mail Traffic Summary",
+    "description": "Top mail senders and recipients by message volume over the last 30 days"
+  },
   {
     "type": "OneDriveSiteListing",
     "collectedBy": "OneDriveUsage",
@@ -301,6 +316,11 @@
     "friendlyName": "SharePoint Site Usage",
     "description": "SharePoint site usage statistics"
   },
+  {
+    "type": "SharePointUsageReport",
+    "friendlyName": "SharePoint Usage Report (Tenant-level)",
+    "description": "Aggregated SharePoint storage usage across all sites in the tenant"
+  },
   {
     "type": "SiteActivity",
     "friendlyName": "Site Activity",
diff --git a/Config/CIPPDefaultTable.BPATemplate.json b/Config/CIPPDefaultTable.BPATemplate.json
deleted file mode 100644
index 735012b4bd777..0000000000000
--- a/Config/CIPPDefaultTable.BPATemplate.json
+++ /dev/null
@@ -1,194 +0,0 @@
-{
-  "name": "CIPP Best Practices v1.5 - Table view",
-  "style": "Table",
-  "Fields": [
-    {
-      "name": "PasswordNeverExpires",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/domains",
-      "ExtractFields": ["passwordValidityPeriodInDays"],
-      "where": "$_.passwordValidityPeriodInDays -eq 2147483647",
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Password Never Expires",
-          "value": "PasswordNeverExpires",
-          "formatter": "bool"
-        }
-      ]
-    },
-    {
-      "name": "OAuthAppConsent",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/v1.0/policies/authorizationPolicy?$select=defaultUserRolePermissions",
-      "ExtractFields": ["defaultuserrolepermissions"],
-      "where": "'ManagePermissionGrantsForSelf.microsoft-user-default-legacy' -notin $_.defaultuserrolepermissions.permissionGrantPoliciesAssigned",
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "OAuth App Consent",
-          "value": "OAuthAppConsent",
-          "formatter": "bool"
-        }
-      ]
-    },
-    {
-      "name": "UnifiedAuditLog",
-      "API": "Exchange",
-      "Command": "Get-AdminAuditLogConfig",
-      "ExtractFields": ["UnifiedAuditLogIngestionEnabled"],
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Unified Audit Log",
-          "value": "UnifiedAuditLog",
-          "formatter": "bool"
-        }
-      ]
-    },
-    {
-      "name": "MFANudgeState",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy",
-      "ExtractFields": ["registrationEnforcement"],
-      "StoreAs": "bool",
-      "where": "$_.registrationEnforcement.authenticationMethodsRegistrationCampaign.state -eq 'Enabled'",
-      "FrontendFields": [
-        {
-          "name": "MFA Registration Campaign Enabled",
-          "value": "MFANudgeState",
-          "formatter": "bool"
-        }
-      ]
-    },
-    {
-      "name": "TAPEnabled",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/policies/authenticationmethodspolicy/authenticationMethodConfigurations/TemporaryAccessPass",
-      "ExtractFields": ["State"],
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Temporary Access Pass Enabled",
-          "value": "TAPEnabled",
-          "formatter": "bool"
-        }
-      ]
-    },
-    {
-      "name": "SecureDefaultState",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/policies/identitySecurityDefaultsEnforcementPolicy",
-      "ExtractFields": ["IsEnabled"],
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Secure Defaults State Enabled",
-          "value": "SecureDefaultState",
-          "formatter": "warnBool"
-        }
-      ]
-    },
-    {
-      "name": "AnonymousPrivacyReports",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/admin/reportSettings",
-      "ExtractFields": ["displayConcealedNames"],
-      "StoreAs": "bool",
-      "where": "$_.displayConcealedNames -eq $false",
-      "FrontendFields": [
-        {
-          "name": "Anonymous Privacy Reports",
-          "value": "AnonymousPrivacyReports",
-          "formatter": "reverseBool"
-        }
-      ]
-    },
-    {
-      "name": "MessageCopyforSentAsDisabled",
-      "API": "Exchange",
-      "Command": "Get-Mailbox",
-      "Parameters": {
-        "RecipientTypeDetails": ["SharedMailbox", "UserMailbox"]
-      },
-      "where": "$_.MessageCopyForSentAsEnabled -eq $false",
-      "ExtractFields": ["userprincipalname", "messageCopyForSentAsEnabled"],
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Message Copy for Sent-As Disabled",
-          "formatter": "table",
-          "value": "MessageCopyforSentAsDisabled"
-        }
-      ]
-    },
-    {
-      "name": "SharedMailboxeswithenabledusers",
-      "API": "Exchange",
-      "Command": "Get-Mailbox",
-      "Parameters": {
-        "RecipientTypeDetails": "SharedMailbox"
-      },
-      "where": "$_.accountDisabled -eq $false",
-      "ExtractFields": ["userprincipalname", "accountDisabled"],
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Shared Mailboxes with enabled users",
-          "formatter": "table",
-          "value": "SharedMailboxeswithenabledusers"
-        }
-      ]
-    },
-    {
-      "name": "Unusedlicenses",
-      "API": "CIPPFunction",
-      "Command": "Get-CIPPLicenseOverview",
-      "ExtractFields": [
-        "License",
-        "TotalLicenses",
-        "availableUnits",
-        "CountUsed"
-      ],
-      "StoreAs": "JSON",
-      "where": "$_.availableUnits -gt 0",
-      "FrontendFields": [
-        {
-          "name": "Unused licenses",
-          "formatter": "table",
-          "value": "Unusedlicenses"
-        }
-      ]
-    },
-    {
-      "name": "CurrentSecureScore",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/security/secureScores?$top=1",
-      "Parameters": {
-        "Nopagination": true
-      },
-      "ExtractFields": ["currentScore", "maxScore", "averageComparativeScores"],
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Current Secure Score",
-          "value": "CurrentSecureScore.currentScore / CurrentSecureScore.maxScore * 100",
-          "formatter": "math",
-          "showAs": "percentage"
-        },
-        {
-          "name": "Average Comparative Score (All Tenants)",
-          "value": "CurrentSecureScore.averageComparativeScores[0].averageScore / CurrentSecureScore.maxScore * 100",
-          "formatter": "math",
-          "showAs": "percentage"
-        },
-        {
-          "name": "Average Comparative Score (Similiar Size Tenants)",
-          "value": "CurrentSecureScore.averageComparativeScores[1].averageScore / CurrentSecureScore.maxScore * 100",
-          "formatter": "math",
-          "showAs": "percentage"
-        }
-      ]
-    }
-  ]
-}
diff --git a/Config/CIPPDefaultTenantPage.BPATemplate.json b/Config/CIPPDefaultTenantPage.BPATemplate.json
deleted file mode 100644
index aa706369f1192..0000000000000
--- a/Config/CIPPDefaultTenantPage.BPATemplate.json
+++ /dev/null
@@ -1,155 +0,0 @@
-{
-  "name": "CIPP Best Practices v1.0 - Tenant view",
-  "style": "Tenant",
-  "Fields": [
-    {
-      "name": "PasswordNeverExpires",
-      "UseExistingInfo": true,
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Password Never Expires",
-          "value": "PasswordNeverExpires",
-          "formatter": "bool",
-          "desc": "This setting shows if your environment has enabled the password never expires setting. This setting is expected to be set to 'No'"
-        }
-      ]
-    },
-    {
-      "name": "OAuthAppConsent",
-      "UseExistingInfo": true,
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "OAuth App Consent",
-          "value": "OAuthAppConsent",
-          "formatter": "bool",
-          "desc": "This setting shows if your environment has enabled OAuth App Consent. This setting is expected to be set to 'Yes'"
-        }
-      ]
-    },
-    {
-      "name": "UnifiedAuditLog",
-      "UseExistingInfo": true,
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Unified Audit Log",
-          "value": "UnifiedAuditLog",
-          "formatter": "bool",
-          "desc": "This setting shows if your environment has enabled the unified audit log. This setting is expected to be set to 'Yes'"
-        }
-      ]
-    },
-    {
-      "name": "MFANudgeState",
-      "UseExistingInfo": true,
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "MFA Registration Campaign Enabled",
-          "value": "MFANudgeState",
-          "formatter": "bool",
-          "desc": "This setting shows if your environment has enabled the MFA registration campaign, also known as the MFA Nudge. This setting is recommended to be set to 'Yes'"
-        }
-      ]
-    },
-    {
-      "name": "TAPEnabled",
-      "UseExistingInfo": true,
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Temporary Access Pass Enabled",
-          "value": "TAPEnabled",
-          "formatter": "bool",
-          "desc": "This setting shows if your environment has enabled the temporary access pass feature."
-        }
-      ]
-    },
-    {
-      "name": "SecureDefaultState",
-      "UseExistingInfo": true,
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Secure Defaults State Enabled",
-          "value": "SecureDefaultState",
-          "formatter": "warnBool",
-          "desc": "This setting shows if your environment has enabled the secure defaults state. If you are using Conditional Access this setting may be set to `No`"
-        }
-      ]
-    },
-    {
-      "name": "AnonymousPrivacyReports",
-      "UseExistingInfo": true,
-      "StoreAs": "bool",
-      "FrontendFields": [
-        {
-          "name": "Anonymous Privacy Reports",
-          "value": "AnonymousPrivacyReports",
-          "formatter": "reverseBool",
-          "desc": "This setting shows if your environment has enabled the anonymous privacy reports, these will need to be disabled to be able to view mailboxes and onedrive reports"
-        }
-      ]
-    },
-    {
-      "name": "MessageCopyforSentAsDisabled",
-      "UseExistingInfo": true,
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Message Copy for Sent-As Disabled",
-          "formatter": "table",
-          "value": "MessageCopyforSentAsDisabled",
-          "desc": "These are the mailboxes that have the MessageCopyForSentAsDisabled setting enabled."
-        }
-      ]
-    },
-    {
-      "name": "SharedMailboxeswithenabledusers",
-      "UseExistingInfo": true,
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Shared Mailboxes with enabled users",
-          "formatter": "table",
-          "value": "SharedMailboxeswithenabledusers",
-          "desc": "These are the shared mailboxes that have enabled users."
-        }
-      ]
-    },
-    {
-      "name": "Unusedlicenses",
-      "UseExistingInfo": true,
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Unused licenses",
-          "formatter": "table",
-          "value": "Unusedlicenses",
-          "desc": "These are the licenses that are not assigned to an user, but have been purchased."
-        }
-      ]
-    },
-    {
-      "name": "CurrentSecureScore",
-      "UseExistingInfo": true,
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Current Secure Score",
-          "value": "CurrentSecureScore.currentScore",
-          "desc": "The current Secure Score for this tenant. This is the sum of all the individual controls that have been implemented.",
-          "formatter": "number"
-        },
-        {
-          "name": "Max Secure Score",
-          "value": "CurrentSecureScore.maxScore",
-          "desc": "The maximum Secure Score for this tenant. This is the sum of all the individual controls that can be implemented.",
-          "formatter": "number"
-        }
-      ]
-    }
-  ]
-}
diff --git a/Config/CIPPTenantFeatures.BPATemplate.json b/Config/CIPPTenantFeatures.BPATemplate.json
deleted file mode 100644
index 19cc09628a4fd..0000000000000
--- a/Config/CIPPTenantFeatures.BPATemplate.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "name": "CIPP Tenant Feature Licensing",
-  "style": "Table",
-  "Fields": [
-    {
-      "name": "AssignedPlans",
-      "UseExistingInfo": false,
-      "ExtractFields": ["AADPremiumService", "exchange", "SharePoint"],
-      "FrontendFields": [
-        {
-          "name": "Entra ID Premium",
-          "value": "AssignedPlans.AADPremiumService",
-          "formatter": "bool"
-        },
-        {
-          "name": "Exchange",
-          "value": "AssignedPlans.exchange",
-          "formatter": "bool"
-        },
-        {
-          "name": "SharePoint",
-          "value": "AssignedPlans.SharePoint",
-          "formatter": "bool"
-        }
-      ],
-      "desc": "Entra ID Premium Status",
-      "StoreAs": "JSON",
-      "API": "CIPPFunction",
-      "Command": "Get-CIPPTenantCapabilities",
-      "Parameters": {}
-    }
-  ]
-}
diff --git a/Config/CIPPTimers.json b/Config/CIPPTimers.json
index 48bbfec9312bb..ae05799079f0c 100644
--- a/Config/CIPPTimers.json
+++ b/Config/CIPPTimers.json
@@ -157,15 +157,6 @@
     "TZOffset": true,
     "RunOnProcessor": true
   },
-  {
-    "Id": "80070b4f-95ed-4e5f-be4c-9e339306d4aa",
-    "Command": "Start-BPAOrchestrator",
-    "Description": "Orchestrator to process BPA reports",
-    "Cron": "0 0 3 * * *",
-    "Priority": 10,
-    "TZOffset": true,
-    "RunOnProcessor": true
-  },
   {
     "Id": "54c39540-fe91-4795-8613-ac4295751a51",
     "Command": "Start-ExtensionOrchestrator",
diff --git a/Config/CommunityRepos.json b/Config/CommunityRepos.json
index 126df73ba79b2..a62b763d9b81c 100644
--- a/Config/CommunityRepos.json
+++ b/Config/CommunityRepos.json
@@ -38,7 +38,6 @@
       "GroupTemplate",
       "AppApprovalTemplate",
       "ReportBuilderTemplate",
-      "BPATemplate",
       "TransportTemplate",
       "ExConnectorTemplate",
       "AppTemplate",
diff --git a/Config/CyberEssentials.BPATemplate.json b/Config/CyberEssentials.BPATemplate.json
deleted file mode 100644
index af2a2476ce0ef..0000000000000
--- a/Config/CyberEssentials.BPATemplate.json
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  "name": "CIPP Cyber Essentials Helper - Tenant view",
-  "style": "Tenant",
-  "Fields": [
-    {
-      "name": "deviceregister",
-      "UseExistingInfo": false,
-      "FrontendFields": [
-        {
-          "name": "Device Register",
-          "value": "deviceregister",
-          "desc": "These are all devices found in M365 to add to your CE Device Register.",
-          "formatter": "table"
-        }
-      ],
-      "StoreAs": "JSON",
-      "API": "Graph",
-      "ExtractFields": [
-        "deviceName",
-        "lastSyncDateTime",
-        "osVersion",
-        "userPrincipalName",
-        "complianceState"
-      ],
-      "URL": "https://graph.microsoft.com/beta/deviceManagement/managedDevices"
-    },
-    {
-      "name": "adminsTable",
-      "UseExistingInfo": false,
-      "FrontendFields": [
-        {
-          "name": "Admins Table",
-          "value": "adminsTable",
-          "desc": "The list of admin accounts in your M365 environment. These must all be named and attached to actual users.",
-          "formatter": "table"
-        }
-      ],
-      "StoreAs": "JSON",
-      "API": "Graph",
-      "ExtractFields": ["displayName", "userPrincipalName"],
-      "URL": "https://graph.microsoft.com/beta/directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members"
-    },
-    {
-      "name": "windowsProtectionState",
-      "UseExistingInfo": false,
-      "FrontendFields": [
-        {
-          "name": "Defender List",
-          "value": "windowsProtectionState",
-          "formatter": "table",
-          "desc": "List of Defender protected workstations. Add this to your Malware Protection Audit List"
-        }
-      ],
-      "StoreAs": "JSON",
-      "API": "Graph",
-      "ExtractFields": ["windowsProtectionState"],
-      "Parameters": {},
-      "URL": "https://graph.microsoft.com/beta/deviceManagement/managedDevices?$expand=windowsProtectionState"
-    },
-    {
-      "name": "detectedApps",
-      "UseExistingInfo": false,
-      "FrontendFields": [
-        {
-          "name": "Detected Apps",
-          "value": "detectedApps",
-          "desc": "All Detected Software and their version. Add this to your software audit list",
-          "formatter": "table"
-        }
-      ],
-      "StoreAs": "JSON",
-      "API": "Graph",
-      "ExtractFields": ["displayName", "version", "platform", "publisher"],
-      "URL": "https://graph.microsoft.com/beta/deviceManagement/detectedApps"
-    },
-    {
-      "name": "userRegistrationDetails",
-      "UseExistingInfo": false,
-      "FrontendFields": [
-        {
-          "name": "User Registration Details",
-          "desc": "All MFA settings (Requires a P1 Subscription)",
-          "value": "userRegistrationDetails",
-          "formatter": "table"
-        }
-      ],
-      "StoreAs": "JSON",
-      "API": "Graph",
-      "ExtractFields": [
-        "userDisplayName",
-        "isAdmin",
-        "isMFARegistered",
-        "defaultMFAMethod"
-      ],
-      "URL": "https://graph.microsoft.com/beta/reports/authenticationMethods/userRegistrationDetails",
-      "Parameters": {
-        "asApp": "True"
-      }
-    }
-  ]
-}
diff --git a/Config/DocsPublishedPages.txt b/Config/DocsPublishedPages.txt
index 1e21236768e88..7f31da7270420 100644
--- a/Config/DocsPublishedPages.txt
+++ b/Config/DocsPublishedPages.txt
@@ -1,7 +1,7 @@
 # Slugs published on docs.cipp.app, snapshotted from llms.txt.
 # Generated by build/tools/Update-DocsPublishedPages.ps1 - do not hand-edit.
 # Read by Get-CippDocsPublishedSet so the docs search index never emits a URL that 404s.
-# 426 pages.
+# 464 pages.
 api-documentation/endpoints
 api-documentation/setup-and-authentication
 demos/showcases
@@ -36,6 +36,7 @@ setup/installation/owntenant
 setup/maintaining-cipp
 setup/maintaining-cipp/migrating-to-hosted-cipp
 setup/maintaining-cipp/migrating-to-the-latest-version-of-cipp
+setup/maintaining-cipp/migrating-to-the-new-infrastructure
 setup/maintaining-cipp/recommended-roles
 setup/maintaining-cipp/updating
 setup/resources
@@ -68,8 +69,10 @@ user-documentation/cipp/advanced/authentication/cipp-users
 user-documentation/cipp/advanced/authentication/sam-app-permissions
 user-documentation/cipp/advanced/authentication/sam-app-roles
 user-documentation/cipp/advanced/authentication/sso
+user-documentation/cipp/advanced/cippdb-cache
 user-documentation/cipp/advanced/container-management
 user-documentation/cipp/advanced/container-management/custom-domains
+user-documentation/cipp/advanced/container-management/diagnostics
 user-documentation/cipp/advanced/container-management/logs
 user-documentation/cipp/advanced/container-management/status
 user-documentation/cipp/advanced/container-management/worker-health
@@ -107,6 +110,7 @@ user-documentation/cipp/sam-setup-wizard
 user-documentation/cipp/settings
 user-documentation/cipp/settings/backend
 user-documentation/cipp/settings/backup
+user-documentation/cipp/settings/bec-remediation
 user-documentation/cipp/settings/branding
 user-documentation/cipp/settings/features
 user-documentation/cipp/settings/licenses
@@ -147,6 +151,9 @@ user-documentation/email/administration/hve-accounts
 user-documentation/email/administration/mailbox-rules
 user-documentation/email/administration/mailboxes
 user-documentation/email/administration/quarantine
+user-documentation/email/administration/quarantine/files
+user-documentation/email/administration/quarantine/teams
+user-documentation/email/administration/quarantine/user-reported
 user-documentation/email/administration/restricted-users
 user-documentation/email/administration/tenant-allow-block-list-templates
 user-documentation/email/administration/tenant-allow-block-lists
@@ -162,6 +169,7 @@ user-documentation/email/reports/activesync-devices
 user-documentation/email/reports/antiphishing-filters
 user-documentation/email/reports/calendar-permissions
 user-documentation/email/reports/global-address-list
+user-documentation/email/reports/mail-flow-statistics
 user-documentation/email/reports/mailbox-activity
 user-documentation/email/reports/mailbox-cas-settings
 user-documentation/email/reports/mailbox-forwarding
@@ -226,6 +234,8 @@ user-documentation/endpoint/reports/detected-apps
 user-documentation/endpoint/reports/work-from-anywhere
 user-documentation/identity
 user-documentation/identity/administration
+user-documentation/identity/administration/bec
+user-documentation/identity/administration/bec/case
 user-documentation/identity/administration/deleted-items
 user-documentation/identity/administration/devices
 user-documentation/identity/administration/group-templates
@@ -236,25 +246,37 @@ user-documentation/identity/administration/groups
 user-documentation/identity/administration/groups/add
 user-documentation/identity/administration/groups/edit
 user-documentation/identity/administration/groups/group
+user-documentation/identity/administration/guest-users
 user-documentation/identity/administration/jit-admin
 user-documentation/identity/administration/jit-admin-templates
 user-documentation/identity/administration/jit-admin-templates/add
 user-documentation/identity/administration/jit-admin-templates/edit
 user-documentation/identity/administration/jit-admin/add
+user-documentation/identity/administration/jit-role-templates
+user-documentation/identity/administration/jit-role-templates/add
+user-documentation/identity/administration/jit-role-templates/edit
 user-documentation/identity/administration/offboarding-wizard
 user-documentation/identity/administration/risky-users
+user-documentation/identity/administration/roles
+user-documentation/identity/administration/roles/role
+user-documentation/identity/administration/roles/role/audit
+user-documentation/identity/administration/roles/role/pim
+user-documentation/identity/administration/roles/templates
+user-documentation/identity/administration/roles/templates/add
+user-documentation/identity/administration/roles/templates/edit
 user-documentation/identity/administration/user-defaults
 user-documentation/identity/administration/users
 user-documentation/identity/administration/users/patch-wizard
 user-documentation/identity/administration/users/user
-user-documentation/identity/administration/users/user/bec
 user-documentation/identity/administration/users/user/conditional-access
 user-documentation/identity/administration/users/user/edit
 user-documentation/identity/administration/users/user/exchange
+user-documentation/identity/administration/users/user/onedrive-shortcuts
 user-documentation/identity/administration/vacation-mode
 user-documentation/identity/administration/vacation-mode/add-vacation-schedule
 user-documentation/identity/reports
 user-documentation/identity/reports/azure-ad-connect-report
+user-documentation/identity/reports/group-usage
 user-documentation/identity/reports/inactive-users-report
 user-documentation/identity/reports/mfa-report
 user-documentation/identity/reports/risk-detections
@@ -293,16 +315,19 @@ user-documentation/security/safelinks/safelinks/add
 user-documentation/security/safelinks/safelinks/edit
 user-documentation/shared-features
 user-documentation/shared-features/breadcrumb-navigation
+user-documentation/shared-features/entity-switcher
 user-documentation/shared-features/get-help
 user-documentation/shared-features/global-page-icon
 user-documentation/shared-features/keyboard-shortcuts
 user-documentation/shared-features/menu-bar
 user-documentation/shared-features/menu-bar/bookmarks
 user-documentation/shared-features/menu-bar/display-mode
+user-documentation/shared-features/menu-bar/refresh-my-access
 user-documentation/shared-features/menu-bar/search
 user-documentation/shared-features/menu-bar/tenant-select
 user-documentation/shared-features/menu-bar/universal-search
 user-documentation/shared-features/menu-bar/user-settings
+user-documentation/shared-features/mobile-layout
 user-documentation/shared-features/release-notes-notification
 user-documentation/shared-features/speed-dial
 user-documentation/shared-features/table-features
@@ -318,6 +343,7 @@ user-documentation/teams-share/sharepoint-templates/add
 user-documentation/teams-share/sharepoint/add-site
 user-documentation/teams-share/sharepoint/bulk-add-site
 user-documentation/teams-share/sharing-report
+user-documentation/teams-share/storage-report
 user-documentation/teams-share/teams
 user-documentation/teams-share/teams/business-voice
 user-documentation/teams-share/teams/list-team
@@ -327,6 +353,8 @@ user-documentation/tenant
 user-documentation/tenant/administration
 user-documentation/tenant/administration/alert-configuration
 user-documentation/tenant/administration/alert-configuration/alert
+user-documentation/tenant/administration/alert-configuration/alert-history
+user-documentation/tenant/administration/alert-configuration/rogue-apps
 user-documentation/tenant/administration/alert-configuration/snoozed-alerts
 user-documentation/tenant/administration/app-consent-requests
 user-documentation/tenant/administration/applications
@@ -354,6 +382,10 @@ user-documentation/tenant/administration/tenants
 user-documentation/tenant/administration/tenants/global-variables
 user-documentation/tenant/administration/tenants/groups
 user-documentation/tenant/administration/tenants/groups/edit
+user-documentation/tenant/baselines
+user-documentation/tenant/baselines/alignment
+user-documentation/tenant/baselines/template
+user-documentation/tenant/baselines/templates
 user-documentation/tenant/conditional
 user-documentation/tenant/conditional/list-named-locations
 user-documentation/tenant/conditional/list-named-locations/add
@@ -374,6 +406,7 @@ user-documentation/tenant/gdap-management/relationships/relationship/mappings
 user-documentation/tenant/gdap-management/role-templates
 user-documentation/tenant/gdap-management/role-templates/add
 user-documentation/tenant/gdap-management/role-templates/edit
+user-documentation/tenant/gdap-management/role-templates/mappings
 user-documentation/tenant/gdap-management/role-templates/mappings/add
 user-documentation/tenant/gdap-management/roles
 user-documentation/tenant/manage
@@ -390,13 +423,15 @@ user-documentation/tenant/reports/graph-office-reports
 user-documentation/tenant/reports/list-csp-licenses
 user-documentation/tenant/reports/list-csp-licenses/add-subscription
 user-documentation/tenant/reports/list-licenses
+user-documentation/tenant/reports/list-licenses/optimization
+user-documentation/tenant/reports/list-licenses/pricing
+user-documentation/tenant/security-simulator
+user-documentation/tenant/security-simulator/conditional-access
+user-documentation/tenant/security-simulator/situations
 user-documentation/tenant/standards
 user-documentation/tenant/standards/alignment
 user-documentation/tenant/standards/alignment/templates
 user-documentation/tenant/standards/alignment/templates/available-standards
-user-documentation/tenant/standards/bpa-report
-user-documentation/tenant/standards/bpa-report/best-practice-templates
-user-documentation/tenant/standards/bpa-report/builder
 user-documentation/tenant/standards/domains-analyser
 user-documentation/tenant/standards/domains-analyser/domain-analyser-updates-and-data-refreshing
 user-documentation/tenant/standards/template
@@ -410,7 +445,9 @@ user-documentation/tools/dark-web-tools
 user-documentation/tools/dark-web-tools/breach-lookup
 user-documentation/tools/dark-web-tools/tenant-breach-lookup
 user-documentation/tools/email-tools
+user-documentation/tools/email-tools/historical-search
 user-documentation/tools/email-tools/mailbox-restores
+user-documentation/tools/email-tools/message-encryption
 user-documentation/tools/email-tools/message-trace
 user-documentation/tools/email-tools/message-viewer
 user-documentation/tools/intune-tools
@@ -421,6 +458,7 @@ user-documentation/tools/report-builder/generated
 user-documentation/tools/report-builder/templates
 user-documentation/tools/scheduler
 user-documentation/tools/scheduler/task
+user-documentation/tools/template-packages
 user-documentation/tools/templatelib
 user-documentation/tools/tenant-tools
 user-documentation/tools/tenant-tools/appapproval
diff --git a/Config/DocsSynonyms.json b/Config/DocsSynonyms.json
index 91affbe50f91e..5dc23f733405d 100644
--- a/Config/DocsSynonyms.json
+++ b/Config/DocsSynonyms.json
@@ -9,7 +9,6 @@
     "dap": ["delegated admin privileges"],
     "sam": ["secure application model", "service account", "application registration"],
     "bec": ["business email compromise", "compromise remediation", "indicators of compromise"],
-    "bpa": ["best practice analyser", "report builder"],
     "cis": ["compliance benchmark test"],
     "spf": ["domain analyser", "email authentication", "dns record"],
     "dkim": ["domain analyser", "email authentication", "dns record"],
diff --git a/Config/FeatureFlags.json b/Config/FeatureFlags.json
index 75a740f482d1d..6cf9d0945b5dd 100644
--- a/Config/FeatureFlags.json
+++ b/Config/FeatureFlags.json
@@ -1,25 +1,4 @@
 [
-  {
-    "Id": "BestPracticeAnalyser",
-    "Name": "Best Practice Analyser",
-    "Description": "The Best Practice Analyser has been deprecated and will be removed in a future release.",
-    "Enabled": false,
-    "AllowUserToggle": true,
-    "Timers": ["80070b4f-95ed-4e5f-be4c-9e339306d4aa"],
-    "Endpoints": [
-      "BestPracticeAnalyser_List",
-      "ExecBPA",
-      "ListBPA",
-      "ListBPATemplates",
-      "RemoveBPATemplate"
-    ],
-    "Pages": [
-      "/tenant/standards/bpa-report",
-      "/tenant/standards/bpa-report/builder",
-      "/tenant/standards/bpa-report/view"
-    ],
-    "Hidden": false
-  },
   {
     "Id": "SuperAdminNG",
     "Name": "Super Admin",
@@ -91,7 +70,7 @@
   {
     "Id": "Baselines",
     "Name": "Baselines",
-    "Description": "This is pre-alpha do not enable in production. The drift-first baseline engine that replaces classic Standards and Drift. Enables the scheduled baseline run and the Baselines menu, hides the classic Standards and Drift pages, and skips the scheduled classic Standards and Drift runs - the two systems never run side by side.",
+    "Description": "This is currently in public beta. The drift-first baseline engine that replaces classic Standards and Drift. Enables the scheduled baseline run and the Baselines menu, hides the classic Standards and Drift pages, and skips the scheduled classic Standards and Drift runs - the two systems never run side by side.",
     "Enabled": false,
     "AllowUserToggle": true,
     "Timers": ["9f2c7b1e-4a6d-4c3f-8b9a-5e1d2f7c0a44"],
@@ -105,6 +84,18 @@
     ],
     "Hidden": false
   },
+  {
+    "Id": "SecuritySimulations",
+    "Name": "Security Simulations",
+    "Description": "This is currently in public beta. Play security events (a stolen token, an admin on an unmanaged device, a mass deletion, an anonymous sharing link) against a tenant to see what an attacker would experience today and which standards close each gap, plus a live Conditional Access gap analysis. Read-only: nothing is changed in the tenant.",
+    "Enabled": false,
+    "AllowUserToggle": true,
+    "Timers": [],
+    "Endpoints": [],
+    "Pages": ["/tenant/security-simulator"],
+    "HidesPages": [],
+    "Hidden": false
+  },
   {
     "Id": "CertificateAuthentication",
     "Name": "Certificate Authentication",
diff --git a/Config/GraphEndpointBlocklist.json b/Config/GraphEndpointBlocklist.json
new file mode 100644
index 0000000000000..07b3f3062de5b
--- /dev/null
+++ b/Config/GraphEndpointBlocklist.json
@@ -0,0 +1,136 @@
+{
+  "version": 1,
+  "description": "Graph paths treated as customer-content for Test-CIPPGraphEndpointBlocked. Case-insensitive regexes against the percent-decoded path (host/version stripped) and against $expand values. Segments end at /, (, ;, : or end of path so OData key syntax like messages('id') is covered.",
+  "blockedEndpoints": [
+    {
+      "id": "drive-trees",
+      "pattern": "(^|/)drives?(?=[/(;:]|$)",
+      "reason": "driveItem GETs/children return @microsoft.graph.downloadUrl"
+    },
+    {
+      "id": "drive-item",
+      "pattern": "(^|/)driveItem(?=[/(;:]|$)",
+      "reason": "List item driveItem returns @microsoft.graph.downloadUrl"
+    },
+    {
+      "id": "shares",
+      "pattern": "(^|/)(?<!(^|/)print/)shares(?=[/(;:]|$)",
+      "reason": "Sharing-link resolution returns driveItems with @microsoft.graph.downloadUrl"
+    },
+    {
+      "id": "media-value",
+      "pattern": "(?<!(^|/)photo/)(?<!(^|/)photos/\\d+x\\d+/)\\$value(?=[/(;:]|$)",
+      "reason": "Raw binary/MIME via /$value; allows users/.../photo/$value and photos/{size}/$value"
+    },
+    {
+      "id": "file-content",
+      "pattern": "(^|/)(?<!(^|/)admin/serviceAnnouncement/messages[/(][^/]*/attachments[/(][^/]*/)content(?=[/(;:]|$)",
+      "reason": "Explicit /content bytes; does not match contentTypes; excludes Message Center attachment content"
+    },
+    {
+      "id": "mail-messages",
+      "pattern": "(^|/)(?<!(^|/)admin/serviceAnnouncement/(\\$expand/)?)(getAll(Retained)?)?messages(?=[/(;:]|$)",
+      "reason": "Mail/Teams message bodies (incl. getAllMessages/getAllRetainedMessages); excludes admin/serviceAnnouncement/messages"
+    },
+    {
+      "id": "mail-attachments",
+      "pattern": "(^|/)(?<!(^|/)admin/serviceAnnouncement/messages[/(][^/]*/(\\$expand/)?)attachments(?=[/(;:]|$)",
+      "reason": "Mail/chat/group attachment names and content; excludes Message Center attachments"
+    },
+    {
+      "id": "chats",
+      "pattern": "(^|/)chats(?=[/(;:]|$)",
+      "reason": "Teams chats; lastMessagePreview expands to message text"
+    },
+    {
+      "id": "calendar-events",
+      "pattern": "(^|/)(events|calendarView|reminderView)(?=[/(;:]|$)",
+      "reason": "Calendar event bodies, attendees, locations (reminderView returns event subjects and locations)"
+    },
+    {
+      "id": "contacts",
+      "pattern": "/contacts(?=[/(;:]|$)",
+      "reason": "Personal (mailbox) contact PII; root contacts (directory org contacts) stays allowed"
+    },
+    {
+      "id": "onenote",
+      "pattern": "(^|/)onenote(?=[/(;:]|$)",
+      "reason": "OneNote page content"
+    },
+    {
+      "id": "online-meetings",
+      "pattern": "(^|/)onlineMeetings(?=[/(;:]|$)",
+      "reason": "Meeting participants, joinWebUrl, recordings/transcripts"
+    },
+    {
+      "id": "call-records",
+      "pattern": "(^|/)callRecords(?=[/(;:]|$)",
+      "reason": "Call participant and phone-number PII"
+    },
+    {
+      "id": "group-conversations",
+      "pattern": "(^|/)(conversations|threads|posts)(?=[/(;:]|$)",
+      "reason": "Group mailbox conversation/thread/post content"
+    },
+    {
+      "id": "todo-tasks",
+      "pattern": "(^|/)(todo|outlook)/(.*/)?tasks(?=[/(;:]|$)",
+      "reason": "To Do (and legacy Outlook) task titles, bodies, checklist items and attachments; todo/lists (list names) stays allowed"
+    },
+    {
+      "id": "planner-tasks",
+      "pattern": "(^|/)planner/(.*/)?(\\w*tasks|all)(?=[/(;:]|$)",
+      "reason": "Planner task titles, assignees, descriptions and checklists (tasks, tasks/{id}/details, myDayTasks, planner/all delta); plans and plan details stay allowed"
+    },
+    {
+      "id": "site-pages",
+      "pattern": "(^|/)pages(?=[/(;:]|$)",
+      "reason": "SharePoint site page content (canvasLayout, web parts)"
+    },
+    {
+      "id": "list-items",
+      "pattern": "(^|/)(sites|lists)(?=[/(:]).*/items(?=[/(;:]|$)",
+      "reason": "SharePoint list item fields (row data), including sites/{id}/items/{id}; list definitions and columns stay allowed"
+    },
+    {
+      "id": "copilot-interactions",
+      "pattern": "(^|/)(ai)?interactionHistory(?=[/(;:]|$)",
+      "reason": "Copilot prompts and responses"
+    },
+    {
+      "id": "adhoc-calls",
+      "pattern": "(^|/)adhocCalls(?=[/(;:]|$)",
+      "reason": "Ad hoc call transcripts/recordings; transcripts/{id}/metadataContent returns spokenText"
+    },
+    {
+      "id": "document-insights",
+      "pattern": "(^|/)insights(?=[/(;:]|$)",
+      "reason": "Trending/used/shared documents: titles, previewText, and /resource returns the driveItem"
+    },
+    {
+      "id": "external-items",
+      "pattern": "(^|/)external/connections(?=[/(:]).*/items(?=[/(;:]|$)",
+      "reason": "Graph connector items include indexed content (content.value) and properties"
+    },
+    {
+      "id": "bookings-customers",
+      "pattern": "(^|/)bookingBusinesses(?=[/(:]).*/(appointments|customers)(?=[/(;:]|$)",
+      "reason": "Bookings customer names, emails, phones, addresses and notes"
+    },
+    {
+      "id": "virtual-event-attendees",
+      "pattern": "(^|/)virtualEvents/(.*/)?(registrations|attendanceReports)(?=[/(;:]|$)",
+      "reason": "Webinar/town hall registrant and attendee names, emails and registration answers"
+    },
+    {
+      "id": "people",
+      "pattern": "(^|/)(?<!(^|/)admin/)people(?=[/(;:]|$)",
+      "reason": "Relevant-people list inferred from mail, chat and meeting history; admin/people settings stay allowed"
+    },
+    {
+      "id": "ediscovery",
+      "pattern": "(^|/)(ediscoveryCases|ediscovery)(?=[/(;:]|$)",
+      "reason": "eDiscovery cases, searches and holds; export operations return downloadUrl for collected content"
+    }
+  ]
+}
diff --git a/Config/LicenseCatalog.json b/Config/LicenseCatalog.json
new file mode 100644
index 0000000000000..c3cd4feb0e7cb
--- /dev/null
+++ b/Config/LicenseCatalog.json
@@ -0,0 +1,2593 @@
+{
+  "$comment": "License catalog for the license optimization report. SKU names and part numbers are NOT stored here: Config/ConversionTable.csv (the shipped Microsoft SKU list) is the single SKU database and products are keyed by its GUID. Each product carries: prices = public per-user/month list price on an annual commitment per ISO currency (Update-LicensePricingDefaults.ps1 refreshes them from Microsoft); family/tier = position on the product ladder; eligibleTarget=false = never recommended outside its own family (frontline terms, regional no-Teams variants, add-ons). capabilities map plain-language features to service plan ids so any SKU can be compared.",
+  "meta": {
+    "currencyNote": "Prices are per user per month with an annual commitment, in the currency listed.",
+    "monthlyCommitmentUplift": 0.2,
+    "upliftNote": "Microsoft NCE month-to-month subscriptions cost 20% more than an annual commitment. Used to value moving stable seats to annual terms.",
+    "seatLimits": {
+      "business": 300
+    },
+    "priceSources": {
+      "CAD": "Microsoft public list price where published; otherwise Sherweb SRP price list 2026-09-19 (yearly commitment / 12), matched to the SKU list by product name",
+      "EUR": "Microsoft public list price where published; otherwise CAD list price x 0,6388, the median EUR/CAD ratio across the 45 SKUs Microsoft prices in both currencies (2026-09-19)",
+      "USD": "Microsoft public list price where published; otherwise CAD list price x 0,7366, the median USD/CAD ratio across the 48 SKUs Microsoft prices in both currencies (2026-09-19)"
+    },
+    "tenantLevelSkusNote": "SKUs that are consumed by the tenant without being assigned to a user (storage, server protection, capacity). Unassigned seats of these are never reported as waste.",
+    "tenantLevelSkus": [
+      "99049c9c-6011-4908-bf17-15f496e6519d",
+      "509e8ab6-0274-4cda-bcbd-bd164fd562c4",
+      "328dc228-00bc-48c6-8b09-1fbc8bc3435d",
+      "9bd7c846-9556-4453-a542-191d527209e8",
+      "7b26f5ab-a763-4c00-a1ac-f6c4b5506945"
+    ]
+  },
+  "capabilities": [
+    {
+      "id": "email",
+      "label": "Email and calendar",
+      "description": "A business mailbox with calendar and contacts.",
+      "signal": "exchange",
+      "servicePlanIds": [
+        "9aaf7827-d63c-4b61-89c3-182f06f82e5c",
+        "efb87545-963c-4e0d-99df-69c6916d9eb0",
+        "4a82b400-a79f-41a4-b4e2-e94f5787b113"
+      ]
+    },
+    {
+      "id": "largeMailbox",
+      "label": "Large mailbox and archive",
+      "description": "A 100 GB mailbox with an unlimited email archive. Only needed when a mailbox is near the 50 GB limit or uses an archive.",
+      "signal": "mailboxStorage",
+      "servicePlanIds": [
+        "efb87545-963c-4e0d-99df-69c6916d9eb0"
+      ]
+    },
+    {
+      "id": "desktopApps",
+      "label": "Office desktop apps",
+      "description": "Word, Excel, PowerPoint and Outlook installed on a PC or Mac.",
+      "signal": "desktopApps",
+      "servicePlanIds": [
+        "43de0ff5-c92c-492b-9116-175376d08c38",
+        "094e7854-93fc-4d55-b2c0-3ab5369ebdc1"
+      ]
+    },
+    {
+      "id": "teams",
+      "label": "Teams chat and meetings",
+      "description": "Microsoft Teams for chat, calls and online meetings.",
+      "signal": "teams",
+      "servicePlanIds": [
+        "57ff2da0-773e-42df-b2af-ffb7a2317929",
+        "f4f2f6de-6830-442b-a433-e92249faebe2"
+      ]
+    },
+    {
+      "id": "files",
+      "label": "File storage and sharing",
+      "description": "OneDrive and SharePoint for storing and sharing documents.",
+      "signal": "files",
+      "servicePlanIds": [
+        "c7699d2e-19aa-44de-8edf-1736da088ca1",
+        "5dbe027f-2339-4123-9542-606e4d348a72",
+        "902b47e5-dcb2-4fdc-858b-c63a90a2bdb9",
+        "13696edf-5a08-49f6-8134-03083ed8ba30",
+        "da792a53-cbc0-4184-a10d-e544dd34b3c1"
+      ]
+    },
+    {
+      "id": "copilot",
+      "label": "Microsoft 365 Copilot",
+      "description": "The AI assistant inside Word, Excel, Outlook and Teams.",
+      "signal": "copilot",
+      "servicePlanIds": [
+        "a62f8878-de10-42f3-b68f-6149a25ceb97",
+        "b95945de-b3bd-46db-8437-f2beb6ea2347"
+      ]
+    },
+    {
+      "id": "deviceManagement",
+      "label": "Device management",
+      "description": "Intune: enrolling, securing and wiping company laptops and phones.",
+      "signal": null,
+      "servicePlanIds": [
+        "c1ec4a95-1f05-45b3-a911-aa3fa01094f5"
+      ]
+    },
+    {
+      "id": "signInSecurity",
+      "label": "Advanced sign-in security",
+      "description": "Entra ID P1: Conditional Access rules that decide who can sign in from where.",
+      "signal": null,
+      "servicePlanIds": [
+        "41781fb2-bc02-4b7c-bd55-b576c07bb09d"
+      ]
+    },
+    {
+      "id": "identityRisk",
+      "label": "Identity risk protection",
+      "description": "Entra ID P2: automatic detection of risky sign-ins and privileged access controls.",
+      "signal": null,
+      "servicePlanIds": [
+        "eec0eb4f-6444-4f95-aba0-50c24d67f998"
+      ]
+    },
+    {
+      "id": "identityGovernance",
+      "label": "Identity governance",
+      "description": "Access reviews and lifecycle workflows for user access.",
+      "signal": null,
+      "servicePlanIds": [
+        "e866a266-3cff-43a3-acca-0c90a7e00c8b"
+      ]
+    },
+    {
+      "id": "endpointSecurity",
+      "label": "Device threat protection",
+      "description": "Microsoft Defender for Business or Endpoint: antivirus and attack detection on devices.",
+      "signal": null,
+      "servicePlanIds": [
+        "bfc1bbd9-981b-4f71-9b82-17c35fd0e2a4",
+        "871d91ec-ec1a-452b-a83f-bd76c7d770ef",
+        "292cc034-7b7c-4950-aaf5-943befd3f1d4"
+      ]
+    },
+    {
+      "id": "emailSecurity",
+      "label": "Advanced email threat protection",
+      "description": "Defender for Office 365: safe links, safe attachments and phishing protection.",
+      "signal": null,
+      "servicePlanIds": [
+        "f20fedf3-f3c3-43c3-8267-2bfdd51c0939",
+        "8e0c0a52-6a6c-4d40-8370-dd62790dcd70"
+      ]
+    },
+    {
+      "id": "cloudAppSecurity",
+      "label": "Cloud app security",
+      "description": "Defender for Cloud Apps: visibility and control over cloud services staff use.",
+      "signal": null,
+      "servicePlanIds": [
+        "2e2ddb96-6af9-4b1d-a3f0-d6ecfd22edb2",
+        "8c098270-9dd4-4350-9b30-ba4703f3b36b"
+      ]
+    },
+    {
+      "id": "informationProtection",
+      "label": "Data protection and labelling",
+      "description": "Purview sensitivity labels and rights management for confidential documents.",
+      "signal": null,
+      "servicePlanIds": [
+        "5136a095-5cf0-4aff-bec3-e84448b38ea5",
+        "efb0351d-3b08-4503-993d-383af8de41e3",
+        "6c57d4b6-3b23-47a5-9bc9-69f17b4947b3"
+      ]
+    },
+    {
+      "id": "compliance",
+      "label": "Advanced compliance",
+      "description": "eDiscovery, advanced audit, insider risk and customer lockbox.",
+      "signal": null,
+      "servicePlanIds": [
+        "4de31727-a228-4ec3-a5bf-8e45b5ca48cc",
+        "2f442157-a11c-46b9-ae5b-6e39ff4e5849",
+        "d587c7a3-bda9-4f99-8776-9bcf59c84f75",
+        "9f431833-0334-42de-a7dc-70aa40db46db"
+      ]
+    },
+    {
+      "id": "phone",
+      "label": "Teams Phone",
+      "description": "Making and receiving regular phone calls through Teams.",
+      "signal": null,
+      "servicePlanIds": [
+        "4828c8ec-dc2e-4779-b502-87ac9ce28ab7"
+      ]
+    },
+    {
+      "id": "audioConferencing",
+      "label": "Dial-in meetings",
+      "description": "Phone dial-in numbers for Teams meetings.",
+      "signal": null,
+      "servicePlanIds": [
+        "3e26ee1f-8a5f-4d52-aee2-b81ce45c8f40"
+      ]
+    },
+    {
+      "id": "analytics",
+      "label": "Power BI reporting",
+      "description": "Building and sharing interactive business reports.",
+      "signal": null,
+      "servicePlanIds": [
+        "70d33638-9c74-4d01-bfd3-562de28bd4ba",
+        "0bf3c642-7bb5-4ccc-884e-59d09df0266c"
+      ]
+    },
+    {
+      "id": "windows",
+      "label": "Windows upgrade rights",
+      "description": "Upgrading Windows Pro to Enterprise or Business edition.",
+      "signal": null,
+      "servicePlanIds": [
+        "21b439ba-a0ca-424f-a6cc-52f954a5b111",
+        "8e229017-d77b-43d5-9305-903395523b99"
+      ]
+    }
+  ],
+  "families": [
+    {
+      "id": "business",
+      "label": "Microsoft 365 Business",
+      "note": "Limited to 300 users per plan."
+    },
+    {
+      "id": "enterprise",
+      "label": "Microsoft 365 / Office 365 Enterprise",
+      "note": null
+    },
+    {
+      "id": "frontline",
+      "label": "Microsoft 365 Frontline",
+      "note": "Licensing terms restrict these plans to frontline workers, so they are only recommended to people already on a frontline plan."
+    },
+    {
+      "id": "apps",
+      "label": "Microsoft 365 Apps",
+      "note": null
+    },
+    {
+      "id": "exchange",
+      "label": "Exchange Online",
+      "note": null
+    },
+    {
+      "id": "teams",
+      "label": "Microsoft Teams",
+      "note": null
+    },
+    {
+      "id": "security",
+      "label": "Security add-ons",
+      "note": null
+    },
+    {
+      "id": "analytics",
+      "label": "Analytics",
+      "note": null
+    },
+    {
+      "id": "addon",
+      "label": "Other add-ons",
+      "note": null
+    }
+  ],
+  "products": [
+    {
+      "skuId": "00e1ec7b-e4a3-40d1-9441-b69b597ab222",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 25.5,
+        "EUR": 16.29,
+        "USD": 18.78
+      }
+    },
+    {
+      "skuId": "05735051-46c0-4c84-9107-bb13d77d0b88",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 678.4,
+        "EUR": 433.36,
+        "USD": 499.71
+      }
+    },
+    {
+      "skuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
+      "family": "enterprise",
+      "tier": 3,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 58.4,
+        "BRL": 223.3,
+        "CAD": 52.9,
+        "CHF": 35.32,
+        "DKK": 281.97,
+        "EUR": 37.78,
+        "GBP": 33.5,
+        "INR": 3245.0,
+        "JPY": 5847.0,
+        "KRW": 52700.0,
+        "NOK": 442.03,
+        "NZD": 63.1,
+        "SEK": 416.77,
+        "TWD": 1255.0,
+        "USD": 39.0
+      }
+    },
+    {
+      "skuId": "061f9ace-7d42-4136-88ac-31dc755f143f",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10.9,
+        "EUR": 6.96,
+        "USD": 8.03
+      }
+    },
+    {
+      "skuId": "0666269f-b167-4c5b-a76f-fc574f2b1118",
+      "family": "frontline",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 3.52,
+        "CHF": 2.02,
+        "DKK": 16.16,
+        "EUR": 2.16,
+        "NOK": 25.41,
+        "SEK": 23.89,
+        "USD": 2.59
+      }
+    },
+    {
+      "skuId": "06ebc4ee-1bb5-47dd-8120-11324bc54e06",
+      "family": "enterprise",
+      "tier": 5,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 89.8,
+        "BRL": 343.5,
+        "CAD": 81.4,
+        "CHF": 54.33,
+        "DKK": 433.8,
+        "EUR": 58.13,
+        "GBP": 51.6,
+        "INR": 4990.0,
+        "JPY": 8995.0,
+        "KRW": 81100.0,
+        "NOK": 680.04,
+        "NZD": 97.1,
+        "SEK": 641.18,
+        "TWD": 1930.0,
+        "USD": 60.0
+      }
+    },
+    {
+      "skuId": "078d2b04-f1bd-4111-bbd4-b4b1b354cef4",
+      "family": "security",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 10.5,
+        "BRL": 40.1,
+        "CAD": 9.5,
+        "CHF": 5.7,
+        "DKK": 45.3,
+        "EUR": 6.1,
+        "GBP": 5.4,
+        "INR": 580.0,
+        "JPY": 1049.0,
+        "KRW": 9500.0,
+        "NOK": 71.2,
+        "NZD": 11.3,
+        "SEK": 66.9,
+        "TWD": 225.0,
+        "USD": 7.0
+      }
+    },
+    {
+      "skuId": "08e18479-4483-4f70-8f17-6f92156d8ea9",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 339.2,
+        "EUR": 216.68,
+        "USD": 249.85
+      }
+    },
+    {
+      "skuId": "0c266dff-15dd-4b49-8397-2bb16070ed52",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 3.4,
+        "EUR": 2.17,
+        "USD": 2.5
+      }
+    },
+    {
+      "skuId": "0da63026-e422-4390-89e8-b14520d7e699",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 139.41,
+        "EUR": 89.06,
+        "USD": 102.69
+      }
+    },
+    {
+      "skuId": "0fe440c5-f2bf-442b-a4f4-9a7af77a200b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 9.5,
+        "EUR": 6.07,
+        "USD": 7.0
+      }
+    },
+    {
+      "skuId": "111046dd-295b-4d6d-9724-d52ac90bd1f2",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 7.1,
+        "EUR": 4.54,
+        "USD": 5.23
+      }
+    },
+    {
+      "skuId": "11dee6af-eca8-419f-8061-6864517c1875",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 8.1,
+        "EUR": 5.17,
+        "USD": 5.97
+      }
+    },
+    {
+      "skuId": "135bee78-485b-4181-ad6e-40286e311850",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 38.61,
+        "EUR": 24.66,
+        "USD": 28.44
+      }
+    },
+    {
+      "skuId": "1439b6e2-5d59-4873-8c59-d60e2a196e92",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 67.8,
+        "EUR": 43.31,
+        "USD": 49.94
+      }
+    },
+    {
+      "skuId": "16a55f2f-ff35-4cd5-9146-fb784e3761a5",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 4.1,
+        "EUR": 2.62,
+        "USD": 3.02
+      }
+    },
+    {
+      "skuId": "18181a46-0d4e-45cd-891e-60aabd171b4e",
+      "family": "enterprise",
+      "tier": 1,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 15.0,
+        "BRL": 57.3,
+        "CAD": 13.6,
+        "CHF": 8.1,
+        "DKK": 64.67,
+        "EUR": 8.66,
+        "GBP": 7.7,
+        "INR": 830.0,
+        "JPY": 1499.0,
+        "KRW": 13500.0,
+        "NOK": 101.65,
+        "NZD": 16.2,
+        "SEK": 95.59,
+        "TWD": 320.0,
+        "USD": 10.0
+      }
+    },
+    {
+      "skuId": "18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e",
+      "family": "enterprise",
+      "tier": 5,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 77.0,
+        "BRL": 294.6,
+        "CAD": 69.8,
+        "EUR": 44.59,
+        "GBP": 45.0,
+        "INR": 4280.0,
+        "JPY": 7713.0,
+        "KRW": 69500.0,
+        "NZD": 83.2,
+        "TWD": 1655.0,
+        "USD": 51.45
+      }
+    },
+    {
+      "skuId": "1925967e-8013-495f-9644-c99f8b463748",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 4.1,
+        "EUR": 2.62,
+        "USD": 3.02
+      }
+    },
+    {
+      "skuId": "19ec0d23-8335-4cbd-94ac-6050e30712fa",
+      "family": "exchange",
+      "tier": 2,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 12.0,
+        "BRL": 45.8,
+        "CAD": 10.9,
+        "CHF": 6.5,
+        "DKK": 51.7,
+        "EUR": 6.9,
+        "GBP": 6.2,
+        "INR": 665.0,
+        "JPY": 1199.0,
+        "KRW": 10800.0,
+        "NOK": 81.3,
+        "NZD": 12.9,
+        "SEK": 76.5,
+        "TWD": 255.0,
+        "USD": 8.0
+      }
+    },
+    {
+      "skuId": "1b3043ad-dfc6-427e-a2c0-5ca7a6c94a2b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 115.92,
+        "EUR": 74.05,
+        "USD": 85.39
+      }
+    },
+    {
+      "skuId": "1c79494f-e170-431f-a409-428f6053fa35",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 69.03,
+        "EUR": 44.1,
+        "USD": 50.85
+      }
+    },
+    {
+      "skuId": "1d506c23-1702-46f1-b940-160c55f98d05",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 27.1,
+        "EUR": 17.31,
+        "USD": 19.96
+      }
+    },
+    {
+      "skuId": "1fc08a02-8b3d-43b9-831e-f76859e04e1a",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 6.8,
+        "EUR": 4.34,
+        "USD": 5.01
+      }
+    },
+    {
+      "skuId": "21502a13-c8dc-4744-be9c-177fd9d2eafc",
+      "family": "business",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 8.1,
+        "CAD": 7.3,
+        "EUR": 4.66,
+        "GBP": 4.2,
+        "NZD": 8.7,
+        "USD": 5.4
+      }
+    },
+    {
+      "skuId": "21943e3a-2429-4f83-84c1-02735cd49e78",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 59.9,
+        "CAD": 54.3,
+        "EUR": 34.7,
+        "GBP": 30.8,
+        "NZD": 64.7,
+        "USD": 40.0
+      }
+    },
+    {
+      "skuId": "226ca751-f0a4-4232-9be5-73c02a92555e",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 42.75,
+        "EUR": 27.31,
+        "USD": 31.49
+      }
+    },
+    {
+      "skuId": "245e6bf9-411e-481e-8611-5c08595e2988",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 27.1,
+        "EUR": 17.31,
+        "USD": 19.96
+      }
+    },
+    {
+      "skuId": "24be3cd7-82ca-41a5-94a7-4903373cdcae",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 352.17,
+        "EUR": 224.97,
+        "USD": 259.41
+      }
+    },
+    {
+      "skuId": "253ce8d3-6122-4240-8b04-f434a8fa831f",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 203.5,
+        "EUR": 130.0,
+        "USD": 149.9
+      }
+    },
+    {
+      "skuId": "26d45bd9-adf1-46cd-a9e1-51e9a5524128",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 55.6,
+        "EUR": 35.52,
+        "USD": 40.95
+      }
+    },
+    {
+      "skuId": "2880026b-2b0c-4251-8656-5d41ff11e3aa",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 108.5,
+        "EUR": 69.31,
+        "USD": 79.92
+      }
+    },
+    {
+      "skuId": "295a8eb0-f78d-45c7-8b5b-1eed5ed02dff",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10.9,
+        "EUR": 6.96,
+        "USD": 8.03
+      }
+    },
+    {
+      "skuId": "2b317a4a-77a6-4188-9437-b68a77b4e2c6",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 3.6,
+        "EUR": 2.3,
+        "USD": 2.65
+      }
+    },
+    {
+      "skuId": "2e3c4023-80f6-4711-aa5d-29e0ecb46835",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10.9,
+        "EUR": 6.96,
+        "USD": 8.03
+      }
+    },
+    {
+      "skuId": "2edaa1dc-966d-4475-93d6-8ee8dfd96877",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 203.5,
+        "EUR": 130.0,
+        "USD": 149.9
+      }
+    },
+    {
+      "skuId": "2ef3064c-c95c-426c-96dd-9ffeaa2f2c37",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 12.2,
+        "EUR": 7.79,
+        "USD": 8.99
+      }
+    },
+    {
+      "skuId": "3271cf8e-2be5-4a09-a549-70fd05baaa17",
+      "family": "enterprise",
+      "tier": 5,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 82.67,
+        "CHF": 47.4,
+        "DKK": 378.5,
+        "EUR": 50.71,
+        "NOK": 593.13,
+        "SEK": 559.44,
+        "USD": 60.89
+      }
+    },
+    {
+      "skuId": "3539d28c-6e35-4a30-b3a9-cd43d5d3e0e2",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 203.5,
+        "EUR": 130.0,
+        "USD": 149.9
+      }
+    },
+    {
+      "skuId": "359ea3e6-8130-4a57-9f8f-ad897a0342f1",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 271.4,
+        "EUR": 173.37,
+        "USD": 199.91
+      }
+    },
+    {
+      "skuId": "38b434d2-a15e-4cde-9a98-e737c75623e1",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 20.4,
+        "EUR": 13.03,
+        "USD": 15.03
+      }
+    },
+    {
+      "skuId": "39a78eb6-3a8a-4e1e-878a-575a5c8984e7",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 122.1,
+        "EUR": 78.0,
+        "USD": 89.94
+      }
+    },
+    {
+      "skuId": "3b555118-da6a-4418-894f-7df1e2096870",
+      "family": "business",
+      "tier": 1,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 10.5,
+        "BRL": 33.4,
+        "CAD": 9.5,
+        "CHF": 5.67,
+        "DKK": 45.27,
+        "EUR": 6.07,
+        "GBP": 5.4,
+        "INR": 170.0,
+        "JPY": 1049.0,
+        "KRW": 9500.0,
+        "NOK": 71.16,
+        "NZD": 11.3,
+        "SEK": 66.91,
+        "TWD": 225.0,
+        "USD": 7.0
+      }
+    },
+    {
+      "skuId": "3bbd44ed-8a70-4c07-9088-6232ddbd5ddd",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 115.3,
+        "EUR": 73.65,
+        "USD": 84.93
+      }
+    },
+    {
+      "skuId": "3cb45fab-ae53-4ff6-af40-24c1915ca07b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 140.22,
+        "EUR": 89.57,
+        "USD": 103.29
+      }
+    },
+    {
+      "skuId": "3dc7332d-f0fa-40a3-81d3-dd6b84469b78",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 2.7,
+        "EUR": 1.72,
+        "USD": 1.99
+      }
+    },
+    {
+      "skuId": "3dd6cf57-d688-4eed-ba52-9e40b5468c3e",
+      "family": "security",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 7.5,
+        "CAD": 6.8,
+        "EUR": 4.3,
+        "GBP": 3.8,
+        "NZD": 8.1,
+        "USD": 5.0
+      }
+    },
+    {
+      "skuId": "42e6818f-8966-444b-b7ac-0027c83fa8b5",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 35.28,
+        "EUR": 22.54,
+        "USD": 25.99
+      }
+    },
+    {
+      "skuId": "446a86f8-a0cb-4095-83b3-d100eb050e3d",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 135.7,
+        "EUR": 86.69,
+        "USD": 99.96
+      }
+    },
+    {
+      "skuId": "45a2423b-e884-448d-a831-d9e139c52d2f",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 1.36,
+        "EUR": 0.87,
+        "USD": 1.0
+      }
+    },
+    {
+      "skuId": "46c3a859-c90d-40b3-9551-6178a48d5c18",
+      "family": "enterprise",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 26.1,
+        "BRL": 99.9,
+        "CAD": 23.7,
+        "EUR": 15.14,
+        "GBP": 16.7,
+        "INR": 1450.0,
+        "JPY": 2616.0,
+        "KRW": 23600.0,
+        "NZD": 30.6,
+        "TWD": 635.0,
+        "USD": 17.45
+      }
+    },
+    {
+      "skuId": "481f3bc2-5756-4b28-9375-5c8c86b99e6b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 4.1,
+        "EUR": 2.62,
+        "USD": 3.02
+      }
+    },
+    {
+      "skuId": "488ba24a-39a9-4473-8ee5-19291e71b002",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 17.4,
+        "EUR": 11.12,
+        "USD": 12.82
+      }
+    },
+    {
+      "skuId": "4a51bf65-409c-4a91-b845-1121b571cc9d",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 20.4,
+        "EUR": 13.03,
+        "USD": 15.03
+      }
+    },
+    {
+      "skuId": "4b244418-9658-4451-a2b8-b5e2b364e9bd",
+      "family": "addon",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 7.5,
+        "CAD": 6.8,
+        "EUR": 4.3,
+        "GBP": 3.8,
+        "NZD": 8.1,
+        "USD": 5.0
+      }
+    },
+    {
+      "skuId": "4b2c20e4-939d-4bf4-9dd8-6870240cfe19",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 6.8,
+        "EUR": 4.34,
+        "USD": 5.01
+      }
+    },
+    {
+      "skuId": "4b585984-651b-448a-9e53-3b10f069cf7f",
+      "family": "frontline",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 5.4,
+        "EUR": 3.45,
+        "USD": 4.0
+      }
+    },
+    {
+      "skuId": "4b9405b0-7788-4568-add1-99614e613b69",
+      "family": "exchange",
+      "tier": 1,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 6.0,
+        "BRL": 22.9,
+        "CAD": 5.4,
+        "CHF": 3.2,
+        "DKK": 25.9,
+        "EUR": 3.5,
+        "GBP": 3.1,
+        "INR": 335.0,
+        "JPY": 599.0,
+        "KRW": 5400.0,
+        "NOK": 40.7,
+        "NZD": 6.5,
+        "SEK": 38.2,
+        "TWD": 130.0,
+        "USD": 4.0
+      }
+    },
+    {
+      "skuId": "4cde982a-ede4-4409-9ae6-b003453c8ea6",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 59.9,
+        "BRL": 229.0,
+        "CAD": 54.3,
+        "CHF": 32.4,
+        "DKK": 258.7,
+        "EUR": 34.7,
+        "GBP": 30.8,
+        "JPY": 5997.0,
+        "KRW": 54100.0,
+        "NOK": 406.6,
+        "NZD": 64.7,
+        "SEK": 382.3,
+        "TWD": 1285.0,
+        "USD": 40.0
+      }
+    },
+    {
+      "skuId": "4ef96642-f096-40de-a3e9-d83fb2f90211",
+      "family": "security",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 3.0,
+        "CAD": 2.7,
+        "EUR": 1.73,
+        "GBP": 1.54,
+        "NZD": 3.2,
+        "USD": 2.0
+      }
+    },
+    {
+      "skuId": "509e8ab6-0274-4cda-bcbd-bd164fd562c4",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 7.1,
+        "EUR": 4.54,
+        "USD": 5.23
+      }
+    },
+    {
+      "skuId": "50f60901-3181-4b75-8a2c-4c8e4c1d5a72",
+      "family": "frontline",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 4.5,
+        "BRL": 17.2,
+        "CAD": 4.1,
+        "CHF": 2.43,
+        "DKK": 19.4,
+        "EUR": 2.6,
+        "GBP": 2.3,
+        "INR": 250.0,
+        "JPY": 449.0,
+        "KRW": 4100.0,
+        "NOK": 30.5,
+        "NZD": 4.9,
+        "SEK": 28.68,
+        "TWD": 96.5,
+        "USD": 3.0
+      }
+    },
+    {
+      "skuId": "5265a84e-8def-4fa2-ab4b-5dc278df5025",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 55.17,
+        "EUR": 35.24,
+        "USD": 40.64
+      }
+    },
+    {
+      "skuId": "52cdf00e-8303-4223-a749-ff69a13e2dd0",
+      "family": "security",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 4.5,
+        "CAD": 4.1,
+        "EUR": 2.6,
+        "GBP": 2.3,
+        "NZD": 4.9,
+        "USD": 3.0
+      }
+    },
+    {
+      "skuId": "53818b1b-4a27-454b-8896-0dba576410e6",
+      "family": "addon",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 44.9,
+        "CAD": 40.7,
+        "EUR": 26.0,
+        "GBP": 23.1,
+        "NZD": 48.5,
+        "USD": 30.0
+      }
+    },
+    {
+      "skuId": "55c9eb4e-c746-45b4-b255-9ab6b19d5c62",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 284.9,
+        "EUR": 181.99,
+        "USD": 209.86
+      }
+    },
+    {
+      "skuId": "59d3d0bf-df39-4b8b-8601-ea6c09a7fd66",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 128.9,
+        "EUR": 82.34,
+        "USD": 94.95
+      }
+    },
+    {
+      "skuId": "5a1c7b8d-0739-4ca8-bf69-ec87e69133ac",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 14.6,
+        "EUR": 9.33,
+        "USD": 10.75
+      }
+    },
+    {
+      "skuId": "5b22585d-1b71-4c6b-b6ec-160b1a9c2323",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 27.1,
+        "EUR": 17.31,
+        "USD": 19.96
+      }
+    },
+    {
+      "skuId": "5e1e7702-a2b7-4360-8d07-2f515792896f",
+      "family": "security",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 4.5,
+        "BRL": 13.7,
+        "CAD": 4.1,
+        "CHF": 2.4,
+        "DKK": 19.4,
+        "EUR": 2.6,
+        "GBP": 2.3,
+        "INR": 250.0,
+        "JPY": 449.0,
+        "KRW": 4100.0,
+        "NOK": 30.5,
+        "NZD": 4.9,
+        "SEK": 28.7,
+        "TWD": 96.5,
+        "USD": 3.0
+      }
+    },
+    {
+      "skuId": "5e36d0d4-e9e5-4052-aba0-0257465c9b86",
+      "family": "security",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 7.5,
+        "CAD": 6.8,
+        "EUR": 4.3,
+        "GBP": 3.8,
+        "NZD": 8.1,
+        "USD": 5.0
+      }
+    },
+    {
+      "skuId": "61902246-d7cb-453e-85cd-53ee28eec138",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 16.3,
+        "EUR": 10.41,
+        "USD": 12.01
+      }
+    },
+    {
+      "skuId": "639dec6b-bb19-468b-871c-c5c441c4b0cb",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 44.9,
+        "BRL": 171.8,
+        "CAD": 40.7,
+        "CHF": 24.3,
+        "DKK": 194.0,
+        "EUR": 26.0,
+        "GBP": 23.1,
+        "INR": 2495.0,
+        "JPY": 4497.0,
+        "KRW": 40500.0,
+        "NOK": 305.0,
+        "NZD": 48.5,
+        "SEK": 286.8,
+        "TWD": 965.0,
+        "USD": 30.0
+      }
+    },
+    {
+      "skuId": "6432c818-bcef-43b6-9290-aec052964950",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 15.0,
+        "CAD": 13.6,
+        "EUR": 8.7,
+        "GBP": 7.7,
+        "NZD": 16.2,
+        "USD": 10.0
+      }
+    },
+    {
+      "skuId": "66b55226-6b4f-492c-910c-a3b7a3c9d993",
+      "family": "frontline",
+      "tier": 3,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 15.0,
+        "BRL": 57.3,
+        "CAD": 13.6,
+        "CHF": 8.1,
+        "DKK": 64.67,
+        "EUR": 8.66,
+        "GBP": 7.7,
+        "INR": 830.0,
+        "JPY": 1499.0,
+        "KRW": 13500.0,
+        "NOK": 101.65,
+        "NZD": 16.2,
+        "SEK": 95.59,
+        "TWD": 320.0,
+        "USD": 10.0
+      }
+    },
+    {
+      "skuId": "673afb9d-d85b-40c2-914e-7bf46cd5cd75",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 135.7,
+        "EUR": 86.69,
+        "USD": 99.96
+      }
+    },
+    {
+      "skuId": "67ffe999-d9ca-49e1-9d2c-03fb28aa7a48",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10.9,
+        "EUR": 6.96,
+        "USD": 8.03
+      }
+    },
+    {
+      "skuId": "6a0f6da5-0b87-4190-a6ae-9bb5a2b9546a",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10.4,
+        "EUR": 6.64,
+        "USD": 7.66
+      }
+    },
+    {
+      "skuId": "6fd2c87f-b296-42f0-b197-1e91e994b900",
+      "family": "enterprise",
+      "tier": 2,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 38.9,
+        "BRL": 148.9,
+        "CAD": 35.3,
+        "CHF": 24.56,
+        "DKK": 195.65,
+        "EUR": 26.27,
+        "GBP": 23.3,
+        "INR": 2165.0,
+        "JPY": 3898.0,
+        "KRW": 35100.0,
+        "NOK": 305.29,
+        "NZD": 44.4,
+        "SEK": 289.81,
+        "TWD": 905.0,
+        "USD": 26.0
+      }
+    },
+    {
+      "skuId": "6fe1e61a-91e5-40d7-a547-0d2dcc81bce8",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 101.8,
+        "EUR": 65.03,
+        "USD": 74.99
+      }
+    },
+    {
+      "skuId": "71f21848-f89b-4aaa-a2dc-780c8e8aac5b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 49.68,
+        "EUR": 31.74,
+        "USD": 36.59
+      }
+    },
+    {
+      "skuId": "73e8b747-20bf-463d-8ffd-274a7d65d0bc",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 101.8,
+        "EUR": 65.03,
+        "USD": 74.99
+      }
+    },
+    {
+      "skuId": "750d9542-a2f8-41c7-8c81-311352173432",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 59.58,
+        "EUR": 38.06,
+        "USD": 43.89
+      }
+    },
+    {
+      "skuId": "75564b9c-51e8-431c-b8fe-d472d5a545c8",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 271.4,
+        "EUR": 173.37,
+        "USD": 199.91
+      }
+    },
+    {
+      "skuId": "7818ca3e-73c8-4e49-bc34-1276a2d27918",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 182.16,
+        "EUR": 116.36,
+        "USD": 134.18
+      }
+    },
+    {
+      "skuId": "796a6fb4-740b-4d36-bf56-9c12ca7fa069",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 20.4,
+        "EUR": 13.03,
+        "USD": 15.03
+      }
+    },
+    {
+      "skuId": "79909bd8-4c69-4202-939e-11bc4385b134",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 284.9,
+        "EUR": 181.99,
+        "USD": 209.86
+      }
+    },
+    {
+      "skuId": "79e2368c-4568-48d5-a352-b0344afabcf8",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 128.9,
+        "EUR": 82.34,
+        "USD": 94.95
+      }
+    },
+    {
+      "skuId": "7ac9fe77-66b7-4e5e-9e46-10eed1cff547",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10.9,
+        "EUR": 6.96,
+        "USD": 8.03
+      }
+    },
+    {
+      "skuId": "7bb14422-3b90-4389-a7be-f1b745fc037f",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 38.61,
+        "EUR": 24.66,
+        "USD": 28.44
+      }
+    },
+    {
+      "skuId": "7d0d4f9a-2686-4cb8-814c-eff3fdab6d74",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 13.6,
+        "EUR": 8.69,
+        "USD": 10.02
+      }
+    },
+    {
+      "skuId": "7e31c0d9-9551-471d-836f-32ee72be4a01",
+      "family": "teams",
+      "tier": 2,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 12.8,
+        "BRL": 49.0,
+        "CAD": 11.6,
+        "EUR": 7.41,
+        "GBP": 6.6,
+        "INR": 710.0,
+        "JPY": 1281.0,
+        "KRW": 11600.0,
+        "NZD": 13.8,
+        "TWD": 275.0,
+        "USD": 8.55
+      }
+    },
+    {
+      "skuId": "7e6e6091-1680-4532-9370-6cd4598483ac",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 101.8,
+        "EUR": 65.03,
+        "USD": 74.99
+      }
+    },
+    {
+      "skuId": "7e74bd05-2c47-404e-829a-ba95c66fe8e5",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 12.08,
+        "EUR": 7.72,
+        "USD": 8.9
+      }
+    },
+    {
+      "skuId": "805d57c3-a97d-4c12-a1d0-858ffe5015d0",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 48.6,
+        "EUR": 31.05,
+        "USD": 35.8
+      }
+    },
+    {
+      "skuId": "80b2d799-d2ba-4d2a-8842-fb0d0f3a4b82",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 2.7,
+        "EUR": 1.72,
+        "USD": 1.99
+      }
+    },
+    {
+      "skuId": "83c489a4-94b6-4dcc-9fdc-ff9b107a4621",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 40.7,
+        "EUR": 26.0,
+        "USD": 29.98
+      }
+    },
+    {
+      "skuId": "84951599-62b7-46f3-9c9d-30551b2ad607",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 2.7,
+        "EUR": 1.72,
+        "USD": 1.99
+      }
+    },
+    {
+      "skuId": "84a661c4-e949-4bd2-a560-ed7766fcaf2b",
+      "family": "security",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 15.0,
+        "BRL": 57.3,
+        "CAD": 13.6,
+        "CHF": 8.1,
+        "DKK": 64.7,
+        "EUR": 8.7,
+        "GBP": 7.7,
+        "INR": 830.0,
+        "JPY": 1499.0,
+        "KRW": 13500.0,
+        "NOK": 101.7,
+        "NZD": 16.2,
+        "SEK": 95.6,
+        "TWD": 320.0,
+        "USD": 10.0
+      }
+    },
+    {
+      "skuId": "878b8bbd-3cd0-4b44-9a56-3406741e65e0",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 67.8,
+        "EUR": 43.31,
+        "USD": 49.94
+      }
+    },
+    {
+      "skuId": "8a5fbbed-8b8c-41e5-907e-c50c471340fd",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 678.4,
+        "EUR": 433.36,
+        "USD": 499.71
+      }
+    },
+    {
+      "skuId": "8ee402cd-e6a8-4b67-a411-54d1f37a2049",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 178.83,
+        "EUR": 114.24,
+        "USD": 131.73
+      }
+    },
+    {
+      "skuId": "90277bc7-a6fe-4181-99d8-712b08b8d32b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 84.28,
+        "EUR": 53.84,
+        "USD": 62.08
+      }
+    },
+    {
+      "skuId": "90b5e015-709a-4b8b-b08e-3200f994494c",
+      "family": "exchange",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 4.5,
+        "CAD": 4.1,
+        "EUR": 2.6,
+        "GBP": 2.3,
+        "NZD": 4.9,
+        "USD": 3.0
+      }
+    },
+    {
+      "skuId": "93d9955a-ec70-44d5-8faa-a194492390f7",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 310.23,
+        "EUR": 198.17,
+        "USD": 228.52
+      }
+    },
+    {
+      "skuId": "9467fd84-2758-4287-b1fa-6a908c441b8a",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 407.0,
+        "EUR": 259.99,
+        "USD": 299.8
+      }
+    },
+    {
+      "skuId": "96d2951e-cb42-4481-9d6d-cad3baac177e",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 103.5,
+        "EUR": 66.12,
+        "USD": 76.24
+      }
+    },
+    {
+      "skuId": "98619618-9dc8-48c6-8f0c-741890ba5f93",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 183.2,
+        "EUR": 117.03,
+        "USD": 134.95
+      }
+    },
+    {
+      "skuId": "98defdf7-f6c1-44f5-a1f6-943b6764e7a5",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 7.5,
+        "EUR": 4.79,
+        "USD": 5.52
+      }
+    },
+    {
+      "skuId": "99049c9c-6011-4908-bf17-15f496e6519d",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 0.27,
+        "EUR": 0.17,
+        "USD": 0.2
+      }
+    },
+    {
+      "skuId": "9a18296a-025f-4e37-9ffa-30bf8d1ce775",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 134.3,
+        "EUR": 85.79,
+        "USD": 98.93
+      }
+    },
+    {
+      "skuId": "9ea4bdef-a20b-4668-b4a7-73e1f7696e0a",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 2035.2,
+        "EUR": 1300.09,
+        "USD": 1499.13
+      }
+    },
+    {
+      "skuId": "9f3d9c1d-25a5-4aaa-8e59-23a1e6450a67",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 5.4,
+        "EUR": 3.45,
+        "USD": 3.98
+      }
+    },
+    {
+      "skuId": "9fb0ba5f-4825-4e84-b239-5167a3a5d4dc",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 217.98,
+        "EUR": 139.25,
+        "USD": 160.56
+      }
+    },
+    {
+      "skuId": "a23dbafb-3396-48b3-ad9c-a304fe206043",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 49.5,
+        "EUR": 31.62,
+        "USD": 36.46
+      }
+    },
+    {
+      "skuId": "a3f586b6-8cce-4d9b-99d6-55238397f77a",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 26.54,
+        "EUR": 16.95,
+        "USD": 19.55
+      }
+    },
+    {
+      "skuId": "a58f5506-b382-44d4-bfab-225b2fbf8390",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 407.0,
+        "EUR": 259.99,
+        "USD": 299.8
+      }
+    },
+    {
+      "skuId": "a809996b-059e-42e2-9866-db24b99a9782",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 40.7,
+        "EUR": 26.0,
+        "USD": 29.98
+      }
+    },
+    {
+      "skuId": "a929cd4d-8672-47c9-8664-159c1f322ba8",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 13.6,
+        "EUR": 8.69,
+        "USD": 10.02
+      }
+    },
+    {
+      "skuId": "ad7a56e0-6903-4d13-94f3-5ad491e78960",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 2.7,
+        "EUR": 1.72,
+        "USD": 1.99
+      }
+    },
+    {
+      "skuId": "ad83ac17-4a5a-4ebb-adb2-079fb277e8b9",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 77.31,
+        "EUR": 49.39,
+        "USD": 56.95
+      }
+    },
+    {
+      "skuId": "ae2343d1-0999-43f6-ae18-d816516f6e78",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 32.9,
+        "CAD": 23.1,
+        "EUR": 19.1,
+        "GBP": 13.1,
+        "NZD": 35.6,
+        "USD": 17.0
+      }
+    },
+    {
+      "skuId": "aecb477b-2f56-4e38-b711-b752c24fc19b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 16281.6,
+        "EUR": 10400.69,
+        "USD": 11993.03
+      }
+    },
+    {
+      "skuId": "af739e8e-dd11-4eb5-a986-5908f595c603",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 40.7,
+        "EUR": 26.0,
+        "USD": 29.98
+      }
+    },
+    {
+      "skuId": "b05e124f-c7cc-45a0-a6aa-8cf78c946968",
+      "family": "security",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 27.0,
+        "BRL": 103.3,
+        "CAD": 24.5,
+        "CHF": 14.6,
+        "DKK": 116.7,
+        "EUR": 15.6,
+        "GBP": 13.9,
+        "INR": 1500.0,
+        "JPY": 2704.0,
+        "KRW": 24400.0,
+        "NOK": 183.4,
+        "NZD": 29.2,
+        "SEK": 172.4,
+        "TWD": 580.0,
+        "USD": 18.0
+      }
+    },
+    {
+      "skuId": "b1f3042b-a390-4b56-ab61-b88e7e767a97",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 7.61,
+        "EUR": 4.86,
+        "USD": 5.61
+      }
+    },
+    {
+      "skuId": "b30411f5-fea1-4a59-9ad9-3db7c7ead579",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 29.9,
+        "CAD": 27.1,
+        "EUR": 17.3,
+        "GBP": 15.4,
+        "NZD": 32.4,
+        "USD": 20.0
+      }
+    },
+    {
+      "skuId": "b3891a9f-c7d9-463c-a2ec-0b2321bda6f9",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 87.21,
+        "EUR": 55.71,
+        "USD": 64.24
+      }
+    },
+    {
+      "skuId": "b3a42176-0a8c-4c3f-ba4e-f2b37fe5be6b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 135.7,
+        "EUR": 86.69,
+        "USD": 99.96
+      }
+    },
+    {
+      "skuId": "b57282e3-65bd-4252-9502-c0eae1e5ab7f",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 9.59,
+        "EUR": 6.13,
+        "USD": 7.06
+      }
+    },
+    {
+      "skuId": "b75074f1-4c54-41bf-970f-c9ac871567f5",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 67.8,
+        "EUR": 43.31,
+        "USD": 49.94
+      }
+    },
+    {
+      "skuId": "beb6439c-caad-48d3-bf46-0c82871e12be",
+      "family": "addon",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 15.0,
+        "CAD": 13.6,
+        "EUR": 8.7,
+        "GBP": 7.7,
+        "NZD": 16.2,
+        "USD": 10.0
+      }
+    },
+    {
+      "skuId": "c1d032e0-5619-4761-9b5c-75b6831e1711",
+      "family": "analytics",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 35.9,
+        "BRL": 137.4,
+        "CAD": 32.6,
+        "CHF": 19.4,
+        "DKK": 155.2,
+        "EUR": 20.8,
+        "GBP": 18.5,
+        "INR": 1995.0,
+        "JPY": 3598.0,
+        "KRW": 32400.0,
+        "NOK": 244.0,
+        "NZD": 38.8,
+        "SEK": 229.4,
+        "TWD": 770.0,
+        "USD": 24.0
+      }
+    },
+    {
+      "skuId": "c1f79c29-5d7a-4bec-a2c1-1a76774864c0",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 15.23,
+        "EUR": 9.73,
+        "USD": 11.22
+      }
+    },
+    {
+      "skuId": "c2273bd0-dff7-4215-9ef5-2c7bcfb06425",
+      "family": "apps",
+      "tier": 2,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 22.1,
+        "BRL": 80.2,
+        "CAD": 19.8,
+        "CHF": 14.2,
+        "DKK": 114.7,
+        "EUR": 15.4,
+        "GBP": 13.7,
+        "INR": 1165.0,
+        "JPY": 2098.0,
+        "KRW": 18500.0,
+        "NOK": 178.6,
+        "NZD": 26.9,
+        "SEK": 168.0,
+        "TWD": 515.0,
+        "USD": 14.0
+      }
+    },
+    {
+      "skuId": "c2ac2ee4-9bb1-47e4-8541-d689c7e83371",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 52.9,
+        "EUR": 33.79,
+        "USD": 38.97
+      }
+    },
+    {
+      "skuId": "c2e41e49-e2a2-4c55-832a-cf13ffba1d6a",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 2.7,
+        "EUR": 1.72,
+        "USD": 1.99
+      }
+    },
+    {
+      "skuId": "c2fe850d-fbbb-4858-b67d-bd0c6e746da3",
+      "family": "enterprise",
+      "tier": 3,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 49.5,
+        "CHF": 28.38,
+        "DKK": 226.68,
+        "EUR": 30.36,
+        "NOK": 355.12,
+        "SEK": 335.04,
+        "USD": 36.46
+      }
+    },
+    {
+      "skuId": "c5928f49-12ba-48f7-ada3-0d743a3601d5",
+      "family": "addon",
+      "tier": 2,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 22.4,
+        "CAD": 20.4,
+        "EUR": 13.0,
+        "GBP": 11.5,
+        "NZD": 24.3,
+        "USD": 15.0
+      }
+    },
+    {
+      "skuId": "c7df2760-2c81-4ef7-b578-5b5392b571df",
+      "family": "enterprise",
+      "tier": 4,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 61.4,
+        "BRL": 234.8,
+        "CAD": 55.6,
+        "CHF": 38.72,
+        "DKK": 308.53,
+        "EUR": 41.42,
+        "GBP": 36.8,
+        "INR": 3410.0,
+        "JPY": 6146.0,
+        "KRW": 55400.0,
+        "NOK": 481.41,
+        "NZD": 70.1,
+        "SEK": 457.0,
+        "TWD": 1425.0,
+        "USD": 41.0
+      }
+    },
+    {
+      "skuId": "c97d00e4-0c4c-4ec2-a016-9448c65de986",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 169.74,
+        "EUR": 108.43,
+        "USD": 125.03
+      }
+    },
+    {
+      "skuId": "cb10e6cd-9da4-4992-867b-67546b1db821",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10.4,
+        "EUR": 6.64,
+        "USD": 7.66
+      }
+    },
+    {
+      "skuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+      "family": "business",
+      "tier": 3,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 32.9,
+        "BRL": 126.0,
+        "CAD": 29.8,
+        "CHF": 17.82,
+        "DKK": 142.27,
+        "EUR": 19.06,
+        "GBP": 16.9,
+        "INR": 1830.0,
+        "JPY": 3298.0,
+        "KRW": 29700.0,
+        "NOK": 223.63,
+        "NZD": 35.6,
+        "SEK": 210.29,
+        "TWD": 705.0,
+        "USD": 22.0
+      }
+    },
+    {
+      "skuId": "cd2925a3-5076-4233-8931-638a8c94f773",
+      "family": "enterprise",
+      "tier": 5,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 89.8,
+        "BRL": 343.5,
+        "CAD": 81.4,
+        "CHF": 54.33,
+        "DKK": 433.8,
+        "EUR": 58.13,
+        "GBP": 51.6,
+        "INR": 4990.0,
+        "JPY": 8995.0,
+        "KRW": 81100.0,
+        "NOK": 680.04,
+        "NZD": 97.1,
+        "SEK": 641.18,
+        "TWD": 1930.0,
+        "USD": 60.0
+      }
+    },
+    {
+      "skuId": "cdd28e44-67e3-425e-be4c-737fab2899d3",
+      "family": "apps",
+      "tier": 1,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 15.8,
+        "BRL": 57.3,
+        "CAD": 14.2,
+        "CHF": 10.1,
+        "DKK": 81.9,
+        "EUR": 11.0,
+        "GBP": 9.8,
+        "INR": 830.0,
+        "JPY": 1499.0,
+        "KRW": 13200.0,
+        "NOK": 127.6,
+        "NZD": 19.2,
+        "SEK": 120.0,
+        "TWD": 370.0,
+        "USD": 10.0
+      }
+    },
+    {
+      "skuId": "cf6b0d46-4093-4546-a0ab-0b1546dcc10e",
+      "family": "security",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 10.5,
+        "BRL": 40.1,
+        "CAD": 9.5,
+        "CHF": 5.7,
+        "DKK": 45.3,
+        "EUR": 6.1,
+        "GBP": 5.4,
+        "INR": 580.0,
+        "JPY": 1049.0,
+        "KRW": 9500.0,
+        "NOK": 71.2,
+        "NZD": 11.3,
+        "SEK": 66.9,
+        "TWD": 225.0,
+        "USD": 7.0
+      }
+    },
+    {
+      "skuId": "d13ef257-988a-46f3-8fce-f47484dd4550",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 19.3,
+        "EUR": 12.33,
+        "USD": 14.22
+      }
+    },
+    {
+      "skuId": "d201f153-d3b2-4057-be2f-fe25c8983e6f",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 91.08,
+        "EUR": 58.18,
+        "USD": 67.09
+      }
+    },
+    {
+      "skuId": "d711d25a-a21c-492f-bd19-aae1e8ebaf30",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 30.73,
+        "EUR": 19.63,
+        "USD": 22.64
+      }
+    },
+    {
+      "skuId": "dab7782a-93b1-4074-8bb1-0e61318bea0b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 9.5,
+        "EUR": 6.07,
+        "USD": 7.0
+      }
+    },
+    {
+      "skuId": "dbd31205-338e-4dec-903d-44402e305e32",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 2.7,
+        "EUR": 1.72,
+        "USD": 1.99
+      }
+    },
+    {
+      "skuId": "dcf0408c-aaec-446c-afd4-43e3683943ea",
+      "family": "enterprise",
+      "tier": 3,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 45.6,
+        "BRL": 174.3,
+        "CAD": 41.3,
+        "EUR": 26.38,
+        "GBP": 27.0,
+        "INR": 2535.0,
+        "JPY": 4565.0,
+        "KRW": 41100.0,
+        "NZD": 49.3,
+        "TWD": 980.0,
+        "USD": 30.45
+      }
+    },
+    {
+      "skuId": "de376a03-6e5b-42ec-855f-093fb50b8ca5",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 13.6,
+        "EUR": 8.69,
+        "USD": 10.02
+      }
+    },
+    {
+      "skuId": "debc9e58-f2d7-412c-a0b6-575608564228",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 271.4,
+        "EUR": 173.37,
+        "USD": 199.91
+      }
+    },
+    {
+      "skuId": "dfb1700c-013e-4132-8bce-0d319c43a95d",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 149.2,
+        "EUR": 95.31,
+        "USD": 109.9
+      }
+    },
+    {
+      "skuId": "e2aebe6c-897d-480f-9d62-fff1381581f7",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 56.61,
+        "EUR": 36.16,
+        "USD": 41.7
+      }
+    },
+    {
+      "skuId": "e42bc969-759a-4820-9283-6b73085b68e6",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 6.8,
+        "EUR": 4.34,
+        "USD": 5.01
+      }
+    },
+    {
+      "skuId": "e430a580-c37b-4d16-adba-d881d7cd0364",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 4.7,
+        "EUR": 3.0,
+        "USD": 3.46
+      }
+    },
+    {
+      "skuId": "e43b5b99-8dfb-405f-9987-dc307f34bcbd",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 15.0,
+        "BRL": 57.3,
+        "CAD": 13.6,
+        "CHF": 8.1,
+        "DKK": 64.7,
+        "EUR": 8.7,
+        "GBP": 7.7,
+        "INR": 830.0,
+        "JPY": 1499.0,
+        "KRW": 13500.0,
+        "NOK": 101.7,
+        "NZD": 16.2,
+        "SEK": 95.6,
+        "TWD": 320.0,
+        "USD": 10.0
+      }
+    },
+    {
+      "skuId": "e4654015-5daf-4a48-9b37-4f309dddd88b",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 16.3,
+        "EUR": 10.41,
+        "USD": 12.01
+      }
+    },
+    {
+      "skuId": "e485d696-4c87-4aac-bf4a-91b2fb6f0fa7",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 1831.7,
+        "EUR": 1170.09,
+        "USD": 1349.23
+      }
+    },
+    {
+      "skuId": "eda1941c-3c4f-4995-b5eb-e85a42175ab9",
+      "family": "addon",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 22.4,
+        "CAD": 20.4,
+        "EUR": 13.0,
+        "GBP": 11.5,
+        "NZD": 24.3,
+        "USD": 15.0
+      }
+    },
+    {
+      "skuId": "ee02fd1b-340e-4a4b-b355-4a514e4c8943",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 4.1,
+        "EUR": 2.62,
+        "USD": 3.02
+      }
+    },
+    {
+      "skuId": "efccb6f7-5641-4e0e-bd10-b4976e1bf68e",
+      "family": "security",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 18.0,
+        "BRL": 68.9,
+        "CAD": 16.3,
+        "CHF": 9.8,
+        "DKK": 77.9,
+        "EUR": 10.4,
+        "GBP": 9.3,
+        "INR": 1000.0,
+        "JPY": 1805.0,
+        "KRW": 16300.0,
+        "NOK": 122.4,
+        "NZD": 19.5,
+        "SEK": 115.1,
+        "TWD": 385.0,
+        "USD": 12.0
+      }
+    },
+    {
+      "skuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+      "family": "business",
+      "tier": 2,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 21.0,
+        "BRL": 80.2,
+        "CAD": 19.0,
+        "CHF": 11.34,
+        "DKK": 90.54,
+        "EUR": 12.13,
+        "GBP": 10.8,
+        "INR": 860.0,
+        "JPY": 2098.0,
+        "KRW": 18900.0,
+        "NOK": 142.31,
+        "NZD": 22.6,
+        "SEK": 133.82,
+        "TWD": 450.0,
+        "USD": 14.0
+      }
+    },
+    {
+      "skuId": "f7ad4bca-7221-452c-bdb6-3e6089f25e06",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 10718.7,
+        "EUR": 6847.11,
+        "USD": 7895.39
+      }
+    },
+    {
+      "skuId": "f7ee79a7-7aec-4ca4-9fb9-34d6b930ad87",
+      "family": "frontline",
+      "tier": 3,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 12.6,
+        "CHF": 7.23,
+        "DKK": 57.74,
+        "EUR": 7.73,
+        "NOK": 90.77,
+        "SEK": 85.35,
+        "USD": 9.28
+      }
+    },
+    {
+      "skuId": "f8a1db68-be16-40ed-86d5-cb42ce701560",
+      "family": "analytics",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 21.0,
+        "BRL": 80.2,
+        "CAD": 19.0,
+        "CHF": 11.3,
+        "DKK": 90.5,
+        "EUR": 12.1,
+        "GBP": 10.8,
+        "INR": 1165.0,
+        "JPY": 2098.0,
+        "KRW": 18900.0,
+        "NOK": 142.3,
+        "NZD": 22.6,
+        "SEK": 133.8,
+        "TWD": 450.0,
+        "USD": 14.0
+      }
+    },
+    {
+      "skuId": "f8ced641-8e17-4dc5-b014-f5a2d53f6ac8",
+      "family": "enterprise",
+      "tier": 1,
+      "eligibleTarget": false,
+      "prices": {
+        "AUD": 10.2,
+        "BRL": 38.9,
+        "CAD": 9.2,
+        "EUR": 5.88,
+        "GBP": 5.2,
+        "INR": 565.0,
+        "JPY": 1017.0,
+        "KRW": 9200.0,
+        "NZD": 11.0,
+        "TWD": 220.0,
+        "USD": 6.79
+      }
+    },
+    {
+      "skuId": "f991cecc-3f91-4cd0-a9a8-bf1c8167e029",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 149.2,
+        "EUR": 95.31,
+        "USD": 109.9
+      }
+    },
+    {
+      "skuId": "fbc79df2-da01-4c17-8d88-17f8c9493d8f",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 150.12,
+        "EUR": 95.9,
+        "USD": 110.58
+      }
+    },
+    {
+      "skuId": "fde42873-30b6-436b-b361-21af5a6b84ae",
+      "family": "teams",
+      "tier": 1,
+      "eligibleTarget": true,
+      "prices": {
+        "AUD": 6.0,
+        "BRL": 22.9,
+        "CAD": 5.4,
+        "CHF": 3.2,
+        "DKK": 25.9,
+        "EUR": 3.5,
+        "GBP": 3.1,
+        "INR": 115.0,
+        "JPY": 599.0,
+        "KRW": 5400.0,
+        "NOK": 40.7,
+        "NZD": 6.5,
+        "SEK": 38.2,
+        "TWD": 130.0,
+        "USD": 4.0
+      }
+    },
+    {
+      "skuId": "ff22b8d4-5073-4b24-ba45-84ad5d9b6642",
+      "family": "other",
+      "tier": 0,
+      "eligibleTarget": false,
+      "prices": {
+        "CAD": 1356.8,
+        "EUR": 866.72,
+        "USD": 999.42
+      }
+    }
+  ]
+}
diff --git a/Config/LicensePricingDefaults.csv b/Config/LicensePricingDefaults.csv
deleted file mode 100644
index 30a2ea1a7bcfc..0000000000000
--- a/Config/LicensePricingDefaults.csv
+++ /dev/null
@@ -1,476 +0,0 @@
-skuId,skuPartNumber,Product_Display_Name,MonthlyPrice,Currency
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,18,AUD
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,68.9,BRL
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,16.3,CAD
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,9.8,CHF
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,77.9,DKK
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,10.4,EUR
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,9.3,GBP
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,1000,INR
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,1805,JPY
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,16300,KRW
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,122.4,NOK
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,19.5,NZD
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,115.1,SEK
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,385,TWD
-efccb6f7-5641-4e0e-bd10-b4976e1bf68e,EMS,Enterprise Mobility + Security E3,12,USD
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,27,AUD
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,103.3,BRL
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,24.5,CAD
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,14.6,CHF
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,116.7,DKK
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,15.6,EUR
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,13.9,GBP
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,1500,INR
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,2704,JPY
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,24400,KRW
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,183.4,NOK
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,29.2,NZD
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,172.4,SEK
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,580,TWD
-b05e124f-c7cc-45a0-a6aa-8cf78c946968,EMSPREMIUM,Enterprise Mobility + Security E5,18,USD
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),6,AUD
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),22.9,BRL
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),5.4,CAD
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),3.2,CHF
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),25.9,DKK
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),3.5,EUR
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),3.1,GBP
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),335,INR
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),599,JPY
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),5400,KRW
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),40.7,NOK
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),6.5,NZD
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),38.2,SEK
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),130,TWD
-4b9405b0-7788-4568-add1-99614e613b69,EXCHANGESTANDARD,Exchange Online (Plan 1),4,USD
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),12,AUD
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),45.8,BRL
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),10.9,CAD
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),6.5,CHF
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),51.7,DKK
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),6.9,EUR
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),6.2,GBP
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),665,INR
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),1199,JPY
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),10800,KRW
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),81.3,NOK
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),12.9,NZD
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),76.5,SEK
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),255,TWD
-19ec0d23-8335-4cbd-94ac-6050e30712fa,EXCHANGEENTERPRISE,Exchange Online (Plan 2),8,USD
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,15.8,AUD
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,57.3,BRL
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,14.2,CAD
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,10.1,CHF
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,81.9,DKK
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,11,EUR
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,9.8,GBP
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,830,INR
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,1499,JPY
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,13200,KRW
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,127.6,NOK
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,19.2,NZD
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,120,SEK
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,370,TWD
-cdd28e44-67e3-425e-be4c-737fab2899d3,O365_BUSINESS,Microsoft 365 Apps for Business,10,USD
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,22.1,AUD
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,80.2,BRL
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,19.8,CAD
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,14.2,CHF
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,114.7,DKK
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,15.4,EUR
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,13.7,GBP
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,1165,INR
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,2098,JPY
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,18500,KRW
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,178.6,NOK
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,26.9,NZD
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,168,SEK
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,515,TWD
-c2273bd0-dff7-4215-9ef5-2c7bcfb06425,OFFICESUBSCRIPTION,Microsoft 365 Apps for Enterprise,14,USD
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,10.5,AUD
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,33.4,BRL
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,9.5,CAD
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,5.67,CHF
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,45.27,DKK
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,6.07,EUR
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,5.4,GBP
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,170,INR
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,1049,JPY
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,9500,KRW
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,71.16,NOK
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,11.3,NZD
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,66.91,SEK
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,225,TWD
-3b555118-da6a-4418-894f-7df1e2096870,O365_BUSINESS_ESSENTIALS,Microsoft 365 Business Basic,7,USD
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,32.9,AUD
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,126,BRL
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,29.8,CAD
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,17.82,CHF
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,142.27,DKK
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,19.06,EUR
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,16.9,GBP
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,1830,INR
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,3298,JPY
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,29700,KRW
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,223.63,NOK
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,35.6,NZD
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,210.29,SEK
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,705,TWD
-cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46,SPB,Microsoft 365 Business Premium,22,USD
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,21,AUD
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,80.2,BRL
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,19,CAD
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,11.34,CHF
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,90.54,DKK
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,12.13,EUR
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,10.8,GBP
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,860,INR
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,2098,JPY
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,18900,KRW
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,142.31,NOK
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,22.6,NZD
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,133.82,SEK
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,450,TWD
-f245ecc8-75af-4f8e-b61f-27d8114de5f3,O365_BUSINESS_PREMIUM,Microsoft 365 Business Standard,14,USD
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,58.4,AUD
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,223.3,BRL
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,52.9,CAD
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,35.32,CHF
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,281.97,DKK
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,37.78,EUR
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,33.5,GBP
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,3245,INR
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,5847,JPY
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,52700,KRW
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,442.03,NOK
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,63.1,NZD
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,416.77,SEK
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,1255,TWD
-05e9a617-0261-4cee-bb44-138d3ef5d965,SPE_E3,Microsoft 365 E3,39,USD
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),45.6,AUD
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),174.3,BRL
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),41.3,CAD
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),27,GBP
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),2535,INR
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),4565,JPY
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),41100,KRW
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),49.3,NZD
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),980,TWD
-dcf0408c-aaec-446c-afd4-43e3683943ea,Microsoft_365_E3_(no_Teams),Microsoft 365 E3 (no Teams),30.45,USD
-c2fe850d-fbbb-4858-b67d-bd0c6e746da3,O365_w/o Teams Bundle_M3,Microsoft 365 E3 EEA (no Teams),28.38,CHF
-c2fe850d-fbbb-4858-b67d-bd0c6e746da3,O365_w/o Teams Bundle_M3,Microsoft 365 E3 EEA (no Teams),226.68,DKK
-c2fe850d-fbbb-4858-b67d-bd0c6e746da3,O365_w/o Teams Bundle_M3,Microsoft 365 E3 EEA (no Teams),30.36,EUR
-c2fe850d-fbbb-4858-b67d-bd0c6e746da3,O365_w/o Teams Bundle_M3,Microsoft 365 E3 EEA (no Teams),355.12,NOK
-c2fe850d-fbbb-4858-b67d-bd0c6e746da3,O365_w/o Teams Bundle_M3,Microsoft 365 E3 EEA (no Teams),335.04,SEK
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,89.8,AUD
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,343.5,BRL
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,81.4,CAD
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,54.33,CHF
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,433.8,DKK
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,58.13,EUR
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,51.6,GBP
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,4990,INR
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,8995,JPY
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,81100,KRW
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,680.04,NOK
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,97.1,NZD
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,641.18,SEK
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,1930,TWD
-06ebc4ee-1bb5-47dd-8120-11324bc54e06,SPE_E5,Microsoft 365 E5,60,USD
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),77,AUD
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),294.6,BRL
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),69.8,CAD
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),45,GBP
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),4280,INR
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),7713,JPY
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),69500,KRW
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),83.2,NZD
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),1655,TWD
-18a4bd3f-0b5b-4887-b04f-61dd0ee15f5e,Microsoft_365_E5_(no_Teams),Microsoft 365 E5 (no Teams),51.45,USD
-3271cf8e-2be5-4a09-a549-70fd05baaa17,O365_w/o_Teams_Bundle_M5,Microsoft 365 E5 EEA (no Teams),47.4,CHF
-3271cf8e-2be5-4a09-a549-70fd05baaa17,O365_w/o_Teams_Bundle_M5,Microsoft 365 E5 EEA (no Teams),378.5,DKK
-3271cf8e-2be5-4a09-a549-70fd05baaa17,O365_w/o_Teams_Bundle_M5,Microsoft 365 E5 EEA (no Teams),50.71,EUR
-3271cf8e-2be5-4a09-a549-70fd05baaa17,O365_w/o_Teams_Bundle_M5,Microsoft 365 E5 EEA (no Teams),593.13,NOK
-3271cf8e-2be5-4a09-a549-70fd05baaa17,O365_w/o_Teams_Bundle_M5,Microsoft 365 E5 EEA (no Teams),559.44,SEK
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,89.8,AUD
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,343.5,BRL
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,81.4,CAD
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,54.33,CHF
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,433.8,DKK
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,58.13,EUR
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,51.6,GBP
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,4990,INR
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,8995,JPY
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,81100,KRW
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,680.04,NOK
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,97.1,NZD
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,641.18,SEK
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,1930,TWD
-cd2925a3-5076-4233-8931-638a8c94f773,SPE_E5_NOPSTNCONF,Microsoft 365 E5 without Audio Conferencing,60,USD
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,4.5,AUD
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,17.2,BRL
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,4.1,CAD
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,2.43,CHF
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,19.4,DKK
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,2.6,EUR
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,2.3,GBP
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,250,INR
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,449,JPY
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,4100,KRW
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,30.5,NOK
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,4.9,NZD
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,28.68,SEK
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,96.5,TWD
-50f60901-3181-4b75-8a2c-4c8e4c1d5a72,M365_F1_COMM,Microsoft 365 F1,3,USD
-0666269f-b167-4c5b-a76f-fc574f2b1118,Microsoft_365_F1_EEA_(no_Teams),Microsoft 365 F1 EEA (no Teams),2.02,CHF
-0666269f-b167-4c5b-a76f-fc574f2b1118,Microsoft_365_F1_EEA_(no_Teams),Microsoft 365 F1 EEA (no Teams),16.16,DKK
-0666269f-b167-4c5b-a76f-fc574f2b1118,Microsoft_365_F1_EEA_(no_Teams),Microsoft 365 F1 EEA (no Teams),2.16,EUR
-0666269f-b167-4c5b-a76f-fc574f2b1118,Microsoft_365_F1_EEA_(no_Teams),Microsoft 365 F1 EEA (no Teams),25.41,NOK
-0666269f-b167-4c5b-a76f-fc574f2b1118,Microsoft_365_F1_EEA_(no_Teams),Microsoft 365 F1 EEA (no Teams),23.89,SEK
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,15,AUD
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,57.3,BRL
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,13.6,CAD
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,8.1,CHF
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,64.67,DKK
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,8.66,EUR
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,7.7,GBP
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,830,INR
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,1499,JPY
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,13500,KRW
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,101.65,NOK
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,16.2,NZD
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,95.59,SEK
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,320,TWD
-66b55226-6b4f-492c-910c-a3b7a3c9d993,SPE_F1,Microsoft 365 F3,10,USD
-f7ee79a7-7aec-4ca4-9fb9-34d6b930ad87,Microsoft_365_F3_EEA_(no_Teams),Microsoft 365 F3 EEA (no Teams),7.23,CHF
-f7ee79a7-7aec-4ca4-9fb9-34d6b930ad87,Microsoft_365_F3_EEA_(no_Teams),Microsoft 365 F3 EEA (no Teams),57.74,DKK
-f7ee79a7-7aec-4ca4-9fb9-34d6b930ad87,Microsoft_365_F3_EEA_(no_Teams),Microsoft 365 F3 EEA (no Teams),7.73,EUR
-f7ee79a7-7aec-4ca4-9fb9-34d6b930ad87,Microsoft_365_F3_EEA_(no_Teams),Microsoft 365 F3 EEA (no Teams),90.77,NOK
-f7ee79a7-7aec-4ca4-9fb9-34d6b930ad87,Microsoft_365_F3_EEA_(no_Teams),Microsoft 365 F3 EEA (no Teams),85.35,SEK
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,44.9,AUD
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,171.8,BRL
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,40.7,CAD
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,24.3,CHF
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,194,DKK
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,26,EUR
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,23.1,GBP
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,2495,INR
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,4497,JPY
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,40500,KRW
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,305,NOK
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,48.5,NZD
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,286.8,SEK
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,965,TWD
-639dec6b-bb19-468b-871c-c5c441c4b0cb,Microsoft_365_Copilot,Microsoft Copilot for Microsoft 365,30,USD
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,4.5,AUD
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,13.7,BRL
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,4.1,CAD
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,2.4,CHF
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,19.4,DKK
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,2.6,EUR
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,2.3,GBP
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,250,INR
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,449,JPY
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,4100,KRW
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,30.5,NOK
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,4.9,NZD
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,28.7,SEK
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,96.5,TWD
-5e1e7702-a2b7-4360-8d07-2f515792896f,MDE_SMB,Microsoft Defender for Business,3,USD
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,10.5,AUD
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,40.1,BRL
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,9.5,CAD
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,5.7,CHF
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,45.3,DKK
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,6.1,EUR
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,5.4,GBP
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,580,INR
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,1049,JPY
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,9500,KRW
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,71.2,NOK
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,11.3,NZD
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,66.9,SEK
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,225,TWD
-cf6b0d46-4093-4546-a0ab-0b1546dcc10e,Microsoft_Entra_ID_Governance,Microsoft Entra ID Governance,7,USD
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,10.5,AUD
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,40.1,BRL
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,9.5,CAD
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,5.7,CHF
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,45.3,DKK
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,6.1,EUR
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,5.4,GBP
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,580,INR
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,1049,JPY
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,9500,KRW
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,71.2,NOK
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,11.3,NZD
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,66.9,SEK
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,225,TWD
-078d2b04-f1bd-4111-bbd4-b4b1b354cef4,AAD_PREMIUM,Microsoft Entra ID P1,7,USD
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,15,AUD
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,57.3,BRL
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,13.6,CAD
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,8.1,CHF
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,64.7,DKK
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,8.7,EUR
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,7.7,GBP
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,830,INR
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,1499,JPY
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,13500,KRW
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,101.7,NOK
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,16.2,NZD
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,95.6,SEK
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,320,TWD
-84a661c4-e949-4bd2-a560-ed7766fcaf2b,AAD_PREMIUM_P2,Microsoft Entra ID P2,10,USD
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,12.8,AUD
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,49,BRL
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,11.6,CAD
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,6.6,GBP
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,710,INR
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,1281,JPY
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,11600,KRW
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,13.8,NZD
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,275,TWD
-7e31c0d9-9551-471d-836f-32ee72be4a01,Microsoft_Teams_Enterprise_New,Microsoft Teams Enterprise,8.55,USD
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,6,AUD
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,22.9,BRL
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,5.4,CAD
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,3.2,CHF
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,25.9,DKK
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,3.5,EUR
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,3.1,GBP
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,115,INR
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,599,JPY
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,5400,KRW
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,40.7,NOK
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,6.5,NZD
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,38.2,SEK
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,130,TWD
-fde42873-30b6-436b-b361-21af5a6b84ae,Teams_Ess,Microsoft Teams Essentials,4,USD
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,15,AUD
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,57.3,BRL
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,13.6,CAD
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,8.1,CHF
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,64.7,DKK
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,8.7,EUR
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,7.7,GBP
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,830,INR
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,1499,JPY
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,13500,KRW
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,101.7,NOK
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,16.2,NZD
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,95.6,SEK
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,320,TWD
-e43b5b99-8dfb-405f-9987-dc307f34bcbd,MCOEV,Microsoft Teams Phone Standard,10,USD
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,59.9,AUD
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,229,BRL
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,54.3,CAD
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,32.4,CHF
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,258.7,DKK
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,34.7,EUR
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,30.8,GBP
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,5997,JPY
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,54100,KRW
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,406.6,NOK
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,64.7,NZD
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,382.3,SEK
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,1285,TWD
-4cde982a-ede4-4409-9ae6-b003453c8ea6,Microsoft_Teams_Rooms_Pro,Microsoft Teams Rooms Pro,40,USD
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,15,AUD
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,57.3,BRL
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,13.6,CAD
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,8.1,CHF
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,64.67,DKK
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,8.66,EUR
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,7.7,GBP
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,830,INR
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,1499,JPY
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,13500,KRW
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,101.65,NOK
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,16.2,NZD
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,95.59,SEK
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,320,TWD
-18181a46-0d4e-45cd-891e-60aabd171b4e,STANDARDPACK,Office 365 E1,10,USD
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),10.2,AUD
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),38.9,BRL
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),9.2,CAD
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),5.2,GBP
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),565,INR
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),1017,JPY
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),9200,KRW
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),11,NZD
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),220,TWD
-f8ced641-8e17-4dc5-b014-f5a2d53f6ac8,Office_365_E1_(no_Teams),Office 365 E1 (no Teams),6.79,USD
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,38.9,AUD
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,148.9,BRL
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,35.3,CAD
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,24.56,CHF
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,195.65,DKK
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,26.27,EUR
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,23.3,GBP
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,2165,INR
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,3898,JPY
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,35100,KRW
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,305.29,NOK
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,44.4,NZD
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,289.81,SEK
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,905,TWD
-6fd2c87f-b296-42f0-b197-1e91e994b900,ENTERPRISEPACK,Office 365 E3,26,USD
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),26.1,AUD
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),99.9,BRL
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),23.7,CAD
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),16.7,GBP
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),1450,INR
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),2616,JPY
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),23600,KRW
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),30.6,NZD
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),635,TWD
-46c3a859-c90d-40b3-9551-6178a48d5c18,Office_365_E3_(no_Teams),Office 365 E3 (no Teams),17.45,USD
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,61.4,AUD
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,234.8,BRL
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,55.6,CAD
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,38.72,CHF
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,308.53,DKK
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,41.42,EUR
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,36.8,GBP
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,3410,INR
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,6146,JPY
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,55400,KRW
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,481.41,NOK
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,70.1,NZD
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,457,SEK
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,1425,TWD
-c7df2760-2c81-4ef7-b578-5b5392b571df,ENTERPRISEPREMIUM,Office 365 E5,41,USD
-4b585984-651b-448a-9e53-3b10f069cf7f,DESKLESSPACK,Office 365 F3,4.00,USD
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,35.9,AUD
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,137.4,BRL
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,32.6,CAD
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,19.4,CHF
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,155.2,DKK
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,20.8,EUR
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,18.5,GBP
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,1995,INR
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,3598,JPY
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,32400,KRW
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,244,NOK
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,38.8,NZD
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,229.4,SEK
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,770,TWD
-c1d032e0-5619-4761-9b5c-75b6831e1711,PBI_PREMIUM_PER_USER,Power BI Premium Per User,24,USD
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,21,AUD
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,80.2,BRL
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,19,CAD
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,11.3,CHF
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,90.5,DKK
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,12.1,EUR
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,10.8,GBP
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,1165,INR
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,2098,JPY
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,18900,KRW
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,142.3,NOK
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,22.6,NZD
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,133.8,SEK
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,450,TWD
-f8a1db68-be16-40ed-86d5-cb42ce701560,POWER_BI_PRO,Power BI Pro,14,USD
diff --git a/Config/MicrosoftFirstPartyApps.json b/Config/MicrosoftFirstPartyApps.json
new file mode 100644
index 0000000000000..87d04ebd17be0
--- /dev/null
+++ b/Config/MicrosoftFirstPartyApps.json
@@ -0,0 +1,146 @@
+{
+  "1b912ec3-a9dd-4c4d-a53e-76aa7adb28d7": "AADReporting",
+  "23523755-3a2b-41ca-9315-f81f3f566a95": "ACOM Azure Website",
+  "74658136-14ec-4630-ad9b-26e160ff0fc6": "ADIbizaUX",
+  "69893ee3-dd10-4b1c-832d-4870354be3d8": "AEM-DualAuth",
+  "0cb7b9ec-5336-483b-bc31-b15b5788de71": "ASM Campaign Servicing",
+  "4354e225-50c9-4423-9ece-2d5afd904870": "Augmentation Loop",
+  "7b7531ad-5926-4f2d-8a1d-38495ad33e17": "Azure Advanced Threat Protection",
+  "ea890292-c8c8-4433-b5ea-b09d0668e1a6": "Azure Credential Configuration Endpoint Service",
+  "e9f49c6b-5ce5-44c8-925d-015017e9f7ad": "Azure Data Lake",
+  "499b84ac-1321-427f-aa17-267ca6975798": "Azure DevOps",
+  "835b2a73-6e10-4aa5-a979-21dfda45231c": "Azure Lab Services Portal",
+  "c44b4083-3bb0-49c1-b47d-974e53cbdf3c": "Azure Portal",
+  "5a6fd92b-8a2c-41d2-b3bb-98d35d258d9e": "Azure Portal Fx Copilot Web",
+  "797f4846-ba00-4fd7-ba43-dac1f8f63013": "Azure Resource Manager",
+  "9cdead84-a844-4324-93f2-b2e6bb768d07": "Azure Virtual Desktop",
+  "37182072-3c9c-4f6a-a4b3-b3f91cacffce": "AzureSupportCenter",
+  "9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7": "Bing",
+  "8fbcdaa8-9342-48c2-927f-3a15d30f7b8b": "Code Center Premium",
+  "bb2a2e3a-c5e7-4f0a-88e0-8e01fd3fc1f4": "CPIM Service",
+  "e64aa8bc-8eb4-40e2-898b-cf261a25954f": "CRM Power BI Integration",
+  "00000007-0000-0000-c000-000000000000": "Dataverse",
+  "de50c81f-5f80-4771-b66b-cebd28ccdfc1": "Device Management Client",
+  "3a4d129e-7f50-4e0d-a7fd-033add0a29f4": "Enterprise Dashboard Project",
+  "60c8bde5-3167-4f92-8fdb-059f6176dc0f": "Enterprise Roaming and Backup",
+  "ffe59ab3-5993-4931-863a-2e78afcf0d1f": "Entra-Copilot-UX",
+  "6da466b6-1d13-4a2c-97bd-51a99e8d4d74": "Exchange Office Graph Client for AAD - Interactive",
+  "765fe668-04e7-42ba-aec0-2c96f1d8b652": "Exchange Office Graph Client for AAD - Noninteractive",
+  "789e8929-0390-42a2-8934-0f9dafb8ec89": "Exchange Rbac",
+  "4b0964e4-58f1-47f4-a552-e2e1fc56dcd7": "FXIrisClient",
+  "cde6adac-58fd-4b78-8d6d-9beaf1b0d668": "Global Secure Access Client",
+  "a57aca87-cbc0-4f3c-8b9e-dc095fdc8978": "IAM Supportability",
+  "16aeb910-ce68-41d1-9ac3-9e1673ac9575": "IrisSelectionFrontDoor",
+  "c0ab8ce9-e9a0-42e7-b064-33d422df41f1": "M365ChatClient",
+  "d73f4b35-55c9-48c7-8b10-651f6f2acb2e": "MCAPI Authorization Prod",
+  "0cd196ee-71bf-4fd6-a57c-b491ffd4fb1e": "Media Analysis and Transformation Service",
+  "944f0bd1-117b-4b1c-af26-804ed95e767e": "Media Analysis and Transformation Service",
+  "fb8d773d-7ef8-4ec0-a117-179f88add510": "Microsoft 365 Copilot",
+  "ee272b19-4411-433f-8f28-5c13cb6fd407": "Microsoft 365 Support Service",
+  "0000000c-0000-0000-c000-000000000000": "Microsoft App Access Panel",
+  "6f7e0f60-9401-4f5b-98e2-cf15bd5fd5e3": "Microsoft Application Command Service",
+  "38049638-cc2c-4cde-abe4-4479d721ed44": "Microsoft Approval Management",
+  "65d91a3d-ab74-42e6-8a2f-0add61688c74": "Microsoft Approval Management",
+  "29d9ed98-a469-4536-ade2-f981bc1d605e": "Microsoft Authentication Broker",
+  "4813382a-8fa7-425e-ab75-3b753aab3abb": "Microsoft Authenticator App",
+  "04b07795-8ddb-461a-bbee-02f9e1bf7b46": "Microsoft Azure CLI",
+  "1950a258-227b-4e31-a9cf-717495945fc2": "Microsoft Azure PowerShell",
+  "1786c5ed-9644-47b2-8aa0-7201292175b6": "Microsoft Bing Default Search Engine",
+  "cf36b471-5b44-428c-9ce7-313bf84528de": "Microsoft Bing Search",
+  "2d7f3606-b07d-41d1-b9d2-0d0c9296a6e8": "Microsoft Bing Search for Microsoft Edge",
+  "3090ab82-f1c1-4cdf-af2c-5d7a6f3e2cc7": "Microsoft Defender for Cloud Apps",
+  "8a0c2593-9cbc-4f86-a247-beb7aab00d83": "Microsoft Defender for Cloud Apps - Session Controls",
+  "dd47d17a-3194-4d86-bfd5-c6ae6f5651e3": "Microsoft Defender for Mobile",
+  "e724aa31-0f56-4018-b8be-f8cb82ca1196": "Microsoft Defender for Mobile TVM",
+  "cab96880-db5b-4e15-90a7-f3f1d62ffe39": "Microsoft Defender Platform",
+  "00000015-0000-0000-c000-000000000000": "Microsoft Dynamics ERP",
+  "ecd6b820-32c2-49b6-98a6-444530e5a77a": "Microsoft Edge",
+  "d7b530a4-7680-4c23-a8bf-c52c121d2e87": "Microsoft Edge Enterprise New Tab Page",
+  "6253bca8-faf2-4587-8f2f-b056d80998a7": "Microsoft Edge Insider Addons Prod",
+  "00000007-0000-0ff1-ce00-000000000000": "Microsoft Exchange Online Protection",
+  "c9a559d2-7aab-4f13-a6ed-e7e9c52aec87": "Microsoft Forms",
+  "5f00fd34-f302-417f-81ef-1adda179d8fd": "Microsoft Forms Web",
+  "00000003-0000-0000-c000-000000000000": "Microsoft Graph",
+  "d4ebce55-015a-49b5-a083-c84d1797ae8c": "Microsoft Intune Enrollment",
+  "74bcdadc-2fdc-4bb3-8459-76d06952a0e9": "Microsoft Intune Web Company Portal",
+  "fc0f3af4-6835-4174-b806-f7db311fd2f3": "Microsoft Intune Windows Agent",
+  "18fbca16-2224-45f6-85b0-f7bf2b39b3f3": "Microsoft Learn",
+  "d3590ed6-52b3-4102-aeff-aad2292ab01c": "Microsoft Office",
+  "00000006-0000-0ff1-ce00-000000000000": "Microsoft Office 365 Portal",
+  "67e3df25-268a-4324-a550-0de1c7f97287": "Microsoft Office Web Apps Service",
+  "d176f6e7-38e5-40c9-8a78-3998aab820e7": "Microsoft Online Syndication Partner Portal",
+  "5d661950-3475-41cd-a2c3-d671a3162bc1": "Microsoft Outlook",
+  "93625bc8-bfe2-437a-97e0-3d0060024faa": "Microsoft password reset service",
+  "871c010f-5e61-4fb1-83ac-98610a7e9110": "Microsoft Power BI",
+  "a4a365df-50f1-4397-bc59-1a1564b8bb9c": "Microsoft Remote Desktop",
+  "28b567f6-162c-4f54-99a0-6887f387bbcc": "Microsoft Storefronts",
+  "cf53fce8-def6-4aeb-8d30-b158e7b1cf83": "Microsoft Stream Portal",
+  "98db8bd6-0cc0-4e67-9de5-f187f1cd1b41": "Microsoft Substrate Management",
+  "fdf9885b-dd37-42bf-82e5-c3129ef5a302": "Microsoft Support",
+  "1fec8e78-bce4-4aaf-ab1b-5451cc387264": "Microsoft Teams",
+  "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe": "Microsoft Teams Services",
+  "5e3ce6c0-2b1f-4285-8d4b-75ee78787346": "Microsoft Teams Web Client",
+  "3678c9e9-9681-447a-974d-d19f668fcd88": "Microsoft Tunnel Gateway",
+  "95de633a-083e-42f5-b444-a4295d8e9314": "Microsoft Whiteboard Services",
+  "f9885e6e-6f74-46b3-b595-350157a27541": "Microsoft_AAD_UsersAndTenants",
+  "50aaa389-5a33-4f1a-91d7-2c45ecd8dac8": "Microsoft_Azure_PIMCommon",
+  "a0e84e36-b067-4d5c-ab4a-3db38e598ae2": "MicrosoftDefenderATP XPlat",
+  "a150d169-7d37-47dd-9b20-156207b7b02f": "MIP Exchange Solutions",
+  "8c59ead7-d703-4a27-9e55-c96a0054c8d2": "My Profile",
+  "19db86c3-b2b9-44cc-b339-36da233a3be2": "My Signins",
+  "ba9ff945-a723-4ab5-a977-bd8c9044fe61": "My Staff",
+  "4345a7b9-9a63-4910-a426-35363201d503": "O365 Suite UX",
+  "00000002-0000-0ff1-ce00-000000000000": "Office 365 Exchange Online",
+  "00b41c95-dab0-4487-9791-b9d2c32c80f2": "Office 365 Management",
+  "66a88757-258c-4c72-893c-3e8bed4d6899": "Office 365 Search Service",
+  "00000003-0000-0ff1-ce00-000000000000": "Office 365 SharePoint Online",
+  "94c63fef-13a3-47bc-8074-75af8c65887a": "Office Delve",
+  "93d53678-613d-4013-afc1-62e9e444a0a5": "Office Online Add-in SSO",
+  "2abdc806-e091-4495-9b10-b04d93c3f040": "Office Online Client AAD- Augmentation Loop",
+  "b23dd4db-9142-4734-867f-3577f640ad0c": "Office Online Client AAD- Loki",
+  "17d5e35f-655b-4fb0-8ae6-86356e9a49f5": "Office Online Client AAD- Maker",
+  "b6e69c34-5f1f-4c34-8cdf-7fea120b8670": "Office Online Client MSA- Loki",
+  "243c63a3-247d-41c5-9d83-7788c43f1c43": "Office Online Core SSO",
+  "a9b49b65-0a12-430b-9540-c80b3332c127": "Office Online Search",
+  "4b233688-031c-404b-9a80-a4f3f2351f90": "Office.com",
+  "89bee1f7-5e6e-4d8a-9f3d-ecd601259da7": "Office365 Shell WCSS-Client",
+  "0f698dd4-f011-4d23-a33e-b36416dcb1e6": "OfficeClientService",
+  "4765445b-32c6-49b0-83e6-1d93765276ca": "OfficeHome",
+  "4d5c2d63-cf83-4365-853c-925fd1a64357": "OfficeShredderWacClient",
+  "bb893c22-978d-4cd4-a6f7-bb6cc0d6e6ce": "Olympus",
+  "62256cef-54c0-4cb4-bcac-4c67989bdc40": "OMSOctopiPROD",
+  "9199bf20-a13f-4107-85dc-02114787ef48": "One Outlook Web",
+  "af124e86-4e96-495a-b70a-90f90ab96707": "OneDrive iOS App",
+  "ab9b8c07-8f02-4f72-87fa-80105867a763": "OneDrive SyncEngine",
+  "2d4d3d8e-2be3-4bef-9f87-7875a61c29de": "OneNote",
+  "e9b154d0-7658-433b-bb25-6b8e0a8a7c59": "Outlook Lite",
+  "27922004-5251-4030-b22d-91ecd9a37ea4": "Outlook Mobile",
+  "bc59ab01-8403-45c6-8796-ac3ef710b3e3": "Outlook Online Add-in App",
+  "87223343-80b1-4097-be13-2332ffa1d666": "Outlook Web App Widgets",
+  "a3475900-ccec-4a69-98f5-a65cd5dc5306": "Partner Customer Delegated Admin Offline Processor",
+  "bdd48c81-3a58-4ea9-849c-ebea7f6b6360": "Password Breach Authenticator",
+  "00000009-0000-0000-c000-000000000000": "Power BI Service",
+  "ffcb16e8-f789-467c-8ce9-f826a080d987": "SharedWithMe",
+  "08e18876-6177-487e-b8b5-cf950c1e598c": "SharePoint Online Web Client Extensibility",
+  "b4bddae8-ab25-483e-8670-df09b9f1d0ea": "Signup",
+  "00000004-0000-0ff1-ce00-000000000000": "Skype for Business Online",
+  "905fcf26-4eb7-48a0-9ff0-8dcc7194b5ba": "Sway",
+  "268761a2-03f3-40df-8a8b-c3db24145b6b": "Universal Store Native Client",
+  "aebc6443-996d-45c2-90f0-388ff96faa56": "Visual Studio Code",
+  "5572c4c0-d078-44ce-b81c-6cbf8d3ed39e": "Vortex [wsfed enabled]",
+  "6dec647e-42c4-45a6-8f13-e8250d34e033": "WeveAgave",
+  "0af06dc6-e4b5-4f28-818e-e78e62d137a5": "Windows 365",
+  "00000002-0000-0000-c000-000000000000": "Windows Azure Active Directory",
+  "26a7ee05-5602-4d76-a7ba-eae8b7b67941": "Windows Search",
+  "38aa3b87-a06d-4817-b275-7a316988d93b": "Windows Sign In",
+  "1b3c667f-cde3-4090-b60b-3d2abd0117f0": "Windows Spotlight",
+  "45a330b1-b1ec-4cc1-9161-9f03992aa49f": "Windows Store for Business",
+  "a3b79187-70b2-4139-83f9-6016c58cd27b": "WindowsDefenderATP Portal",
+  "00000005-0000-0ff1-ce00-000000000000": "Yammer",
+  "c1c74fed-04c9-4704-80dc-9f79a2e515cb": "Yammer Web",
+  "e1ef36fd-b883-4dbf-97f0-9ece4b576fc6": "Yammer Web Embed",
+  "760282b4-0cfc-4952-b467-c8e0298fee16": "ZTNA Network Access Client -- Private",
+  "b3fa0115-39b3-4bec-8cc6-8c4fcd33e69d": "ZTNA Policy Service",
+  "ca01d00c-bfd6-46d6-ae7d-be5b5267d037": "ZTNA Policy Service Client",
+  "ea8d014c-04e7-450c-a600-eaa309e42309": "ZTNA UX Portal"
+}
diff --git a/Config/PermissionsTranslator.json b/Config/PermissionsTranslator.json
index 9e140b5ded6ab..2c02810c248b2 100644
--- a/Config/PermissionsTranslator.json
+++ b/Config/PermissionsTranslator.json
@@ -6,27 +6,6 @@
     "origin": "Delegated (1ES Resource Management PPE)",
     "value": "manage_ado_pools"
   },
-  {
-    "description": "Allows the application to create or delete document libraries and lists in all site collections on behalf of the signed-in user.",
-    "displayName": "Create, edit, and delete items and lists in all site collections",
-    "id": "65e50fdc-43b7-4915-933e-e8138f11f40a",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Sites.Manage.All"
-  },
-  {
-    "description": "Allows the application to read documents and list  items in all site collections on behalf of the signed-in user",
-    "displayName": "Read items in all site collections",
-    "id": "205e70e5-aba6-4c52-a976-6d2d46c48043",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Sites.Read.All"
-  },
-  {
-    "description": "Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user.",
-    "displayName": "Edit or delete items in all site collections",
-    "id": "89fe6a52-be36-487e-b7d8-d061c450a026",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Sites.ReadWrite.All"
-  },
   {
     "description": "Allow the application to access a subset of site collections on behalf of the signed-in user.  The specific site collections and the permissions granted will be configured in SharePoint Online.",
     "displayName": "Access selected Sites, on behalf of the signed-in user",
@@ -125,13 +104,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Tasks.Read.Shared"
   },
-  {
-    "description": "Allows the application to have full control of all site collections on behalf of the signed-in user.",
-    "displayName": "Have full control of all site collections",
-    "id": "5a54b8b3-347c-476d-8f8e-42d5c7424d29",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Sites.FullControl.All"
-  },
   {
     "description": "Allows the app to create, read, update, and delete the signed-in user's tasks and task lists, including any shared with the user.",
     "displayName": "Create, read, update, and delete user’s tasks and task lists",
@@ -140,39 +112,46 @@
     "value": "Tasks.ReadWrite"
   },
   {
-    "description": "Allow the application to create site collections on behalf of the signed in user. Upon creation the application will be granted Sites.Selected(delegated) + FullControl to the newly created site.",
-    "displayName": "Create Site Collections, on behalf of the signed-in user",
-    "id": "0e2e68e1-3f32-4e10-9281-f749e097fcbe",
+    "description": "Allows the app to create, read, update, and delete tasks a user has permissions to, including their own and shared tasks.",
+    "displayName": "Read and write user and shared tasks",
+    "id": "c5ddf11b-c114-4886-8558-8a4e557cd52b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Sites.Create.All"
+    "value": "Tasks.ReadWrite.Shared"
   },
   {
-    "description": "Allows the app to read your organization's sign-in identifiers, on behalf of the signed-in user.",
-    "displayName": "Read SignInIdentifiers",
-    "id": "458e1edc-1e75-438c-8c7b-c32115c9d373",
+    "description": "Allows the app to create teams on behalf of the signed-in user.",
+    "displayName": "Create teams",
+    "id": "7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SignInIdentifier.Read.All"
+    "value": "Team.Create"
   },
   {
-    "description": "Allows the app to get sensitivity labels.",
-    "displayName": "Get labels app scope.",
-    "id": "8b377c27-ea19-4863-a948-8a8588c8f2c3",
+    "description": "Allows the application to edit or delete documents and list items in all site collections on behalf of the signed-in user.",
+    "displayName": "Edit or delete items in all site collections",
+    "id": "89fe6a52-be36-487e-b7d8-d061c450a026",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SensitivityLabels.Read.All"
+    "value": "Sites.ReadWrite.All"
   },
   {
-    "description": "Allows the app to export all Sentiment Survey, on behalf of the signed-in user.",
-    "displayName": "Export all Sentiment Survey",
-    "id": "df9fd94d-51ff-443d-8f31-ae4dc1b5b8d8",
+    "description": "Read the names and  descriptions of teams, on behalf of the signed-in user.",
+    "displayName": "Read the names and descriptions of teams",
+    "id": "485be79e-c497-4b35-9400-0e3fa7f2a5d4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SentimentSurvey.Export.All"
+    "value": "Team.ReadBasic.All"
   },
   {
-    "description": "Allows the app to read all Exchange service activity, on behalf of the signed-in user.",
-    "displayName": "Read all Exchange service activity",
-    "id": "1fe7aa48-9373-4a47-8df3-168335e0f4c9",
+    "description": "Allows the application to read documents and list  items in all site collections on behalf of the signed-in user",
+    "displayName": "Read items in all site collections",
+    "id": "205e70e5-aba6-4c52-a976-6d2d46c48043",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ServiceActivity-Exchange.Read.All"
+    "value": "Sites.Read.All"
+  },
+  {
+    "description": "Allows the application to have full control of all site collections on behalf of the signed-in user.",
+    "displayName": "Have full control of all site collections",
+    "id": "5a54b8b3-347c-476d-8f8e-42d5c7424d29",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Sites.FullControl.All"
   },
   {
     "description": "Allows the app to read all Microsoft 365 Web service activity, on behalf of the signed-in user.",
@@ -272,6 +251,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "ShortNotes.ReadWrite"
   },
+  {
+    "description": "Allows the app to read your organization's sign-in identifiers, on behalf of the signed-in user.",
+    "displayName": "Read SignInIdentifiers",
+    "id": "458e1edc-1e75-438c-8c7b-c32115c9d373",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "SignInIdentifier.Read.All"
+  },
   {
     "description": "Allows the app to read and write your organization's sign-in identifiers, on behalf of the signed-in user.",
     "displayName": "Read and write all sign-in identifiers",
@@ -280,46 +266,39 @@
     "value": "SignInIdentifier.ReadWrite.All"
   },
   {
-    "description": "Allows the app to create, read, update, and delete tasks a user has permissions to, including their own and shared tasks.",
-    "displayName": "Read and write user and shared tasks",
-    "id": "c5ddf11b-c114-4886-8558-8a4e557cd52b",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Tasks.ReadWrite.Shared"
-  },
-  {
-    "description": "Allows the app to create teams on behalf of the signed-in user.",
-    "displayName": "Create teams",
-    "id": "7825d5d6-6049-4ce7-bdf6-3b8d53f4bcd0",
+    "description": "Allow the application to create site collections on behalf of the signed in user. Upon creation the application will be granted Sites.Selected(delegated) + FullControl to the newly created site.",
+    "displayName": "Create Site Collections, on behalf of the signed-in user",
+    "id": "0e2e68e1-3f32-4e10-9281-f749e097fcbe",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Team.Create"
+    "value": "Sites.Create.All"
   },
   {
-    "description": "Read the names and  descriptions of teams, on behalf of the signed-in user.",
-    "displayName": "Read the names and descriptions of teams",
-    "id": "485be79e-c497-4b35-9400-0e3fa7f2a5d4",
+    "description": "Allows the application to create or delete document libraries and lists in all site collections on behalf of the signed-in user.",
+    "displayName": "Create, edit, and delete items and lists in all site collections",
+    "id": "65e50fdc-43b7-4915-933e-e8138f11f40a",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Team.ReadBasic.All"
+    "value": "Sites.Manage.All"
   },
   {
-    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps installed for the signed-in user. Does not give the ability to read application-specific settings.",
-    "displayName": "Manage user's installed Teams apps",
-    "id": "093f8818-d05f-49b8-95bc-9d2a73e9a43c",
+    "description": "Read the members of teams, on behalf of the signed-in user.",
+    "displayName": "Read the members of teams",
+    "id": "2497278c-d82d-46a2-b1ce-39d4cdde5570",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteForUser"
+    "value": "TeamMember.Read.All"
   },
   {
-    "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
-    "displayName": "Manage selected Teams apps installed in chats",
-    "id": "690aa3b6-4b71-41c2-a990-77a8c4768d2b",
+    "description": "Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.",
+    "displayName": "Add and remove members from teams",
+    "id": "4a06efd2-f825-4e34-813e-82a57b03d1ee",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteSelectedForChat"
+    "value": "TeamMember.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
-    "displayName": "Manage selected Teams apps installed in teams",
-    "id": "9131c833-9a49-4c54-b38f-615ecfc4fc69",
+    "description": "Add and remove members from all teams, on behalf of the signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.",
+    "displayName": "Add and remove members with non-owner role for all teams",
+    "id": "2104a4db-3a2f-4ea0-9dba-143d457dc666",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteSelectedForTeam"
+    "value": "TeamMember.ReadWriteNonOwnerRole.All"
   },
   {
     "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps installed for the signed in user. Does not give the ability to read application-specific settings.",
@@ -420,53 +399,53 @@
     "value": "TeamsTab.ReadWriteForUser"
   },
   {
-    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
-    "displayName": "Manage installed Teams apps in teams",
-    "id": "2e25a044-2580-450d-8859-42eeb6e996c0",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access.",
+    "displayName": "Allow the Teams app to manage only its own tabs in chats",
+    "id": "0c219d04-3abf-47f7-912d-5cca239e90e6",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteForTeam"
+    "value": "TeamsTab.ReadWriteSelfForChat"
   },
   {
-    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
-    "displayName": "Manage installed Teams apps in chats",
-    "id": "aa85bf13-d771-4d5d-a9e6-bca04ce44edf",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access.",
+    "displayName": "Allow the Teams app to manage only its own tabs in teams",
+    "id": "f266662f-120a-4314-b26a-99b08617c7ef",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteForChat"
+    "value": "TeamsTab.ReadWriteSelfForTeam"
   },
   {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself in user accounts, and manage its permission grants for accessing those specific users' data, on behalf of the signed-in user.",
-    "displayName": "Allow the Teams app to manage itself and its permission grants in user accounts",
-    "id": "7a349935-c54d-44ab-ab66-1b460d315be7",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user.",
+    "displayName": "Allow the Teams app to manage only its own tabs for a user",
+    "id": "395dfec1-a0b9-465f-a783-8250a430cb8c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForUser"
+    "value": "TeamsTab.ReadWriteSelfForUser"
   },
   {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams' data.",
-    "displayName": "Allow the Teams app to manage itself and its permission grants in teams",
-    "id": "4a6bbf29-a0e1-4a4d-a7d1-cef17f772975",
+    "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
+    "displayName": "Manage selected Teams apps installed in teams",
+    "id": "9131c833-9a49-4c54-b38f-615ecfc4fc69",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam"
+    "value": "TeamsAppInstallation.ReadWriteSelectedForTeam"
   },
   {
-    "description": "Read the members of teams, on behalf of the signed-in user.",
-    "displayName": "Read the members of teams",
-    "id": "2497278c-d82d-46a2-b1ce-39d4cdde5570",
+    "description": "Allows the app to read, install, upgrade, and uninstall selected Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
+    "displayName": "Manage selected Teams apps installed in chats",
+    "id": "690aa3b6-4b71-41c2-a990-77a8c4768d2b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamMember.Read.All"
+    "value": "TeamsAppInstallation.ReadWriteSelectedForChat"
   },
   {
-    "description": "Add and remove members from teams, on behalf of the signed-in user. Also allows changing a member's role, for example from owner to non-owner.",
-    "displayName": "Add and remove members from teams",
-    "id": "4a06efd2-f825-4e34-813e-82a57b03d1ee",
+    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps installed for the signed-in user. Does not give the ability to read application-specific settings.",
+    "displayName": "Manage user's installed Teams apps",
+    "id": "093f8818-d05f-49b8-95bc-9d2a73e9a43c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamMember.ReadWrite.All"
+    "value": "TeamsAppInstallation.ReadWriteForUser"
   },
   {
-    "description": "Add and remove members from all teams, on behalf of the signed-in user. Does not allow adding or removing a member with the owner role. Additionally, does not allow the app to elevate an existing member to the owner role.",
-    "displayName": "Add and remove members with non-owner role for all teams",
-    "id": "2104a4db-3a2f-4ea0-9dba-143d457dc666",
+    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
+    "displayName": "Manage installed Teams apps in teams",
+    "id": "2e25a044-2580-450d-8859-42eeb6e996c0",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamMember.ReadWriteNonOwnerRole.All"
+    "value": "TeamsAppInstallation.ReadWriteForTeam"
   },
   {
     "description": "Allows the app to read the signed-in user's teamwork activity feed.",
@@ -503,13 +482,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamsAppInstallation.ManageSelectedForUser"
   },
-  {
-    "description": "Allows the app to get sensitivity labels.",
-    "displayName": "Get labels user scope.",
-    "id": "1aeb73ce-68d7-49b7-913a-eedc80844551",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "SensitivityLabel.Read"
-  },
   {
     "description": "Allows the app to read the Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
     "displayName": "Read installed Teams apps in chats",
@@ -517,6 +489,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamsAppInstallation.ReadForChat"
   },
+  {
+    "description": "Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
+    "displayName": "Read installed Teams apps in teams",
+    "id": "5248dcb1-f83b-4ec3-9f4d-a4428a961a72",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "TeamsAppInstallation.ReadForTeam"
+  },
   {
     "description": "Allows the app to read the Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.",
     "displayName": "Read user's installed Teams apps",
@@ -524,6 +503,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamsAppInstallation.ReadForUser"
   },
+  {
+    "description": "Allows the app to read all Exchange service activity, on behalf of the signed-in user.",
+    "displayName": "Read all Exchange service activity",
+    "id": "1fe7aa48-9373-4a47-8df3-168335e0f4c9",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "ServiceActivity-Exchange.Read.All"
+  },
   {
     "description": "Allows the app to read the selected Teams apps that are installed in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
     "displayName": "Read selected installed Teams apps in chats",
@@ -531,13 +517,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamsAppInstallation.ReadSelectedForChat"
   },
-  {
-    "description": "Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
-    "displayName": "Read selected installed Teams apps in teams",
-    "id": "b55df1c0-db20-435b-aef2-afe6ed487e16",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadSelectedForTeam"
-  },
   {
     "description": "Allows the app to read the selected Teams apps that are installed for the signed-in user. Does not give the ability to read application-specific settings.",
     "displayName": "Read user's selected installed Teams apps",
@@ -574,53 +553,53 @@
     "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForChat"
   },
   {
-    "description": "Allows the app to read the Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
-    "displayName": "Read installed Teams apps in teams",
-    "id": "5248dcb1-f83b-4ec3-9f4d-a4428a961a72",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself in teams the signed-in user can access, and manage its permission grants for accessing those specific teams' data.",
+    "displayName": "Allow the Teams app to manage itself and its permission grants in teams",
+    "id": "4a6bbf29-a0e1-4a4d-a7d1-cef17f772975",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadForTeam"
+    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam"
   },
   {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in chats the signed-in user can access.",
-    "displayName": "Allow the Teams app to manage only its own tabs in chats",
-    "id": "0c219d04-3abf-47f7-912d-5cca239e90e6",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself in user accounts, and manage its permission grants for accessing those specific users' data, on behalf of the signed-in user.",
+    "displayName": "Allow the Teams app to manage itself and its permission grants in user accounts",
+    "id": "7a349935-c54d-44ab-ab66-1b460d315be7",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsTab.ReadWriteSelfForChat"
+    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForUser"
   },
   {
-    "description": "Allows the app to evaluate all sensitivity label.",
-    "displayName": "Evaluate labels tenant scope.",
-    "id": "a42e3c42-b31e-4919-b699-696dca5dc9e7",
+    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in chats the signed-in user can access. Does not give the ability to read application-specific settings.",
+    "displayName": "Manage installed Teams apps in chats",
+    "id": "aa85bf13-d771-4d5d-a9e6-bca04ce44edf",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SensitivityLabel.Evaluate.All"
+    "value": "TeamsAppInstallation.ReadWriteForChat"
   },
   {
-    "description": "Allows the app to read and write security incidents, on behalf of the signed-in user.",
-    "displayName": "Read and write to incidents",
-    "id": "128ca929-1a19-45e6-a3b8-435ec44a36ba",
+    "description": "Allows the app to read the selected Teams apps that are installed in teams the signed-in user can access. Does not give the ability to read application-specific settings.",
+    "displayName": "Read selected installed Teams apps in teams",
+    "id": "b55df1c0-db20-435b-aef2-afe6ed487e16",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityIncident.ReadWrite.All"
+    "value": "TeamsAppInstallation.ReadSelectedForTeam"
   },
   {
-    "description": "Allows an app to read all service usage reports on behalf of the signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory.",
-    "displayName": "Read all usage reports",
-    "id": "02e97553-ed7b-43d0-ab3c-f8bace0d040c",
+    "description": "Allows the app to export all Sentiment Survey, on behalf of the signed-in user.",
+    "displayName": "Export all Sentiment Survey",
+    "id": "df9fd94d-51ff-443d-8f31-ae4dc1b5b8d8",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Reports.Read.All"
+    "value": "SentimentSurvey.Export.All"
   },
   {
-    "description": "Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user",
-    "displayName": "Read admin report settings",
-    "id": "84fac5f4-33a9-4100-aa38-a20c6d29e5e7",
+    "description": "Allows the app to get sensitivity labels.",
+    "displayName": "Get labels app scope.",
+    "id": "8b377c27-ea19-4863-a948-8a8588c8f2c3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ReportSettings.Read.All"
+    "value": "SensitivityLabels.Read.All"
   },
   {
-    "description": "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user.",
-    "displayName": "Read and write admin report settings",
-    "id": "b955410e-7715-4a88-a940-dfd551018df3",
+    "description": "Allows the app to get sensitivity labels.",
+    "displayName": "Get labels user scope.",
+    "id": "1aeb73ce-68d7-49b7-913a-eedc80844551",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ReportSettings.ReadWrite.All"
+    "value": "SensitivityLabel.Read"
   },
   {
     "description": "Allows the app to read the resource specific permissions granted on the chat, on behalf of the signed-in user.",
@@ -720,13 +699,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "RoleManagement.Read.Defender"
   },
-  {
-    "description": "Allows the app to read available properties of remoteTenantGroups, on behalf of the signed-in user.",
-    "displayName": "Read RemoteTenantGroups information",
-    "id": "d207fff0-6e36-4360-a23b-495e23b60385",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "RemoteTenantGroups.Read.All"
-  },
   {
     "description": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user.  This includes reading directory role templates, directory roles and memberships.",
     "displayName": "Read directory RBAC settings",
@@ -735,32 +707,46 @@
     "value": "RoleManagement.Read.Directory"
   },
   {
-    "description": "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user.",
-    "displayName": "Read and write Records Management configuration, labels, and policies",
-    "id": "f2833d75-a4e6-40ab-86d4-6dfe73c97605",
+    "description": "Allows the app to read the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
+    "displayName": "Read Exchange Online RBAC configuration",
+    "id": "3bc15058-7858-4141-b24f-ae43b4e80b52",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RecordsManagement.ReadWrite.All"
+    "value": "RoleManagement.Read.Exchange"
   },
   {
-    "description": "Allows the app to get direct access to real-time enriched data in a meeting, on behalf of the signed-in user.",
-    "displayName": "Access real-time enriched data in a meeting",
-    "id": "db5d5bae-0c9e-444e-9390-8a5fea98c253",
+    "description": "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading and managing Cloud PC role definitions and role assignments.",
+    "displayName": "Read and write Cloud PC RBAC settings",
+    "id": "501d06f8-07b8-4f18-b5c6-c191a4af7a82",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RealTimeActivityFeed.Read.All"
+    "value": "RoleManagement.ReadWrite.CloudPC"
   },
   {
-    "description": "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.",
-    "displayName": "Read, create, and delete eligibility schedules for access to Azure AD groups",
-    "id": "ba974594-d163-484e-ba39-c330d5897667",
+    "description": "Allows the app to read and update admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user.",
+    "displayName": "Read and write admin report settings",
+    "id": "b955410e-7715-4a88-a940-dfd551018df3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup"
+    "value": "ReportSettings.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
-    "displayName": "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
-    "id": "f7ff1cb0-e255-4bb3-b24a-6708c60c5418",
+    "description": "Allows the app to read admin report settings, such as whether to display concealed information in reports, on behalf of the signed-in user",
+    "displayName": "Read admin report settings",
+    "id": "84fac5f4-33a9-4100-aa38-a20c6d29e5e7",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole"
+    "value": "ReportSettings.Read.All"
+  },
+  {
+    "description": "Allows an app to read all service usage reports on behalf of the signed-in user.  Services that provide usage reports include Office 365 and Azure Active Directory.",
+    "displayName": "Read all usage reports",
+    "id": "02e97553-ed7b-43d0-ab3c-f8bace0d040c",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Reports.Read.All"
+  },
+  {
+    "description": "Allows the app to read available properties of remoteTenantGroups, on behalf of the signed-in user.",
+    "displayName": "Read RemoteTenantGroups information",
+    "id": "d207fff0-6e36-4360-a23b-495e23b60385",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "RemoteTenantGroups.Read.All"
   },
   {
     "description": "Allows the app to delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.",
@@ -818,6 +804,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "ProtectionScopes.Compute.User"
   },
+  {
+    "description": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments.",
+    "displayName": "Read M365 Defender RBAC configuration",
+    "id": "d8914f8f-9f64-4bd1-b4d3-f5a701ed8457",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "RoleManagement.ReadWrite.Defender"
+  },
   {
     "description": "Allows the app to read and query your provisioning log activities, on behalf of the signed-in user.",
     "displayName": "Read provisioning log data",
@@ -825,13 +818,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "ProvisioningLog.Read.All"
   },
-  {
-    "description": "Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user.",
-    "displayName": "Read certificate based authentication configurations",
-    "id": "04a4b2a2-3f26-4fc8-87ee-9c46e68db175",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "PublicKeyInfrastructure.Read.All"
-  },
   {
     "description": "Allows the application to read  and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user.",
     "displayName": "Read and write certificate based authentication configurations",
@@ -867,6 +853,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "QnA.Read.All"
   },
+  {
+    "description": "Allows the app to get direct access to real-time enriched data in a meeting, on behalf of the signed-in user.",
+    "displayName": "Access real-time enriched data in a meeting",
+    "id": "db5d5bae-0c9e-444e-9390-8a5fea98c253",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "RealTimeActivityFeed.Read.All"
+  },
   {
     "description": "Allows the application to read any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user.",
     "displayName": "Read Records Management configuration, labels, and policies",
@@ -875,46 +868,39 @@
     "value": "RecordsManagement.Read.All"
   },
   {
-    "description": "Allows the app to read the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
-    "displayName": "Read Exchange Online RBAC configuration",
-    "id": "3bc15058-7858-4141-b24f-ae43b4e80b52",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "RoleManagement.Read.Exchange"
-  },
-  {
-    "description": "Allows the app to read and manage the Cloud PC role-based access control (RBAC) settings, on behalf of the signed-in user. This includes reading and managing Cloud PC role definitions and role assignments.",
-    "displayName": "Read and write Cloud PC RBAC settings",
-    "id": "501d06f8-07b8-4f18-b5c6-c191a4af7a82",
+    "description": "Allow the application to create, update and delete any data from Records Management, such as configuration, labels, and policies on behalf of the signed-in user.",
+    "displayName": "Read and write Records Management configuration, labels, and policies",
+    "id": "f2833d75-a4e6-40ab-86d4-6dfe73c97605",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RoleManagement.ReadWrite.CloudPC"
+    "value": "RecordsManagement.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes reading M365 Defender role definitions and role assignments.",
-    "displayName": "Read M365 Defender RBAC configuration",
-    "id": "d8914f8f-9f64-4bd1-b4d3-f5a701ed8457",
+    "description": "Allows the application to read certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, on behalf of the signed-in user.",
+    "displayName": "Read certificate based authentication configurations",
+    "id": "04a4b2a2-3f26-4fc8-87ee-9c46e68db175",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RoleManagement.ReadWrite.Defender"
+    "value": "PublicKeyInfrastructure.Read.All"
   },
   {
-    "description": "Allows the app to read all Security Copilot signed-in user's resources on behalf of the signed-in user",
-    "displayName": "Read all Security Copilot resources for the signed-in user",
-    "id": "84499c31-ac2e-44d3-a0cf-a6c386d4dfe8",
+    "description": "Allows the app to read your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
+    "displayName": "Read Tenant-Acquired Telephone Number Details",
+    "id": "1bc6eab1-058d-4557-b011-d4c41cec88b7",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityCopilotWorkspaces.Read.All"
+    "value": "TeamsTelephoneNumber.Read.All"
   },
   {
-    "description": "Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf.",
-    "displayName": "Read and write individually owned Security Copilot resources of the signed-in user",
-    "id": "206291b0-2167-47a7-a640-6cdc1df710ba",
+    "description": "Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.",
+    "displayName": "Read and write directory RBAC settings",
+    "id": "d01b97e9-cbc0-49fe-810a-750afd5527a3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityCopilotWorkspaces.ReadWrite.All"
+    "value": "RoleManagement.ReadWrite.Directory"
   },
   {
-    "description": "Allows the app to read your organization’s security events on behalf of the signed-in user.",
-    "displayName": "Read your organization’s security events",
-    "id": "64733abd-851e-478a-bffb-e47a14b18235",
+    "description": "Allows the app to read the role-based access control (RBAC) alerts for your company's directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.",
+    "displayName": "Read all alert data for your company's directory",
+    "id": "cce71173-f76d-446e-97ff-efb2d82e11b1",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityEvents.Read.All"
+    "value": "RoleManagementAlert.Read.Directory"
   },
   {
     "description": "Allows the app to read your organization’s security events on behalf of the signed-in user. Also allows the app to update editable properties in security events on behalf of the signed-in user.",
@@ -1015,53 +1001,53 @@
     "value": "SecurityIncident.Read.All"
   },
   {
-    "description": "Read email metadata, security detection details, and execute remediation actions like deleting an email, on behalf of the signed in user.",
-    "displayName": "Read metadata, detection details, and execute remediation actions on emails in your organization",
-    "id": "48eb8c83-6e58-46e7-a6d3-8805822f5940",
+    "description": "Allows the app to read and write security incidents, on behalf of the signed-in user.",
+    "displayName": "Read and write to incidents",
+    "id": "128ca929-1a19-45e6-a3b8-435ec44a36ba",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityAnalyzedMessage.ReadWrite.All"
+    "value": "SecurityIncident.ReadWrite.All"
   },
   {
-    "description": "Read email metadata and security detection details on behalf of the signed in user.",
-    "displayName": "Read metadata and detection details for emails in your organization",
-    "id": "53e6783e-b127-4a35-ab3a-6a52d80a9077",
+    "description": "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, on behalf of the signed-in user.",
+    "displayName": "Evaluate sensitivity labels",
+    "id": "a4633e44-d355-4474-99df-8c2de6b0e39e",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityAnalyzedMessage.Read.All"
+    "value": "SensitivityLabel.Evaluate"
   },
   {
-    "description": "Allows the app to read and write to all security alerts, on behalf of the signed-in user.",
-    "displayName": "Read and write to all security alerts",
-    "id": "471f2a7f-2a42-4d45-a2bf-594d0838070d",
+    "description": "Allows the app to evaluate all sensitivity label.",
+    "displayName": "Evaluate labels tenant scope.",
+    "id": "a42e3c42-b31e-4919-b699-696dca5dc9e7",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityAlert.ReadWrite.All"
+    "value": "SensitivityLabel.Evaluate.All"
   },
   {
-    "description": "Allows the app to read all security alerts, on behalf of the signed-in user.",
-    "displayName": "Read all security alerts",
-    "id": "bc257fb8-46b4-4b15-8713-01e91bfbe4ea",
+    "description": "Allows the app to read your organization’s security events on behalf of the signed-in user.",
+    "displayName": "Read your organization’s security events",
+    "id": "64733abd-851e-478a-bffb-e47a14b18235",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "SecurityAlert.Read.All"
+    "value": "SecurityEvents.Read.All"
   },
   {
-    "description": "Allows the app to read and manage the role-based access control (RBAC) settings for your company's directory, on behalf of the signed-in user. This includes instantiating directory roles and managing directory role membership, and reading directory role templates, directory roles and memberships.",
-    "displayName": "Read and write directory RBAC settings",
-    "id": "d01b97e9-cbc0-49fe-810a-750afd5527a3",
+    "description": "Allows the app to read and write Security Copilot resources owned by the signed-in user on their behalf.",
+    "displayName": "Read and write individually owned Security Copilot resources of the signed-in user",
+    "id": "206291b0-2167-47a7-a640-6cdc1df710ba",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RoleManagement.ReadWrite.Directory"
+    "value": "SecurityCopilotWorkspaces.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and manage the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
-    "displayName": "Read and write Exchange Online RBAC configuration",
-    "id": "c1499fe0-52b1-4b22-bed2-7a244e0e879f",
+    "description": "Allows the app to read all Security Copilot signed-in user's resources on behalf of the signed-in user",
+    "displayName": "Read all Security Copilot resources for the signed-in user",
+    "id": "84499c31-ac2e-44d3-a0cf-a6c386d4dfe8",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RoleManagement.ReadWrite.Exchange"
+    "value": "SecurityCopilotWorkspaces.Read.All"
   },
   {
-    "description": "Allows the app to read the role-based access control (RBAC) alerts for your company's directory, on behalf of the signed-in user. This includes reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.",
-    "displayName": "Read all alert data for your company's directory",
-    "id": "cce71173-f76d-446e-97ff-efb2d82e11b1",
+    "description": "Read email metadata, security detection details, and execute remediation actions like deleting an email, on behalf of the signed in user.",
+    "displayName": "Read metadata, detection details, and execute remediation actions on emails in your organization",
+    "id": "48eb8c83-6e58-46e7-a6d3-8805822f5940",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RoleManagementAlert.Read.Directory"
+    "value": "SecurityAnalyzedMessage.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and manage the role-based access control (RBAC) alerts for your company's directory, on behalf of the signed-in user. This includes managing alert settings, initiating alert scans, dismissing alerts, remediating alert incidents, and reading alert statuses, alert definitions, alert configurations and incidents that lead to an alert.",
@@ -1098,13 +1084,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "RoleManagementPolicy.ReadWrite.AzureADGroup"
   },
-  {
-    "description": "Allow the app to determine if there is any sensitivity label to be applied automatically to the content or recommended to the user for manual application, on behalf of the signed-in user.",
-    "displayName": "Evaluate sensitivity labels",
-    "id": "a4633e44-d355-4474-99df-8c2de6b0e39e",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "SensitivityLabel.Evaluate"
-  },
   {
     "description": "Allows the app to read, update, and delete policies for privileged role-based access control (RBAC) assignments of your company's directory, on behalf of the signed-in user.",
     "displayName": "Read, update, and delete all policies for privileged role assignments of your company's directory",
@@ -1112,6 +1091,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "RoleManagementPolicy.ReadWrite.Directory"
   },
+  {
+    "description": "Allows the app to manage policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.",
+    "displayName": "Manage all policies in PIM for App Roles",
+    "id": "652ec839-e4ac-4eb5-b545-ecc90eeceb2d",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "RoleManagementPolicy.ReadWrite.EntraAppRole"
+  },
   {
     "description": "Allows the app to read schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user.",
     "displayName": "Read user schedule items",
@@ -1119,6 +1105,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Schedule.Read.All"
   },
+  {
+    "description": "Allows the app to read and manage the role-based access control (RBAC) settings for your organization's Exchange Online service, on behalf of the signed-in user. This includes reading, creating, updating, and deleting Exchange management role definitions, role groups, role group membership, role assignments, management scopes, and role assignment policies.",
+    "displayName": "Read and write Exchange Online RBAC configuration",
+    "id": "c1499fe0-52b1-4b22-bed2-7a244e0e879f",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "RoleManagement.ReadWrite.Exchange"
+  },
   {
     "description": "Allows the app to manage schedule, schedule groups, shifts and associated entities in the Teams or Shifts application on behalf of the signed-in user.",
     "displayName": "Read and write user schedule items",
@@ -1126,13 +1119,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Schedule.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read/write schedule permissions for a specific role in Shifts application on behalf of the signed-in user.",
-    "displayName": "Read/Write schedule permissions for a role.",
-    "id": "07919803-6073-4cd8-bc55-28077db0ee10",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "SchedulePermissions.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read search configuration, on behalf of the signed-in user.",
     "displayName": "Read your organization's search configuration",
@@ -1169,53 +1155,53 @@
     "value": "SecurityAlert.Create.All"
   },
   {
-    "description": "Allows the app to manage policies in Privileged Identity Management for App Roles, on behalf of the signed-in user.",
-    "displayName": "Manage all policies in PIM for App Roles",
-    "id": "652ec839-e4ac-4eb5-b545-ecc90eeceb2d",
+    "description": "Allows the app to read all security alerts, on behalf of the signed-in user.",
+    "displayName": "Read all security alerts",
+    "id": "bc257fb8-46b4-4b15-8713-01e91bfbe4ea",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "RoleManagementPolicy.ReadWrite.EntraAppRole"
+    "value": "SecurityAlert.Read.All"
   },
   {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs to teams the signed-in user can access.",
-    "displayName": "Allow the Teams app to manage only its own tabs in teams",
-    "id": "f266662f-120a-4314-b26a-99b08617c7ef",
+    "description": "Allows the app to read and write to all security alerts, on behalf of the signed-in user.",
+    "displayName": "Read and write to all security alerts",
+    "id": "471f2a7f-2a42-4d45-a2bf-594d0838070d",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsTab.ReadWriteSelfForTeam"
+    "value": "SecurityAlert.ReadWrite.All"
   },
   {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for the signed-in user.",
-    "displayName": "Allow the Teams app to manage only its own tabs for a user",
-    "id": "395dfec1-a0b9-465f-a783-8250a430cb8c",
+    "description": "Read email metadata and security detection details on behalf of the signed in user.",
+    "displayName": "Read metadata and detection details for emails in your organization",
+    "id": "53e6783e-b127-4a35-ab3a-6a52d80a9077",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsTab.ReadWriteSelfForUser"
+    "value": "SecurityAnalyzedMessage.Read.All"
   },
   {
-    "description": "Allows the app to read your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
-    "displayName": "Read Tenant-Acquired Telephone Number Details",
-    "id": "1bc6eab1-058d-4557-b011-d4c41cec88b7",
+    "description": "Allows the app to read/write schedule permissions for a specific role in Shifts application on behalf of the signed-in user.",
+    "displayName": "Read/Write schedule permissions for a role.",
+    "id": "07919803-6073-4cd8-bc55-28077db0ee10",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsTelephoneNumber.Read.All"
+    "value": "SchedulePermissions.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write all users' Temporary Access Pass methods.",
-    "id": "05de4a66-e51a-4312-842a-30c8094698d2",
+    "description": "Allows the app to read, create, and delete time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
+    "displayName": "Read, create, and delete eligibility schedules for app permission grants and app role assignments",
+    "id": "f7ff1cb0-e255-4bb3-b24a-6708c60c5418",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-TAP.ReadWrite.All"
+    "value": "PrivilegedEligibilitySchedule.ReadWrite.EntraAppRole"
   },
   {
-    "description": "Allows the app to read the signed-in user's Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read the signed-in user's Windows Hello methods",
-    "id": "efe2b5aa-3a8e-486c-b0be-cc4d185c1b40",
+    "description": "Allows the app to read and modify your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
+    "displayName": "Read and Modify Tenant-Acquired Telephone Number Details",
+    "id": "424b07a8-1209-4d17-9fe4-9018a93a1024",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-WindowsHello.Read"
+    "value": "TeamsTelephoneNumber.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' Windows Hello methods",
-    "id": "ff37d46d-b88a-4e0c-85ee-7e26c37b18eb",
+    "description": "Allows the app to read the available Teams templates, on behalf of the signed-in user.",
+    "displayName": "Read available Teams templates",
+    "id": "cd87405c-5792-4f15-92f7-debc0db6d1d6",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-WindowsHello.Read.All"
+    "value": "TeamTemplates.Read"
   },
   {
     "description": "Allows the app to read and write the signed-in user's Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
@@ -1315,13 +1301,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "UserWindowsSettings.Read.All"
   },
-  {
-    "description": "Allows the app to read and write the signed-in user's Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write the signed-in user's Temporary Access Pass authentication methods",
-    "id": "2424436d-902f-4651-a1c7-b3b93147c960",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-TAP.ReadWrite"
-  },
   {
     "description": "Allows the app to read and write a user's windows settings which are stored in cloud and their values on behalf of the signed-in user.",
     "displayName": "Read and write windows settings for all devices",
@@ -1330,39 +1309,46 @@
     "value": "UserWindowsSettings.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' Temporary Access Pass methods",
-    "id": "6976c635-c9c2-41e6-a21d-e6913a155273",
+    "description": "This role can read Verified Id profiles in a tenant.",
+    "displayName": "Read Verified Id profiles",
+    "id": "604b2056-41ed-4c56-aad5-1241d4ef7333",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-TAP.Read.All"
+    "value": "VerifiedId-Profile.Read.All"
   },
   {
-    "description": "Allows the app to read and write SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write all users' SoftwareOATH methods.",
-    "id": "5b34c8b5-2396-4b35-b284-83fb6a3e73ce",
+    "description": "This role can read and write Verified Id profiles in a tenant.",
+    "displayName": "Read and write Verified Id profiles",
+    "id": "e4a9cb5e-4767-48f8-9029-decf26a54456",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-SoftwareOATH.ReadWrite.All"
+    "value": "VerifiedId-Profile.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read the signed-in user's phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read the signed-in user's phone authentication methods",
-    "id": "43dab3b9-e8b4-424d-8e13-6a2ad2a625fa",
+    "description": "Allows the app to read Windows Hello authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' Windows Hello methods",
+    "id": "ff37d46d-b88a-4e0c-85ee-7e26c37b18eb",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Phone.Read"
+    "value": "UserAuthMethod-WindowsHello.Read.All"
   },
   {
-    "description": "Allows the app to read phone authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' phone authentication methods",
-    "id": "20cf4ae1-09b9-4d29-a6f8-43e1820ce60c",
+    "description": "Allows an application to read virtual appointments for the signed-in user. Only an organizer or participant user can read their virtual appointments.  ",
+    "displayName": "Read a user's virtual appointments",
+    "id": "27470298-d3b8-4b9c-aad4-6334312a3eac",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Phone.Read.All"
+    "value": "VirtualAppointment.Read"
   },
   {
-    "description": "Allows the app to read and write the signed-in user's phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write the signed-in user's phone authentication methods",
-    "id": "6c4aad61-f76b-46ad-a22c-57d4d3d962af",
+    "description": "Allows the app to read the signed-in user's Windows Hello authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read the signed-in user's Windows Hello methods",
+    "id": "efe2b5aa-3a8e-486c-b0be-cc4d185c1b40",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Phone.ReadWrite"
+    "value": "UserAuthMethod-WindowsHello.Read"
+  },
+  {
+    "description": "Allows the app to read and write the signed-in user's Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write the signed-in user's Temporary Access Pass authentication methods",
+    "id": "2424436d-902f-4651-a1c7-b3b93147c960",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "UserAuthMethod-TAP.ReadWrite"
   },
   {
     "description": "Allows the app to read and write Phone methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
@@ -1462,6 +1448,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "UserAuthMethod-SoftwareOATH.ReadWrite"
   },
+  {
+    "description": "Allows the app to read and write SoftwareOATH authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write all users' SoftwareOATH methods.",
+    "id": "5b34c8b5-2396-4b35-b284-83fb6a3e73ce",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "UserAuthMethod-SoftwareOATH.ReadWrite.All"
+  },
   {
     "description": "Allows the app to read the signed-in user's Temporary Access Pass authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
     "displayName": "Read the signed-in user's Temporary Access Pass authentication methods",
@@ -1470,46 +1463,39 @@
     "value": "UserAuthMethod-TAP.Read"
   },
   {
-    "description": "This role can read Verified Id profiles in a tenant.",
-    "displayName": "Read Verified Id profiles",
-    "id": "604b2056-41ed-4c56-aad5-1241d4ef7333",
+    "description": "Allows the app to read Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' Temporary Access Pass methods",
+    "id": "6976c635-c9c2-41e6-a21d-e6913a155273",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "VerifiedId-Profile.Read.All"
+    "value": "UserAuthMethod-TAP.Read.All"
   },
   {
-    "description": "This role can read and write Verified Id profiles in a tenant.",
-    "displayName": "Read and write Verified Id profiles",
-    "id": "e4a9cb5e-4767-48f8-9029-decf26a54456",
+    "description": "Allows the app to read and write Temporary Access Pass authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write all users' Temporary Access Pass methods.",
+    "id": "05de4a66-e51a-4312-842a-30c8094698d2",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "VerifiedId-Profile.ReadWrite.All"
+    "value": "UserAuthMethod-TAP.ReadWrite.All"
   },
   {
-    "description": "Allows an application to read virtual appointments for the signed-in user. Only an organizer or participant user can read their virtual appointments.  ",
-    "displayName": "Read a user's virtual appointments",
-    "id": "27470298-d3b8-4b9c-aad4-6334312a3eac",
+    "description": "Allows an application to read and write virtual appointments for the signed-in user. Only an organizer or participant user can read and write their virtual appointments. ",
+    "displayName": "Read and write a user's virtual appointments  ",
+    "id": "2ccc2926-a528-4b17-b8bb-860eed29d64c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "VirtualAppointment.Read"
-  },
-  {
-    "description": "Allow this app to receive information about devices (such as compliance and enrollment state) that are managed by Intune.",
-    "displayName": "Get device state and compliance information from Microsoft Intune",
-    "id": "7ec88bad-30c7-4928-a005-4455362cfd98",
-    "origin": "Application (Microsoft Intune API)",
-    "value": "get_device_compliance"
+    "value": "VirtualAppointment.ReadWrite"
   },
   {
-    "description": "Allows the app to send partner compliance policies and its Azure AD Group assignment to Microsoft Intune without a signed-in user.",
-    "displayName": "Manage partner compliance policies with Microsoft Intune.",
-    "id": "3857e233-c379-404e-85e9-bdbf3a62b28f",
-    "origin": "Application (Microsoft Intune API)",
-    "value": "manage_partner_compliance_policy"
+    "description": "Allows an application to send notifications for virtual appointments for the signed-in user.",
+    "displayName": "Send notification regarding virtual appointments for the signed-in user",
+    "id": "20d02fff-a0ef-49e7-a46e-019d4a6523b7",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "VirtualAppointmentNotification.Send"
   },
   {
-    "description": "Read PFX certificate requests and send certificates to Microsoft Intune.",
-    "displayName": "PFX certificate management",
-    "id": "907d16c7-7591-49a4-b523-6fd42e5f2c7e",
-    "origin": "Application (Microsoft Intune API)",
-    "value": "pfx_cert_provider"
+    "description": "Allows the app to read virtual events created by you",
+    "displayName": "Read your virtual events",
+    "id": "6b616635-ae58-433a-a918-8c45e4f304dc",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "VirtualEvent.Read"
   },
   {
     "description": "Send SCEP challenges to Intune for certificate request validation. ",
@@ -1610,53 +1596,39 @@
     "value": "arrtest.signin"
   },
   {
-    "description": "Grants access to the Intune data warehouse API",
-    "displayName": "Get data warehouse information from Microsoft Intune",
-    "id": "3d9dc976-32fb-45a8-90bd-c9f8a850d098",
-    "origin": "Application (Microsoft Intune API)",
-    "value": "get_data_warehouse"
-  },
-  {
-    "description": "Allows user to view their BitLocker recovery keys",
-    "displayName": "Read BitLocker recovery keys",
-    "id": "ecff1a9d-e6bb-4e01-9136-c8825bbfceb3",
-    "origin": "Delegated (Microsoft Intune AAD BitLocker Recovery Key Integration)",
-    "value": "IntuneAADBitLockerRecoveryKey.Read"
-  },
-  {
-    "description": "Allows Intune Admins to enroll a Microsoft Tunnel Gateway Agent",
-    "displayName": "MicrosoftTunnelGatewayEnrollment",
-    "id": "e323f13a-1fcc-49cc-883f-c6da13ae0542",
-    "origin": "Delegated (Microsoft Intune)",
-    "value": "MicrosoftTunnelGatewayEnrollment"
+    "description": "Sign In to Mixed Reality Services",
+    "displayName": "Signin",
+    "id": "b24fe742-e2a6-4995-adbf-aba1516932c5",
+    "origin": "Application (Microsoft Mixed Reality)",
+    "value": "mixedreality.signin"
   },
   {
-    "description": "Read all unified policies a user has access to.",
-    "displayName": "Read all unified policies a user has access to.",
-    "id": "34f7024b-1bed-402f-9664-f5316a1e1b4a",
-    "origin": "Delegated (Microsoft Information Protection Sync Service)",
-    "value": "UnifiedPolicy.User.Read"
+    "description": "Read PFX certificate requests and send certificates to Microsoft Intune.",
+    "displayName": "PFX certificate management",
+    "id": "907d16c7-7591-49a4-b523-6fd42e5f2c7e",
+    "origin": "Application (Microsoft Intune API)",
+    "value": "pfx_cert_provider"
   },
   {
-    "description": "Allows an application to read and write virtual appointments for the signed-in user. Only an organizer or participant user can read and write their virtual appointments. ",
-    "displayName": "Read and write a user's virtual appointments  ",
-    "id": "2ccc2926-a528-4b17-b8bb-860eed29d64c",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "VirtualAppointment.ReadWrite"
+    "description": "Allows the app to send partner compliance policies and its Azure AD Group assignment to Microsoft Intune without a signed-in user.",
+    "displayName": "Manage partner compliance policies with Microsoft Intune.",
+    "id": "3857e233-c379-404e-85e9-bdbf3a62b28f",
+    "origin": "Application (Microsoft Intune API)",
+    "value": "manage_partner_compliance_policy"
   },
   {
-    "description": "Allows an application to send notifications for virtual appointments for the signed-in user.",
-    "displayName": "Send notification regarding virtual appointments for the signed-in user",
-    "id": "20d02fff-a0ef-49e7-a46e-019d4a6523b7",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "VirtualAppointmentNotification.Send"
+    "description": "Allow this app to receive information about devices (such as compliance and enrollment state) that are managed by Intune.",
+    "displayName": "Get device state and compliance information from Microsoft Intune",
+    "id": "7ec88bad-30c7-4928-a005-4455362cfd98",
+    "origin": "Application (Microsoft Intune API)",
+    "value": "get_device_compliance"
   },
   {
-    "description": "Allows the app to read virtual events created by you",
-    "displayName": "Read your virtual events",
-    "id": "6b616635-ae58-433a-a918-8c45e4f304dc",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "VirtualEvent.Read"
+    "description": "Grants access to the Intune data warehouse API",
+    "displayName": "Get data warehouse information from Microsoft Intune",
+    "id": "3d9dc976-32fb-45a8-90bd-c9f8a850d098",
+    "origin": "Application (Microsoft Intune API)",
+    "value": "get_data_warehouse"
   },
   {
     "description": "Allows the app to read and write virtual events for you",
@@ -1693,13 +1665,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "WorkforceIntegration.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read and write password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write all users' password methods.",
-    "id": "7f5b683d-df96-4690-a88d-6e336ed6dc7c",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Password.ReadWrite.All"
-  },
   {
     "description": "Allows the current signed-in user to read Content Domain information.",
     "displayName": "ContentDomain.Read.All",
@@ -1707,6 +1672,13 @@
     "origin": "Application (Microsoft Graph Connectors Core)",
     "value": "ContentDomain.Read.All"
   },
+  {
+    "description": "Allows the current signed in user to update the Content Domain information",
+    "displayName": "ContentDomain.ReadWrite",
+    "id": "6662245d-d5f3-42cb-b401-b08c2f424d5f",
+    "origin": "Application (Microsoft Graph Connectors Core)",
+    "value": "ContentDomain.ReadWrite"
+  },
   {
     "description": "Read and Write permission of Content Domain Items into all content domain shards. ",
     "displayName": "ContentDomainItem.ReadWrite.All",
@@ -1714,6 +1686,13 @@
     "origin": "Application (Microsoft Graph Connectors Core)",
     "value": "ContentDomainItem.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read and write the signed-in user's phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write the signed-in user's phone authentication methods",
+    "id": "6c4aad61-f76b-46ad-a22c-57d4d3d962af",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "UserAuthMethod-Phone.ReadWrite"
+  },
   {
     "description": "Read and Write permission of Content Domain Items into the content domain shard owned by the application. ",
     "displayName": "ContentDomainItem.ReadWrite.OwnedBy",
@@ -1721,13 +1700,6 @@
     "origin": "Application (Microsoft Graph Connectors Core)",
     "value": "ContentDomainItem.ReadWrite.OwnedBy"
   },
-  {
-    "description": "Allows the current signed in user to update the Content Domain information",
-    "displayName": "ContentDomain.ReadWrite",
-    "id": "6662245d-d5f3-42cb-b401-b08c2f424d5f",
-    "origin": "Delegated (Microsoft Graph Connectors Core)",
-    "value": "ContentDomain.ReadWrite"
-  },
   {
     "description": "Read all published labels and label policies for an organization.",
     "displayName": "InformationProtectionPolicy.Read.All",
@@ -1757,46 +1729,46 @@
     "value": "UnifiedPolicy.Tenant.Read"
   },
   {
-    "description": "Allows the app to read and write the signed-in user's password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write the signed-in user's password authentication methods",
-    "id": "60cce20d-d41e-4594-b391-84bbf8cc31f3",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Password.ReadWrite"
+    "description": "Read all unified policies a user has access to.",
+    "displayName": "Read all unified policies a user has access to.",
+    "id": "34f7024b-1bed-402f-9664-f5316a1e1b4a",
+    "origin": "Delegated (Microsoft Information Protection Sync Service)",
+    "value": "UnifiedPolicy.User.Read"
   },
   {
-    "description": "Allows the app to read password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' password authentication methods",
-    "id": "4f69a4e2-2aa0-43a7-ad6b-98b4cda1f23f",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Password.Read.All"
+    "description": "Allows Intune Admins to enroll a Microsoft Tunnel Gateway Agent",
+    "displayName": "MicrosoftTunnelGatewayEnrollment",
+    "id": "e323f13a-1fcc-49cc-883f-c6da13ae0542",
+    "origin": "Delegated (Microsoft Intune)",
+    "value": "MicrosoftTunnelGatewayEnrollment"
   },
   {
-    "description": "Allows the app to read the signed-in user's password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read the signed-in user's password authentication methods",
-    "id": "7f0f82c3-de19-4ddc-810d-a2206d7637fd",
+    "description": "Allows user to view their BitLocker recovery keys",
+    "displayName": "Read BitLocker recovery keys",
+    "id": "ecff1a9d-e6bb-4e01-9136-c8825bbfceb3",
+    "origin": "Delegated (Microsoft Intune AAD BitLocker Recovery Key Integration)",
+    "value": "IntuneAADBitLockerRecoveryKey.Read"
+  },
+  {
+    "description": "Allows the app to read phone authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' phone authentication methods",
+    "id": "20cf4ae1-09b9-4d29-a6f8-43e1820ce60c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Password.Read"
+    "value": "UserAuthMethod-Phone.Read.All"
   },
   {
-    "description": "Allows the application to list and read all Tenant Governance relationships on behalf of the signed-in user.",
-    "displayName": "Read Tenant Governance relationships",
-    "id": "0b1c2458-4845-477b-a704-3cce8b06bf28",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "TenantGovernance-Relationship.Read.All"
-  },
-  {
-    "description": "Allows the application to list, read, and update Tenant Governance relationships on behalf of the signed-in user.",
-    "displayName": "Read and write Tenant Governance relationships",
-    "id": "3fbcd6a3-a9a5-4d69-8a78-acc7d7195180",
+    "description": "Allows the app to read the signed-in user's phone authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read the signed-in user's phone authentication methods",
+    "id": "43dab3b9-e8b4-424d-8e13-6a2ad2a625fa",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TenantGovernance-Relationship.ReadWrite.All"
+    "value": "UserAuthMethod-Phone.Read"
   },
   {
-    "description": "Allows the application to list and read all Tenant Governance requests on behalf of the signed-in user.",
-    "displayName": "Read Tenant Governance requests",
-    "id": "a924b9f1-7af0-4982-aecf-b6e0e10b2830",
+    "description": "Allows the app to read and write password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write all users' password methods.",
+    "id": "7f5b683d-df96-4690-a88d-6e336ed6dc7c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TenantGovernance-Request.Read.All"
+    "value": "UserAuthMethod-Password.ReadWrite.All"
   },
   {
     "description": "Allows the application to list, read, create, and update Tenant Governance requests on behalf of the signed-in user.",
@@ -1897,53 +1869,53 @@
     "value": "ThreatSubmission.ReadWrite.All"
   },
   {
-    "description": "Allows the application to list, read, and refresh related tenants information on behalf of the signed-in user.",
-    "displayName": "Read and write related tenants",
-    "id": "e61db2de-de55-461e-942d-52a028ed1076",
+    "description": "Allows the app to read your organization's threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user.",
+    "displayName": "Read and write all threat submission policies",
+    "id": "059e5840-5353-4c68-b1da-666a033fc5e8",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TenantGovernance-RelatedTenant.ReadWrite.All"
+    "value": "ThreatSubmissionPolicy.ReadWrite.All"
   },
   {
-    "description": "Allows the application to list and read related tenants information on behalf of the signed-in user.",
-    "displayName": "Read related tenants",
-    "id": "9caaca93-f090-4b9a-b4bb-17de251354d4",
+    "description": "Allows the app to read topics data on behalf of the signed-in user.",
+    "displayName": "Read topic items",
+    "id": "79c4c76f-409a-4f98-884d-e2c09291ec26",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TenantGovernance-RelatedTenant.Read.All"
+    "value": "Topic.Read.All"
   },
   {
-    "description": "Allows the application to list, read, create, update, and delete Tenant Governance policy templates on behalf of the signed-in user.",
-    "displayName": "Read and write Tenant Governance policy templates",
-    "id": "7cd0bd21-45fe-4c8e-a549-3c95bd27d185",
+    "description": "Allows the app to read trust framework key set properties on behalf of the signed-in user.",
+    "displayName": "Read trust framework key sets",
+    "id": "7ad34336-f5b1-44ce-8682-31d7dfcd9ab9",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TenantGovernance-PolicyTemplate.ReadWrite.All"
+    "value": "TrustFrameworkKeySet.Read.All"
   },
   {
-    "description": "Allows the application to list and read all Tenant Governance policy templates on behalf of the signed-in user.",
-    "displayName": "Read Tenant Governance policy templates",
-    "id": "ad222a15-813d-46b8-8f8d-1976a69a74f3",
+    "description": "Allows the application to list and read all Tenant Governance requests on behalf of the signed-in user.",
+    "displayName": "Read Tenant Governance requests",
+    "id": "a924b9f1-7af0-4982-aecf-b6e0e10b2830",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TenantGovernance-PolicyTemplate.Read.All"
+    "value": "TenantGovernance-Request.Read.All"
   },
   {
-    "description": "Allows the app to read and modify your tenant's acquired telephone number details on behalf of the signed-in admin user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
-    "displayName": "Read and Modify Tenant-Acquired Telephone Number Details",
-    "id": "424b07a8-1209-4d17-9fe4-9018a93a1024",
+    "description": "Allows the application to list, read, and update Tenant Governance relationships on behalf of the signed-in user.",
+    "displayName": "Read and write Tenant Governance relationships",
+    "id": "3fbcd6a3-a9a5-4d69-8a78-acc7d7195180",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsTelephoneNumber.ReadWrite.All"
+    "value": "TenantGovernance-Relationship.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read your tenant's user configurations on behalf of the signed-in admin user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.",
-    "displayName": "Read Teams user configurations",
-    "id": "5c469ce4-dab5-4afd-b9de-14f1ba4004a7",
+    "description": "Allows the application to list and read all Tenant Governance relationships on behalf of the signed-in user.",
+    "displayName": "Read Tenant Governance relationships",
+    "id": "0b1c2458-4845-477b-a704-3cce8b06bf28",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamsUserConfiguration.Read.All"
+    "value": "TenantGovernance-Relationship.Read.All"
   },
   {
-    "description": "Allows the app to read the available Teams templates, on behalf of the signed-in user.",
-    "displayName": "Read available Teams templates",
-    "id": "cd87405c-5792-4f15-92f7-debc0db6d1d6",
+    "description": "Allows the application to list, read, and refresh related tenants information on behalf of the signed-in user.",
+    "displayName": "Read and write related tenants",
+    "id": "e61db2de-de55-461e-942d-52a028ed1076",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamTemplates.Read"
+    "value": "TenantGovernance-RelatedTenant.ReadWrite.All"
   },
   {
     "description": "Allows the app to read the teamwork settings of the organization, on behalf of the signed-in user.",
@@ -1980,13 +1952,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamworkCustomEmoji.Read"
   },
-  {
-    "description": "Allows the app to read your organization's threat submission policies on behalf of the signed-in user. Also allows the app to create new threat submission policies on behalf of the signed-in user.",
-    "displayName": "Read and write all threat submission policies",
-    "id": "059e5840-5353-4c68-b1da-666a033fc5e8",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "ThreatSubmissionPolicy.ReadWrite.All"
-  },
   {
     "description": "Allow the app to read the management data for Teams devices on behalf of the signed-in user.",
     "displayName": "Read Teams devices",
@@ -1994,6 +1959,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamworkDevice.Read.All"
   },
+  {
+    "description": "Allow the app to read and write the management data for Teams devices on behalf of the signed-in user.",
+    "displayName": "Read and write Teams devices",
+    "id": "ddd97ecb-5c31-43db-a235-0ee20e635c40",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "TeamworkDevice.ReadWrite.All"
+  },
   {
     "description": "Allows the app to read the signed-in user's sections (folders) for organizing chats and channels in Teams.",
     "displayName": "Read your sections",
@@ -2001,6 +1973,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamworkSection.Read"
   },
+  {
+    "description": "Allows the app to read and write trust framework key set properties on behalf of the signed-in user.",
+    "displayName": "Read and write trust framework key sets",
+    "id": "39244520-1e7d-4b4a-aee0-57c65826e427",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "TrustFrameworkKeySet.ReadWrite.All"
+  },
   {
     "description": "Allows the app to read and write the signed-in user's sections (folders) for organizing chats and channels in Teams.",
     "displayName": "Read and write your sections",
@@ -2008,13 +1987,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "TeamworkSection.ReadWrite"
   },
-  {
-    "description": "Allows the app to read tags in Teams, on behalf of the signed-in user.",
-    "displayName": "Read tags in Teams",
-    "id": "57587d0b-8399-45be-b207-8050cec54575",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamworkTag.Read"
-  },
   {
     "description": "Allows the app to read and write tags in Teams, on behalf of the signed-in user.",
     "displayName": "Read and write tags in Teams",
@@ -2051,53 +2023,53 @@
     "value": "TenantGovernance-Invitation.ReadWrite.All"
   },
   {
-    "description": "Allow the app to read and write the management data for Teams devices on behalf of the signed-in user.",
-    "displayName": "Read and write Teams devices",
-    "id": "ddd97ecb-5c31-43db-a235-0ee20e635c40",
+    "description": "Allows the application to list and read all Tenant Governance policy templates on behalf of the signed-in user.",
+    "displayName": "Read Tenant Governance policy templates",
+    "id": "ad222a15-813d-46b8-8f8d-1976a69a74f3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TeamworkDevice.ReadWrite.All"
+    "value": "TenantGovernance-PolicyTemplate.Read.All"
   },
   {
-    "description": "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
-    "displayName": "Read eligibility schedules for app permission grants and app role assignments",
-    "id": "9b9eb231-5483-4f3c-89e9-9d5048dafe9d",
+    "description": "Allows the application to list, read, create, update, and delete Tenant Governance policy templates on behalf of the signed-in user.",
+    "displayName": "Read and write Tenant Governance policy templates",
+    "id": "7cd0bd21-45fe-4c8e-a549-3c95bd27d185",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrivilegedEligibilitySchedule.Read.EntraAppRole"
+    "value": "TenantGovernance-PolicyTemplate.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read topics data on behalf of the signed-in user.",
-    "displayName": "Read topic items",
-    "id": "79c4c76f-409a-4f98-884d-e2c09291ec26",
+    "description": "Allows the application to list and read related tenants information on behalf of the signed-in user.",
+    "displayName": "Read related tenants",
+    "id": "9caaca93-f090-4b9a-b4bb-17de251354d4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Topic.Read.All"
+    "value": "TenantGovernance-RelatedTenant.Read.All"
   },
   {
-    "description": "Allows the app to read and write trust framework key set properties on behalf of the signed-in user.",
-    "displayName": "Read and write trust framework key sets",
-    "id": "39244520-1e7d-4b4a-aee0-57c65826e427",
+    "description": "Allows the app to read tags in Teams, on behalf of the signed-in user.",
+    "displayName": "Read tags in Teams",
+    "id": "57587d0b-8399-45be-b207-8050cec54575",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "TrustFrameworkKeySet.ReadWrite.All"
+    "value": "TeamworkTag.Read"
   },
   {
-    "description": "Allows the app to read and write email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write all users' email methods.",
-    "id": "074f680f-c89e-45be-880e-5d0642860a1c",
+    "description": "Allows the app to read your tenant's user configurations on behalf of the signed-in admin user. User configuration may include attributes related to user, such as telephone number, assigned policies, etc.",
+    "displayName": "Read Teams user configurations",
+    "id": "5c469ce4-dab5-4afd-b9de-14f1ba4004a7",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Email.ReadWrite.All"
+    "value": "TeamsUserConfiguration.Read.All"
   },
   {
-    "description": "Allows the app to read the signed-in user's external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read the signed-in user's external authentication methods",
-    "id": "d1739827-146b-4f7f-b52c-1c509253aa57",
+    "description": "Allows the app to read basic unified group properties, memberships and owners of the group the signed-in guest is a member of.",
+    "displayName": "Read unified group memberships as guest",
+    "id": "73e75199-7c3e-41bb-9357-167164dbb415",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-External.Read"
+    "value": "UnifiedGroupMember.Read.AsGuest"
   },
   {
-    "description": "Allows the app to read external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' external authentication methods",
-    "id": "cbca9646-4c34-4cea-8e54-9a7088018820",
+    "description": "Allows the app to delete and restore all users, on behalf of the signed-in user.",
+    "displayName": "Delete and restore users",
+    "id": "4bb440cd-2cf2-4f90-8004-aa2acd2537c5",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-External.Read.All"
+    "value": "User.DeleteRestore.All"
   },
   {
     "description": "Allows the app to read and write the signed-in user's external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
@@ -2198,53 +2170,53 @@
     "value": "UserAuthMethod-Passkey.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write the signed-in user's email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write the signed-in user's email authentication methods",
-    "id": "696aa421-62dc-4c99-be16-015b23444089",
+    "description": "Allows the app to read the signed-in user's password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read the signed-in user's password authentication methods",
+    "id": "7f0f82c3-de19-4ddc-810d-a2206d7637fd",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Email.ReadWrite"
+    "value": "UserAuthMethod-Password.Read"
   },
   {
-    "description": "Allows the app to read email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' email methods",
-    "id": "76caaf3a-ebdb-40a3-9299-4196e636f290",
+    "description": "Allows the app to read password authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' password authentication methods",
+    "id": "4f69a4e2-2aa0-43a7-ad6b-98b4cda1f23f",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Email.Read.All"
+    "value": "UserAuthMethod-Password.Read.All"
   },
   {
-    "description": "Allows the app to read the signed-in user's email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read the signed-in user's email authentication methods",
-    "id": "12b23cea-90c1-4873-9094-f45c5f290f86",
+    "description": "Allows the app to read and write the signed-in user's password authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write the signed-in user's password authentication methods",
+    "id": "60cce20d-d41e-4594-b391-84bbf8cc31f3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthMethod-Email.Read"
+    "value": "UserAuthMethod-Password.ReadWrite"
   },
   {
-    "description": " Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to.                       Authentication methods include things like a user's phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write all users' authentication methods",
-    "id": "b7887744-6746-4312-813d-72daeaee7e2d",
+    "description": "Allows the app to read external authentication methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' external authentication methods",
+    "id": "cbca9646-4c34-4cea-8e54-9a7088018820",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UserAuthenticationMethod.ReadWrite.All"
+    "value": "UserAuthMethod-External.Read.All"
   },
   {
-    "description": "Allows the app to read basic unified group properties, memberships and owners of the group the signed-in guest is a member of.",
-    "displayName": "Read unified group memberships as guest",
-    "id": "73e75199-7c3e-41bb-9357-167164dbb415",
+    "description": "Allows the app to read the signed-in user's external authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read the signed-in user's external authentication methods",
+    "id": "d1739827-146b-4f7f-b52c-1c509253aa57",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "UnifiedGroupMember.Read.AsGuest"
+    "value": "UserAuthMethod-External.Read"
   },
   {
-    "description": "Allows the app to create users, on behalf of the signed-in user.",
-    "displayName": "Create users",
-    "id": "d8ce6a2a-46ff-438e-96bc-020f23870a55",
+    "description": "Allows the app to read and write email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write all users' email methods.",
+    "id": "074f680f-c89e-45be-880e-5d0642860a1c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "User.Create"
+    "value": "UserAuthMethod-Email.ReadWrite.All"
   },
   {
-    "description": "Allows the app to delete and restore all users, on behalf of the signed-in user.",
-    "displayName": "Delete and restore users",
-    "id": "4bb440cd-2cf2-4f90-8004-aa2acd2537c5",
+    "description": "Allows the app to read and write the signed-in user's email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write the signed-in user's email authentication methods",
+    "id": "696aa421-62dc-4c99-be16-015b23444089",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "User.DeleteRestore.All"
+    "value": "UserAuthMethod-Email.ReadWrite"
   },
   {
     "description": "Allows the app to enable and disable users' accounts, on behalf of the signed-in user.",
@@ -2281,13 +2253,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "User.Read"
   },
-  {
-    "description": "Allows the app to read trust framework key set properties on behalf of the signed-in user.",
-    "displayName": "Read trust framework key sets",
-    "id": "7ad34336-f5b1-44ce-8682-31d7dfcd9ab9",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "TrustFrameworkKeySet.Read.All"
-  },
   {
     "description": "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.",
     "displayName": "Read all users' full profiles",
@@ -2295,6 +2260,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "User.Read.All"
   },
+  {
+    "description": "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.",
+    "displayName": "Read all users' basic profiles",
+    "id": "b340eb25-3456-403f-be2f-af7a0d370277",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "User.ReadBasic.All"
+  },
   {
     "description": "Allows the app to read and update users, on behalf of the signed-in user.",
     "displayName": "Read and update users",
@@ -2302,6 +2274,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "User.ReadUpdate.All"
   },
+  {
+    "description": "Allows the app to create users, on behalf of the signed-in user.",
+    "displayName": "Create users",
+    "id": "d8ce6a2a-46ff-438e-96bc-020f23870a55",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "User.Create"
+  },
   {
     "description": "Allows the app to read your profile. It also allows the app to update your profile information on your behalf.",
     "displayName": "Read and write access to user profile",
@@ -2309,13 +2288,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "User.ReadWrite"
   },
-  {
-    "description": "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.",
-    "displayName": "Read and write all users' full profiles",
-    "id": "204e0828-b5ca-4ad8-b9f3-f32a958e7cc4",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "User.ReadWrite.All"
-  },
   {
     "description": "Allow the app to revoke all sign in sessions for a user, on behalf of a signed-in user.",
     "displayName": "Revoke all sign in sessions for a user",
@@ -2352,46 +2324,53 @@
     "value": "UserAuthenticationMethod.ReadWrite"
   },
   {
-    "description": "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.",
-    "displayName": "Read all users' basic profiles",
-    "id": "b340eb25-3456-403f-be2f-af7a0d370277",
+    "description": " Allows the app to read and write authentication methods of all users in your organization that the signed-in user has access to.                       Authentication methods include things like a user's phone numbers and Authenticator app settings. This                      does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write all users' authentication methods",
+    "id": "b7887744-6746-4312-813d-72daeaee7e2d",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "User.ReadBasic.All"
+    "value": "UserAuthenticationMethod.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.",
-    "displayName": "Read eligibility schedules for access to Azure AD groups",
-    "id": "8f44f93d-ecef-46ae-a9bf-338508d44d6b",
+    "description": "Allows the app to read the signed-in user's email authentication methods. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read the signed-in user's email authentication methods",
+    "id": "12b23cea-90c1-4873-9094-f45c5f290f86",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrivilegedEligibilitySchedule.Read.AzureADGroup"
+    "value": "UserAuthMethod-Email.Read"
   },
   {
-    "description": "Allows the app to delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.",
-    "displayName": "Delete assignment schedules for access to Azure AD groups",
-    "id": "ca5fe595-68ff-4dfd-907d-4509501a0e49",
+    "description": "Allows the app to read email methods of all users in your organization that the signed-in user has access to. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' email methods",
+    "id": "76caaf3a-ebdb-40a3-9299-4196e636f290",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrivilegedAssignmentSchedule.Remove.AzureADGroup"
+    "value": "UserAuthMethod-Email.Read.All"
   },
   {
-    "description": "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
-    "displayName": "Read, create, and delete assignment schedules for app permission grants and app role assignments",
-    "id": "e07122a7-d275-4a27-a2f5-eb62349edae0",
+    "description": "Allows the app to read and write the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.",
+    "displayName": "Read and write all users' full profiles",
+    "id": "204e0828-b5ca-4ad8-b9f3-f32a958e7cc4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole"
+    "value": "User.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write financials data on behalf of the signed-in user.",
-    "displayName": "Read and write financials data",
-    "id": "f534bf13-55d4-45a9-8f3c-c92fe64d6131",
+    "description": "Sign in to synthetics service",
+    "displayName": "syntest.signin",
+    "id": "9f56f4b8-4de2-4e83-a632-45d1e4b47400",
+    "origin": "Delegated (Microsoft Mixed Reality)",
+    "value": "syntest.signin"
+  },
+  {
+    "description": "Allows the app to read, create, and delete time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.",
+    "displayName": "Read, create, and delete eligibility schedules for access to Azure AD groups",
+    "id": "ba974594-d163-484e-ba39-c330d5897667",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Financials.ReadWrite.All"
+    "value": "PrivilegedEligibilitySchedule.ReadWrite.AzureADGroup"
   },
   {
-    "description": "Allows the app to read all goals and export jobs that the signed-in user can access.",
-    "displayName": "Read all goals and export jobs that a user can access",
-    "id": "092211d9-ca1a-427b-813e-b79c7653fe71",
+    "description": "Allows the app to read time-based eligibility schedules for access to Azure AD groups, on behalf of the signed-in user.",
+    "displayName": "Read eligibility schedules for access to Azure AD groups",
+    "id": "8f44f93d-ecef-46ae-a9bf-338508d44d6b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Goals-Export.Read.All"
+    "value": "PrivilegedEligibilitySchedule.Read.AzureADGroup"
   },
   {
     "description": "Allows the app to read goals, create and read export jobs that the signed-in user can access.",
@@ -2498,13 +2477,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "HealthMonitoringAlert.ReadWrite.All"
   },
-  {
-    "description": "Allows the application to manage selected file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
-    "displayName": "Access selected file storage container type registrations.",
-    "id": "d1e4f63a-1569-475c-b9b2-bdc140405e38",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "FileStorageContainerTypeReg.Selected"
-  },
   {
     "description": "Allows the app to read all scenario health monitoring alert configurations",
     "displayName": "Read all scenario health monitoring alert configurations",
@@ -2513,32 +2485,39 @@
     "value": "HealthMonitoringAlertConfig.Read.All"
   },
   {
-    "description": "Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
-    "displayName": "Manage file storage container type registrations on behalf of the signed in user",
-    "id": "c319a7df-930e-44c0-a43b-7e5e9c7f4f24",
+    "description": "Allows the app to read and write all scenario monitoring alert configurations, on behalf of the signed-in user.",
+    "displayName": "Read and write all scenario monitoring alert configurations.",
+    "id": "b3e5ebc6-1c23-4337-8286-3f27165addb4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "FileStorageContainerTypeReg.Manage.All"
+    "value": "HealthMonitoringAlertConfig.ReadWrite.All"
   },
   {
-    "description": "Allows the application to utilize the file storage container platform to manage containers on behalf of the signed in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type.",
-    "displayName": "Access selected file storage containers",
-    "id": "085ca537-6565-41c2-aca7-db852babc212",
+    "description": "Allows the app to read all goals and export jobs that the signed-in user can access.",
+    "displayName": "Read all goals and export jobs that a user can access",
+    "id": "092211d9-ca1a-427b-813e-b79c7653fe71",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "FileStorageContainer.Selected"
+    "value": "Goals-Export.Read.All"
   },
   {
-    "description": "Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator.",
-    "displayName": "Read and write all external connections",
-    "id": "bbbbd9b3-3566-4931-ac37-2b2180d9e334",
+    "description": "Allows the app to read own identity diagnostics information, including symptoms, runs, statuses, and results for the signed-in user",
+    "displayName": "Read your identity diagnostics",
+    "id": "3839e465-e636-4c8e-b959-340182fb0567",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ExternalConnection.ReadWrite.All"
+    "value": "IdentityDiagnostic.Read"
   },
   {
-    "description": "Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to.",
-    "displayName": "Read and write external connections",
-    "id": "4082ad95-c812-4f02-be92-780c4c4f1830",
+    "description": "Allows the app to read and write financials data on behalf of the signed-in user.",
+    "displayName": "Read and write financials data",
+    "id": "f534bf13-55d4-45a9-8f3c-c92fe64d6131",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ExternalConnection.ReadWrite.OwnedBy"
+    "value": "Financials.ReadWrite.All"
+  },
+  {
+    "description": "Allows the application to manage file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
+    "displayName": "Manage file storage container type registrations on behalf of the signed in user",
+    "id": "c319a7df-930e-44c0-a43b-7e5e9c7f4f24",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "FileStorageContainerTypeReg.Manage.All"
   },
   {
     "description": "Allow the app to read external datasets and content, on behalf of the signed-in user.",
@@ -2645,6 +2624,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "FileStorageContainer.Manage.All"
   },
+  {
+    "description": "Allows the application to utilize the file storage container platform to manage containers on behalf of the signed in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type.",
+    "displayName": "Access selected file storage containers",
+    "id": "085ca537-6565-41c2-aca7-db852babc212",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "FileStorageContainer.Selected"
+  },
   {
     "description": "Allows the application to manage file storage container types on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
     "displayName": "Manage file storage container types on behalf of the signed in user",
@@ -2653,18 +2639,11 @@
     "value": "FileStorageContainerType.Manage.All"
   },
   {
-    "description": "Allows the app to read and write all scenario monitoring alert configurations, on behalf of the signed-in user.",
-    "displayName": "Read and write all scenario monitoring alert configurations.",
-    "id": "b3e5ebc6-1c23-4337-8286-3f27165addb4",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "HealthMonitoringAlertConfig.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read own identity diagnostics information, including symptoms, runs, statuses, and results for the signed-in user",
-    "displayName": "Read your identity diagnostics",
-    "id": "3839e465-e636-4c8e-b959-340182fb0567",
+    "description": "Allows the application to manage selected file storage container type registrations on behalf of the signed in user. The user must be a SharePoint Embedded Admin or Global Admin.",
+    "displayName": "Access selected file storage container type registrations.",
+    "id": "d1e4f63a-1569-475c-b9b2-bdc140405e38",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IdentityDiagnostic.Read"
+    "value": "FileStorageContainerTypeReg.Selected"
   },
   {
     "description": "Allows the app to read all identity diagnostics information, including symptoms, runs, statuses, and results for all users in the organization, on behalf of the signed-in user.",
@@ -2674,18 +2653,18 @@
     "value": "IdentityDiagnostic.Read.All"
   },
   {
-    "description": "Allows the app to read and write inbound data flows on behalf of the signed-in user.",
-    "displayName": "Manage inbound flow definitions",
-    "id": "97044676-2cec-40ee-bd70-38df444c9e70",
+    "description": "Allows the app to start identity diagnostic processes for the signed-in user.",
+    "displayName": "Start identity diagnostics",
+    "id": "1ad58246-a11b-4ea3-9b75-8b6c315cbe21",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IndustryData-InboundFlow.ReadWrite.All"
+    "value": "IdentityDiagnostic.StartDiagnosis"
   },
   {
-    "description": "Allows the app to read outbound data flows on behalf of the signed-in user.",
-    "displayName": "View outbound flow definitions",
-    "id": "4741a003-8952-4be4-9217-33a0ac327122",
+    "description": "Allows the app to start identity diagnostic processes for all users in the organization, on behalf of the signed-in user.",
+    "displayName": "Start identity diagnostics for all users",
+    "id": "51470ff5-62b6-4aef-9a3a-d8c8a1e66d09",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IndustryData-OutboundFlow.Read.All"
+    "value": "IdentityDiagnostic.StartDiagnosis.All"
   },
   {
     "description": "Allows the app to read and write outbound data flows on behalf of the signed-in user.",
@@ -2793,46 +2772,46 @@
     "value": "LearningContent.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read inbound data flows on behalf of the signed-in user.",
-    "displayName": "View inbound flow definitions",
-    "id": "cb0774da-a605-42af-959c-32f438fb38f4",
+    "description": "Allows the app to read data for the learning provider in the organization's directory, on behalf of the signed-in user.",
+    "displayName": "Read learning provider",
+    "id": "dd8ce36f-9245-45ea-a99e-8ac398c22861",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IndustryData-InboundFlow.Read.All"
+    "value": "LearningProvider.Read"
   },
   {
-    "description": "Allows the app to upload data files to a data connector on behalf of the signed-in user.",
-    "displayName": "Upload files to a data connector",
-    "id": "fc47391d-ab2c-410f-9059-5600f7af660d",
+    "description": "Allows the app to create, update, read, and delete data for the learning provider in the organization's directory, on behalf of the signed-in user.",
+    "displayName": "Manage learning provider",
+    "id": "40c2eb57-abaf-49f5-9331-e90fd01f7130",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IndustryData-DataConnector.Upload"
+    "value": "LearningProvider.ReadWrite"
   },
   {
-    "description": "Allows the app to read and write data connectors on behalf of the signed-in user.",
-    "displayName": "Manage data connector definitions",
-    "id": "5ce933ac-3997-4280-aed0-cc072e5c062a",
+    "description": "Allows the app to read outbound data flows on behalf of the signed-in user.",
+    "displayName": "View outbound flow definitions",
+    "id": "4741a003-8952-4be4-9217-33a0ac327122",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IndustryData-DataConnector.ReadWrite.All"
+    "value": "IndustryData-OutboundFlow.Read.All"
   },
   {
-    "description": "Allows the app to read data connectors on behalf of the signed-in user.",
-    "displayName": "View data connector definitions",
-    "id": "d19c0de5-7ecb-4aba-b090-da35ebcd5425",
+    "description": "Allows the app to read and write inbound data flows on behalf of the signed-in user.",
+    "displayName": "Manage inbound flow definitions",
+    "id": "97044676-2cec-40ee-bd70-38df444c9e70",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IndustryData-DataConnector.Read.All"
+    "value": "IndustryData-InboundFlow.ReadWrite.All"
   },
   {
-    "description": "Allows the app to start identity diagnostic processes for the signed-in user.",
-    "displayName": "Start identity diagnostics",
-    "id": "1ad58246-a11b-4ea3-9b75-8b6c315cbe21",
+    "description": "Allows the app to read inbound data flows on behalf of the signed-in user.",
+    "displayName": "View inbound flow definitions",
+    "id": "cb0774da-a605-42af-959c-32f438fb38f4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IdentityDiagnostic.StartDiagnosis"
+    "value": "IndustryData-InboundFlow.Read.All"
   },
   {
-    "description": "Allows the app to start identity diagnostic processes for all users in the organization, on behalf of the signed-in user.",
-    "displayName": "Start identity diagnostics for all users",
-    "id": "51470ff5-62b6-4aef-9a3a-d8c8a1e66d09",
+    "description": "Allows the app to upload data files to a data connector on behalf of the signed-in user.",
+    "displayName": "Upload files to a data connector",
+    "id": "fc47391d-ab2c-410f-9059-5600f7af660d",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IdentityDiagnostic.StartDiagnosis.All"
+    "value": "IndustryData-DataConnector.Upload"
   },
   {
     "description": "Allows the app to read identity notification settings, email templates, and prerequisites on behalf of the signed-in user.",
@@ -2876,13 +2855,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "IdentityRiskEvent.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read all external connections on behalf of a signed-in user. The signed-in user must be an administrator.",
-    "displayName": "Read all external connections",
-    "id": "a38267a5-26b6-4d76-9493-935b7599116b",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "ExternalConnection.Read.All"
-  },
   {
     "description": "Allows the app to read risky agents information in your organization, on behalf of the signed-in user.",
     "displayName": "Read risky agents information",
@@ -2890,6 +2862,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "IdentityRiskyAgent.Read.All"
   },
+  {
+    "description": "Allows the app to read and update identity risky agents information for all agents in your organization on behalf of the signed-in user. Update operations include dismissing risky agents.",
+    "displayName": "Read and write risky agents information",
+    "id": "d343bdeb-db6a-4e06-97da-9dafc2d61c60",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "IdentityRiskyAgent.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read and write settings of external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write settings of connections that it is authorized to.",
+    "displayName": "Read and write external connections",
+    "id": "4082ad95-c812-4f02-be92-780c4c4f1830",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "ExternalConnection.ReadWrite.OwnedBy"
+  },
   {
     "description": "Allows the app to read all identity risky service principal information for your organization, on behalf of the signed-in user.",
     "displayName": "Read all identity risky service principal information",
@@ -2897,13 +2883,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "IdentityRiskyServicePrincipal.Read.All"
   },
-  {
-    "description": "Allows the app to read and update identity risky service principal information for all service principals in your organization, on behalf of the signed-in user. Update operations include dismissing risky service principals.",
-    "displayName": "Read and write all identity risky service principal information",
-    "id": "bb6f654c-d7fd-4ae3-85c3-fc380934f515",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "IdentityRiskyServicePrincipal.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read identity risky user information for all users in your organization on behalf of the signed-in user.",
     "displayName": "Read identity risky user information",
@@ -2947,46 +2926,46 @@
     "value": "IndustryData.ReadBasic.All"
   },
   {
-    "description": "Allows the app to read and update identity risky agents information for all agents in your organization on behalf of the signed-in user. Update operations include dismissing risky agents.",
-    "displayName": "Read and write risky agents information",
-    "id": "d343bdeb-db6a-4e06-97da-9dafc2d61c60",
+    "description": "Allows the app to read data connectors on behalf of the signed-in user.",
+    "displayName": "View data connector definitions",
+    "id": "d19c0de5-7ecb-4aba-b090-da35ebcd5425",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "IdentityRiskyAgent.ReadWrite.All"
+    "value": "IndustryData-DataConnector.Read.All"
   },
   {
-    "description": "Allows the app to search the email message trace on behalf of the signed-in user.",
-    "displayName": "Search the email message trace",
-    "id": "b2e7d27e-14e7-41ad-bb15-a88ceb9c3e90",
+    "description": "Allows the app to read and write data connectors on behalf of the signed-in user.",
+    "displayName": "Manage data connector definitions",
+    "id": "5ce933ac-3997-4280-aed0-cc072e5c062a",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ExchangeMessageTrace.Read.All"
+    "value": "IndustryData-DataConnector.ReadWrite.All"
   },
   {
-    "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.",
-    "displayName": "Access mailboxes as the signed-in user via Exchange Web Services",
-    "id": "9769c687-087d-48ac-9cb3-c37dde652038",
+    "description": "Allows the app to read and update identity risky service principal information for all service principals in your organization, on behalf of the signed-in user. Update operations include dismissing risky service principals.",
+    "displayName": "Read and write all identity risky service principal information",
+    "id": "bb6f654c-d7fd-4ae3-85c3-fc380934f515",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "EWS.AccessAsUser.All"
+    "value": "IdentityRiskyServicePrincipal.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read or write your organization's authentication event listeners on behalf of the signed-in user.",
-    "displayName": "Read and write your organization's authentication event listeners",
-    "id": "d11625a6-fe21-4fc6-8d3d-063eba5525ad",
+    "description": "Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator.",
+    "displayName": "Read and write all external connections",
+    "id": "bbbbd9b3-3566-4931-ac37-2b2180d9e334",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "EventListener.ReadWrite.All"
+    "value": "ExternalConnection.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read your organization's devices' configuration information on behalf of the signed-in user.",
-    "displayName": "Read all devices",
-    "id": "951183d1-1a61-466f-a6d1-1fde911bfd95",
+    "description": "Allows the app to read all external connections on behalf of a signed-in user. The signed-in user must be an administrator.",
+    "displayName": "Read all external connections",
+    "id": "a38267a5-26b6-4d76-9493-935b7599116b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Device.Read.All"
+    "value": "ExternalConnection.Read.All"
   },
   {
-    "description": "Allows the app to read device local credential properties including passwords, on behalf of the signed-in user.",
-    "displayName": "Read device local credential passwords",
-    "id": "280b3b69-0437-44b1-bc20-3b2fca1ee3e9",
+    "description": "Allows the app to search the email message trace on behalf of the signed-in user.",
+    "displayName": "Search the email message trace",
+    "id": "b2e7d27e-14e7-41ad-bb15-a88ceb9c3e90",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "DeviceLocalCredential.Read.All"
+    "value": "ExchangeMessageTrace.Read.All"
   },
   {
     "description": "Allows the app to read device local credential properties excluding passwords, on behalf of the signed-in user.",
@@ -3094,46 +3073,46 @@
     "value": "DeviceManagementScripts.Read.All"
   },
   {
-    "description": "Allows the app to read a user's list of devices on behalf of the signed-in user.",
-    "displayName": "Read user devices",
-    "id": "11d4cd79-5ba5-460f-803f-e22c8ab85ccd",
+    "description": "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.",
+    "displayName": "Read and write Microsoft Intune Scripts",
+    "id": "8b9d79d0-ad75-4566-8619-f7500ecfcebe",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Device.Read"
+    "value": "DeviceManagementScripts.ReadWrite.All"
   },
   {
-    "description": "Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user.",
-    "displayName": "Create devices based on owned device templates",
-    "id": "edc92e89-a987-48a9-911a-a7b1967dd7b1",
+    "description": "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration.",
+    "displayName": "Read Microsoft Intune configuration",
+    "id": "8696daa5-bce5-4b2e-83f9-51b6defc4e1e",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Device.CreateFromOwnedTemplate"
+    "value": "DeviceManagementServiceConfig.Read.All"
   },
   {
-    "description": "Allows the app to launch another app or communicate with another app on a user's device on behalf of the signed-in user.",
-    "displayName": "Communicate with user devices",
-    "id": "bac3b9c2-b516-4ef4-bd3b-c2ef73d8d804",
+    "description": "Allows the app to read device local credential properties including passwords, on behalf of the signed-in user.",
+    "displayName": "Read device local credential passwords",
+    "id": "280b3b69-0437-44b1-bc20-3b2fca1ee3e9",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Device.Command"
+    "value": "DeviceLocalCredential.Read.All"
   },
   {
-    "description": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on behalf of the signed in user.",
-    "displayName": "Manage all delegated permission grants",
-    "id": "41ce6ca6-6826-4807-84f1-1c82854f7ee5",
+    "description": "Allows the app to read your organization's devices' configuration information on behalf of the signed-in user.",
+    "displayName": "Read all devices",
+    "id": "951183d1-1a61-466f-a6d1-1fde911bfd95",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "DelegatedPermissionGrant.ReadWrite.All"
+    "value": "Device.Read.All"
   },
   {
-    "description": "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.",
-    "displayName": "Read shared cross-tenant user profile and export or delete data",
-    "id": "eed0129d-dc60-4f30-8641-daf337a39ffd",
+    "description": "Allows the app to read a user's list of devices on behalf of the signed-in user.",
+    "displayName": "Read user devices",
+    "id": "11d4cd79-5ba5-460f-803f-e22c8ab85ccd",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "CrossTenantUserProfileSharing.ReadWrite"
+    "value": "Device.Read"
   },
   {
-    "description": "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.",
-    "displayName": "Read all shared cross-tenant user profiles and export or delete their data",
-    "id": "64dfa325-cbf8-48e3-938d-51224a0cac01",
+    "description": "Allows the app to create device objects based on device templates owned by the signed-in user, on behalf of the signed in user.",
+    "displayName": "Create devices based on owned device templates",
+    "id": "edc92e89-a987-48a9-911a-a7b1967dd7b1",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "CrossTenantUserProfileSharing.ReadWrite.All"
+    "value": "Device.CreateFromOwnedTemplate"
   },
   {
     "description": "Allows the app to read your organization's custom authentication extensions on behalf of the signed-in user.",
@@ -3177,13 +3156,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "CustomSecAttributeAssignment.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read and write Microsoft Intune device compliance scripts, device management scripts, device shell scripts, device custom attribute shell scripts and device health scripts on behalf of the signed in user.",
-    "displayName": "Read and write Microsoft Intune Scripts",
-    "id": "8b9d79d0-ad75-4566-8619-f7500ecfcebe",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "DeviceManagementScripts.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read audit logs for events that contain information about custom security attributes, on behalf of the signed-in user.",
     "displayName": "Read custom security attribute audit logs",
@@ -3191,6 +3163,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "CustomSecAttributeAuditLogs.Read.All"
   },
+  {
+    "description": "Allows the app to read custom security attribute definitions for the tenant on behalf of a signed in user.",
+    "displayName": "Read custom security attribute definitions",
+    "id": "ce026878-a0ff-4745-a728-d4fedd086c07",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "CustomSecAttributeDefinition.Read.All"
+  },
+  {
+    "description": "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration.",
+    "displayName": "Read and write Microsoft Intune configuration",
+    "id": "662ed50a-ac44-4eef-ad86-62eed9be2a29",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "DeviceManagementServiceConfig.ReadWrite.All"
+  },
   {
     "description": "Allows the app to read and write custom security attribute definitions for the tenant on behalf of a signed in user.",
     "displayName": "Read and write custom security attribute definitions",
@@ -3198,13 +3184,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "CustomSecAttributeDefinition.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user.",
-    "displayName": "Read the provisioning configuration of all active custom security attributes",
-    "id": "9ddd870d-077c-49e7-b3e3-6b3012a8a880",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "CustomSecAttributeProvisioning.Read.All"
-  },
   {
     "description": "Allows the app to read and edit the provisioning configuration of all active custom security attributes on behalf of a signed in user.",
     "displayName": "Read and edit the provisioning configuration of all active custom security attributes",
@@ -3248,25 +3227,32 @@
     "value": "DelegatedPermissionGrant.Read.All"
   },
   {
-    "description": "Allows the app to read custom security attribute definitions for the tenant on behalf of a signed in user.",
-    "displayName": "Read custom security attribute definitions",
-    "id": "ce026878-a0ff-4745-a728-d4fedd086c07",
+    "description": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), on behalf of the signed in user.",
+    "displayName": "Manage all delegated permission grants",
+    "id": "41ce6ca6-6826-4807-84f1-1c82854f7ee5",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "CustomSecAttributeDefinition.Read.All"
+    "value": "DelegatedPermissionGrant.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read data for the learning provider in the organization's directory, on behalf of the signed-in user.",
-    "displayName": "Read learning provider",
-    "id": "dd8ce36f-9245-45ea-a99e-8ac398c22861",
+    "description": "Allows the app to launch another app or communicate with another app on a user's device on behalf of the signed-in user.",
+    "displayName": "Communicate with user devices",
+    "id": "bac3b9c2-b516-4ef4-bd3b-c2ef73d8d804",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LearningProvider.Read"
+    "value": "Device.Command"
   },
   {
-    "description": "Allows the app to read Microsoft Intune service properties including device enrollment and third party service connection configuration.",
-    "displayName": "Read Microsoft Intune configuration",
-    "id": "8696daa5-bce5-4b2e-83f9-51b6defc4e1e",
+    "description": "Allows the app to read the provisioning configuration of all active custom security attributes on behalf of a signed in user.",
+    "displayName": "Read the provisioning configuration of all active custom security attributes",
+    "id": "9ddd870d-077c-49e7-b3e3-6b3012a8a880",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "DeviceManagementServiceConfig.Read.All"
+    "value": "CustomSecAttributeProvisioning.Read.All"
+  },
+  {
+    "description": "Allows the app to read data for the learner's self-initiated courses in the organization's directory, on behalf of the signed-in user.",
+    "displayName": "Read user's self-initiated courses",
+    "id": "f6403ef7-4a96-47be-a190-69ba274c3f11",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "LearningSelfInitiatedCourse.Read"
   },
   {
     "description": "Allows the app to create device templates on behalf of the signed in user. The user is marked as owners of the created device template. As a member of owners, the user will be allowed to manage devices created from the template.",
@@ -3276,18 +3262,11 @@
     "value": "DeviceTemplate.Create"
   },
   {
-    "description": "Allows the app to read the structure of schools and classes in an organization's roster and education-specific information about users to be read on behalf of the user.",
-    "displayName": "Read users' view of the roster",
-    "id": "a4389601-22d9-4096-ac18-36a927199112",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "EduRoster.Read"
-  },
-  {
-    "description": "Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization's roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo.",
-    "displayName": "Read a limited subset of users' view of the roster",
-    "id": "5d186531-d1bf-4f07-8cea-7c42119e1bd9",
+    "description": "Allows the app to create, read, update and delete the device template, on behalf of the signed in user. It also allows the app to add or remove owners on any device template.",
+    "displayName": "Read and write all device templates",
+    "id": "2d372e98-f1ae-406c-a157-2ea83f6f5e4a",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "EduRoster.ReadBasic"
+    "value": "DeviceTemplate.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and write the structure of schools and classes in an organization's roster and education-specific information about users to be read and written on behalf of the user.",
@@ -3395,46 +3374,46 @@
     "value": "EventListener.Read.All"
   },
   {
-    "description": "Allows the app to read and write user's modules and resources on behalf of the signed-in user.",
-    "displayName": "Read and write the user's class modules and resources",
-    "id": "4793c53b-df34-44fd-8d26-d15c517732f5",
+    "description": "Allows the app to read or write your organization's authentication event listeners on behalf of the signed-in user.",
+    "displayName": "Read and write your organization's authentication event listeners",
+    "id": "d11625a6-fe21-4fc6-8d3d-063eba5525ad",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "EduCurricula.ReadWrite"
+    "value": "EventListener.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read the user's modules and resources on behalf of the signed-in user.",
-    "displayName": "Read the user's class modules and resources",
-    "id": "484859e8-b9e2-4e92-b910-84db35dadd29",
+    "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.",
+    "displayName": "Access mailboxes as the signed-in user via Exchange Web Services",
+    "id": "9769c687-087d-48ac-9cb3-c37dde652038",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "EduCurricula.Read"
+    "value": "EWS.AccessAsUser.All"
   },
   {
-    "description": "Allows the app to read and write assignments without grades on behalf of the user.",
-    "displayName": "Read and write users' class assignments without grades",
-    "id": "2ef770a1-622a-47c4-93ee-28d6adbed3a0",
+    "description": "Allows the app to read a limited subset of the properties from the structure of schools and classes in an organization's roster and a limited subset of properties about users to be read on behalf of the user. Includes name, status, education role, email address and photo.",
+    "displayName": "Read a limited subset of users' view of the roster",
+    "id": "5d186531-d1bf-4f07-8cea-7c42119e1bd9",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "EduAssignments.ReadWriteBasic"
+    "value": "EduRoster.ReadBasic"
   },
   {
-    "description": "Allows the app to read and write assignments and their grades on behalf of the user.",
-    "displayName": "Read and write users' class assignments and their grades",
-    "id": "2f233e90-164b-4501-8bce-31af2559a2d3",
+    "description": "Allows the app to read the structure of schools and classes in an organization's roster and education-specific information about users to be read on behalf of the user.",
+    "displayName": "Read users' view of the roster",
+    "id": "a4389601-22d9-4096-ac18-36a927199112",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "EduAssignments.ReadWrite"
+    "value": "EduRoster.Read"
   },
   {
-    "description": "Allows the app to read all device templates, on behalf of the signed in user.",
-    "displayName": "Read all device templates",
-    "id": "2bcae0b0-aa93-48e4-a9e4-855482dffdcd",
+    "description": "Allows the app to read and write user's modules and resources on behalf of the signed-in user.",
+    "displayName": "Read and write the user's class modules and resources",
+    "id": "4793c53b-df34-44fd-8d26-d15c517732f5",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "DeviceTemplate.Read.All"
+    "value": "EduCurricula.ReadWrite"
   },
   {
-    "description": "Allows the app to create, read, update and delete the device template, on behalf of the signed in user. It also allows the app to add or remove owners on any device template.",
-    "displayName": "Read and write all device templates",
-    "id": "2d372e98-f1ae-406c-a157-2ea83f6f5e4a",
+    "description": "Allows the app to read the user's modules and resources on behalf of the signed-in user.",
+    "displayName": "Read the user's class modules and resources",
+    "id": "484859e8-b9e2-4e92-b910-84db35dadd29",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "DeviceTemplate.ReadWrite.All"
+    "value": "EduCurricula.Read"
   },
   {
     "description": "Allows the app to have the same access to information in the directory as the signed-in user.",
@@ -3478,13 +3457,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Domain.Read.All"
   },
-  {
-    "description": "Allows the app to read and write Microsoft Intune service properties including device enrollment and third party service connection configuration.",
-    "displayName": "Read and write Microsoft Intune configuration",
-    "id": "662ed50a-ac44-4eef-ad86-62eed9be2a29",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "DeviceManagementServiceConfig.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read and write all domain properties on behalf of the signed-in user. Also allows the app to add, verify and remove domains.",
     "displayName": "Read and write domains",
@@ -3492,6 +3464,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Domain.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read internal federation configuration for a domain.",
+    "displayName": "Read internal federation configuration for a domain.",
+    "id": "33203a2a-a761-40f0-8a7c-a7e74a9f8ac6",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Domain-InternalFederation.Read.All"
+  },
+  {
+    "description": "Allows the app to read all device templates, on behalf of the signed in user.",
+    "displayName": "Read all device templates",
+    "id": "2bcae0b0-aa93-48e4-a9e4-855482dffdcd",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "DeviceTemplate.Read.All"
+  },
   {
     "description": "Allows the app to create, read, update and delete internal federation configuration for a domain.",
     "displayName": "Create, read, update and delete internal federation configuration for a domain.",
@@ -3499,13 +3485,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Domain-InternalFederation.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync.",
-    "displayName": "Access mailboxes via Exchange ActiveSync",
-    "id": "ff91d191-45a0-43fd-b837-bd682c4a0b0f",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "EAS.AccessAsUser.All"
-  },
   {
     "description": "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects on behalf of the signed-in user.",
     "displayName": "Read all eDiscovery objects",
@@ -3549,25 +3528,32 @@
     "value": "EduAssignments.ReadBasic"
   },
   {
-    "description": "Allows the app to read internal federation configuration for a domain.",
-    "displayName": "Read internal federation configuration for a domain.",
-    "id": "33203a2a-a761-40f0-8a7c-a7e74a9f8ac6",
+    "description": "Allows the app to read and write assignments and their grades on behalf of the user.",
+    "displayName": "Read and write users' class assignments and their grades",
+    "id": "2f233e90-164b-4501-8bce-31af2559a2d3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Domain-InternalFederation.Read.All"
+    "value": "EduAssignments.ReadWrite"
   },
   {
-    "description": "Sign In to Mixed Reality Services",
-    "displayName": "Signin",
-    "id": "b24fe742-e2a6-4995-adbf-aba1516932c5",
-    "origin": "Application (Microsoft Mixed Reality)",
-    "value": "mixedreality.signin"
+    "description": "Allows the app to read and write assignments without grades on behalf of the user.",
+    "displayName": "Read and write users' class assignments without grades",
+    "id": "2ef770a1-622a-47c4-93ee-28d6adbed3a0",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "EduAssignments.ReadWriteBasic"
   },
   {
-    "description": "Allows the app to create, update, read, and delete data for the learning provider in the organization's directory, on behalf of the signed-in user.",
-    "displayName": "Manage learning provider",
-    "id": "40c2eb57-abaf-49f5-9331-e90fd01f7130",
+    "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync.",
+    "displayName": "Access mailboxes via Exchange ActiveSync",
+    "id": "ff91d191-45a0-43fd-b837-bd682c4a0b0f",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LearningProvider.ReadWrite"
+    "value": "EAS.AccessAsUser.All"
+  },
+  {
+    "description": "Allows the app to read time-based eligibility schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
+    "displayName": "Read eligibility schedules for app permission grants and app role assignments",
+    "id": "9b9eb231-5483-4f3c-89e9-9d5048dafe9d",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "PrivilegedEligibilitySchedule.Read.EntraAppRole"
   },
   {
     "description": "Allows an app to read license assignments for users and groups, on behalf of the signed-in user.",
@@ -3577,18 +3563,11 @@
     "value": "LicenseAssignment.Read.All"
   },
   {
-    "description": "Allows the app to read your organization's device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
-    "displayName": "Read your organization's device configuration policies",
-    "id": "3616a4b0-6746-49c4-a678-4c237599074d",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.Read.DeviceConfiguration"
-  },
-  {
-    "description": "Allows the app to read your organization’s identity protection policy on behalf of the signed-in user.",
-    "displayName": "Read your organization’s identity protection policy",
-    "id": "d146432f-b803-4ed4-8d42-ba74193a6ede",
+    "description": "Allows the app to read identity lifecycle policies for agent identities that the signed-in user has access to in the organization.",
+    "displayName": "Read identity lifecycle policies for agent identities",
+    "id": "65857db0-62ac-4279-aa73-c2b5dab186f5",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.Read.IdentityProtection"
+    "value": "LifecyclePolicies-AgentId.Read.All"
   },
   {
     "description": "Allows the app to read policies related to consent and permission grants for applications, on behalf of the signed-in user.",
@@ -3695,13 +3674,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Policy.ReadWrite.FeatureRollout"
   },
-  {
-    "description": "Allows the app to read your organization's cross tenant access policies on behalf of the signed-in user.",
-    "displayName": "Read your organization's cross tenant access policies",
-    "id": "b337372a-8b4d-428d-9cd8-3d7363865736",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.Read.CrossTenantAccess"
-  },
   {
     "description": "Allows the application to read and update the organization's federated token validation policy on behalf of the signed-in user.",
     "displayName": "Read and write your organization's federated token validation policy",
@@ -3710,32 +3682,39 @@
     "value": "Policy.ReadWrite.FedTokenValidation"
   },
   {
-    "description": "Allows the app to read your organization's conditional access policies on behalf of the signed-in user.",
-    "displayName": "Read your organization's conditional access policies",
-    "id": "633e0fce-8c58-4cfb-9495-12bbd5a24f7c",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.Read.ConditionalAccess"
+    "description": "Allows the app to read and write your organization’s identity protection policy on behalf of the signed-in user.",
+    "displayName": "Read and write your organization’s identity protection policy ",
+    "id": "7256e131-3efb-4323-9854-cf41c6021770",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Policy.ReadWrite.IdentityProtection"
   },
   {
-    "description": "Allows the app to read the authentication method policies, on behalf of the signed-in user. ",
-    "displayName": "Read authentication method policies",
-    "id": "a6ff13ac-1851-4993-8ca9-a671d70de2d5",
+    "description": "Allows the app to read your organization’s identity protection policy on behalf of the signed-in user.",
+    "displayName": "Read your organization’s identity protection policy",
+    "id": "d146432f-b803-4ed4-8d42-ba74193a6ede",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.Read.AuthenticationMethod"
+    "value": "Policy.Read.IdentityProtection"
   },
   {
-    "description": "Allows the app to read and write organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user.",
-    "displayName": "Read and write organization-wide Microsoft 365 apps installation settings",
-    "id": "1ff35e91-19eb-42d8-aa2d-cc9891127ae5",
+    "description": "Allows the app to read and write your organization's mobility management policies on behalf of the signed-in user.  For example, a mobility management policy can set the enrollment scope for a given mobility management application.",
+    "displayName": "Read and write your organization's mobility management policies",
+    "id": "a8ead177-1889-4546-9387-f25e658e2a79",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "OrgSettings-Microsoft365Install.ReadWrite.All"
+    "value": "Policy.ReadWrite.MobilityManagement"
   },
   {
-    "description": "Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user.",
-    "displayName": "Read organization-wide Microsoft To Do settings",
-    "id": "7ff96f41-f022-45ba-acd8-ef3f03063d6b",
+    "description": "Allows the app to read your organization's device configuration policies on behalf of the signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
+    "displayName": "Read your organization's device configuration policies",
+    "id": "3616a4b0-6746-49c4-a678-4c237599074d",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "OrgSettings-Todo.Read.All"
+    "value": "Policy.Read.DeviceConfiguration"
+  },
+  {
+    "description": "Allows the app to read your organization's conditional access policies on behalf of the signed-in user.",
+    "displayName": "Read your organization's conditional access policies",
+    "id": "633e0fce-8c58-4cfb-9495-12bbd5a24f7c",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Policy.Read.ConditionalAccess"
   },
   {
     "description": "Allows the app to read and write organization-wide Microsoft To Do settings on behalf of the signed-in user.",
@@ -3842,6 +3821,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Policy.Read.All"
   },
+  {
+    "description": "Allows the app to read the authentication method policies, on behalf of the signed-in user. ",
+    "displayName": "Read authentication method policies",
+    "id": "a6ff13ac-1851-4993-8ca9-a671d70de2d5",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Policy.Read.AuthenticationMethod"
+  },
   {
     "description": "Allows the app to read your organization's B2BManagement policies on behalf of the signed-in user.",
     "displayName": "Read your organization's B2BManagement policies",
@@ -3850,18 +3836,11 @@
     "value": "Policy.Read.B2BManagementPolicy"
   },
   {
-    "description": "Allows the app to read and write your organization’s identity protection policy on behalf of the signed-in user.",
-    "displayName": "Read and write your organization’s identity protection policy ",
-    "id": "7256e131-3efb-4323-9854-cf41c6021770",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.ReadWrite.IdentityProtection"
-  },
-  {
-    "description": "Allows the app to read and write your organization's mobility management policies on behalf of the signed-in user.  For example, a mobility management policy can set the enrollment scope for a given mobility management application.",
-    "displayName": "Read and write your organization's mobility management policies",
-    "id": "a8ead177-1889-4546-9387-f25e658e2a79",
+    "description": "Allows the app to read your organization's cross tenant access policies on behalf of the signed-in user.",
+    "displayName": "Read your organization's cross tenant access policies",
+    "id": "b337372a-8b4d-428d-9cd8-3d7363865736",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.ReadWrite.MobilityManagement"
+    "value": "Policy.Read.CrossTenantAccess"
   },
   {
     "description": "Allows the app to manage policies related to consent and permission grants for applications, on behalf of the signed-in user.",
@@ -3871,18 +3850,18 @@
     "value": "Policy.ReadWrite.PermissionGrant"
   },
   {
-    "description": "Allows the application to read and update the metadata and document content of print jobs that the signed-in user created.",
-    "displayName": "Read and write user's print jobs",
-    "id": "b81dd597-8abb-4b3f-a07a-820b0316ed04",
+    "description": "Allows the application to read and update the organization's recovery policy on behalf of the signed-in user.",
+    "displayName": "Read and write your organization's recovery policy",
+    "id": "1e7a2f4c-e602-4b1b-9547-304dd65c4cc2",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrintJob.ReadWrite"
+    "value": "Policy.ReadWrite.Recovery"
   },
   {
-    "description": "Allows the application to read and update the metadata and document content of print jobs on behalf of the signed-in user. ",
-    "displayName": "Read and write print jobs",
-    "id": "036b9544-e8c5-46ef-900a-0646cc42b271",
+    "description": "Allows the app to read and write your organization's security defaults policy on behalf of the signed-in user.",
+    "displayName": "Read and write your organization's security defaults policy",
+    "id": "0b2a744c-2abf-4f1e-ad7e-17a087e2be99",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrintJob.ReadWrite.All"
+    "value": "Policy.ReadWrite.SecurityDefaults"
   },
   {
     "description": "Allows the application to read and update the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.",
@@ -3990,46 +3969,46 @@
     "value": "PrivilegedAssignmentSchedule.ReadWrite.AzureADGroup"
   },
   {
-    "description": "Allows the application to read the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.",
-    "displayName": "Read basic information of print jobs",
-    "id": "04ce8d60-72ce-4867-85cf-6d82f36922f3",
+    "description": "Allows the app to read, create, and delete time-based assignment schedules for permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
+    "displayName": "Read, create, and delete assignment schedules for app permission grants and app role assignments",
+    "id": "e07122a7-d275-4a27-a2f5-eb62349edae0",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrintJob.ReadBasic.All"
+    "value": "PrivilegedAssignmentSchedule.ReadWrite.EntraAppRole"
   },
   {
-    "description": "Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.",
-    "displayName": "Read basic information of user's print jobs",
-    "id": "6a71a747-280f-4670-9ca0-a9cbf882b274",
+    "description": "Allows the app to delete time-based assignment schedules for access to Azure AD groups, on behalf of the signed-in user.",
+    "displayName": "Delete assignment schedules for access to Azure AD groups",
+    "id": "ca5fe595-68ff-4dfd-907d-4509501a0e49",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrintJob.ReadBasic"
+    "value": "PrivilegedAssignmentSchedule.Remove.AzureADGroup"
   },
   {
-    "description": "Allows the application to read the metadata and document content of print jobs on behalf of the signed-in user. ",
-    "displayName": "Read print jobs",
-    "id": "afdd6933-a0d8-40f7-bd1a-b5d778e8624b",
+    "description": "Allows the application to read and update the metadata and document content of print jobs on behalf of the signed-in user. ",
+    "displayName": "Read and write print jobs",
+    "id": "036b9544-e8c5-46ef-900a-0646cc42b271",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrintJob.Read.All"
+    "value": "PrintJob.ReadWrite.All"
   },
   {
-    "description": "Allows the application to read the metadata and document content of print jobs that the signed-in user created.",
-    "displayName": "Read user's print jobs",
-    "id": "248f5528-65c0-4c88-8326-876c7236df5e",
+    "description": "Allows the application to read and update the metadata and document content of print jobs that the signed-in user created.",
+    "displayName": "Read and write user's print jobs",
+    "id": "b81dd597-8abb-4b3f-a07a-820b0316ed04",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrintJob.Read"
+    "value": "PrintJob.ReadWrite"
   },
   {
-    "description": "Allows the application to read and update the organization's recovery policy on behalf of the signed-in user.",
-    "displayName": "Read and write your organization's recovery policy",
-    "id": "1e7a2f4c-e602-4b1b-9547-304dd65c4cc2",
+    "description": "Allows the application to read the metadata of print jobs on behalf of the signed-in user. Does not allow access to print job document content.",
+    "displayName": "Read basic information of print jobs",
+    "id": "04ce8d60-72ce-4867-85cf-6d82f36922f3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.ReadWrite.Recovery"
+    "value": "PrintJob.ReadBasic.All"
   },
   {
-    "description": "Allows the app to read and write your organization's security defaults policy on behalf of the signed-in user.",
-    "displayName": "Read and write your organization's security defaults policy",
-    "id": "0b2a744c-2abf-4f1e-ad7e-17a087e2be99",
+    "description": "Allows the application to read the metadata of print jobs that the signed-in user created. Does not allow access to print job document content.",
+    "displayName": "Read basic information of user's print jobs",
+    "id": "6a71a747-280f-4670-9ca0-a9cbf882b274",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Policy.ReadWrite.SecurityDefaults"
+    "value": "PrintJob.ReadBasic"
   },
   {
     "description": "Allows the app to read and write your organization's trust framework policies on behalf of the signed-in user.",
@@ -4073,13 +4052,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Presence.ReadWrite"
   },
-  {
-    "description": "Allows the app to read organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user.",
-    "displayName": "Read organization-wide Microsoft 365 apps installation settings",
-    "id": "8cbdb9f6-9c2e-451a-814d-ec606e5d0212",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "OrgSettings-Microsoft365Install.Read.All"
-  },
   {
     "description": "Allows the application to read print connectors on behalf of the signed-in user.",
     "displayName": "Read print connectors",
@@ -4087,6 +4059,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "PrintConnector.Read.All"
   },
+  {
+    "description": "Allows the application to read and write print connectors on behalf of the signed-in user.",
+    "displayName": "Read and write print connectors",
+    "id": "79ef9967-7d59-4213-9c64-4b10687637d8",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "PrintConnector.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read organization-wide Microsoft To Do settings on behalf of the signed-in user.",
+    "displayName": "Read organization-wide Microsoft To Do settings",
+    "id": "7ff96f41-f022-45ba-acd8-ef3f03063d6b",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "OrgSettings-Todo.Read.All"
+  },
   {
     "description": "Allows the application to create (register) printers on behalf of the signed-in user. ",
     "displayName": "Register printers  ",
@@ -4094,13 +4080,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Printer.Create"
   },
-  {
-    "description": "Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. ",
-    "displayName": "Register, read, update, and unregister printers",
-    "id": "93dae4bd-43a1-4a23-9a1a-92957e1d9121",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Printer.FullControl.All"
-  },
   {
     "description": "Allows the application to read printers on behalf of the signed-in user. ",
     "displayName": "Read printers",
@@ -4144,46 +4123,46 @@
     "value": "PrintJob.Create"
   },
   {
-    "description": "Allows the application to read and write print connectors on behalf of the signed-in user.",
-    "displayName": "Read and write print connectors",
-    "id": "79ef9967-7d59-4213-9c64-4b10687637d8",
+    "description": "Allows the application to read the metadata and document content of print jobs that the signed-in user created.",
+    "displayName": "Read user's print jobs",
+    "id": "248f5528-65c0-4c88-8326-876c7236df5e",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "PrintConnector.ReadWrite.All"
+    "value": "PrintJob.Read"
   },
   {
-    "description": "Allows the app to read and write organization-wide Microsoft Forms settings on behalf of the signed-in user.",
-    "displayName": "Read and write organization-wide Microsoft Forms settings",
-    "id": "346c19ff-3fb2-4e81-87a0-bac9e33990c1",
+    "description": "Allows the application to read the metadata and document content of print jobs on behalf of the signed-in user. ",
+    "displayName": "Read print jobs",
+    "id": "afdd6933-a0d8-40f7-bd1a-b5d778e8624b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "OrgSettings-Forms.ReadWrite.All"
+    "value": "PrintJob.Read.All"
   },
   {
-    "description": "Allows the app to read organization-wide Microsoft Forms settings on behalf of the signed-in user.",
-    "displayName": "Read organization-wide Microsoft Forms settings",
-    "id": "210051a0-1ffc-435c-ae76-02d226d05752",
+    "description": "Allows the application to create (register), read, update, and delete (unregister) printers on behalf of the signed-in user. ",
+    "displayName": "Register, read, update, and unregister printers",
+    "id": "93dae4bd-43a1-4a23-9a1a-92957e1d9121",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "OrgSettings-Forms.Read.All"
+    "value": "Printer.FullControl.All"
   },
   {
-    "description": "Allows the app to read and write organization-wide Dynamics customer voice settings on behalf of the signed-in user.",
-    "displayName": "Read and write organization-wide Dynamics customer voice settings",
-    "id": "4cea26fb-6967-4234-82c4-c044414743f8",
+    "description": "Allows the app to read and write organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user.",
+    "displayName": "Read and write organization-wide Microsoft 365 apps installation settings",
+    "id": "1ff35e91-19eb-42d8-aa2d-cc9891127ae5",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "OrgSettings-DynamicsVoice.ReadWrite.All"
+    "value": "OrgSettings-Microsoft365Install.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read email in the signed-in user's mailbox except body, previewBody, attachments and any extended properties.",
-    "displayName": "Read user basic mail",
-    "id": "a4b8392a-d8d1-4954-a029-8e668a39a170",
+    "description": "Allows the app to read organization-wide Microsoft 365 apps installation settings on behalf of the signed-in user.",
+    "displayName": "Read organization-wide Microsoft 365 apps installation settings",
+    "id": "8cbdb9f6-9c2e-451a-814d-ec606e5d0212",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Mail.ReadBasic"
+    "value": "OrgSettings-Microsoft365Install.Read.All"
   },
   {
-    "description": "Allows the app to read mail the signed-in user can access, including their own and shared mail, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties.",
-    "displayName": "Read user and shared basic mail",
-    "id": "b11fa0e7-fdb7-4dc9-b1f1-59facd463480",
+    "description": "Allows the app to read and write organization-wide Microsoft Forms settings on behalf of the signed-in user.",
+    "displayName": "Read and write organization-wide Microsoft Forms settings",
+    "id": "346c19ff-3fb2-4e81-87a0-bac9e33990c1",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Mail.ReadBasic.Shared"
+    "value": "OrgSettings-Forms.ReadWrite.All"
   },
   {
     "description": "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail.",
@@ -4291,46 +4270,46 @@
     "value": "MailboxSettings.Read"
   },
   {
-    "description": "Allows the app to read mail a user can access, including their own and shared mail.",
-    "displayName": "Read user and shared mail",
-    "id": "7b9103a5-4610-446b-9670-80643382c1fa",
+    "description": "Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail.",
+    "displayName": "Read and write user mailbox settings",
+    "id": "818c620a-27a9-40bd-a6a5-d96f7d610b4b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Mail.Read.Shared"
+    "value": "MailboxSettings.ReadWrite"
   },
   {
-    "description": "Allows the app to read the signed-in user's mailbox.",
-    "displayName": "Read user mail ",
-    "id": "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
+    "description": "Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
+    "displayName": "Read mail tips for mailboxes you can access",
+    "id": "4776cae1-54bd-4dfd-823c-e5861ed49a98",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Mail.Read"
+    "value": "MailTips.ReadBasic.Shared"
   },
   {
-    "description": "Allows the app to read and modify lockbox configuration settings on behalf of the signed-in user",
-    "displayName": "Read and write lockbox settings",
-    "id": "bdc52289-9ed7-4339-83ab-772ae618713c",
+    "description": "Allows the app to read mail the signed-in user can access, including their own and shared mail, except for body, bodyPreview, uniqueBody, attachments, extensions, and any extended properties.",
+    "displayName": "Read user and shared basic mail",
+    "id": "b11fa0e7-fdb7-4dc9-b1f1-59facd463480",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LockboxSettings.ReadWrite.All"
+    "value": "Mail.ReadBasic.Shared"
   },
   {
-    "description": "Allows the app to read lockbox configuration settings on behalf of the signed-in user",
-    "displayName": "Read lockbox settings",
-    "id": "2ea429a7-d1fa-4f96-b451-e91ecc5e5fe2",
+    "description": "Allows the app to read email in the signed-in user's mailbox except body, previewBody, attachments and any extended properties.",
+    "displayName": "Read user basic mail",
+    "id": "a4b8392a-d8d1-4954-a029-8e668a39a170",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LockboxSettings.Read.All"
+    "value": "Mail.ReadBasic"
   },
   {
-    "description": "Allows an app to manage license assignments for users and groups, on behalf of the signed-in user.",
-    "displayName": "Manage all license assignments",
-    "id": "f55016cc-149c-447e-8f21-7cf3ec1d6350",
+    "description": "Allows the app to read mail a user can access, including their own and shared mail.",
+    "displayName": "Read user and shared mail",
+    "id": "7b9103a5-4610-446b-9670-80643382c1fa",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LicenseAssignment.ReadWrite.All"
+    "value": "Mail.Read.Shared"
   },
   {
-    "description": "Allows the app to read identity lifecycle policies for agent identities that the signed-in user has access to in the organization.",
-    "displayName": "Read identity lifecycle policies for agent identities",
-    "id": "65857db0-62ac-4279-aa73-c2b5dab186f5",
+    "description": "Allows the app to read the signed-in user's mailbox.",
+    "displayName": "Read user mail ",
+    "id": "570282fd-fa5c-430d-a7fd-fc8dc98a9dca",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LifecyclePolicies-AgentId.Read.All"
+    "value": "Mail.Read"
   },
   {
     "description": "Allows the app to read, create, update and delete identity lifecycle policies for agent identities that the signed-in user has access to in the organization.",
@@ -4374,13 +4353,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "LifecycleWorkflows-CustomExt.Read.All"
   },
-  {
-    "description": "Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail.",
-    "displayName": "Read and write user mailbox settings",
-    "id": "818c620a-27a9-40bd-a6a5-d96f7d610b4b",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "MailboxSettings.ReadWrite"
-  },
   {
     "description": "Allows the app to create, update, list, read and delete all Lifecycle workflows custom task extensions on behalf of a signed-in user.",
     "displayName": "Read and write all Lifecycle workflows custom task extensions",
@@ -4389,18 +4361,25 @@
     "value": "LifecycleWorkflows-CustomExt.ReadWrite.All"
   },
   {
-    "description": "Allows the app to run workflows on-demand on behalf of a signed-in user.",
-    "displayName": "Run workflows on-demand in Lifecycle workflows",
-    "id": "df1c25b3-072c-45cd-8403-c63441e4cca1",
+    "description": "Allows the app to read all Lifecycle workflows reports on behalf of a signed-in user.",
+    "displayName": "Read all Lifecycle workflows reports",
+    "id": "4d3d7f81-163f-426a-8432-5638d2e82083",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LifecycleWorkflows-Workflow.Activate"
+    "value": "LifecycleWorkflows-Reports.Read.All"
   },
   {
-    "description": "Allows the app to list and read all workflows and tasks on behalf of a signed-in user.",
-    "displayName": "Read all workflows in Lifecycle workflows",
-    "id": "7fabe5bd-2e47-4e61-b924-327117024e18",
+    "description": "Allows the app to read all managed tenant information on behalf of the signed-in user.",
+    "displayName": "Read all managed tenant information",
+    "id": "dc34164e-6c4a-41a0-be89-3ae2fbad7cd3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LifecycleWorkflows-Workflow.Read.All"
+    "value": "ManagedTenants.Read.All"
+  },
+  {
+    "description": "Allows the app to run workflows on-demand on behalf of a signed-in user.",
+    "displayName": "Run workflows on-demand in Lifecycle workflows",
+    "id": "df1c25b3-072c-45cd-8403-c63441e4cca1",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "LifecycleWorkflows-Workflow.Activate"
   },
   {
     "description": "Allows the app to list all workflows on behalf of a signed-in user.",
@@ -4445,25 +4424,32 @@
     "value": "LockboxRequest.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read all Lifecycle workflows reports on behalf of a signed-in user.",
-    "displayName": "Read all Lifecycle workflows reports",
-    "id": "4d3d7f81-163f-426a-8432-5638d2e82083",
+    "description": "Allows the app to read lockbox configuration settings on behalf of the signed-in user",
+    "displayName": "Read lockbox settings",
+    "id": "2ea429a7-d1fa-4f96-b451-e91ecc5e5fe2",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LifecycleWorkflows-Reports.Read.All"
+    "value": "LockboxSettings.Read.All"
   },
   {
-    "description": "Allows the app to read data for the learner's self-initiated courses in the organization's directory, on behalf of the signed-in user.",
-    "displayName": "Read user's self-initiated courses",
-    "id": "f6403ef7-4a96-47be-a190-69ba274c3f11",
+    "description": "Allows the app to read and modify lockbox configuration settings on behalf of the signed-in user",
+    "displayName": "Read and write lockbox settings",
+    "id": "bdc52289-9ed7-4339-83ab-772ae618713c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "LearningSelfInitiatedCourse.Read"
+    "value": "LockboxSettings.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read mail tips on behalf of the signed-in user for mailboxes they have access to. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
-    "displayName": "Read mail tips for mailboxes you can access",
-    "id": "4776cae1-54bd-4dfd-823c-e5861ed49a98",
+    "description": "Allows the app to list and read all workflows and tasks on behalf of a signed-in user.",
+    "displayName": "Read all workflows in Lifecycle workflows",
+    "id": "7fabe5bd-2e47-4e61-b924-327117024e18",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "MailTips.ReadBasic.Shared"
+    "value": "LifecycleWorkflows-Workflow.Read.All"
+  },
+  {
+    "description": "Allows an app to manage license assignments for users and groups, on behalf of the signed-in user.",
+    "displayName": "Manage all license assignments",
+    "id": "f55016cc-149c-447e-8f21-7cf3ec1d6350",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "LicenseAssignment.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and write all managed tenant information on behalf of the signed-in user.",
@@ -4473,18 +4459,11 @@
     "value": "ManagedTenants.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read online meeting artifacts on behalf of the signed-in user.",
-    "displayName": "Read user's online meeting artifacts",
-    "id": "110e5abb-a10c-4b59-8b55-9b4daa4ef743",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "OnlineMeetingArtifact.Read.All"
-  },
-  {
-    "description": "Allows the app to read all recordings of online meetings, on behalf of the signed-in user.",
-    "displayName": "Read all recordings of online meetings.",
-    "id": "190c2bb6-1fdd-4fec-9aa2-7d571b5e1fe3",
+    "description": "Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user.",
+    "displayName": "Read multi-tenant organization details and tenants",
+    "id": "526aa72a-5878-49fe-bf4e-357973af9b06",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "OnlineMeetingRecording.Read.All"
+    "value": "MultiTenantOrganization.Read.All"
   },
   {
     "description": "Allows the app to read online meeting details on behalf of the signed-in user.",
@@ -4592,46 +4571,46 @@
     "value": "OrgSettings-DynamicsVoice.Read.All"
   },
   {
-    "description": "Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user.",
-    "displayName": "Read all AI Insights for online meetings.",
-    "id": "166741d6-eeb8-46fe-91f4-817d2af7bc88",
+    "description": "Allows the app to read and write organization-wide Dynamics customer voice settings on behalf of the signed-in user.",
+    "displayName": "Read and write organization-wide Dynamics customer voice settings",
+    "id": "4cea26fb-6967-4234-82c4-c044414743f8",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "OnlineMeetingAiInsight.Read.All"
+    "value": "OrgSettings-DynamicsVoice.ReadWrite.All"
   },
   {
-    "description": "Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.",
-    "displayName": "Maintain access to data you have given it access to",
-    "id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182",
+    "description": "Allows the app to read organization-wide Microsoft Forms settings on behalf of the signed-in user.",
+    "displayName": "Read organization-wide Microsoft Forms settings",
+    "id": "210051a0-1ffc-435c-ae76-02d226d05752",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "offline_access"
+    "value": "OrgSettings-Forms.Read.All"
   },
   {
-    "description": "Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user's notification items for this app.",
-    "displayName": "Deliver and manage user notifications for this app",
-    "id": "89497502-6e42-46a2-8cb2-427fd3df970a",
+    "description": "Allows the app to read all recordings of online meetings, on behalf of the signed-in user.",
+    "displayName": "Read all recordings of online meetings.",
+    "id": "190c2bb6-1fdd-4fec-9aa2-7d571b5e1fe3",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Notifications.ReadWrite.CreatedByApp"
+    "value": "OnlineMeetingRecording.Read.All"
   },
   {
-    "description": "This is deprecated!  Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app.",
-    "displayName": "Limited notebook access (deprecated)",
-    "id": "ed68249d-017c-4df5-9113-e684c7f8760b",
+    "description": "Allows the app to read online meeting artifacts on behalf of the signed-in user.",
+    "displayName": "Read user's online meeting artifacts",
+    "id": "110e5abb-a10c-4b59-8b55-9b4daa4ef743",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Notes.ReadWrite.CreatedByApp"
+    "value": "OnlineMeetingArtifact.Read.All"
   },
   {
-    "description": "Allows the app to read the memberships of hidden groups and administrative units on behalf of the signed-in user, for those hidden groups and administrative units that the signed-in user has access to.",
-    "displayName": "Read hidden memberships",
-    "id": "f6a3db3e-f7e8-4ed2-a414-557c8c9830be",
+    "description": "Allows the app to read all AI Insights for online meetings, on behalf of the signed-in user.",
+    "displayName": "Read all AI Insights for online meetings.",
+    "id": "166741d6-eeb8-46fe-91f4-817d2af7bc88",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Member.Read.Hidden"
+    "value": "OnlineMeetingAiInsight.Read.All"
   },
   {
-    "description": "Allows the app to read multi-tenant organization details and tenants on behalf of the signed-in user.",
-    "displayName": "Read multi-tenant organization details and tenants",
-    "id": "526aa72a-5878-49fe-bf4e-357973af9b06",
+    "description": "Allows the app to see and update the data you gave it access to, even when users are not currently using the app. This does not give the app any additional permissions.",
+    "displayName": "Maintain access to data you have given it access to",
+    "id": "7427e0e9-2fba-42fe-b0c0-848c9e6a8182",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "MultiTenantOrganization.Read.All"
+    "value": "offline_access"
   },
   {
     "description": "Allows the app to read multi-tenant organization basic details and active tenants on behalf of the signed-in user.",
@@ -4675,13 +4654,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "NetworkAccess.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read all managed tenant information on behalf of the signed-in user.",
-    "displayName": "Read all managed tenant information",
-    "id": "dc34164e-6c4a-41a0-be89-3ae2fbad7cd3",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "ManagedTenants.Read.All"
-  },
   {
     "description": "Allows the app to read your organization's branches for network access on behalf of the signed-in user.",
     "displayName": "Read properties of branches for network access",
@@ -4689,6 +4661,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "NetworkAccessBranch.Read.All"
   },
+  {
+    "description": "Allows the app to read and write your organization's branches for network access on behalf of the signed-in user.",
+    "displayName": "Read and write properties of branches for network access",
+    "id": "b8a36cc2-b810-461a-baa4-a7281e50bd5c",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "NetworkAccessBranch.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read the memberships of hidden groups and administrative units on behalf of the signed-in user, for those hidden groups and administrative units that the signed-in user has access to.",
+    "displayName": "Read hidden memberships",
+    "id": "f6a3db3e-f7e8-4ed2-a414-557c8c9830be",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Member.Read.Hidden"
+  },
   {
     "description": "Allows the app to read your organization's security and routing network access policies on behalf of the signed-in user.",
     "displayName": "Read security and routing policies for network access",
@@ -4696,13 +4682,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "NetworkAccessPolicy.Read.All"
   },
-  {
-    "description": "Allows the app to read and write your organization's security and routing network access policies on behalf of the signed-in user.",
-    "displayName": "Read and write security and routing policies for network access",
-    "id": "b1fbad0f-ef6e-42ed-8676-bca7fa3e7291",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "NetworkAccessPolicy.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read all network access reports on behalf of the signed-in user.",
     "displayName": "Read all network access reports",
@@ -4746,25 +4725,46 @@
     "value": "Notes.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write your organization's branches for network access on behalf of the signed-in user.",
-    "displayName": "Read and write properties of branches for network access",
-    "id": "b8a36cc2-b810-461a-baa4-a7281e50bd5c",
+    "description": "This is deprecated!  Do not use! This permission no longer has any effect. You can safely consent to it. No additional privileges will be granted to the app.",
+    "displayName": "Limited notebook access (deprecated)",
+    "id": "ed68249d-017c-4df5-9113-e684c7f8760b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "NetworkAccessBranch.ReadWrite.All"
+    "value": "Notes.ReadWrite.CreatedByApp"
   },
   {
-    "description": "Sign in to synthetics service",
-    "displayName": "syntest.signin",
-    "id": "9f56f4b8-4de2-4e83-a632-45d1e4b47400",
-    "origin": "Delegated (Microsoft Mixed Reality)",
-    "value": "syntest.signin"
+    "description": "Allows the app to deliver its notifications on behalf of signed-in users. Also allows the app to read, update, and delete the user's notification items for this app.",
+    "displayName": "Deliver and manage user notifications for this app",
+    "id": "89497502-6e42-46a2-8cb2-427fd3df970a",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Notifications.ReadWrite.CreatedByApp"
   },
   {
-    "description": " ",
-    "displayName": "OrgApp.Reshare (retired)",
-    "id": "02d9fa8b-e936-407b-a8f2-9b8fa5bda3bc",
-    "origin": "Delegated (Power BI Service)",
-    "value": "OrgApp.Reshare.All"
+    "description": "Allows the app to read and write your organization's security and routing network access policies on behalf of the signed-in user.",
+    "displayName": "Read and write security and routing policies for network access",
+    "id": "b1fbad0f-ef6e-42ed-8676-bca7fa3e7291",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "NetworkAccessPolicy.ReadWrite.All"
+  },
+  {
+    "description": "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.",
+    "displayName": "Read all shared cross-tenant user profiles and export or delete their data",
+    "id": "64dfa325-cbf8-48e3-938d-51224a0cac01",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "CrossTenantUserProfileSharing.ReadWrite.All"
+  },
+  {
+    "description": "Allows the Application to read and write the user's data pertaining to itself in the Intune Mobile Application Management service",
+    "displayName": "Read and Write the User's App Management data",
+    "id": "3c7192af-9629-4473-9276-d35e4e4b36c5",
+    "origin": "Delegated (Microsoft Mobile Application Management)",
+    "value": "DeviceManagementManagedApps.ReadWrite"
+  },
+  {
+    "description": "Allows the app to refresh and recreate on-premises configuration for Microsoft self-service password reset.",
+    "displayName": "Read, write and manage self-service password reset writeback configuration",
+    "id": "fc7e8088-95b5-453e-8bef-b17ecfec5ba3",
+    "origin": "Application (Microsoft password reset service)",
+    "value": "PasswordWriteback.RefreshClient.All"
   },
   {
     "description": " ",
@@ -4878,13 +4878,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "Report.Reshare.All"
   },
-  {
-    "description": "Allows modifying org apps on the user’s behalf.",
-    "displayName": "Read and write org apps",
-    "id": "38536678-0d9f-4f82-88e5-a13a78d1d209",
-    "origin": "Delegated (Power BI Service)",
-    "value": "OrgApp.ReadWrite.All"
-  },
   {
     "description": " ",
     "displayName": "RetailDataManager.Execute (retired)",
@@ -4893,25 +4886,32 @@
     "value": "RetailDataManager.Execute.All"
   },
   {
-    "description": "Allows reading org apps on the user’s behalf.",
-    "displayName": "Read org apps",
-    "id": "d27d5544-b17d-471f-9a02-ef09d6720508",
+    "description": " ",
+    "displayName": "OrgApp.Reshare (retired)",
+    "id": "02d9fa8b-e936-407b-a8f2-9b8fa5bda3bc",
     "origin": "Delegated (Power BI Service)",
-    "value": "OrgApp.Read.All"
+    "value": "OrgApp.Reshare.All"
   },
   {
-    "description": "Allows the app to make API calls that read OneLake metadata on your behalf.",
-    "displayName": "Make API calls that read OneLake metadata",
-    "id": "547211ef-7223-404f-8519-fee52fda6402",
+    "description": "Allows reading retail data manager items on the user’s behalf.",
+    "displayName": "Read retail data manager items",
+    "id": "1ddcbaa9-c4cf-4684-9048-e04a12739a8c",
     "origin": "Delegated (Power BI Service)",
-    "value": "OneLake.Read.All"
+    "value": "RetailDataManager.Read.All"
   },
   {
-    "description": " ",
-    "displayName": "MirroredDatabase.Reshare (retired)",
-    "id": "c18991d0-0a42-4567-983a-1993bc79f327",
+    "description": "Allows modifying org apps on the user’s behalf.",
+    "displayName": "Read and write org apps",
+    "id": "38536678-0d9f-4f82-88e5-a13a78d1d209",
     "origin": "Delegated (Power BI Service)",
-    "value": "MirroredDatabase.Reshare.All"
+    "value": "OrgApp.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to make API calls that read and write OneLake metadata, on your behalf.",
+    "displayName": "Make API calls that read and write OneLake metadata",
+    "id": "ada1b44b-4474-40ed-b32c-e3543dccec0e",
+    "origin": "Delegated (Power BI Service)",
+    "value": "OneLake.ReadWrite.All"
   },
   {
     "description": "Allows executing ML experiments on the user’s behalf.",
@@ -5026,18 +5026,18 @@
     "value": "Notebook.Reshare.All"
   },
   {
-    "description": "Allows the app to make API calls that read and write OneLake metadata, on your behalf.",
-    "displayName": "Make API calls that read and write OneLake metadata",
-    "id": "ada1b44b-4474-40ed-b32c-e3543dccec0e",
+    "description": "Allows the app to make API calls that read OneLake metadata on your behalf.",
+    "displayName": "Make API calls that read OneLake metadata",
+    "id": "547211ef-7223-404f-8519-fee52fda6402",
     "origin": "Delegated (Power BI Service)",
-    "value": "OneLake.ReadWrite.All"
+    "value": "OneLake.Read.All"
   },
   {
-    "description": "Allows reading retail data manager items on the user’s behalf.",
-    "displayName": "Read retail data manager items",
-    "id": "1ddcbaa9-c4cf-4684-9048-e04a12739a8c",
+    "description": "Allows reading org apps on the user’s behalf.",
+    "displayName": "Read org apps",
+    "id": "d27d5544-b17d-471f-9a02-ef09d6720508",
     "origin": "Delegated (Power BI Service)",
-    "value": "RetailDataManager.Read.All"
+    "value": "OrgApp.Read.All"
   },
   {
     "description": "Allows modifying retail data manager items on the user’s behalf.",
@@ -5054,11 +5054,11 @@
     "value": "RetailDataManager.Reshare.All"
   },
   {
-    "description": "The app can view all storage accounts registered with Power BI that the signed in user is an admin of.",
-    "displayName": "View all storage accounts",
-    "id": "e677843f-76d8-44d3-bcdb-ec40dea919e7",
+    "description": " ",
+    "displayName": "Scorecard.Execute (retired)",
+    "id": "dc75a12a-fef2-436d-8311-fed5b7e3a9d0",
     "origin": "Delegated (Power BI Service)",
-    "value": "StorageAccount.Read.All"
+    "value": "Scorecard.Execute.All"
   },
   {
     "description": "The app can view and edit all storage accounts registered with Power BI that the signed in user is an admin of.",
@@ -5173,9 +5173,23 @@
     "value": "Warehouse.Reshare.All"
   },
   {
-    "description": " ",
-    "displayName": "SQLEndpoint.Reshare (retired)",
-    "id": "15a808d7-2065-4357-8b76-47f701df3575",
+    "description": "Allows the app to make API calls that require restore permissions on all Warehouses, on behalf of the signed-in user.",
+    "displayName": "Make API calls that require restore permissions on all Warehouses",
+    "id": "7da32ee4-ec68-43a4-b13a-b5385ad9770e",
+    "origin": "Delegated (Power BI Service)",
+    "value": "Warehouse.Restore.All"
+  },
+  {
+    "description": "The app can view all storage accounts registered with Power BI that the signed in user is an admin of.",
+    "displayName": "View all storage accounts",
+    "id": "e677843f-76d8-44d3-bcdb-ec40dea919e7",
+    "origin": "Delegated (Power BI Service)",
+    "value": "StorageAccount.Read.All"
+  },
+  {
+    "description": " ",
+    "displayName": "SQLEndpoint.Reshare (retired)",
+    "id": "15a808d7-2065-4357-8b76-47f701df3575",
     "origin": "Delegated (Power BI Service)",
     "value": "SQLEndpoint.Reshare.All"
   },
@@ -5193,20 +5207,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "SQLEndpoint.Read.All"
   },
-  {
-    "description": " ",
-    "displayName": "SQLEndpoint.Execute (retired)",
-    "id": "aa70d616-e57e-4a5a-84cd-07de4250dd2e",
-    "origin": "Delegated (Power BI Service)",
-    "value": "SQLEndpoint.Execute.All"
-  },
-  {
-    "description": " ",
-    "displayName": "Scorecard.Execute (retired)",
-    "id": "dc75a12a-fef2-436d-8311-fed5b7e3a9d0",
-    "origin": "Delegated (Power BI Service)",
-    "value": "Scorecard.Execute.All"
-  },
   {
     "description": "Allows the app to make API calls that require read permissions on all scorecards, on behalf of the signed-in user.",
     "displayName": "Make API calls that require read permissions on all scorecards",
@@ -5256,13 +5256,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "SemanticModel.ReadWrite.All"
   },
-  {
-    "description": "Allows modifying mirrored databases on the user’s behalf.",
-    "displayName": "Read and write mirrored databases",
-    "id": "2eb0ab4e-195e-45ec-9eb3-3b9842bea4f4",
-    "origin": "Delegated (Power BI Service)",
-    "value": "MirroredDatabase.ReadWrite.All"
-  },
   {
     "description": " ",
     "displayName": "SemanticModel.Reshare (retired)",
@@ -5271,11 +5264,18 @@
     "value": "SemanticModel.Reshare.All"
   },
   {
-    "description": "Allows reading spark job definitions on the user’s behalf.",
-    "displayName": "Read spark job definitions",
-    "id": "beaf3087-05af-4060-a0a5-29779c902004",
+    "description": " ",
+    "displayName": "MirroredDatabase.Reshare (retired)",
+    "id": "c18991d0-0a42-4567-983a-1993bc79f327",
     "origin": "Delegated (Power BI Service)",
-    "value": "SparkJobDefinition.Read.All"
+    "value": "MirroredDatabase.Reshare.All"
+  },
+  {
+    "description": "Allows executing spark job definitions on the user’s behalf.",
+    "displayName": "Execute spark job definitions",
+    "id": "3492d2fc-251d-4a2b-8be4-97f06fd6d0d4",
+    "origin": "Delegated (Power BI Service)",
+    "value": "SparkJobDefinition.Execute.All"
   },
   {
     "description": "Allows modifying spark job definitions on the user’s behalf.",
@@ -5327,11 +5327,25 @@
     "value": "SQLDatabase.Reshare.All"
   },
   {
-    "description": "Allows executing spark job definitions on the user’s behalf.",
-    "displayName": "Execute spark job definitions",
-    "id": "3492d2fc-251d-4a2b-8be4-97f06fd6d0d4",
+    "description": " ",
+    "displayName": "SQLEndpoint.Execute (retired)",
+    "id": "aa70d616-e57e-4a5a-84cd-07de4250dd2e",
     "origin": "Delegated (Power BI Service)",
-    "value": "SparkJobDefinition.Execute.All"
+    "value": "SQLEndpoint.Execute.All"
+  },
+  {
+    "description": "Allows reading spark job definitions on the user’s behalf.",
+    "displayName": "Read spark job definitions",
+    "id": "beaf3087-05af-4060-a0a5-29779c902004",
+    "origin": "Delegated (Power BI Service)",
+    "value": "SparkJobDefinition.Read.All"
+  },
+  {
+    "description": "Allows modifying mirrored databases on the user’s behalf.",
+    "displayName": "Read and write mirrored databases",
+    "id": "2eb0ab4e-195e-45ec-9eb3-3b9842bea4f4",
+    "origin": "Delegated (Power BI Service)",
+    "value": "MirroredDatabase.ReadWrite.All"
   },
   {
     "description": "Allows reading mirrored databases on the user’s behalf.",
@@ -5347,20 +5361,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "MirroredDatabase.ExternalDataShare.All"
   },
-  {
-    "description": " ",
-    "displayName": "MirroredDatabase.Execute (retired)",
-    "id": "67d4aa3f-531f-4db2-a382-7db42788fd35",
-    "origin": "Delegated (Power BI Service)",
-    "value": "MirroredDatabase.Execute.All"
-  },
-  {
-    "description": "Allows reading eventhouses on the user’s behalf.",
-    "displayName": "Read eventhouses",
-    "id": "cd1718e4-3e09-4381-a6e1-183e245f8613",
-    "origin": "Delegated (Power BI Service)",
-    "value": "Eventhouse.Read.All"
-  },
   {
     "description": "Allows modifying eventhouses on the user’s behalf.",
     "displayName": "Read and write eventhouses",
@@ -5473,6 +5473,20 @@
     "origin": "Delegated (Power BI Service)",
     "value": "GraphInstance.Reshare.All"
   },
+  {
+    "description": "Allows the app to make API calls that executes requests on all API for GraphQL items, on behalf of the signed-in user.",
+    "displayName": "Make API calls that executes requests on all API for GraphQL items",
+    "id": "fc011432-d782-46d3-8143-f0328911e0a3",
+    "origin": "Delegated (Power BI Service)",
+    "value": "GraphQL.Execute.All"
+  },
+  {
+    "description": "Allows reading eventhouses on the user’s behalf.",
+    "displayName": "Read eventhouses",
+    "id": "cd1718e4-3e09-4381-a6e1-183e245f8613",
+    "origin": "Delegated (Power BI Service)",
+    "value": "Eventhouse.Read.All"
+  },
   {
     "description": " ",
     "displayName": "Eventhouse.Execute (retired)",
@@ -5494,20 +5508,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "Environment.ReadWrite.All"
   },
-  {
-    "description": "Allows reading environment items on the user’s behalf.",
-    "displayName": "Read environment items",
-    "id": "80a4f621-10a7-45e5-a961-79e9b81831d0",
-    "origin": "Delegated (Power BI Service)",
-    "value": "Environment.Read.All"
-  },
-  {
-    "description": " ",
-    "displayName": "DataAgent.Reshare (retired)",
-    "id": "82b1d51c-42df-4ba9-9aee-bbba1e3f2ab7",
-    "origin": "Delegated (Power BI Service)",
-    "value": "DataAgent.Reshare.All"
-  },
   {
     "description": "Allows reading Databricks workspaces catalog metadata on the user’s behalf.",
     "displayName": "Read Databricks workspaces catalog metadata.",
@@ -5557,13 +5557,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "Datamart.Read.All"
   },
-  {
-    "description": "Allows the app to make API calls that executes requests on all API for GraphQL items, on behalf of the signed-in user.",
-    "displayName": "Make API calls that executes requests on all API for GraphQL items",
-    "id": "fc011432-d782-46d3-8143-f0328911e0a3",
-    "origin": "Delegated (Power BI Service)",
-    "value": "GraphQL.Execute.All"
-  },
   {
     "description": "Allows modifying datamarts on the user’s behalf.",
     "displayName": "Read and write datamarts",
@@ -5572,11 +5565,18 @@
     "value": "Datamart.ReadWrite.All"
   },
   {
-    "description": "Allows the app to make API calls that require execute permissions on all data pipelines, on behalf of the signed-in user.",
-    "displayName": "Make API calls that require execute permissions all data pipelines",
-    "id": "7e010a28-f5fa-4e63-b03d-2dc25cba9d2e",
+    "description": "Allows executing GraphQLApis on the user’s behalf.",
+    "displayName": "Execute GraphQLApis",
+    "id": "cece14a0-0fa7-4de3-b458-69bd0cfea634",
     "origin": "Delegated (Power BI Service)",
-    "value": "DataPipeline.Execute.All"
+    "value": "GraphQLApi.Execute.All"
+  },
+  {
+    "description": " ",
+    "displayName": "Datamart.Reshare (retired)",
+    "id": "44abf802-73c1-42f4-a26f-915b4c27fa8f",
+    "origin": "Delegated (Power BI Service)",
+    "value": "Datamart.Reshare.All"
   },
   {
     "description": "Allows the app to make API calls that require read permissions on all data pipelines, on behalf of the signed-in user.",
@@ -5628,39 +5628,39 @@
     "value": "Environment.Execute.All"
   },
   {
-    "description": " ",
-    "displayName": "Datamart.Reshare (retired)",
-    "id": "44abf802-73c1-42f4-a26f-915b4c27fa8f",
+    "description": "Allows reading environment items on the user’s behalf.",
+    "displayName": "Read environment items",
+    "id": "80a4f621-10a7-45e5-a961-79e9b81831d0",
     "origin": "Delegated (Power BI Service)",
-    "value": "Datamart.Reshare.All"
+    "value": "Environment.Read.All"
   },
   {
-    "description": "Allows the app to make API calls that require restore permissions on all Warehouses, on behalf of the signed-in user.",
-    "displayName": "Make API calls that require restore permissions on all Warehouses",
-    "id": "7da32ee4-ec68-43a4-b13a-b5385ad9770e",
+    "description": "Allows the app to make API calls that require execute permissions on all data pipelines, on behalf of the signed-in user.",
+    "displayName": "Make API calls that require execute permissions all data pipelines",
+    "id": "7e010a28-f5fa-4e63-b03d-2dc25cba9d2e",
     "origin": "Delegated (Power BI Service)",
-    "value": "Warehouse.Restore.All"
+    "value": "DataPipeline.Execute.All"
   },
   {
-    "description": "Allows executing GraphQLApis on the user’s behalf.",
-    "displayName": "Execute GraphQLApis",
-    "id": "cece14a0-0fa7-4de3-b458-69bd0cfea634",
+    "description": " ",
+    "displayName": "WarehouseSnapshot.Execute (retired)",
+    "id": "f132046a-f99f-4e2f-af2c-bcc6690050a5",
     "origin": "Delegated (Power BI Service)",
-    "value": "GraphQLApi.Execute.All"
+    "value": "WarehouseSnapshot.Execute.All"
   },
   {
-    "description": "Allows modifying GraphQLApis on the user’s behalf.",
-    "displayName": "Read and write GraphQLApis",
-    "id": "73d01b13-cb5e-466e-8752-a50feccb317e",
+    "description": "Allows reading GraphQLApis on the user’s behalf.",
+    "displayName": "Read GraphQLApis",
+    "id": "deae611f-920b-422f-805e-f635080c4cfb",
     "origin": "Delegated (Power BI Service)",
-    "value": "GraphQLApi.ReadWrite.All"
+    "value": "GraphQLApi.Read.All"
   },
   {
     "description": " ",
-    "displayName": "KQLQueryset.Execute (retired)",
-    "id": "b84b0d8d-9870-4b2b-92d2-9bfa7f940db3",
+    "displayName": "GraphQLApi.Reshare (retired)",
+    "id": "88cf9f59-aa53-4386-ae14-3c8263713766",
     "origin": "Delegated (Power BI Service)",
-    "value": "KQLQueryset.Execute.All"
+    "value": "GraphQLApi.Reshare.All"
   },
   {
     "description": "Allows reading KQL querysets on the user’s behalf.",
@@ -5774,6 +5774,20 @@
     "origin": "Delegated (Power BI Service)",
     "value": "MirroredAzureDatabricksCatalog.Reshare.All"
   },
+  {
+    "description": " ",
+    "displayName": "MirroredDatabase.Execute (retired)",
+    "id": "67d4aa3f-531f-4db2-a382-7db42788fd35",
+    "origin": "Delegated (Power BI Service)",
+    "value": "MirroredDatabase.Execute.All"
+  },
+  {
+    "description": " ",
+    "displayName": "KQLQueryset.Execute (retired)",
+    "id": "b84b0d8d-9870-4b2b-92d2-9bfa7f940db3",
+    "origin": "Delegated (Power BI Service)",
+    "value": "KQLQueryset.Execute.All"
+  },
   {
     "description": " ",
     "displayName": "KQLDataConnection.Reshare (retired)",
@@ -5795,20 +5809,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "KQLDataConnection.Read.All"
   },
-  {
-    "description": " ",
-    "displayName": "KQLDataConnection.Execute (retired)",
-    "id": "6872ffe8-d8d4-46f9-9a32-5537dad08dd2",
-    "origin": "Delegated (Power BI Service)",
-    "value": "KQLDataConnection.Execute.All"
-  },
-  {
-    "description": " ",
-    "displayName": "GraphQLApi.Reshare (retired)",
-    "id": "88cf9f59-aa53-4386-ae14-3c8263713766",
-    "origin": "Delegated (Power BI Service)",
-    "value": "GraphQLApi.Reshare.All"
-  },
   {
     "description": "Allows the app to make API calls that require audit permissions on all items, on behalf of the signed-in user.",
     "displayName": "Make API calls that require audit permissions on all items",
@@ -5858,13 +5858,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "ItemMetadata.Read.All"
   },
-  {
-    "description": "Allows reading GraphQLApis on the user’s behalf.",
-    "displayName": "Read GraphQLApis",
-    "id": "deae611f-920b-422f-805e-f635080c4cfb",
-    "origin": "Delegated (Power BI Service)",
-    "value": "GraphQLApi.Read.All"
-  },
   {
     "description": "Allows the app to make API calls that can read and write the item metadata of all Fabric items, on behalf of the signed-in user.",
     "displayName": "Make API calls that can read and write item metadata for all Fabric items",
@@ -5873,11 +5866,18 @@
     "value": "ItemMetadata.ReadWrite.All"
   },
   {
-    "description": "Allows reading KQL dashboards on the user’s behalf.",
-    "displayName": "Read KQL dashboards",
-    "id": "f19ea7d7-2f31-4c6d-9845-d5480c5d1798",
+    "description": "Allows modifying GraphQLApis on the user’s behalf.",
+    "displayName": "Read and write GraphQLApis",
+    "id": "73d01b13-cb5e-466e-8752-a50feccb317e",
     "origin": "Delegated (Power BI Service)",
-    "value": "KQLDashboard.Read.All"
+    "value": "GraphQLApi.ReadWrite.All"
+  },
+  {
+    "description": " ",
+    "displayName": "KQLDashboard.Execute (retired)",
+    "id": "6132db85-22d5-486c-b094-56eb8f746628",
+    "origin": "Delegated (Power BI Service)",
+    "value": "KQLDashboard.Execute.All"
   },
   {
     "description": "Allows modifying KQL dashboards on the user’s behalf.",
@@ -5930,38 +5930,38 @@
   },
   {
     "description": " ",
-    "displayName": "KQLDashboard.Execute (retired)",
-    "id": "6132db85-22d5-486c-b094-56eb8f746628",
+    "displayName": "KQLDataConnection.Execute (retired)",
+    "id": "6872ffe8-d8d4-46f9-9a32-5537dad08dd2",
     "origin": "Delegated (Power BI Service)",
-    "value": "KQLDashboard.Execute.All"
+    "value": "KQLDataConnection.Execute.All"
   },
   {
-    "description": "Allows modifying data agents on the user’s behalf.",
-    "displayName": "Read and write data agents",
-    "id": "c23fda5c-561f-4890-ad72-5f57bb7496fd",
+    "description": "Allows reading KQL dashboards on the user’s behalf.",
+    "displayName": "Read KQL dashboards",
+    "id": "f19ea7d7-2f31-4c6d-9845-d5480c5d1798",
     "origin": "Delegated (Power BI Service)",
-    "value": "DataAgent.ReadWrite.All"
+    "value": "KQLDashboard.Read.All"
   },
   {
     "description": " ",
-    "displayName": "WarehouseSnapshot.Execute (retired)",
-    "id": "f132046a-f99f-4e2f-af2c-bcc6690050a5",
+    "displayName": "DataAgent.Reshare (retired)",
+    "id": "82b1d51c-42df-4ba9-9aee-bbba1e3f2ab7",
     "origin": "Delegated (Power BI Service)",
-    "value": "WarehouseSnapshot.Execute.All"
+    "value": "DataAgent.Reshare.All"
   },
   {
-    "description": "Allows modifying warehouse snapshots on the user’s behalf.",
-    "displayName": "Read and write warehouse snapshots",
-    "id": "00a826b4-8fc8-4273-b68f-5947f7d13795",
+    "description": "Allows reading warehouse snapshots on the user’s behalf.",
+    "displayName": "Read warehouse snapshots",
+    "id": "fe27a477-ed49-4762-9157-5a22eec929a7",
     "origin": "Delegated (Power BI Service)",
-    "value": "WarehouseSnapshot.ReadWrite.All"
+    "value": "WarehouseSnapshot.Read.All"
   },
   {
-    "description": "Allows the app to read any alert",
-    "displayName": "Read all alerts",
-    "id": "71fe6b80-7034-4028-9ed8-0f316df9c3ff",
-    "origin": "Application (WindowsDefenderATP)",
-    "value": "Alert.Read.All"
+    "description": " ",
+    "displayName": "WarehouseSnapshot.Reshare (retired)",
+    "id": "7e23ffe1-cea7-435d-94ce-4a7b4e8b38a0",
+    "origin": "Delegated (Power BI Service)",
+    "value": "WarehouseSnapshot.Reshare.All"
   },
   {
     "description": "Allows the app to create or update any alert",
@@ -6075,13 +6075,6 @@
     "origin": "Application (WindowsDefenderATP)",
     "value": "readonly"
   },
-  {
-    "description": "Allows the app to run advanced queries",
-    "displayName": "Run advanced queries",
-    "id": "93489bf5-0fbc-4f2d-b901-33f2fe08ff05",
-    "origin": "Application (WindowsDefenderATP)",
-    "value": "AdvancedQuery.Read.All"
-  },
   {
     "description": "Allows the app to read all remediation tasks",
     "displayName": "Read all remediation tasks",
@@ -6090,25 +6083,32 @@
     "value": "RemediationTasks.Read.All"
   },
   {
-    "description": "Allow the application to access Windows Virtual Desktop on your behalf.",
-    "displayName": "Access Windows Virtual Desktop",
-    "id": "1ea0ab9c-b888-476f-aca9-0fc9a53b483a",
-    "origin": "Delegated (Windows Virtual Desktop)",
-    "value": "User.Access"
+    "description": "Allows the app to read any alert",
+    "displayName": "Read all alerts",
+    "id": "71fe6b80-7034-4028-9ed8-0f316df9c3ff",
+    "origin": "Application (WindowsDefenderATP)",
+    "value": "Alert.Read.All"
   },
   {
-    "description": "Allow the application to access Windows Store for Business on behalf of the signed-in user.",
-    "displayName": "Access Windows Store for Business",
-    "id": "56cee9a4-2b49-4d48-a5c1-b26a2e48aada",
-    "origin": "Delegated (Windows Store for Business)",
-    "value": "user_impersonation"
+    "description": "Allows the app to read any Threat and Vulnerability Management  score",
+    "displayName": "Read Threat and Vulnerability Management score",
+    "id": "02b005dd-f804-43b4-8fc7-078460413f74",
+    "origin": "Application (WindowsDefenderATP)",
+    "value": "Score.Read.All"
   },
   {
-    "description": "Allows the app to read and write data in your company or school directory, such as users, and groups.  Does not allow user or group deletion.",
-    "displayName": "Read and write directory data",
-    "id": "78c8a3c8-a07e-4b9e-af1b-b5ccab50a175",
-    "origin": "Delegated (Windows Azure Active Directory)",
-    "value": "Directory.ReadWrite.All"
+    "description": "Allows the app to run advanced queries",
+    "displayName": "Run advanced queries",
+    "id": "93489bf5-0fbc-4f2d-b901-33f2fe08ff05",
+    "origin": "Application (WindowsDefenderATP)",
+    "value": "AdvancedQuery.Read.All"
+  },
+  {
+    "description": "Creators can create Windows Virtual Desktop Tenants",
+    "displayName": "Tenant.Create",
+    "id": "299dad25-58e3-473d-9733-171fb3034713",
+    "origin": "Application (Windows Virtual Desktop)",
+    "value": "Tenant.Create"
   },
   {
     "description": "Allows the app to read basic group properties and memberships on behalf of the signed-in user.",
@@ -6223,18 +6223,18 @@
     "value": "Assets.Read"
   },
   {
-    "description": "Creators can create Windows Virtual Desktop Tenants",
-    "displayName": "Tenant.Create",
-    "id": "299dad25-58e3-473d-9733-171fb3034713",
-    "origin": "Application (Windows Virtual Desktop)",
-    "value": "Tenant.Create"
+    "description": "Allow the application to access Windows Store for Business on behalf of the signed-in user.",
+    "displayName": "Access Windows Store for Business",
+    "id": "56cee9a4-2b49-4d48-a5c1-b26a2e48aada",
+    "origin": "Delegated (Windows Store for Business)",
+    "value": "user_impersonation"
   },
   {
-    "description": "Allows the app to read any Threat and Vulnerability Management  score",
-    "displayName": "Read Threat and Vulnerability Management score",
-    "id": "02b005dd-f804-43b4-8fc7-078460413f74",
-    "origin": "Application (WindowsDefenderATP)",
-    "value": "Score.Read.All"
+    "description": "Allow the application to access Windows Virtual Desktop on your behalf.",
+    "displayName": "Access Windows Virtual Desktop",
+    "id": "1ea0ab9c-b888-476f-aca9-0fc9a53b483a",
+    "origin": "Delegated (Windows Virtual Desktop)",
+    "value": "User.Access"
   },
   {
     "description": "Users assign to this role will be able to access the Windows Defender ATP portal, view all the data and be able to perform actions such as change alerts status, apply suppression rules etc.",
@@ -6251,11 +6251,11 @@
     "value": "SecurityBaselinesAssessment.Read.All"
   },
   {
-    "description": "Allows the app to create machine records and to read or update any machine record that the signed-in user can create, read or update.",
-    "displayName": "Read and write  machine information",
-    "id": "f6846c57-9e3c-4a65-81aa-2f5e09ff4f0b",
-    "origin": "Delegated (WindowsDefenderATP)",
-    "value": "Machine.ReadWrite"
+    "description": "Allows the app to read all security configurations",
+    "displayName": "Read all security configurations",
+    "id": "227f2ea0-c2c2-4428-b7af-9ff40f1a720e",
+    "origin": "Application (WindowsDefenderATP)",
+    "value": "SecurityConfiguration.Read.All"
   },
   {
     "description": "Allows the app to restrict code execution on a machine according to policy on behalf of the signed-in user",
@@ -6369,6 +6369,20 @@
     "origin": "Application",
     "value": "Directory.Write.Restricted"
   },
+  {
+    "description": "Allows the app to manage restricted resources based on the other permissions granted to the app, on behalf of the signed-in user.",
+    "displayName": "Manage restricted resources in the directory",
+    "id": "cba5390f-ed6a-4b7f-b657-0efc2210ed20",
+    "origin": "Delegated",
+    "value": "Directory.Write.Restricted"
+  },
+  {
+    "description": "Allows the app to create machine records and to read or update any machine record that the signed-in user can create, read or update.",
+    "displayName": "Read and write  machine information",
+    "id": "f6846c57-9e3c-4a65-81aa-2f5e09ff4f0b",
+    "origin": "Delegated (WindowsDefenderATP)",
+    "value": "Machine.ReadWrite"
+  },
   {
     "description": "Allows the app to read machine profiles (including the commands that were sent to each machine), that the signed in user can access",
     "displayName": "Read machine information",
@@ -6390,20 +6404,6 @@
     "origin": "Delegated (WindowsDefenderATP)",
     "value": "Machine.LiveResponse"
   },
-  {
-    "description": "Allows the app to isolate a machine on behalf of the signed-in user",
-    "displayName": "Isolate machine",
-    "id": "479231ef-3b86-4933-ae6b-1fa84bba9e31",
-    "origin": "Delegated (WindowsDefenderATP)",
-    "value": "Machine.Isolate"
-  },
-  {
-    "description": "Allows the app to read all security configurations",
-    "displayName": "Read all security configurations",
-    "id": "227f2ea0-c2c2-4428-b7af-9ff40f1a720e",
-    "origin": "Application (WindowsDefenderATP)",
-    "value": "SecurityConfiguration.Read.All"
-  },
   {
     "description": "Allows the app to read and write all security configurations",
     "displayName": "Read and write all security configurations",
@@ -6453,13 +6453,6 @@
     "origin": "Application (WindowsDefenderATP)",
     "value": "Url.Read.All"
   },
-  {
-    "description": "Allows the app to read data in your company or school directory, such as users, groups, and apps.",
-    "displayName": "Read directory data",
-    "id": "5778995a-e1bf-45b8-affa-663a9f3f4d04",
-    "origin": "Delegated (Windows Azure Active Directory)",
-    "value": "Directory.Read.All"
-  },
   {
     "description": "Allows the app to read all user profiles",
     "displayName": "Read user profiles",
@@ -6468,11 +6461,18 @@
     "value": "User.Read.All"
   },
   {
-    "description": "Allows the app to run advanced queries, that the signed-in user can execute.",
-    "displayName": "Run advanced queries",
-    "id": "1fb6e712-1bd9-4184-b1c0-5e71e759196b",
-    "origin": "Delegated (WindowsDefenderATP)",
-    "value": "AdvancedQuery.Read"
+    "description": "Allows the app to read and write data in your company or school directory, such as users, and groups.  Does not allow user or group deletion.",
+    "displayName": "Read and write directory data",
+    "id": "78c8a3c8-a07e-4b9e-af1b-b5ccab50a175",
+    "origin": "Delegated (Windows Azure Active Directory)",
+    "value": "Directory.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read any Threat and Vulnerability Management vulnerability information",
+    "displayName": "Read Threat and Vulnerability Management vulnerability information",
+    "id": "41269fc5-d04d-4bfd-bce7-43a51cea049a",
+    "origin": "Application (WindowsDefenderATP)",
+    "value": "Vulnerability.Read.All"
   },
   {
     "description": "Allows the app to read any alert that the signed in user can access",
@@ -6517,11 +6517,25 @@
     "value": "Machine.CollectForensics"
   },
   {
-    "description": "Allows the app to read any Threat and Vulnerability Management vulnerability information",
-    "displayName": "Read Threat and Vulnerability Management vulnerability information",
-    "id": "41269fc5-d04d-4bfd-bce7-43a51cea049a",
-    "origin": "Application (WindowsDefenderATP)",
-    "value": "Vulnerability.Read.All"
+    "description": "Allows the app to isolate a machine on behalf of the signed-in user",
+    "displayName": "Isolate machine",
+    "id": "479231ef-3b86-4933-ae6b-1fa84bba9e31",
+    "origin": "Delegated (WindowsDefenderATP)",
+    "value": "Machine.Isolate"
+  },
+  {
+    "description": "Allows the app to run advanced queries, that the signed-in user can execute.",
+    "displayName": "Run advanced queries",
+    "id": "1fb6e712-1bd9-4184-b1c0-5e71e759196b",
+    "origin": "Delegated (WindowsDefenderATP)",
+    "value": "AdvancedQuery.Read"
+  },
+  {
+    "description": "Allows the app to read data in your company or school directory, such as users, groups, and apps.",
+    "displayName": "Read directory data",
+    "id": "5778995a-e1bf-45b8-affa-663a9f3f4d04",
+    "origin": "Delegated (Windows Azure Active Directory)",
+    "value": "Directory.Read.All"
   },
   {
     "description": "Allows the app to have the same access to information in the directory as the signed-in user.",
@@ -6537,20 +6551,6 @@
     "origin": "Application (Windows Azure Active Directory)",
     "value": "Policy.Read.All"
   },
-  {
-    "description": "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.",
-    "displayName": "Read all hidden memberships",
-    "id": "9728c0c4-a06b-4e0e-8d1b-3d694e8ec207",
-    "origin": "Application (Windows Azure Active Directory)",
-    "value": "Member.Read.Hidden"
-  },
-  {
-    "description": "Allows the app to read M365 assets insights.",
-    "displayName": "Read M365 insights for Purview",
-    "id": "5a55b1b6-8996-4250-abc2-74ec0107ab20",
-    "origin": "Application (Purview Ecosystem)",
-    "value": "PurviewData.Read.All"
-  },
   {
     "description": "Allows the user to call UploadActivity API.",
     "displayName": "Purview UploadActivity API",
@@ -6663,6 +6663,20 @@
     "origin": "Delegated (Signup)",
     "value": "Subscription.Add"
   },
+  {
+    "description": "Allows the caller to perform product signup eligibility check for the given user",
+    "displayName": "Users.Signup.Product",
+    "id": "62c3283a-e0b2-4608-85d5-013e99604063",
+    "origin": "Delegated (Signup)",
+    "value": "Users.Signup.Product"
+  },
+  {
+    "description": "Allows the app to read M365 assets insights.",
+    "displayName": "Read M365 insights for Purview",
+    "id": "5a55b1b6-8996-4250-abc2-74ec0107ab20",
+    "origin": "Application (Purview Ecosystem)",
+    "value": "PurviewData.Read.All"
+  },
   {
     "description": "Allows full access to UploadActivity API",
     "displayName": "Upload Activity for Purview",
@@ -6684,20 +6698,6 @@
     "origin": "Application (Purview Ecosystem)",
     "value": "Purview.SensitivityLabels.File"
   },
-  {
-    "description": "Allows the app access to Purview SensitivityLabels APIs",
-    "displayName": "Sensitivity Labels for Purview",
-    "id": "c79a7e98-4663-4e08-aaf4-cc6dfc36a524",
-    "origin": "Application (Purview Ecosystem)",
-    "value": "Purview.SensitivityLabels.All"
-  },
-  {
-    "description": " ",
-    "displayName": "WarehouseSnapshot.Reshare (retired)",
-    "id": "7e23ffe1-cea7-435d-94ce-4a7b4e8b38a0",
-    "origin": "Delegated (Power BI Service)",
-    "value": "WarehouseSnapshot.Reshare.All"
-  },
   {
     "description": "Allows the app to make API calls that commit workspace content and setting to remote git repository, on behalf of the signed-in user.",
     "displayName": "Make API calls that commit workspace content and setting to remote git repository.",
@@ -6747,13 +6747,6 @@
     "origin": "Application (Purview Ecosystem)",
     "value": "Purview.Activities.UploadBatch.All"
   },
-  {
-    "description": "Allows the caller to perform product signup eligibility check for the given user",
-    "displayName": "Users.Signup.Product",
-    "id": "62c3283a-e0b2-4608-85d5-013e99604063",
-    "origin": "Delegated (Signup)",
-    "value": "Users.Signup.Product"
-  },
   {
     "description": "Allows the app create access to data assets and metadata.",
     "displayName": "Create Assets for Purview",
@@ -6762,11 +6755,18 @@
     "value": "Purview.Assets.Create"
   },
   {
-    "description": "Allows the app read access to data assets and metadata.",
-    "displayName": "Read Assets for Purview",
-    "id": "04cd5d64-65c5-4dc5-9582-89bac29ed189",
+    "description": "Allows the app create an on-demand Skype meeting and join guest users into Skype for Business services",
+    "displayName": "Guest user join services (preview)",
+    "id": "b783bde8-ffc2-4f0c-96ce-6e2900b7aa4e",
+    "origin": "Application (Skype for Business Online)",
+    "value": "Anonymous"
+  },
+  {
+    "description": "Allows the app delete access to data assets and metadata.",
+    "displayName": "Delete Assets for Purview",
+    "id": "f6893e92-b5aa-4634-870a-e2bc4d2d7fad",
     "origin": "Application (Purview Ecosystem)",
-    "value": "Purview.Assets.Read"
+    "value": "Purview.Assets.Delete"
   },
   {
     "description": "Allows the app update access to data assets and metadata.",
@@ -6818,39 +6818,39 @@
     "value": "Purview.ProtectionScopes.Read.All"
   },
   {
-    "description": "Allows the app delete access to data assets and metadata.",
-    "displayName": "Delete Assets for Purview",
-    "id": "f6893e92-b5aa-4634-870a-e2bc4d2d7fad",
+    "description": "Allows the app access to Purview SensitivityLabels APIs",
+    "displayName": "Sensitivity Labels for Purview",
+    "id": "c79a7e98-4663-4e08-aaf4-cc6dfc36a524",
     "origin": "Application (Purview Ecosystem)",
-    "value": "Purview.Assets.Delete"
+    "value": "Purview.SensitivityLabels.All"
   },
   {
-    "description": "Allows reading warehouse snapshots on the user’s behalf.",
-    "displayName": "Read warehouse snapshots",
-    "id": "fe27a477-ed49-4762-9157-5a22eec929a7",
+    "description": "Allows the app read access to data assets and metadata.",
+    "displayName": "Read Assets for Purview",
+    "id": "04cd5d64-65c5-4dc5-9582-89bac29ed189",
+    "origin": "Application (Purview Ecosystem)",
+    "value": "Purview.Assets.Read"
+  },
+  {
+    "description": "Allows modifying warehouse snapshots on the user’s behalf.",
+    "displayName": "Read and write warehouse snapshots",
+    "id": "00a826b4-8fc8-4273-b68f-5947f7d13795",
     "origin": "Delegated (Power BI Service)",
-    "value": "WarehouseSnapshot.Read.All"
+    "value": "WarehouseSnapshot.ReadWrite.All"
   },
   {
-    "description": "Allows the app create an on-demand Skype meeting and join guest users into Skype for Business services",
-    "displayName": "Guest user join services (preview)",
-    "id": "b783bde8-ffc2-4f0c-96ce-6e2900b7aa4e",
+    "description": "Allows the app to send and receive audio and video; and manage audio/video service scenarios",
+    "displayName": "Send/Receive Audio and Video (preview)",
+    "id": "05a4e3e8-cfa6-4934-bb91-b6fc4ce6f340",
     "origin": "Application (Skype for Business Online)",
-    "value": "Anonymous"
+    "value": "Conversations.AudioVideo"
   },
   {
-    "description": "Allows the app to send and receive instant messages; and manage instant messaging service scenarios",
-    "displayName": "Send/Receive Instant Messages (preview)",
-    "id": "f7a521bb-ae17-42df-8096-97ebcc8b4edb",
+    "description": "Allows the app to send and receive voice calls; and manage PSTN service scenarios",
+    "displayName": "Send/Receive PSTN (preview)",
+    "id": "30a91c70-863f-4a08-b01c-6c1d78685414",
     "origin": "Application (Skype for Business Online)",
-    "value": "Conversations.Chat"
-  },
-  {
-    "description": "Gives full access to the API",
-    "displayName": "full_access",
-    "id": "f4922361-5b56-4b3b-808f-a25115425e16",
-    "origin": "Delegated (Verifiable Credentials Service Admin)",
-    "value": "full_access"
+    "value": "Conversations.PSTN"
   },
   {
     "description": "This allows the application to create Verifiable Credential issuance and presentation requests",
@@ -6936,6 +6936,20 @@
     "origin": "Application (Windows Azure Active Directory)",
     "value": "Domain.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.",
+    "displayName": "Read all hidden memberships",
+    "id": "9728c0c4-a06b-4e0e-8d1b-3d694e8ec207",
+    "origin": "Application (Windows Azure Active Directory)",
+    "value": "Member.Read.Hidden"
+  },
+  {
+    "description": "Gives full access to the API",
+    "displayName": "full_access",
+    "id": "f4922361-5b56-4b3b-808f-a25115425e16",
+    "origin": "Delegated (Verifiable Credentials Service Admin)",
+    "value": "full_access"
+  },
   {
     "description": "This allows  the application to search authorities and contracts in the VerifiedID network",
     "displayName": "VerifiableCredential.Network.Read",
@@ -6957,20 +6971,6 @@
     "origin": "Application (Verifiable Credentials Service Admin)",
     "value": "VerifiableCredential.Credential.Revoke"
   },
-  {
-    "description": "This allows the application to perform operations on contracts via Admin API",
-    "displayName": "VerifiableCredential.Contract.ReadWrite",
-    "id": "077813bc-e516-4576-bafd-07bead19c0dc",
-    "origin": "Application (Verifiable Credentials Service Admin)",
-    "value": "VerifiableCredential.Contract.ReadWrite"
-  },
-  {
-    "description": "Allows the app to send and receive voice calls; and manage PSTN service scenarios",
-    "displayName": "Send/Receive PSTN (preview)",
-    "id": "30a91c70-863f-4a08-b01c-6c1d78685414",
-    "origin": "Application (Skype for Business Online)",
-    "value": "Conversations.PSTN"
-  },
   {
     "description": "Allows the app to join and manage Skype meetings",
     "displayName": "Join and Manage Skype Meetings (preview)",
@@ -7020,13 +7020,6 @@
     "origin": "Delegated (Skype for Business Online)",
     "value": "User.ReadWrite"
   },
-  {
-    "description": "Allows the app to send and receive audio and video; and manage audio/video service scenarios",
-    "displayName": "Send/Receive Audio and Video (preview)",
-    "id": "05a4e3e8-cfa6-4934-bb91-b6fc4ce6f340",
-    "origin": "Application (Skype for Business Online)",
-    "value": "Conversations.AudioVideo"
-  },
   {
     "description": "Allows the app to access the SQL Adx Proxy on behalf of the signed-in user.",
     "displayName": "Access Sql Adx Proxy as user",
@@ -7035,11 +7028,18 @@
     "value": "access_as_user"
   },
   {
-    "description": "Allows reading basic user details",
-    "displayName": "user.read",
-    "id": "42ac4dc0-0862-4f71-89ed-85c8dca034a4",
-    "origin": "Delegated (Targeted Messaging Service)",
-    "value": "user.read"
+    "description": "Allows the app to send and receive instant messages; and manage instant messaging service scenarios",
+    "displayName": "Send/Receive Instant Messages (preview)",
+    "id": "f7a521bb-ae17-42df-8096-97ebcc8b4edb",
+    "origin": "Application (Skype for Business Online)",
+    "value": "Conversations.Chat"
+  },
+  {
+    "description": "PhysicalRP.ReadWrite",
+    "displayName": "PhysicalRP.ReadWrite",
+    "id": "da98d496-63c4-4eb4-b55c-19b2c584fca3",
+    "origin": "Delegated (StoreWebServices)",
+    "value": "PhysicalRP.ReadWrite"
   },
   {
     "description": "Allows access to the Azure API Center Data API service on behalf of the signed-in user",
@@ -7091,46 +7091,39 @@
     "value": "VerifiableCredential.Contract.Read"
   },
   {
-    "description": "PhysicalRP.ReadWrite",
-    "displayName": "PhysicalRP.ReadWrite",
-    "id": "da98d496-63c4-4eb4-b55c-19b2c584fca3",
-    "origin": "Delegated (StoreWebServices)",
-    "value": "PhysicalRP.ReadWrite"
+    "description": "This allows the application to perform operations on contracts via Admin API",
+    "displayName": "VerifiableCredential.Contract.ReadWrite",
+    "id": "077813bc-e516-4576-bafd-07bead19c0dc",
+    "origin": "Application (Verifiable Credentials Service Admin)",
+    "value": "VerifiableCredential.Contract.ReadWrite"
   },
   {
-    "description": "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.",
-    "displayName": "Read all shared cross-tenant user profiles and export their data",
-    "id": "759dcd16-3c90-463c-937e-abf89f991c18",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "CrossTenantUserProfileSharing.Read.All"
+    "description": "Allows reading basic user details",
+    "displayName": "user.read",
+    "id": "42ac4dc0-0862-4f71-89ed-85c8dca034a4",
+    "origin": "Delegated (Targeted Messaging Service)",
+    "value": "user.read"
   },
   {
-    "description": "Allows reading data agents on the user’s behalf.",
-    "displayName": "Read data agents",
-    "id": "40fa91d5-73ef-412c-a8c8-c8658670d0eb",
-    "origin": "Delegated (Power BI Service)",
-    "value": "DataAgent.Read.All"
+    "description": "Allows the app to uninstall Microsoft Entra Connect Sync Agent and offboard SSPR for the tenant",
+    "displayName": "Read, write and manage Microsoft Entra Connect Sync Agent",
+    "id": "69201c67-737b-4a20-8f16-e0c8c64e0b0e",
+    "origin": "Application (Microsoft password reset service)",
+    "value": "PasswordWriteback.OffboardClient.All"
   },
   {
-    "description": " ",
-    "displayName": "Dashboard.Reshare (retired)",
-    "id": "c67b16d3-b5b8-4c87-8ca0-a8e00c6d6ff3",
+    "description": "Allows modifying data agents on the user’s behalf.",
+    "displayName": "Read and write data agents",
+    "id": "c23fda5c-561f-4890-ad72-5f57bb7496fd",
     "origin": "Delegated (Power BI Service)",
-    "value": "Dashboard.Reshare.All"
-  },
-  {
-    "description": "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.",
-    "displayName": "Read all company places",
-    "id": "4830e04b-48ac-4de5-bbd9-8aceb58e506b",
-    "origin": "Application (Office 365 Exchange Online)",
-    "value": "Place.Read.All"
+    "value": "DataAgent.ReadWrite.All"
   },
   {
-    "description": "Allow application to access user’s mailbox via POP protocol",
-    "displayName": "POP.AccessAsApp",
-    "id": "cb842b43-da6e-4506-86fe-bb12199c656d",
-    "origin": "Application (Office 365 Exchange Online)",
-    "value": "POP.AccessAsApp"
+    "description": "Allows executing data agents on the user’s behalf.",
+    "displayName": "Execute data agents",
+    "id": "c6756612-6853-4145-a661-90c1d045b2dc",
+    "origin": "Delegated (Power BI Service)",
+    "value": "DataAgent.Execute.All"
   },
   {
     "description": "Download all reports via the Office 365 reporting web service",
@@ -7237,13 +7230,6 @@
     "origin": "Delegated (Office 365 Exchange Online)",
     "value": "Contacts.Read.Shared"
   },
-  {
-    "description": "Allows the application to read and write tenant-wide people settings without a signed-in user.",
-    "displayName": "Read and write all tenant-wide people settings",
-    "id": "98ed40ef-611a-4479-bd35-eaa7863e946a",
-    "origin": "Application (Office 365 Exchange Online)",
-    "value": "PeopleSettings.ReadWrite.All"
-  },
   {
     "description": "Allows the app to create, read, update, and delete user contacts.",
     "displayName": "Read and write user contacts",
@@ -7252,32 +7238,39 @@
     "value": "Contacts.ReadWrite"
   },
   {
-    "description": "Allows the application to read tenant-wide people settings without a signed-in user.",
-    "displayName": "Read all tenant-wide people settings",
-    "id": "789ef6b5-4ecc-4f61-b6b3-66ef3109173c",
-    "origin": "Application (Office 365 Exchange Online)",
-    "value": "PeopleSettings.Read.All"
+    "description": "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
+    "displayName": "Read and write user and shared  contacts ",
+    "id": "44882612-f346-430a-b938-4f00ee1c77a7",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "Contacts.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information.",
-    "displayName": "Organization.Read.All",
-    "id": "15f260d6-f874-4366-8672-6b3658c5a09b",
+    "description": "Allow application to access user’s mailbox via POP protocol",
+    "displayName": "POP.AccessAsApp",
+    "id": "cb842b43-da6e-4506-86fe-bb12199c656d",
     "origin": "Application (Office 365 Exchange Online)",
-    "value": "Organization.Read.All"
+    "value": "POP.AccessAsApp"
   },
   {
-    "description": "Allow the application full access to the OCM service on behalf of the signed-in user",
-    "displayName": "Have full access to the OCM Service ",
-    "id": "9454efbe-3f0a-4074-9ec5-a25adefb6f87",
-    "origin": "Delegated (O365SBRM Service)",
-    "value": "user_impersonation"
+    "description": "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
+    "displayName": "Read and write user and shared  contacts ",
+    "id": "c54cba4f-60fe-4332-b0de-b5990fd1999e",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "Contacts.ReadWrite.Shared"
   },
   {
-    "description": "Allows the app to read events of all calendars without a signed-in user.",
-    "displayName": "Read calendars in all mailboxes",
-    "id": "798ee544-9d2d-430c-a058-570e29e34338",
+    "description": "Allows the app to read company places (conference rooms and room lists) for calendar events and other applications, without a signed-in user.",
+    "displayName": "Read all company places",
+    "id": "4830e04b-48ac-4de5-bbd9-8aceb58e506b",
     "origin": "Application (Office 365 Exchange Online)",
-    "value": "Calendars.Read"
+    "value": "Place.Read.All"
+  },
+  {
+    "description": "Allows the application to read tenant-wide people settings without a signed-in user.",
+    "displayName": "Read all tenant-wide people settings",
+    "id": "789ef6b5-4ecc-4f61-b6b3-66ef3109173c",
+    "origin": "Application (Office 365 Exchange Online)",
+    "value": "PeopleSettings.Read.All"
   },
   {
     "description": "Allows the app to read events of all R without a signed-in user",
@@ -7384,6 +7377,13 @@
     "origin": "Application (Office 365 Exchange Online)",
     "value": "MailboxSettings.ReadWrite"
   },
+  {
+    "description": "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information.",
+    "displayName": "Organization.Read.All",
+    "id": "15f260d6-f874-4366-8672-6b3658c5a09b",
+    "origin": "Application (Office 365 Exchange Online)",
+    "value": "Organization.Read.All"
+  },
   {
     "description": "Allows the app to read and write the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information.",
     "displayName": "Organization.ReadWrite.All",
@@ -7392,18 +7392,11 @@
     "value": "Organization.ReadWrite.All"
   },
   {
-    "description": "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
-    "displayName": "Read and write user and shared  contacts ",
-    "id": "44882612-f346-430a-b938-4f00ee1c77a7",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Contacts.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to create, read, update, and delete contacts a user has permissions to, including their own and shared contacts.",
-    "displayName": "Read and write user and shared  contacts ",
-    "id": "c54cba4f-60fe-4332-b0de-b5990fd1999e",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Contacts.ReadWrite.Shared"
+    "description": "Allows the application to read and write tenant-wide people settings without a signed-in user.",
+    "displayName": "Read and write all tenant-wide people settings",
+    "id": "98ed40ef-611a-4479-bd35-eaa7863e946a",
+    "origin": "Application (Office 365 Exchange Online)",
+    "value": "PeopleSettings.ReadWrite.All"
   },
   {
     "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange ActiveSync.",
@@ -7413,18 +7406,18 @@
     "value": "EAS.AccessAsUser.All"
   },
   {
-    "description": "This allows application to host MyDay Owa powered experience for both user and shared mailbox and calendar",
-    "displayName": "OPX.MyDay.All",
-    "id": "d056cee4-aed2-4aa4-b2a9-292fe18b06d2",
+    "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.",
+    "displayName": "Access mailboxes as the signed-in user via Exchange Web Services",
+    "id": "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",
     "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "OPX.MyDay.All"
+    "value": "EWS.AccessAsUser.All"
   },
   {
-    "description": "This allows application to host MyDay Owa powered experience for shared mailbox and calendar",
-    "displayName": "OPX.MyDay.Shared",
-    "id": "405782ba-4062-4ea3-bd33-f7c731841e3b",
+    "description": "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments. This permission replaces the previous Exchange.ManageV2 permission.",
+    "displayName": "Manage Exchange Online Admin API",
+    "id": "9f021f4d-e924-4317-bf46-8db5e8340c6c",
     "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "OPX.MyDay.Shared"
+    "value": "Exchange.AdminAPI.Manage"
   },
   {
     "description": "Allows the app to read the organization and related resources, on behalf of the signed-in user. Related resources include things like subscribed SKUs and tenant branding information.",
@@ -7531,6 +7524,34 @@
     "origin": "Delegated (Office 365 Exchange Online)",
     "value": "User.Read"
   },
+  {
+    "description": "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.",
+    "displayName": "Read all users' full profiles",
+    "id": "eb665d05-7f76-4d1b-b176-1cfc814e668d",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "User.Read.All"
+  },
+  {
+    "description": "Allows the app to read a basic set of profile properties of users in your company or school on behalf of the signed-in user. Includes display name, photo, and email address.",
+    "displayName": "Read all users' basic profiles",
+    "id": "6222dbab-a24c-4210-9d91-2f47cf565614",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "User.ReadBasic.All"
+  },
+  {
+    "description": "This allows application to host MyDay Owa powered experience for shared mailbox and calendar",
+    "displayName": "OPX.MyDay.Shared",
+    "id": "405782ba-4062-4ea3-bd33-f7c731841e3b",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "OPX.MyDay.Shared"
+  },
+  {
+    "description": "This allows application to host MyDay Owa powered experience for both user and shared mailbox and calendar",
+    "displayName": "OPX.MyDay.All",
+    "id": "d056cee4-aed2-4aa4-b2a9-292fe18b06d2",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "OPX.MyDay.All"
+  },
   {
     "description": "This allows the application to host MyDay Owa powered experience",
     "displayName": "OPX.MyDay",
@@ -7546,46 +7567,18 @@
     "value": "Notes.ReadWrite"
   },
   {
-    "description": "Allows the app to read user notes",
-    "displayName": "Read user notes",
-    "id": "505d82a7-24f3-4632-bffc-4d21625b31de",
+    "description": "Allows the app to manage the organization's Exchange environment, such as mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles to the app user.",
+    "displayName": "Manage Exchange configuration",
+    "id": "ab4f2b77-0b06-4fc1-a9de-02113fc2ab7c",
     "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Notes.Read"
+    "value": "Exchange.Manage"
   },
   {
-    "description": "Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail.",
-    "displayName": "Read and write user mailbox settings",
-    "id": "2e83d72d-8895-4b66-9eea-abb43449ab8b",
+    "description": "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments.",
+    "displayName": "Manage Exchange configuration v2",
+    "id": "44d6b5f2-d42b-4fa7-b999-1c5fcab98e4d",
     "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "MailboxSettings.ReadWrite"
-  },
-  {
-    "description": "Allows the app to have the same access to mailboxes as the signed-in user via Exchange Web Services.",
-    "displayName": "Access mailboxes as the signed-in user via Exchange Web Services",
-    "id": "3b5f3d61-589b-4a3c-a359-5dd4b5ee5bd5",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "EWS.AccessAsUser.All"
-  },
-  {
-    "description": "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments. This permission replaces the previous Exchange.ManageV2 permission.",
-    "displayName": "Manage Exchange Online Admin API",
-    "id": "9f021f4d-e924-4317-bf46-8db5e8340c6c",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Exchange.AdminAPI.Manage"
-  },
-  {
-    "description": "Allows the app to manage the organization's Exchange environment, such as mailboxes, groups, and other configuration objects. To enable management actions, an admin must assign the appropriate roles to the app user.",
-    "displayName": "Manage Exchange configuration",
-    "id": "ab4f2b77-0b06-4fc1-a9de-02113fc2ab7c",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Exchange.Manage"
-  },
-  {
-    "description": "Allows the app to manage a limited set of Exchange Online configuration objects via the adminapi/v2.0 endpoint. This permission is intended for specific scenarios and requires appropriate Exchange RBAC role assignments.",
-    "displayName": "Manage Exchange configuration v2",
-    "id": "44d6b5f2-d42b-4fa7-b999-1c5fcab98e4d",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Exchange.ManageV2"
+    "value": "Exchange.ManageV2"
   },
   {
     "description": "Allows the app to read group properties on behalf of the signed-in user, and read group calendar and conversations on public groups and groups the signed in user is a member of.",
@@ -7615,13 +7608,6 @@
     "origin": "Delegated (Office 365 Exchange Online)",
     "value": "Mail.Read"
   },
-  {
-    "description": "A placeholder scope for preauth",
-    "displayName": "PreAuthPlaceholder",
-    "id": "25b4ea33-257e-47f5-b778-8df9c7e10548",
-    "origin": "Delegated (o365.servicecommunications.microsoft.com)",
-    "value": "PreAuthPlaceholder"
-  },
   {
     "description": "Allows the app to read mail a user can access, including their own and shared mail.",
     "displayName": "Read user and shared mail ",
@@ -7629,6 +7615,20 @@
     "origin": "Delegated (Office 365 Exchange Online)",
     "value": "Mail.Read.All"
   },
+  {
+    "description": "Allows the app to read mail a user can access, including their own and shared mail.",
+    "displayName": "Read user and shared mail ",
+    "id": "1d894596-c906-42b1-8422-9360440c1c0c",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "Mail.Read.Shared"
+  },
+  {
+    "description": "Allows the app to read events of all calendars without a signed-in user.",
+    "displayName": "Read calendars in all mailboxes",
+    "id": "798ee544-9d2d-430c-a058-570e29e34338",
+    "origin": "Application (Office 365 Exchange Online)",
+    "value": "Calendars.Read"
+  },
   {
     "description": "Allows the app to read the signed-in user's mailbox except body, previewBody, attachments and any extended properties.",
     "displayName": "Read user basic mail",
@@ -7636,13 +7636,6 @@
     "origin": "Delegated (Office 365 Exchange Online)",
     "value": "Mail.ReadBasic"
   },
-  {
-    "description": "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail.",
-    "displayName": "Read and write user mail",
-    "id": "75767999-c7a8-481e-a6b4-19458e0b30a5",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Mail.ReadWrite"
-  },
   {
     "description": "Allows the app to create, read, update, and delete mail a user has permission to access, including their own and shared mail. Does not include permission to send mail.",
     "displayName": "Read and write user and shared mail ",
@@ -7686,46 +7679,39 @@
     "value": "MailboxSettings.Read"
   },
   {
-    "description": "Allows the app to read mail a user can access, including their own and shared mail.",
-    "displayName": "Read user and shared mail ",
-    "id": "1d894596-c906-42b1-8422-9360440c1c0c",
+    "description": "Allows the app to create, read, update, and delete user's mailbox settings. Does not include permission to send mail.",
+    "displayName": "Read and write user mailbox settings",
+    "id": "2e83d72d-8895-4b66-9eea-abb43449ab8b",
     "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "Mail.Read.Shared"
-  },
-  {
-    "description": "This allows teams users to access HAPI",
-    "displayName": "teams",
-    "id": "e734da10-5e7c-48a0-a906-1a0d8b751264",
-    "origin": "Delegated (O365 Demeter)",
-    "value": "teams"
+    "value": "MailboxSettings.ReadWrite"
   },
   {
-    "description": "Allows callers to read subscriptions",
-    "displayName": "subscriptions.read",
-    "id": "b24afad3-a979-4f67-8e97-6da6301b3c2e",
-    "origin": "Delegated (O365 Demeter)",
-    "value": "subscriptions.read"
+    "description": "Allows the app to read user notes",
+    "displayName": "Read user notes",
+    "id": "505d82a7-24f3-4632-bffc-4d21625b31de",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "Notes.Read"
   },
   {
-    "description": "Allows reading library resources",
-    "displayName": "Visitor",
-    "id": "91fb9a45-6b1c-4d38-b915-4f1987a64c1c",
-    "origin": "Application (Microsoft Premonition)",
-    "value": "Library.Read"
+    "description": "Allows the app to create, read, update, and delete email in user mailboxes. Does not include permission to send mail.",
+    "displayName": "Read and write user mail",
+    "id": "75767999-c7a8-481e-a6b4-19458e0b30a5",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "Mail.ReadWrite"
   },
   {
-    "description": "Allows for all operations of library resources",
-    "displayName": "Librarian",
-    "id": "59699edb-24d7-488d-a355-2b0e39dce24c",
-    "origin": "Application (Microsoft Premonition)",
-    "value": "Library.ReadWrite"
+    "description": "Allow the application full access to the OCM service on behalf of the signed-in user",
+    "displayName": "Have full access to the OCM Service ",
+    "id": "9454efbe-3f0a-4074-9ec5-a25adefb6f87",
+    "origin": "Delegated (O365SBRM Service)",
+    "value": "user_impersonation"
   },
   {
-    "description": "Allows a client to access Premonition API on users behalf",
-    "displayName": "Access Premonition API",
-    "id": "33ee90e9-11ee-4949-81e2-b93e26b390d6",
-    "origin": "Delegated (Microsoft Premonition)",
-    "value": "All"
+    "description": "A placeholder scope for preauth",
+    "displayName": "PreAuthPlaceholder",
+    "id": "25b4ea33-257e-47f5-b778-8df9c7e10548",
+    "origin": "Delegated (o365.servicecommunications.microsoft.com)",
+    "value": "PreAuthPlaceholder"
   },
   {
     "description": "Allows the application to call Purview APIs without a signed-in user",
@@ -7826,53 +7812,46 @@
     "value": "ComplianceManager.ReadWrite.All"
   },
   {
-    "description": "Allows control plane operations of VNETs owned by the user",
-    "displayName": "VNET.ReadWrite",
-    "id": "9d4d9b26-9ecf-4796-ab43-702f556bc88c",
-    "origin": "Delegated (Microsoft Power Platform Service - PROD)",
-    "value": "VNET.ReadWrite"
-  },
-  {
-    "description": "Allows data plane access to all VNETs on the system",
-    "displayName": "VNET.Read.All",
-    "id": "e2159836-d709-4343-a518-8bb0e5744afa",
-    "origin": "Application (Microsoft Power Platform Service - PROD)",
-    "value": "VNET.Read.All"
+    "description": "Allows users to read documents.",
+    "displayName": "Read all documents",
+    "id": "e808ab43-7555-447f-8b87-1d6a5c5038ef",
+    "origin": "Delegated (Microsoft Service Trust)",
+    "value": "Documents.Read.All"
   },
   {
-    "description": "Allow access the Office People API",
-    "displayName": "Access the Office People API",
-    "id": "9eb61caf-4504-44c6-9d98-48e6a1ab8639",
-    "origin": "Delegated (Microsoft People Cards Service)",
-    "value": "User.ReadWrite"
+    "description": "Our app will be a one stop shop for current and prospective customers who need Security, Privacy, and Compliance information around Microsoft Cloud (Azure, Dynamics CRM Online and Office 365). It should be open any tenant who has AAD record – trial tenants as well as paid tenant across Microsoft Cloud.",
+    "displayName": "Microsoft Service Trust",
+    "id": "b55dae21-0932-4324-a1cd-45a046d7a6e1",
+    "origin": "Delegated (Microsoft Service Trust)",
+    "value": "Trust.Content.All"
   },
   {
-    "description": "Access the Office People API",
-    "displayName": "Access to log on",
-    "id": "07c496ee-38d1-46df-b73d-45e1ff46d11e",
-    "origin": "Delegated (Microsoft People Cards Service)",
-    "value": "User.Read.All"
+    "description": "Allows a client to access Premonition API on users behalf",
+    "displayName": "Access Premonition API",
+    "id": "33ee90e9-11ee-4949-81e2-b93e26b390d6",
+    "origin": "Delegated (Microsoft Premonition)",
+    "value": "All"
   },
   {
-    "description": "Allows the Application to read and write the user's data pertaining to itself in the Intune Mobile Application Management service",
-    "displayName": "Read and Write the User's App Management data",
-    "id": "3c7192af-9629-4473-9276-d35e4e4b36c5",
-    "origin": "Delegated (Microsoft Mobile Application Management)",
-    "value": "DeviceManagementManagedApps.ReadWrite"
+    "description": "Allows for all operations of library resources",
+    "displayName": "Librarian",
+    "id": "59699edb-24d7-488d-a355-2b0e39dce24c",
+    "origin": "Application (Microsoft Premonition)",
+    "value": "Library.ReadWrite"
   },
   {
-    "description": "Allows the app to uninstall Microsoft Entra Connect Sync Agent and offboard SSPR for the tenant",
-    "displayName": "Read, write and manage Microsoft Entra Connect Sync Agent",
-    "id": "69201c67-737b-4a20-8f16-e0c8c64e0b0e",
-    "origin": "Application (Microsoft password reset service)",
-    "value": "PasswordWriteback.OffboardClient.All"
+    "description": "Allows reading library resources",
+    "displayName": "Visitor",
+    "id": "91fb9a45-6b1c-4d38-b915-4f1987a64c1c",
+    "origin": "Application (Microsoft Premonition)",
+    "value": "Library.Read"
   },
   {
-    "description": "Allows the app to refresh and recreate on-premises configuration for Microsoft self-service password reset.",
-    "displayName": "Read, write and manage self-service password reset writeback configuration",
-    "id": "fc7e8088-95b5-453e-8bef-b17ecfec5ba3",
-    "origin": "Application (Microsoft password reset service)",
-    "value": "PasswordWriteback.RefreshClient.All"
+    "description": "Allows control plane operations of VNETs owned by the user",
+    "displayName": "VNET.ReadWrite",
+    "id": "9d4d9b26-9ecf-4796-ab43-702f556bc88c",
+    "origin": "Delegated (Microsoft Power Platform Service - PROD)",
+    "value": "VNET.ReadWrite"
   },
   {
     "description": "Allows the app to register a newer version of on-premises Microsoft Entra Connect Sync Agent.",
@@ -7909,13 +7888,6 @@
     "origin": "Delegated (Microsoft People Cards Service)",
     "value": "Chat.ReadWrite"
   },
-  {
-    "description": "Allows users to read documents.",
-    "displayName": "Read all documents",
-    "id": "e808ab43-7555-447f-8b87-1d6a5c5038ef",
-    "origin": "Delegated (Microsoft Service Trust)",
-    "value": "Documents.Read.All"
-  },
   {
     "description": "Allow access the Office People API",
     "displayName": "Access the Office People API",
@@ -7926,23 +7898,30 @@
   {
     "description": "Allow access the Office People API",
     "displayName": "Access the Office People API",
-    "id": "36e9a6a1-4901-4ea6-bf22-12fa030a7dda",
+    "id": "9beac4c9-e7ab-4507-9600-1f78e7d6097e",
     "origin": "Delegated (Microsoft People Cards Service)",
-    "value": "Group.ReadWrite"
+    "value": "Files.ReadWrite"
   },
   {
     "description": "Allow access the Office People API",
     "displayName": "Access the Office People API",
-    "id": "de67d5fd-90b8-49f3-9ed1-d8010f5455a4",
+    "id": "36e9a6a1-4901-4ea6-bf22-12fa030a7dda",
     "origin": "Delegated (Microsoft People Cards Service)",
-    "value": "Insight.Read"
+    "value": "Group.ReadWrite"
+  },
+  {
+    "description": "Allows the app to run advanced hunting queries",
+    "displayName": "Run advanced hunting queries",
+    "id": "7734e8e5-8dde-42fc-b5ae-6eafea078693",
+    "origin": "Application (Microsoft Threat Protection)",
+    "value": "AdvancedHunting.Read.All"
   },
   {
     "description": "Allow access the Office People API",
     "displayName": "Access the Office People API",
-    "id": "b4ed7afe-ffaf-4a1c-ade1-91d29981e3bb",
+    "id": "de67d5fd-90b8-49f3-9ed1-d8010f5455a4",
     "origin": "Delegated (Microsoft People Cards Service)",
-    "value": "LLM.Read"
+    "value": "Insight.Read"
   },
   {
     "description": "Allow access the Office People API",
@@ -7979,40 +7958,54 @@
     "origin": "Delegated (Microsoft People Cards Service)",
     "value": "User.Read"
   },
+  {
+    "description": "Access the Office People API",
+    "displayName": "Access to log on",
+    "id": "07c496ee-38d1-46df-b73d-45e1ff46d11e",
+    "origin": "Delegated (Microsoft People Cards Service)",
+    "value": "User.Read.All"
+  },
   {
     "description": "Allow access the Office People API",
     "displayName": "Access the Office People API",
-    "id": "9beac4c9-e7ab-4507-9600-1f78e7d6097e",
+    "id": "9eb61caf-4504-44c6-9d98-48e6a1ab8639",
     "origin": "Delegated (Microsoft People Cards Service)",
-    "value": "Files.ReadWrite"
+    "value": "User.ReadWrite"
   },
   {
-    "description": "Allows the app to read the full set of profile properties, reports, and managers of other users in your organization, on behalf of the signed-in user.",
-    "displayName": "Read all users' full profiles",
-    "id": "eb665d05-7f76-4d1b-b176-1cfc814e668d",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "User.Read.All"
+    "description": "Allows data plane access to all VNETs on the system",
+    "displayName": "VNET.Read.All",
+    "id": "e2159836-d709-4343-a518-8bb0e5744afa",
+    "origin": "Application (Microsoft Power Platform Service - PROD)",
+    "value": "VNET.Read.All"
   },
   {
-    "description": "Allows the app to run advanced hunting queries",
-    "displayName": "Run advanced hunting queries",
-    "id": "7734e8e5-8dde-42fc-b5ae-6eafea078693",
-    "origin": "Application (Microsoft Threat Protection)",
-    "value": "AdvancedHunting.Read.All"
+    "description": "Allow access the Office People API",
+    "displayName": "Access the Office People API",
+    "id": "b4ed7afe-ffaf-4a1c-ade1-91d29981e3bb",
+    "origin": "Delegated (Microsoft People Cards Service)",
+    "value": "LLM.Read"
   },
   {
-    "description": "Read Access To MDLRest APIs",
-    "displayName": "MDLRest.Read",
-    "id": "9b5904c8-49e7-4d21-81c0-118a2a9c7d81",
-    "origin": "Delegated (Microsoft.MileIQ.RESTService)",
-    "value": "MDLRest.Read"
+    "description": "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.",
+    "displayName": "Read all users' basic profiles",
+    "id": "9b005f11-86f0-45f7-8c27-4fff5d849916",
+    "origin": "Delegated (Office 365 Exchange Online)",
+    "value": "User.ReadBasic.All"
   },
   {
-    "description": "Read Write Access To MDLRest APIs",
-    "displayName": "MDLRest.ReadWrite",
-    "id": "bd79113c-40b8-4608-8c47-994bf0c2853d",
-    "origin": "Delegated (Microsoft.MileIQ.RESTService)",
-    "value": "MDLRest.ReadWrite"
+    "description": "Allows the app to create or update any custom detection rule",
+    "displayName": "Read and write all custom detection rules",
+    "id": "a7deff90-e2f5-4e4e-83a3-2c74e7002e28",
+    "origin": "Application (Microsoft Threat Protection)",
+    "value": "CustomDetections.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to create or update any incident",
+    "displayName": "Read and write all incidents",
+    "id": "8d90f441-09cf-4fdc-ab45-e874fa3a28e8",
+    "origin": "Application (Microsoft Threat Protection)",
+    "value": "Incident.ReadWrite.All"
   },
   {
     "description": "Allow the application full access to the Azure Key Vault service on behalf of the signed-in user",
@@ -8120,39 +8113,32 @@
     "value": "proposal.read"
   },
   {
-    "description": "MileIQ.All",
-    "displayName": "MileIQ.All",
-    "id": "d26f02bb-ae28-4375-9184-101879252b0f",
-    "origin": "Delegated (Microsoft.MileIQ.Dashboard)",
-    "value": "MileIQ.All"
-  },
-  {
-    "description": "Allow the application full access to the Azure Event Hubs service on behalf of the signed-in user",
-    "displayName": "Have full access to the Azure Event Hub service",
-    "id": "7d388411-3845-4cfc-aa69-33192f4b9735",
-    "origin": "Delegated (Microsoft.EventHubs)",
-    "value": "user_impersonation"
+    "description": "Allows callers to read subscriptions",
+    "displayName": "subscriptions.read",
+    "id": "b24afad3-a979-4f67-8e97-6da6301b3c2e",
+    "origin": "Delegated (O365 Demeter)",
+    "value": "subscriptions.read"
   },
   {
-    "description": "Allows the app to create or update any custom detection rule",
-    "displayName": "Read and write all custom detection rules",
-    "id": "a7deff90-e2f5-4e4e-83a3-2c74e7002e28",
-    "origin": "Application (Microsoft Threat Protection)",
-    "value": "CustomDetections.ReadWrite.All"
+    "description": "This allows teams users to access HAPI",
+    "displayName": "teams",
+    "id": "e734da10-5e7c-48a0-a906-1a0d8b751264",
+    "origin": "Delegated (O365 Demeter)",
+    "value": "teams"
   },
   {
-    "description": "Allows the app to read any incident",
-    "displayName": "Read all incidents",
-    "id": "a9790345-4595-42e4-971a-ccdc79f19b7c",
-    "origin": "Application (Microsoft Threat Protection)",
-    "value": "Incident.Read.All"
+    "description": "Read Write Access To MDLRest APIs",
+    "displayName": "MDLRest.ReadWrite",
+    "id": "bd79113c-40b8-4608-8c47-994bf0c2853d",
+    "origin": "Delegated (Microsoft.MileIQ.RESTService)",
+    "value": "MDLRest.ReadWrite"
   },
   {
-    "description": "Allows the app to create or update any incident",
-    "displayName": "Read and write all incidents",
-    "id": "8d90f441-09cf-4fdc-ab45-e874fa3a28e8",
-    "origin": "Application (Microsoft Threat Protection)",
-    "value": "Incident.ReadWrite.All"
+    "description": "Read Access To MDLRest APIs",
+    "displayName": "MDLRest.Read",
+    "id": "9b5904c8-49e7-4d21-81c0-118a2a9c7d81",
+    "origin": "Delegated (Microsoft.MileIQ.RESTService)",
+    "value": "MDLRest.Read"
   },
   {
     "description": "Allows the app to run advanced hunting queries, that the signed-in user can execute.",
@@ -8189,13 +8175,6 @@
     "origin": "Delegated (Microsoft Visual Studio Services API)",
     "value": "all"
   },
-  {
-    "description": "Our app will be a one stop shop for current and prospective customers who need Security, Privacy, and Compliance information around Microsoft Cloud (Azure, Dynamics CRM Online and Office 365). It should be open any tenant who has AAD record – trial tenants as well as paid tenant across Microsoft Cloud.",
-    "displayName": "Microsoft Service Trust",
-    "id": "b55dae21-0932-4324-a1cd-45a046d7a6e1",
-    "origin": "Delegated (Microsoft Service Trust)",
-    "value": "Trust.Content.All"
-  },
   {
     "description": "Allow the application to delete feature flags on behalf of the signed-in user.",
     "displayName": "Delete Feature Flags",
@@ -8203,6 +8182,13 @@
     "origin": "Delegated (Microsoft.Azconfig)",
     "value": "FeatureFlag.Delete"
   },
+  {
+    "description": "Allow the application to read feature flags on behalf of the signed-in user.",
+    "displayName": "Read Feature Flags",
+    "id": "dd4449fe-4788-4656-b3f2-4f066e14478a",
+    "origin": "Delegated (Microsoft.Azconfig)",
+    "value": "FeatureFlag.Read"
+  },
   {
     "description": "Allow the application to write feature flags on behalf of the signed-in user.",
     "displayName": "Write Feature Flags",
@@ -8210,6 +8196,13 @@
     "origin": "Delegated (Microsoft.Azconfig)",
     "value": "FeatureFlag.Write"
   },
+  {
+    "description": "Allows the app to read any incident",
+    "displayName": "Read all incidents",
+    "id": "a9790345-4595-42e4-971a-ccdc79f19b7c",
+    "origin": "Application (Microsoft Threat Protection)",
+    "value": "Incident.Read.All"
+  },
   {
     "description": "Allow the application to delete key-values on behalf of the signed-in user.",
     "displayName": "Delete Key-Values",
@@ -8217,13 +8210,6 @@
     "origin": "Delegated (Microsoft.Azconfig)",
     "value": "KeyValue.Delete"
   },
-  {
-    "description": "Allow the application to read key-values on behalf of the signed-in user.",
-    "displayName": "Read Key-Values",
-    "id": "8d17f7f7-030c-4b57-8129-cfb5a16433cd",
-    "origin": "Delegated (Microsoft.Azconfig)",
-    "value": "KeyValue.Read"
-  },
   {
     "description": "Allow the application to write key-values on behalf of the signed-in user.",
     "displayName": "Write Key-Values",
@@ -8260,25 +8246,39 @@
     "value": "Notifications.Write"
   },
   {
-    "description": "Allow the application to read feature flags on behalf of the signed-in user.",
-    "displayName": "Read Feature Flags",
-    "id": "dd4449fe-4788-4656-b3f2-4f066e14478a",
-    "origin": "Delegated (Microsoft.Azconfig)",
-    "value": "FeatureFlag.Read"
+    "description": "Allow the application to access Event Hubs on behalf of the signed-in user.",
+    "displayName": "Access Event Hubs as the signed-in user",
+    "id": "f9cf76f3-30cb-44b0-9f16-56986964afc4",
+    "origin": "Delegated (Microsoft.EventHubs)",
+    "value": "access_as_user"
   },
   {
-    "description": "Allows executing data agents on the user’s behalf.",
-    "displayName": "Execute data agents",
-    "id": "c6756612-6853-4145-a661-90c1d045b2dc",
-    "origin": "Delegated (Power BI Service)",
-    "value": "DataAgent.Execute.All"
+    "description": "Allow the application full access to the Azure Event Hubs service on behalf of the signed-in user",
+    "displayName": "Have full access to the Azure Event Hub service",
+    "id": "7d388411-3845-4cfc-aa69-33192f4b9735",
+    "origin": "Delegated (Microsoft.EventHubs)",
+    "value": "user_impersonation"
   },
   {
-    "description": "Allows the app to read a basic set of profile properties of users in your company or school on behalf of the signed-in user. Includes display name, photo, and email address.",
-    "displayName": "Read all users' basic profiles",
-    "id": "6222dbab-a24c-4210-9d91-2f47cf565614",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "User.ReadBasic.All"
+    "description": "MileIQ.All",
+    "displayName": "MileIQ.All",
+    "id": "d26f02bb-ae28-4375-9184-101879252b0f",
+    "origin": "Delegated (Microsoft.MileIQ.Dashboard)",
+    "value": "MileIQ.All"
+  },
+  {
+    "description": "Allow the application to read key-values on behalf of the signed-in user.",
+    "displayName": "Read Key-Values",
+    "id": "8d17f7f7-030c-4b57-8129-cfb5a16433cd",
+    "origin": "Delegated (Microsoft.Azconfig)",
+    "value": "KeyValue.Read"
+  },
+  {
+    "description": "Allows reading data agents on the user’s behalf.",
+    "displayName": "Read data agents",
+    "id": "40fa91d5-73ef-412c-a8c8-c8658670d0eb",
+    "origin": "Delegated (Power BI Service)",
+    "value": "DataAgent.Read.All"
   },
   {
     "description": "Allows the app to create, read, and write a set of the current user's profile properties in your company or school. Includes display name, photo, and email address.",
@@ -8288,18 +8288,11 @@
     "value": "User.ReadWrite"
   },
   {
-    "description": "Allows the app to read documents and list items in all site collections on behalf of the signed-in user.",
-    "displayName": "Read items in all site collections",
-    "id": "4e0d77b0-96ba-4398-af14-3baa780278f4",
-    "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "AllSites.Read"
-  },
-  {
-    "description": "Allows the app to create, read, update, and delete documents and list items in all site collections on behalf of the signed-in user.",
-    "displayName": "Read and write items in all site collections",
-    "id": "640ddd16-e5b7-4d71-9690-3f4022699ee7",
-    "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "AllSites.Write"
+    "description": "c",
+    "displayName": "AggConsumptionBillingReport.Read.All",
+    "id": "f9d2daf6-8028-48d1-b4c1-b963f7ae7a73",
+    "origin": "Application (Office 365 Information Protection)",
+    "value": "AggConsumptionBillingReport.Read.All"
   },
   {
     "description": "Allows the app to read the current user's enterprise resources.",
@@ -8406,13 +8399,6 @@
     "origin": "Delegated (Office 365 SharePoint Online)",
     "value": "Sites.Search.All"
   },
-  {
-    "description": "Allows the app to read, create, update, and delete document libraries and lists in all site collections on behalf of the signed-in user.",
-    "displayName": "Read and write items and lists in all site collections",
-    "id": "b3f70a70-8a4b-4f95-9573-d71c496a53f4",
-    "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "AllSites.Manage"
-  },
   {
     "description": "Allows the app to access a subset of site collections with a signed-in user. The specific site collections and the permissions granted will be configured in SharePoint Online.",
     "displayName": "Access selected site collections",
@@ -8421,32 +8407,39 @@
     "value": "Sites.Selected"
   },
   {
-    "description": "Allows the app to have full control of all site collections on behalf of the signed-in user.",
-    "displayName": "Have full control of all site collections",
-    "id": "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0",
+    "description": "Allows the app to read site collection metadata using the SharePoint admin site, on behalf of the signed-in user.",
+    "displayName": "Can view site collection metadata from the admin site",
+    "id": "ee5c91f0-be0b-463e-85c9-57f0514c3d29",
     "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "AllSites.FullControl"
+    "value": "SitesMetadataAdmin.Read.All"
   },
   {
-    "description": "Allows the app to read user profiles without a signed in user.",
-    "displayName": "Read user profiles",
-    "id": "df021288-bdef-4463-88db-98f22de89214",
-    "origin": "Application (Office 365 SharePoint Online)",
-    "value": "User.Read.All"
+    "description": "Allows the app to create, read, update, and delete documents and list items in all site collections on behalf of the signed-in user.",
+    "displayName": "Read and write items in all site collections",
+    "id": "640ddd16-e5b7-4d71-9690-3f4022699ee7",
+    "origin": "Delegated (Office 365 SharePoint Online)",
+    "value": "AllSites.Write"
   },
   {
-    "description": "Allows the app to read and write migration data via the SharePoint admin site without a signed-in user.",
-    "displayName": "Read and write access to migration data on the SharePoint admin site",
-    "id": "dfe5a59c-77fe-436b-9a47-375a284cf302",
-    "origin": "Application (Office 365 SharePoint Online)",
-    "value": "Migration.ReadWrite.All"
+    "description": "Allows the app to read and write site collection metadata using the SharePoint admin site, on behalf of the signed-in user.",
+    "displayName": "Can view and edit site collection metadata from the admin site",
+    "id": "9aaa3660-6678-4cb8-b4b5-be92b6f4fbf0",
+    "origin": "Delegated (Office 365 SharePoint Online)",
+    "value": "SitesMetadataAdmin.ReadWrite.All"
   },
   {
-    "description": "Allow the application to provision OneDrive for Business drives for users in the tenant, without a signed-in user.",
-    "displayName": "Provision OneDrive for Business drives without a signed-in user.",
-    "id": "7689db6e-2939-41b4-98b7-13c05a52bcd6",
-    "origin": "Application (Office 365 SharePoint Online)",
-    "value": "OneDrive.Provision.All"
+    "description": "Allows the app to read documents and list items in all site collections on behalf of the signed-in user.",
+    "displayName": "Read items in all site collections",
+    "id": "4e0d77b0-96ba-4398-af14-3baa780278f4",
+    "origin": "Delegated (Office 365 SharePoint Online)",
+    "value": "AllSites.Read"
+  },
+  {
+    "description": "Allows the app to have full control of all site collections on behalf of the signed-in user.",
+    "displayName": "Have full control of all site collections",
+    "id": "56680e0d-d2a3-4ae1-80d8-3c4f2100e3d0",
+    "origin": "Delegated (Office 365 SharePoint Online)",
+    "value": "AllSites.FullControl"
   },
   {
     "description": "Read, write and manage Cross-Tenant migration settings and tasks, without a signed-in user",
@@ -8553,6 +8546,13 @@
     "origin": "Application (Office 365 SharePoint Online)",
     "value": "TermStore.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read user profiles without a signed in user.",
+    "displayName": "Read user profiles",
+    "id": "df021288-bdef-4463-88db-98f22de89214",
+    "origin": "Application (Office 365 SharePoint Online)",
+    "value": "User.Read.All"
+  },
   {
     "description": "Allows the app to read and update user profiles and to read basic site info without a signed in user.",
     "displayName": "Read and write user profiles",
@@ -8561,18 +8561,11 @@
     "value": "User.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read site collection metadata using the SharePoint admin site, on behalf of the signed-in user.",
-    "displayName": "Can view site collection metadata from the admin site",
-    "id": "ee5c91f0-be0b-463e-85c9-57f0514c3d29",
-    "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "SitesMetadataAdmin.Read.All"
-  },
-  {
-    "description": "Allows the app to read and write site collection metadata using the SharePoint admin site, on behalf of the signed-in user.",
-    "displayName": "Can view and edit site collection metadata from the admin site",
-    "id": "9aaa3660-6678-4cb8-b4b5-be92b6f4fbf0",
+    "description": "Allows the app to read, create, update, and delete document libraries and lists in all site collections on behalf of the signed-in user.",
+    "displayName": "Read and write items and lists in all site collections",
+    "id": "b3f70a70-8a4b-4f95-9573-d71c496a53f4",
     "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "SitesMetadataAdmin.ReadWrite.All"
+    "value": "AllSites.Manage"
   },
   {
     "description": "Allows the app to submit project task status updates the signed-in user.",
@@ -8582,11 +8575,18 @@
     "value": "TaskStatus.Submit"
   },
   {
-    "description": "Allow the application to access Azure Data Explorer on behalf of the signed-in user.",
-    "displayName": "Access Azure Data Explorer",
-    "id": "eaf7943f-ddfe-4442-96af-9419cf9522f3",
-    "origin": "Delegated (Power BI Service)",
-    "value": "Code.AccessAzureDataExplorer.All"
+    "description": "Allows the app to read tenant reports via the SharePoint admin site, on behalf of the signed-in user.",
+    "displayName": "Can view tenant reports from the admin site",
+    "id": "97533022-c395-42ce-bcf7-7d554ac912fc",
+    "origin": "Delegated (Office 365 SharePoint Online)",
+    "value": "TenantReports.Read.All"
+  },
+  {
+    "description": "Allows the app to read and write tenant reports via the SharePoint admin site, on behalf of the signed-in user.",
+    "displayName": "Can view and edit tenant reports from the admin site",
+    "id": "fb471c34-3a48-412f-969b-e2b9bc071042",
+    "origin": "Delegated (Office 365 SharePoint Online)",
+    "value": "TenantReports.ReadWrite.All"
   },
   {
     "description": "Allow the application full access to the Azure Data Lake service on behalf of the signed-in user.",
@@ -8700,6 +8700,20 @@
     "origin": "Delegated (Power BI Service)",
     "value": "Dashboard.ReadWrite.All"
   },
+  {
+    "description": " ",
+    "displayName": "Dashboard.Reshare (retired)",
+    "id": "c67b16d3-b5b8-4c87-8ca0-a8e00c6d6ff3",
+    "origin": "Delegated (Power BI Service)",
+    "value": "Dashboard.Reshare.All"
+  },
+  {
+    "description": "Allow the application to access Azure Data Explorer on behalf of the signed-in user.",
+    "displayName": "Access Azure Data Explorer",
+    "id": "eaf7943f-ddfe-4442-96af-9419cf9522f3",
+    "origin": "Delegated (Power BI Service)",
+    "value": "Code.AccessAzureDataExplorer.All"
+  },
   {
     "description": "Allows reading Iceberg and Delta table catalog metadata from the external provider on the users behalf.",
     "displayName": "Read Iceberg and Delta table catalog metadata from the provider",
@@ -8721,27 +8735,6 @@
     "origin": "Delegated (Power BI Service)",
     "value": "Capacity.ReadWrite.All"
   },
-  {
-    "description": "The app can view all Power BI Premium and Power BI Embedded capacities that the signed in user has access to.",
-    "displayName": "View all capacities",
-    "id": "76e2ebd5-0dfb-4a5b-93c7-ed89e0362834",
-    "origin": "Delegated (Power BI Service)",
-    "value": "Capacity.Read.All"
-  },
-  {
-    "description": "Allows the app to read tenant reports via the SharePoint admin site, on behalf of the signed-in user.",
-    "displayName": "Can view tenant reports from the admin site",
-    "id": "97533022-c395-42ce-bcf7-7d554ac912fc",
-    "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "TenantReports.Read.All"
-  },
-  {
-    "description": "Allows the app to read and write tenant reports via the SharePoint admin site, on behalf of the signed-in user.",
-    "displayName": "Can view and edit tenant reports from the admin site",
-    "id": "fb471c34-3a48-412f-969b-e2b9bc071042",
-    "origin": "Delegated (Office 365 SharePoint Online)",
-    "value": "TenantReports.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read managed metadata and to read basic site info on behalf of the signed-in user.",
     "displayName": "Read managed metadata",
@@ -8784,13 +8777,6 @@
     "origin": "Application (Office365 Zoom)",
     "value": "eDiscovery.Jobs.Write"
   },
-  {
-    "description": "Allows the app to read migration data via the SharePoint admin site without a signed-in user.",
-    "displayName": "Read access to migration data on the SharePoint admin site",
-    "id": "b7155856-e8b7-4ba1-bf43-8c9912353676",
-    "origin": "Application (Office 365 SharePoint Online)",
-    "value": "Migration.Read.All"
-  },
   {
     "description": "Allow app to access compliance connector",
     "displayName": "Connector.Read",
@@ -8798,6 +8784,20 @@
     "origin": "Delegated (Office365 Zoom)",
     "value": "Connector.Read"
   },
+  {
+    "description": "Allow app to download the ediscovery exported data",
+    "displayName": "eDiscovery.Export.Download",
+    "id": "df0d2e21-1705-4006-b158-1114609fdfbd",
+    "origin": "Delegated (Office365 Zoom)",
+    "value": "eDiscovery.Export.Download"
+  },
+  {
+    "description": "Allow the application to provision OneDrive for Business drives for users in the tenant, without a signed-in user.",
+    "displayName": "Provision OneDrive for Business drives without a signed-in user.",
+    "id": "7689db6e-2939-41b4-98b7-13c05a52bcd6",
+    "origin": "Application (Office 365 SharePoint Online)",
+    "value": "OneDrive.Provision.All"
+  },
   {
     "description": "Legacy scope used by Office Client",
     "displayName": "user_impersonation",
@@ -8812,6 +8812,13 @@
     "origin": "Delegated (OneProfile Service)",
     "value": "User.Read"
   },
+  {
+    "description": "Allows this application to use Playwright Workspaces MCP tools on behalf of the signed-in user.",
+    "displayName": "Access Playwright Workspaces MCP tools",
+    "id": "28d48333-e7f4-4c33-b3c6-043cd9b2fb35",
+    "origin": "Delegated (Playwright Workspaces MCP)",
+    "value": "Playwright.Mcp.Tools"
+  },
   {
     "description": "Allow full access to the Microsoft Authorization Service on behalf of the signed-in user",
     "displayName": "Have full access to the Microsoft Authorization Service",
@@ -8841,46 +8848,32 @@
     "value": "App.Read.All"
   },
   {
-    "description": "Allow app to download the ediscovery exported data",
-    "displayName": "eDiscovery.Export.Download",
-    "id": "df0d2e21-1705-4006-b158-1114609fdfbd",
-    "origin": "Delegated (Office365 Zoom)",
-    "value": "eDiscovery.Export.Download"
+    "description": "The app can view all Power BI Premium and Power BI Embedded capacities that the signed in user has access to.",
+    "displayName": "View all capacities",
+    "id": "76e2ebd5-0dfb-4a5b-93c7-ed89e0362834",
+    "origin": "Delegated (Power BI Service)",
+    "value": "Capacity.Read.All"
   },
   {
-    "description": "Allows the app to search across sharepoint content. This is used for 3S unfurl route.",
-    "displayName": "Search across the users office content",
-    "id": "2aec0168-f9e2-4ce1-bb0f-1145f35f5a60",
-    "origin": "Delegated (Office 365 Search Service)",
-    "value": "SubstrateSearchServiceFiles.ReadAll"
+    "description": "Allows the app to read and write migration data via the SharePoint admin site without a signed-in user.",
+    "displayName": "Read and write access to migration data on the SharePoint admin site",
+    "id": "dfe5a59c-77fe-436b-9a47-375a284cf302",
+    "origin": "Application (Office 365 SharePoint Online)",
+    "value": "Migration.ReadWrite.All"
   },
   {
-    "description": "Allows the app to search across the users office content. This content includes relevant people, documents, emails and skype messages.",
-    "displayName": "Search across the office content of the user",
-    "id": "2aec0168-f9e2-4ce1-bb0f-1145f35f5a64",
-    "origin": "Delegated (Office 365 Search Service)",
-    "value": "SubstrateSearch-Internal.ReadWrite"
+    "description": "Allows the app to read migration data via the SharePoint admin site without a signed-in user.",
+    "displayName": "Read access to migration data on the SharePoint admin site",
+    "id": "b7155856-e8b7-4ba1-bf43-8c9912353676",
+    "origin": "Application (Office 365 SharePoint Online)",
+    "value": "Migration.Read.All"
   },
   {
-    "description": "Allows the app to list QnA and to read their properties on behalf of the signed-in user. ",
-    "displayName": "Read all QnA",
-    "id": "537ceb4f-32cd-4b8e-bab3-8303e950ccf0",
+    "description": "Allows the app to search across sharepoint content. This is used for 3S unfurl route.",
+    "displayName": "Search across the users office content",
+    "id": "2aec0168-f9e2-4ce1-bb0f-1145f35f5a60",
     "origin": "Delegated (Office 365 Search Service)",
-    "value": "QnA.Read.All"
-  },
-  {
-    "description": "c",
-    "displayName": "MessageTrace.Read.All",
-    "id": "06ab0d31-7112-476e-a479-66394bec63d6",
-    "origin": "Application (Office 365 Information Protection)",
-    "value": "MessageTrace.Read.All"
-  },
-  {
-    "description": "c",
-    "displayName": "MessageTraceDetail.tenant.read",
-    "id": "85e837d7-9e4b-4bb2-9535-08bb51aa974a",
-    "origin": "Application (Office 365 Information Protection)",
-    "value": "MessageTraceDetail.tenant.read"
+    "value": "SubstrateSearchServiceFiles.ReadAll"
   },
   {
     "description": "This allows apps to read the MtpAction",
@@ -8988,46 +8981,46 @@
     "value": "reducedrecipient.read.all"
   },
   {
-    "description": "This scope allows Apps to read tenant's MessageEventSummary data",
-    "displayName": "messageeventsummary.tenant.read",
-    "id": "51aa070e-cc8b-45a9-8530-3fc96b0aa701",
+    "description": "c",
+    "displayName": "Relocation.ReadWrite.All",
+    "id": "092afc53-fa1b-44c3-9fdf-46fcd25a5d99",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "messageeventsummary.tenant.read"
+    "value": "Relocation.ReadWrite.All"
   },
   {
     "description": "c",
-    "displayName": "M365ContentExplorer.Read.All",
-    "id": "26872368-3756-4995-a1d0-73cfa9d8f83a",
+    "displayName": "RemediationEmailResult.Read.All",
+    "id": "cae0e51f-af85-4f35-870d-9f024147648d",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "M365ContentExplorer.Read.All"
+    "value": "RemediationEmailResult.Read.All"
   },
   {
     "description": "c",
-    "displayName": "InsiderRiskData.Read.All",
-    "id": "57fee0bb-e97d-4e5c-a663-2b0c7ce0db37",
+    "displayName": "MessageTraceDetail.tenant.read",
+    "id": "85e837d7-9e4b-4bb2-9535-08bb51aa974a",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "InsiderRiskData.Read.All"
+    "value": "MessageTraceDetail.tenant.read"
   },
   {
     "description": "c",
-    "displayName": "EopDataInsights.AccessAsApp",
-    "id": "cfbd1345-3cf0-408c-8c99-1491bde7ce52",
+    "displayName": "MessageTrace.Read.All",
+    "id": "06ab0d31-7112-476e-a479-66394bec63d6",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "EopDataInsights.AccessAsApp"
+    "value": "MessageTrace.Read.All"
   },
   {
-    "description": "c",
-    "displayName": "activitydata.tenant.read",
-    "id": "ba4ca83c-e834-4e66-bfe1-df738f63b557",
+    "description": "This scope allows Apps to read tenant's MessageEventSummary data",
+    "displayName": "messageeventsummary.tenant.read",
+    "id": "51aa070e-cc8b-45a9-8530-3fc96b0aa701",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "activitydata.tenant.read"
+    "value": "messageeventsummary.tenant.read"
   },
   {
     "description": "c",
-    "displayName": "AggConsumptionBillingReport.Read.All",
-    "id": "f9d2daf6-8028-48d1-b4c1-b963f7ae7a73",
+    "displayName": "M365ContentExplorer.Read.All",
+    "id": "26872368-3756-4995-a1d0-73cfa9d8f83a",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "AggConsumptionBillingReport.Read.All"
+    "value": "M365ContentExplorer.Read.All"
   },
   {
     "description": "This allows the app to read AirAdminAction alerts",
@@ -9073,31 +9066,31 @@
   },
   {
     "description": "c",
-    "displayName": "Relocation.ReadWrite.All",
-    "id": "092afc53-fa1b-44c3-9fdf-46fcd25a5d99",
+    "displayName": "AuditProvisioningData.Tenant.Read",
+    "id": "9760b448-d4d4-478b-bebc-0ebe62c935c9",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "Relocation.ReadWrite.All"
+    "value": "AuditProvisioningData.Tenant.Read"
   },
   {
     "description": "c",
-    "displayName": "AuditProvisioningData.Tenant.Read",
-    "id": "9760b448-d4d4-478b-bebc-0ebe62c935c9",
+    "displayName": "AzureActivityData.Read.All",
+    "id": "926c05c5-5941-491b-973a-509c2a4a2542",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "AuditProvisioningData.Tenant.Read"
+    "value": "AzureActivityData.Read.All"
   },
   {
     "description": "c",
-    "displayName": "compliancestatus.tenant.read",
-    "id": "59c90462-e42e-4698-8a51-196ebd407166",
+    "displayName": "RemediationEmailResult.ReadWrite.All",
+    "id": "dac43cb8-9b13-43b1-bc17-e7eb8fe26717",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "compliancestatus.tenant.read"
+    "value": "RemediationEmailResult.ReadWrite.All"
   },
   {
     "description": "c",
-    "displayName": "CustomTag.Tenant.Read",
-    "id": "e0ba9b2a-a247-4d95-bca6-43211b61057f",
+    "displayName": "compliancestatus.tenant.read",
+    "id": "59c90462-e42e-4698-8a51-196ebd407166",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "CustomTag.Tenant.Read"
+    "value": "compliancestatus.tenant.read"
   },
   {
     "description": "c",
@@ -9143,24 +9136,31 @@
   },
   {
     "description": "c",
-    "displayName": "AzureActivityData.Read.All",
-    "id": "926c05c5-5941-491b-973a-509c2a4a2542",
+    "displayName": "EopDataInsights.AccessAsApp",
+    "id": "cfbd1345-3cf0-408c-8c99-1491bde7ce52",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "AzureActivityData.Read.All"
+    "value": "EopDataInsights.AccessAsApp"
   },
   {
-    "description": "Allows the app to read a basic set of profile properties of other users in your organization on behalf of the signed-in user. This includes display name, first and last name, email address and photo.",
-    "displayName": "Read all users' basic profiles",
-    "id": "9b005f11-86f0-45f7-8c27-4fff5d849916",
-    "origin": "Delegated (Office 365 Exchange Online)",
-    "value": "User.ReadBasic.All"
+    "description": "c",
+    "displayName": "InsiderRiskData.Read.All",
+    "id": "57fee0bb-e97d-4e5c-a663-2b0c7ce0db37",
+    "origin": "Application (Office 365 Information Protection)",
+    "value": "InsiderRiskData.Read.All"
   },
   {
     "description": "c",
-    "displayName": "RemediationEmailResult.Read.All",
-    "id": "cae0e51f-af85-4f35-870d-9f024147648d",
+    "displayName": "CustomTag.Tenant.Read",
+    "id": "e0ba9b2a-a247-4d95-bca6-43211b61057f",
     "origin": "Application (Office 365 Information Protection)",
-    "value": "RemediationEmailResult.Read.All"
+    "value": "CustomTag.Tenant.Read"
+  },
+  {
+    "description": "c",
+    "displayName": "activitydata.tenant.read",
+    "id": "ba4ca83c-e834-4e66-bfe1-df738f63b557",
+    "origin": "Application (Office 365 Information Protection)",
+    "value": "activitydata.tenant.read"
   },
   {
     "description": "This allows to change RoleGroupMember to the tenant",
@@ -9170,18 +9170,11 @@
     "value": "RoleGroupMember.tenant.write"
   },
   {
-    "description": "Allows the application to read DLP policy events, including detected sensitive data, for your organization.",
-    "displayName": "Read DLP policy events including detected sensitive data",
-    "id": "4807a72c-ad38-4250-94c9-4eabfe26cd55",
-    "origin": "Application (Office 365 Management APIs)",
-    "value": "ActivityFeed.ReadDlp"
-  },
-  {
-    "description": "Allows the application to read service health information for your organization.",
-    "displayName": "Read activity reports for your organization",
-    "id": "b3b78c39-cb1d-4d17-820a-25d9196a800e",
-    "origin": "Application (Office 365 Management APIs)",
-    "value": "ActivityReports.Read"
+    "description": "c",
+    "displayName": "ThreatSubmission.ReadWrite.All",
+    "id": "944c8d5a-fdcd-4aac-af4d-3366942700d5",
+    "origin": "Application (Office 365 Information Protection)",
+    "value": "ThreatSubmission.ReadWrite.All"
   },
   {
     "description": "Allows the application to read service health information for your organization.",
@@ -9218,6 +9211,20 @@
     "origin": "Delegated (Office 365 Management APIs)",
     "value": "ActivityFeed.Read"
   },
+  {
+    "description": "Allows the application to read DLP policy events, including detected sensitive data, for your organization.",
+    "displayName": "Read DLP policy events including detected sensitive data",
+    "id": "4807a72c-ad38-4250-94c9-4eabfe26cd55",
+    "origin": "Delegated (Office 365 Management APIs)",
+    "value": "ActivityFeed.ReadDlp"
+  },
+  {
+    "description": "Allows the application to read service health information for your organization.",
+    "displayName": "Read activity reports for your organization",
+    "id": "b3b78c39-cb1d-4d17-820a-25d9196a800e",
+    "origin": "Delegated (Office 365 Management APIs)",
+    "value": "ActivityReports.Read"
+  },
   {
     "description": "Allows the application to read all the AppCatalog",
     "displayName": "Read App Catalog",
@@ -9247,32 +9254,25 @@
     "value": "People.Read"
   },
   {
-    "description": "TenantLicenseStatus.Read.All",
-    "displayName": "TenantLicenseStatus.Read.All",
-    "id": "27787a44-0423-4f0d-a417-1276c93397fb",
-    "origin": "Delegated (Office 365 Information Protection)",
-    "value": "TenantLicenseStatus.Read.All"
+    "description": "Allows the app to list QnA and to read their properties on behalf of the signed-in user. ",
+    "displayName": "Read all QnA",
+    "id": "537ceb4f-32cd-4b8e-bab3-8303e950ccf0",
+    "origin": "Delegated (Office 365 Search Service)",
+    "value": "QnA.Read.All"
   },
   {
-    "description": "RbacTenantStatus.Write",
-    "displayName": "RbacTenantStatus.Write",
-    "id": "4e26c42d-fab0-4daa-9ea6-d860a28aa7d0",
-    "origin": "Delegated (Office 365 Information Protection)",
-    "value": "RbacTenantStatus.Write"
+    "description": "Allows the app to search across the users office content. This content includes relevant people, documents, emails and skype messages.",
+    "displayName": "Search across the office content of the user",
+    "id": "2aec0168-f9e2-4ce1-bb0f-1145f35f5a64",
+    "origin": "Delegated (Office 365 Search Service)",
+    "value": "SubstrateSearch-Internal.ReadWrite"
   },
   {
-    "description": "RbacTenantStatus.Read",
-    "displayName": "RbacTenantStatus.Read",
-    "id": "edfd2d1c-b4b5-4b83-b5e8-c38594e49c26",
+    "description": "TenantLicenseStatus.Read.All",
+    "displayName": "TenantLicenseStatus.Read.All",
+    "id": "27787a44-0423-4f0d-a417-1276c93397fb",
     "origin": "Delegated (Office 365 Information Protection)",
-    "value": "RbacTenantStatus.Read"
-  },
-  {
-    "description": "c",
-    "displayName": "ThreatSubmission.ReadWrite.All",
-    "id": "944c8d5a-fdcd-4aac-af4d-3366942700d5",
-    "origin": "Application (Office 365 Information Protection)",
-    "value": "ThreatSubmission.ReadWrite.All"
+    "value": "TenantLicenseStatus.Read.All"
   },
   {
     "description": "c",
@@ -9302,13 +9302,6 @@
     "origin": "Delegated (Office 365 Information Protection)",
     "value": "alert.read"
   },
-  {
-    "description": "c",
-    "displayName": "RemediationEmailResult.ReadWrite.All",
-    "id": "dac43cb8-9b13-43b1-bc17-e7eb8fe26717",
-    "origin": "Application (Office 365 Information Protection)",
-    "value": "RemediationEmailResult.ReadWrite.All"
-  },
   {
     "description": "This allows user to change Office 365 alerts.",
     "displayName": "alert.write",
@@ -9316,6 +9309,13 @@
     "origin": "Delegated (Office 365 Information Protection)",
     "value": "alert.write"
   },
+  {
+    "description": "AtpStandardPolicy.Tenant.Read",
+    "displayName": "AtpStandardPolicy.Tenant.Read",
+    "id": "b87cb2cc-0570-4e76-9606-3528d5fb44e7",
+    "origin": "Delegated (Office 365 Information Protection)",
+    "value": "AtpStandardPolicy.Tenant.Read"
+  },
   {
     "description": "AtpStandardPolicy.Tenant.Write",
     "displayName": "AtpStandardPolicy.Tenant.Write",
@@ -9323,13 +9323,6 @@
     "origin": "Delegated (Office 365 Information Protection)",
     "value": "AtpStandardPolicy.Tenant.Write"
   },
-  {
-    "description": "LabelAnalyticsActivityData.Read.All",
-    "displayName": "LabelAnalyticsActivityData.Read.All",
-    "id": "2da9421b-01d5-43ec-9c8e-b1bfa4a8b2bb",
-    "origin": "Delegated (Office 365 Information Protection)",
-    "value": "LabelAnalyticsActivityData.Read.All"
-  },
   {
     "description": "This allows user to read M365ContentExplorer",
     "displayName": "M365ContentExplorer.Read.All",
@@ -9359,18 +9352,39 @@
     "value": "RbacAccessCheck.read"
   },
   {
-    "description": "AtpStandardPolicy.Tenant.Read",
-    "displayName": "AtpStandardPolicy.Tenant.Read",
-    "id": "b87cb2cc-0570-4e76-9606-3528d5fb44e7",
+    "description": "RbacTenantStatus.Read",
+    "displayName": "RbacTenantStatus.Read",
+    "id": "edfd2d1c-b4b5-4b83-b5e8-c38594e49c26",
     "origin": "Delegated (Office 365 Information Protection)",
-    "value": "AtpStandardPolicy.Tenant.Read"
+    "value": "RbacTenantStatus.Read"
+  },
+  {
+    "description": "RbacTenantStatus.Write",
+    "displayName": "RbacTenantStatus.Write",
+    "id": "4e26c42d-fab0-4daa-9ea6-d860a28aa7d0",
+    "origin": "Delegated (Office 365 Information Protection)",
+    "value": "RbacTenantStatus.Write"
+  },
+  {
+    "description": "LabelAnalyticsActivityData.Read.All",
+    "displayName": "LabelAnalyticsActivityData.Read.All",
+    "id": "2da9421b-01d5-43ec-9c8e-b1bfa4a8b2bb",
+    "origin": "Delegated (Office 365 Information Protection)",
+    "value": "LabelAnalyticsActivityData.Read.All"
   },
   {
-    "description": "Allows the app to manage restricted resources based on the other permissions granted to the app, on behalf of the signed-in user.",
-    "displayName": "Manage restricted resources in the directory",
-    "id": "cba5390f-ed6a-4b7f-b657-0efc2210ed20",
-    "origin": "Delegated",
-    "value": "Directory.Write.Restricted"
+    "description": "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export and remove external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.",
+    "displayName": "Read shared cross-tenant user profile and export or delete data",
+    "id": "eed0129d-dc60-4f30-8641-daf337a39ffd",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "CrossTenantUserProfileSharing.ReadWrite"
+  },
+  {
+    "description": "Allows the application to list and query any shared user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), for any user associated with the current tenant on behalf of the signed-in user.",
+    "displayName": "Read all shared cross-tenant user profiles and export their data",
+    "id": "759dcd16-3c90-463c-937e-abf89f991c18",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "CrossTenantUserProfileSharing.Read.All"
   },
   {
     "description": "Allows the application to list and query user profile information associated with the current tenant on behalf of the signed-in user.  It also permits the application to export external user data (e.g. customer content or system-generated logs), associated with the current tenant on behalf of the signed-in user.",
@@ -9379,20 +9393,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "CrossTenantUserProfileSharing.Read"
   },
-  {
-    "description": "Allows the app to read and write organization-wide copilot limited mode setting on behalf of the signed-in user.",
-    "displayName": "Read and write organization-wide copilot limited mode setting",
-    "id": "4704e5b2-0ada-4aa0-b18c-00ad7525bc06",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "CopilotSettings-LimitedMode.ReadWrite"
-  },
-  {
-    "description": "View discovery alerts, reports, apps, and other related information",
-    "displayName": "discovery.read",
-    "id": "e9aa7b67-ea0d-435b-ab36-592cd9b23d61",
-    "origin": "Application (Microsoft Cloud App Security)",
-    "value": "discovery.read"
-  },
   {
     "description": "Manage alerts, activities, policies, and other investigation-related information",
     "displayName": "investigation.manage",
@@ -9428,6 +9428,13 @@
     "origin": "Delegated (Microsoft Cloud App Security)",
     "value": "discovery.manage"
   },
+  {
+    "description": "View discovery alerts, reports, apps, and other related information",
+    "displayName": "discovery.read",
+    "id": "e9aa7b67-ea0d-435b-ab36-592cd9b23d61",
+    "origin": "Delegated (Microsoft Cloud App Security)",
+    "value": "discovery.read"
+  },
   {
     "description": "Allows the application to access the Cognitive Services API acting as users in the organization.",
     "displayName": "Access Cognitive Services API as organization users.",
@@ -9478,25 +9485,18 @@
     "value": "dds.register"
   },
   {
-    "description": "This scope allows working with Microsoft Project Arcadia Workspaces' Artifacts API.",
-    "displayName": "workspaceartifacts.management",
-    "id": "f99087ab-db8f-46be-8ff0-613ef11c6ed8",
-    "origin": "Delegated (Microsoft Azure Synapse Gateway)",
-    "value": "workspaceartifacts.management"
-  },
-  {
-    "description": "Allows read and write access to cluster node level actions, between the Azure Stack HCI cluster node and the cloud",
-    "displayName": "Read and write access to cluster node level actions",
-    "id": "bbe8afc9-f3ba-4955-bb5f-1cfb6960b242",
-    "origin": "Application (Microsoft Azure Stack HCI Service)",
-    "value": "AzureStackHCI.ClusterNode.ReadWrite"
+    "description": "Scope to allow FirstParty APPS to make PolicySync calls",
+    "displayName": "EopPolicySync.AccessAsApp",
+    "id": "c79b0778-99a8-4d45-9063-3f160ec2776d",
+    "origin": "Application (Microsoft Exchange Online Protection)",
+    "value": "EopPolicySync.AccessAsApp"
   },
   {
-    "description": "This allows users to install a new MDATP network scan agent",
-    "displayName": "NetworkScanAgent.Manage",
-    "id": "c65f274d-9690-45ee-a2ec-09e1e1f81bcd",
-    "origin": "Delegated (MDATPNetworkScanAgent)",
-    "value": "NetworkScanAgent.Manage"
+    "description": "Stream Analytics access to Power BI",
+    "displayName": "Stream Analytics access to Power BI",
+    "id": "27fa5b85-cf15-41f1-a29d-2e44dde75208",
+    "origin": "Delegated (Microsoft Azure Stream Analytics)",
+    "value": "user_impersonation"
   },
   {
     "description": "c",
@@ -9611,18 +9611,18 @@
     "value": "AzureStackHCI.ClusterNode.Read"
   },
   {
-    "description": "Stream Analytics access to Power BI",
-    "displayName": "Stream Analytics access to Power BI",
-    "id": "27fa5b85-cf15-41f1-a29d-2e44dde75208",
-    "origin": "Delegated (Microsoft Azure Stream Analytics)",
-    "value": "user_impersonation"
+    "description": "Allows read and write access to cluster node level actions, between the Azure Stack HCI cluster node and the cloud",
+    "displayName": "Read and write access to cluster node level actions",
+    "id": "bbe8afc9-f3ba-4955-bb5f-1cfb6960b242",
+    "origin": "Application (Microsoft Azure Stack HCI Service)",
+    "value": "AzureStackHCI.ClusterNode.ReadWrite"
   },
   {
-    "description": "Scope to allow FirstParty APPS to make PolicySync calls",
-    "displayName": "EopPolicySync.AccessAsApp",
-    "id": "c79b0778-99a8-4d45-9063-3f160ec2776d",
-    "origin": "Application (Microsoft Exchange Online Protection)",
-    "value": "EopPolicySync.AccessAsApp"
+    "description": "This scope allows working with Microsoft Project Arcadia Workspaces' Artifacts API.",
+    "displayName": "workspaceartifacts.management",
+    "id": "f99087ab-db8f-46be-8ff0-613ef11c6ed8",
+    "origin": "Delegated (Microsoft Azure Synapse Gateway)",
+    "value": "workspaceartifacts.management"
   },
   {
     "description": "c",
@@ -9639,11 +9639,11 @@
     "value": "ThreatSubmission.ReadWrite.All"
   },
   {
-    "description": "Allows the client to read, update, create, and delete agent identities without a signed-in user.",
-    "displayName": "Read and write all agent identities",
-    "id": "dcf7150a-88d4-4fe6-9be1-c2744c455397",
+    "description": "Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user.",
+    "displayName": "Read all access reviews",
+    "id": "d07a8cc0-3d51-4b77-b3b0-32704d1f69fa",
     "origin": "Application (Microsoft Graph)",
-    "value": "AgentIdentity.ReadWrite.All"
+    "value": "AccessReview.Read.All"
   },
   {
     "description": "Allows updating agent identity blueprint credentials without a signed-in user.",
@@ -9757,6 +9757,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "AgentInstance.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to create, read, update, and delete agent instances that designate the calling app as their manager in your organization's Agent Registry without a signed-in user.",
+    "displayName": "Read and write managed-by agent instances in Agent Registry",
+    "id": "782ab1bf-24f1-4c27-8bbc-2006d42792a6",
+    "origin": "Application (Microsoft Graph)",
+    "value": "AgentInstance.ReadWrite.ManagedBy"
+  },
+  {
+    "description": "Allows the client to read, update, create, and delete agent identities without a signed-in user.",
+    "displayName": "Read and write all agent identities",
+    "id": "dcf7150a-88d4-4fe6-9be1-c2744c455397",
+    "origin": "Application (Microsoft Graph)",
+    "value": "AgentIdentity.ReadWrite.All"
+  },
   {
     "description": "Allows the app to read all agent identities without a signed-in user.",
     "displayName": "Read all agent identities",
@@ -9778,20 +9792,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "AgentIdentity.DeleteRestore.All"
   },
-  {
-    "description": "Allows the app to create agent identities as the parent agent identity blueprint and fully manage them, including reading, updating, and deleting, without a signed-in user.",
-    "displayName": "Create and manage agent identities as the parent agent identity blueprint",
-    "id": "4c390976-b2b7-42e0-9187-c6be3bead001",
-    "origin": "Application (Microsoft Graph)",
-    "value": "AgentIdentity.CreateAsManager"
-  },
-  {
-    "description": "Allows the app to read access reviews, reviewers, decisions and settings in the organization, without a signed-in user.",
-    "displayName": "Read all access reviews",
-    "id": "d07a8cc0-3d51-4b77-b3b0-32704d1f69fa",
-    "origin": "Application (Microsoft Graph)",
-    "value": "AccessReview.Read.All"
-  },
   {
     "description": "Allows the app to read, update, delete and perform actions on access reviews, reviewers, decisions and settings in the organization, without a signed-in user.",
     "displayName": "Manage all access reviews",
@@ -9841,13 +9841,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "AgentCard.ReadWrite.All"
   },
-  {
-    "description": "Used to get token for agent to get network scan tasks",
-    "displayName": "NetworkScanAgent.Operate",
-    "id": "2adb0da9-d999-4186-85a4-0b66bbd9a535",
-    "origin": "Application (MDATPNetworkScanAgent)",
-    "value": "NetworkScanAgent.Operate"
-  },
   {
     "description": "Allows the app to read and update agent cards that designate the calling app as their manager and manage their skills in your organization's Agent Registry without a signed-in user.",
     "displayName": "Read and write managed-by agent cards in Agent Registry",
@@ -9856,11 +9849,18 @@
     "value": "AgentCard.ReadWrite.ManagedBy"
   },
   {
-    "description": "Allows the app to read and write to all agent card manifests in your organization's Agent Registry without a signed-in user.",
-    "displayName": "Read and write all agent card manifests in Agent Registry",
-    "id": "228b1a03-f7ca-4348-b50d-e8a547ab61af",
+    "description": "This allows users to install a new MDATP network scan agent",
+    "displayName": "NetworkScanAgent.Manage",
+    "id": "c65f274d-9690-45ee-a2ec-09e1e1f81bcd",
+    "origin": "Delegated (MDATPNetworkScanAgent)",
+    "value": "NetworkScanAgent.Manage"
+  },
+  {
+    "description": "Allows the app to read all agent card manifests in your organization's Agent Registry without a signed-in user.",
+    "displayName": "Read all agent card manifests in Agent Registry",
+    "id": "3ee18438-e6e5-4858-8f1c-d7b723b45213",
     "origin": "Application (Microsoft Graph)",
-    "value": "AgentCardManifest.ReadWrite.All"
+    "value": "AgentCardManifest.Read.All"
   },
   {
     "description": "Allows the app to read and write agent card manifests that name it as manager in your organization's Agent Registry without a signed-in user.",
@@ -9912,18 +9912,25 @@
     "value": "AgentIdentity.Create.All"
   },
   {
-    "description": "Allows the app to read all agent card manifests in your organization's Agent Registry without a signed-in user.",
-    "displayName": "Read all agent card manifests in Agent Registry",
-    "id": "3ee18438-e6e5-4858-8f1c-d7b723b45213",
+    "description": "Allows the app to create agent identities as the parent agent identity blueprint and fully manage them, including reading, updating, and deleting, without a signed-in user.",
+    "displayName": "Create and manage agent identities as the parent agent identity blueprint",
+    "id": "4c390976-b2b7-42e0-9187-c6be3bead001",
     "origin": "Application (Microsoft Graph)",
-    "value": "AgentCardManifest.Read.All"
+    "value": "AgentIdentity.CreateAsManager"
   },
   {
-    "description": "Allows the app to create, read, update, and delete agent instances that designate the calling app as their manager in your organization's Agent Registry without a signed-in user.",
-    "displayName": "Read and write managed-by agent instances in Agent Registry",
-    "id": "782ab1bf-24f1-4c27-8bbc-2006d42792a6",
+    "description": "Allows the app to read and write to all agent card manifests in your organization's Agent Registry without a signed-in user.",
+    "displayName": "Read and write all agent card manifests in Agent Registry",
+    "id": "228b1a03-f7ca-4348-b50d-e8a547ab61af",
     "origin": "Application (Microsoft Graph)",
-    "value": "AgentInstance.ReadWrite.ManagedBy"
+    "value": "AgentCardManifest.ReadWrite.All"
+  },
+  {
+    "description": "Used to get token for agent to get network scan tasks",
+    "displayName": "NetworkScanAgent.Operate",
+    "id": "2adb0da9-d999-4186-85a4-0b66bbd9a535",
+    "origin": "Application (MDATPNetworkScanAgent)",
+    "value": "NetworkScanAgent.Operate"
   },
   {
     "description": "Allows an application to read or write Customer Key Encryption Tenant Data",
@@ -9933,11 +9940,11 @@
     "value": "CustomerKeyTenant-Internal.ReadWrite.All"
   },
   {
-    "description": "Allows the uesr to Read and Write DiscoveryGroup, on behalf of the signed-in user.",
-    "displayName": "Read and Write DiscoveryGroup",
-    "id": "ff3b7cad-a709-4b6f-9304-862191f23ff6",
-    "origin": "Delegated (EASM API)",
-    "value": "DiscoveryGroup.ReadWrite.All"
+    "description": "Allows an application to read or write Microsoft Managed Key Data",
+    "displayName": "Read or Write Microsoft Managed Key Data",
+    "id": "ac23b270-1dc3-4ee4-bd56-d7eb945c2332",
+    "origin": "Application (M365DataAtRestEncryption)",
+    "value": "MicrosoftManagedKey-Internal.ReadWrite.All"
   },
   {
     "description": "Allows the user to read Discovery Run, on behalf of the signed-in user.",
@@ -10051,13 +10058,6 @@
     "origin": "Delegated (Fiji Storage)",
     "value": "user_impersonation"
   },
-  {
-    "description": "Allows the user to read DiscoveryGroup, on behalf of the signed-in user.",
-    "displayName": "Read DiscoveryGroup information",
-    "id": "034f2362-c46e-4e6b-9905-c23d1b928bce",
-    "origin": "Delegated (EASM API)",
-    "value": "DiscoveryGroup.Read.All"
-  },
   {
     "description": "Allow applications to access Genome RP API on behalf of the signed-in user",
     "displayName": "Access Genome RP API as the signed-in user",
@@ -10065,6 +10065,20 @@
     "origin": "Delegated (Genome RP API)",
     "value": "access_as_user"
   },
+  {
+    "description": "Allows the uesr to Read and Write DiscoveryGroup, on behalf of the signed-in user.",
+    "displayName": "Read and Write DiscoveryGroup",
+    "id": "ff3b7cad-a709-4b6f-9304-862191f23ff6",
+    "origin": "Delegated (EASM API)",
+    "value": "DiscoveryGroup.ReadWrite.All"
+  },
+  {
+    "description": "Allows the user to read DiscoveryGroup, on behalf of the signed-in user.",
+    "displayName": "Read DiscoveryGroup information",
+    "id": "034f2362-c46e-4e6b-9905-c23d1b928bce",
+    "origin": "Delegated (EASM API)",
+    "value": "DiscoveryGroup.Read.All"
+  },
   {
     "description": "Allows the uesr to Read and Write Asset Resource, on behalf of the signed-in user.",
     "displayName": "Read and Write Asset Resource",
@@ -10073,11 +10087,11 @@
     "value": "AssetResource.ReadWrite.All"
   },
   {
-    "description": "Dynamics 365 is a business management solution that’s connecting people and processes like never before. From day one, it makes ordering, selling, invoicing, and reporting easier and faster.",
-    "displayName": "Access as the signed-in user",
-    "id": "bce0976a-cb0b-473b-8800-84eda9f8e447",
-    "origin": "Delegated (Dynamics 365 Business Central)",
-    "value": "user_impersonation"
+    "description": "Allows the user to read Asset Resource, including asset resource, asset audit trails, asset summary and asset snapshot, on behalf of the signed-in user.",
+    "displayName": "Read Asset Resource information",
+    "id": "2288f070-b471-48c3-b16b-113c05a3cfbb",
+    "origin": "Delegated (EASM API)",
+    "value": "AssetResource.Read.All"
   },
   {
     "description": "This allows app to access test tenant data",
@@ -10135,6 +10149,13 @@
     "origin": "Delegated (DTS-Authentication)",
     "value": "Manage"
   },
+  {
+    "description": "Allows the app to read all external connections without a signed-in user.",
+    "displayName": "ExternalConnection.Read.All",
+    "id": "1ef94f6e-ade0-4b79-9f7f-a72563e3ad60",
+    "origin": "Application (Graph Connector Service)",
+    "value": "ExternalConnection.Read.All"
+  },
   {
     "description": "Allow raising events to orchestrations",
     "displayName": "Raise Events",
@@ -10142,13 +10163,6 @@
     "origin": "Delegated (DTS-Authentication)",
     "value": "RaiseEvents"
   },
-  {
-    "description": "Get or list orchestrations, including data payloads",
-    "displayName": "Read All",
-    "id": "770cc82b-17ad-4de5-b79d-6ea1a7d2b7f2",
-    "origin": "Delegated (DTS-Authentication)",
-    "value": "Read.All"
-  },
   {
     "description": "Get or lists orchestration metadata, but does not allow returning data payloads",
     "displayName": "Read Metadata",
@@ -10199,39 +10213,39 @@
     "value": "Financials.ReadWrite.All"
   },
   {
-    "description": "Allows the user to read Asset Resource, including asset resource, asset audit trails, asset summary and asset snapshot, on behalf of the signed-in user.",
-    "displayName": "Read Asset Resource information",
-    "id": "2288f070-b471-48c3-b16b-113c05a3cfbb",
-    "origin": "Delegated (EASM API)",
-    "value": "AssetResource.Read.All"
+    "description": "Dynamics 365 is a business management solution that’s connecting people and processes like never before. From day one, it makes ordering, selling, invoicing, and reporting easier and faster.",
+    "displayName": "Access as the signed-in user",
+    "id": "bce0976a-cb0b-473b-8800-84eda9f8e447",
+    "origin": "Delegated (Dynamics 365 Business Central)",
+    "value": "user_impersonation"
   },
   {
-    "description": "Allows the app to read all external connections without a signed-in user.",
-    "displayName": "ExternalConnection.Read.All",
-    "id": "1ef94f6e-ade0-4b79-9f7f-a72563e3ad60",
-    "origin": "Application (Graph Connector Service)",
-    "value": "ExternalConnection.Read.All"
+    "description": "Get or list orchestrations, including data payloads",
+    "displayName": "Read All",
+    "id": "770cc82b-17ad-4de5-b79d-6ea1a7d2b7f2",
+    "origin": "Delegated (DTS-Authentication)",
+    "value": "Read.All"
+  },
+  {
+    "description": "Allows the app to read agent registration information without a signed-in user.",
+    "displayName": "Read all agent registrations",
+    "id": "d3acceb6-4673-47c0-aeac-582f2c7cf72c",
+    "origin": "Application (Microsoft Graph)",
+    "value": "AgentRegistration.Read.All"
   },
   {
     "description": "Allows the app to read external connections without a signed-in user. The app can only read external connections that it is authorized to. ",
     "displayName": "ExternalConnection.Read.OwnedBy",
     "id": "6ed7b42a-d211-4a23-9d86-4ad9bb3cd8c9",
     "origin": "Application (Graph Connector Service)",
-    "value": "ExternalConnection.Read.OwnedBy"
-  },
-  {
-    "description": "Allows the app to read and write all external connections without a signed-in user.",
-    "displayName": "ExternalConnection.ReadWrite.All",
-    "id": "296c3066-18b3-4977-9e2b-9d2ca1fda62c",
-    "origin": "Application (Graph Connector Service)",
-    "value": "ExternalConnection.ReadWrite.All"
+    "value": "ExternalConnection.Read.OwnedBy"
   },
   {
-    "description": "Invoke Diagnostics",
-    "displayName": "Invoke Diagnostics",
-    "id": "8040cfef-0635-4aa6-b099-9f40d6866bbb",
-    "origin": "Delegated (IAM Supportability)",
-    "value": "invoke"
+    "description": "Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections. ",
+    "displayName": "ExternalConnection.ReadWrite.OwnedBy",
+    "id": "f4601885-7fd6-4ade-9175-09e03e5bc85c",
+    "origin": "Application (Graph Connector Service)",
+    "value": "ExternalConnection.ReadWrite.OwnedBy"
   },
   {
     "description": "Allow the application to access Dynamics 365 Recommendations on behalf of the signed-in user.",
@@ -10345,6 +10359,13 @@
     "origin": "Application (M365DataAtRestEncryption)",
     "value": "CustomerKeyTenant-Internal.Delete.All"
   },
+  {
+    "description": "Invoke Diagnostics",
+    "displayName": "Invoke Diagnostics",
+    "id": "8040cfef-0635-4aa6-b099-9f40d6866bbb",
+    "origin": "Delegated (IAM Supportability)",
+    "value": "invoke"
+  },
   {
     "description": "Allow Healthcare Agent Service APIs to process the data sent to it.",
     "displayName": "Healthcare Agent Service APIs Process",
@@ -10366,20 +10387,6 @@
     "origin": "Delegated (Graph Connector Service)",
     "value": "WebhookData.Read.All"
   },
-  {
-    "description": "Allows the app to discover and execute Copilot connector MCP tools on behalf of the signed-in user.",
-    "displayName": "Execute Copilot connector MCP tools as the signed-in user",
-    "id": "4f1e0c5f-7d24-4c8e-9a7b-3c2d1e0f5a61",
-    "origin": "Delegated (Graph Connector Service)",
-    "value": "McpTools.Execute"
-  },
-  {
-    "description": "Allows the app to read and write external connections without a signed-in user. The app can only read and write external connections that it is authorized to, or it can create new external connections. ",
-    "displayName": "ExternalConnection.ReadWrite.OwnedBy",
-    "id": "f4601885-7fd6-4ade-9175-09e03e5bc85c",
-    "origin": "Application (Graph Connector Service)",
-    "value": "ExternalConnection.ReadWrite.OwnedBy"
-  },
   {
     "description": "Allows the app to read settings of external connections without a signed-in user. The app can only read settings of connections that it is authorized to. ",
     "displayName": "ExternalConnectionSetting.Read.OwnedBy",
@@ -10429,13 +10436,6 @@
     "origin": "Application (Graph Connector Service)",
     "value": "WebhookData.Read.All"
   },
-  {
-    "description": "Allows an application to read or write Microsoft Managed Key Data",
-    "displayName": "Read or Write Microsoft Managed Key Data",
-    "id": "ac23b270-1dc3-4ee4-bd56-d7eb945c2332",
-    "origin": "Application (M365DataAtRestEncryption)",
-    "value": "MicrosoftManagedKey-Internal.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read all external connections on behalf of a signed-in user. The signed-in user must be an administrator.",
     "displayName": "ExternalConnection.Read.All",
@@ -10444,12 +10444,19 @@
     "value": "ExternalConnection.Read.All"
   },
   {
-    "description": "Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator.",
+    "description": "Allows the app to read and write all external connections without a signed-in user.",
     "displayName": "ExternalConnection.ReadWrite.All",
-    "id": "d44774bd-e26c-43b1-996d-51bb90a9078e",
-    "origin": "Delegated (Graph Connector Service)",
+    "id": "296c3066-18b3-4977-9e2b-9d2ca1fda62c",
+    "origin": "Application (Graph Connector Service)",
     "value": "ExternalConnection.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external connections that it is authorized to. ",
+    "displayName": "ExternalConnection.Read.OwnedBy",
+    "id": "039455a3-0a80-4713-841a-f87a5d43bee9",
+    "origin": "Delegated (Graph Connector Service)",
+    "value": "ExternalConnection.Read.OwnedBy"
+  },
   {
     "description": "Allows the app to read and write external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read and write external connections that it is authorized to, or it can create new external connections. ",
     "displayName": "ExternalConnection.ReadWrite.OwnedBy",
@@ -10493,18 +10500,25 @@
     "value": "ExternalItem.ReadWrite.OwnedBy"
   },
   {
-    "description": "Allows the app to read external connections on behalf of a signed-in user. The signed-in user must be an administrator. The app can only read external connections that it is authorized to. ",
-    "displayName": "ExternalConnection.Read.OwnedBy",
-    "id": "039455a3-0a80-4713-841a-f87a5d43bee9",
+    "description": "Allows the app to discover and execute Copilot connector MCP tools on behalf of the signed-in user.",
+    "displayName": "Execute Copilot connector MCP tools as the signed-in user",
+    "id": "4f1e0c5f-7d24-4c8e-9a7b-3c2d1e0f5a61",
     "origin": "Delegated (Graph Connector Service)",
-    "value": "ExternalConnection.Read.OwnedBy"
+    "value": "McpTools.Execute"
   },
   {
-    "description": "Allows the app to read agent registration information without a signed-in user.",
-    "displayName": "Read all agent registrations",
-    "id": "d3acceb6-4673-47c0-aeac-582f2c7cf72c",
-    "origin": "Application (Microsoft Graph)",
-    "value": "AgentRegistration.Read.All"
+    "description": "Allows the app to read and write all external connections on behalf of a signed-in user. The signed-in user must be an administrator.",
+    "displayName": "ExternalConnection.ReadWrite.All",
+    "id": "d44774bd-e26c-43b1-996d-51bb90a9078e",
+    "origin": "Delegated (Graph Connector Service)",
+    "value": "ExternalConnection.ReadWrite.All"
+  },
+  {
+    "description": "This allows app to run ppe tenant userscope in DLS",
+    "displayName": "UserScope-PPE.ReadWrite.All",
+    "id": "60f89623-e4c0-4fbd-84c6-a7f1e4108959",
+    "origin": "Application (DirectoryLookupService)",
+    "value": "UserScope-PPE.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and write agent registration information without a signed-in user.",
@@ -10514,11 +10528,11 @@
     "value": "AgentRegistration.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read terms of use agreements, without a signed in user.",
-    "displayName": "Read all terms of use agreements",
-    "id": "2f3e6f8c-093b-4c57-a58b-ba5ce494a169",
+    "description": "Allows the app to read and write terms of use agreements, without a signed in user.",
+    "displayName": "Read and write all terms of use agreements",
+    "id": "c9090d00-6101-42f0-a729-c41074260d47",
     "origin": "Application (Microsoft Graph)",
-    "value": "Agreement.Read.All"
+    "value": "Agreement.ReadWrite.All"
   },
   {
     "description": "Allows the app to update the on-premises sync behavior of all contacts in all mailboxes without a signed-in user.",
@@ -10640,25 +10654,18 @@
     "value": "CustomDetection.Read.All"
   },
   {
-    "description": "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.",
-    "displayName": "Read and write all consent requests",
-    "id": "9f1b81a7-0223-4428-bfa4-0bcb5535f27d",
-    "origin": "Application (Microsoft Graph)",
-    "value": "ConsentRequest.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read and write all Configuration Monitoring entities, without a signed-in user.",
-    "displayName": "Read and write all Configuration Monitoring entities",
-    "id": "cfa85bfb-2ee8-4e13-8e7f-489e57a015a1",
+    "description": "Allows the app to read and write custom detection rules without a signed-in user.",
+    "displayName": "Read and write all custom detection rules",
+    "id": "e0fd9c8d-a12e-4cc9-9827-20c8c3cd6fb8",
     "origin": "Application (Microsoft Graph)",
-    "value": "ConfigurationMonitoring.ReadWrite.All"
+    "value": "CustomDetection.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.",
-    "displayName": "Read all chat messages for chats where the associated Teams application is installed.",
-    "id": "1c1b4c8e-3cc7-4c58-8470-9b92c9d5848b",
+    "description": "Allows the app to read consent requests and approvals without a signed-in user.",
+    "displayName": "Read all consent requests",
+    "id": "1260ad83-98fb-4785-abbb-d6cc1806fd41",
     "origin": "Application (Microsoft Graph)",
-    "value": "Chat.Read.WhereInstalled"
+    "value": "ConsentRequest.Read.All"
   },
   {
     "description": "Read names and members of all one-to-one and group chats in Microsoft Teams, without a signed-in user.",
@@ -10773,18 +10780,18 @@
     "value": "ConfigurationMonitoring.Read.All"
   },
   {
-    "description": "Allows the app to read consent requests and approvals without a signed-in user.",
-    "displayName": "Read all consent requests",
-    "id": "1260ad83-98fb-4785-abbb-d6cc1806fd41",
+    "description": "Allows the app to read and write all Configuration Monitoring entities, without a signed-in user.",
+    "displayName": "Read and write all Configuration Monitoring entities",
+    "id": "cfa85bfb-2ee8-4e13-8e7f-489e57a015a1",
     "origin": "Application (Microsoft Graph)",
-    "value": "ConsentRequest.Read.All"
+    "value": "ConfigurationMonitoring.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write custom detection rules without a signed-in user.",
-    "displayName": "Read and write all custom detection rules",
-    "id": "e0fd9c8d-a12e-4cc9-9827-20c8c3cd6fb8",
+    "description": "Allows the app to read app consent requests and approvals, and deny or approve those requests without a signed-in user.",
+    "displayName": "Read and write all consent requests",
+    "id": "9f1b81a7-0223-4428-bfa4-0bcb5535f27d",
     "origin": "Application (Microsoft Graph)",
-    "value": "CustomDetection.ReadWrite.All"
+    "value": "ConsentRequest.ReadWrite.All"
   },
   {
     "description": "Allows the app to read custom security attribute assignments for all principals in the tenant without a signed in user.",
@@ -10801,11 +10808,11 @@
     "value": "CustomSecAttributeAssignment.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write properties of Microsoft Intune-managed deployment plans and their ring configurations, without a signed-in user.",
-    "displayName": "Read and write Microsoft Intune Deployment Plans",
-    "id": "68356fd1-028d-4ce3-b724-241dec11127a",
+    "description": "Allows the app to read all audit logs for events that contain information about custom security attributes, without a signed-in user.",
+    "displayName": "Read all custom security attribute audit logs",
+    "id": "2a4f026d-e829-4e84-bdbf-d981a2703059",
     "origin": "Application (Microsoft Graph)",
-    "value": "DeviceManagementDeploymentPlans.ReadWrite.All"
+    "value": "CustomSecAttributeAuditLogs.Read.All"
   },
   {
     "description": "Allows the app to perform remote high impact actions such as wiping the device or resetting the passcode on devices managed by Microsoft Intune, without a signed-in user.",
@@ -10919,6 +10926,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "DirectoryRecommendations.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read all domain properties without a signed-in user.",
+    "displayName": "Read domains",
+    "id": "dbb9058a-0e50-45d7-ae91-66909b5d4664",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Domain.Read.All"
+  },
+  {
+    "description": "Allows the app to read and write properties of Microsoft Intune-managed deployment plans and their ring configurations, without a signed-in user.",
+    "displayName": "Read and write Microsoft Intune Deployment Plans",
+    "id": "68356fd1-028d-4ce3-b724-241dec11127a",
+    "origin": "Application (Microsoft Graph)",
+    "value": "DeviceManagementDeploymentPlans.ReadWrite.All"
+  },
   {
     "description": "Allows the app to read properties of Microsoft Intune-managed deployment plans and their ring configurations, without a signed-in user.",
     "displayName": "Read Microsoft Intune Deployment Plans",
@@ -10940,20 +10961,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "DeviceManagementConfiguration.Read.All"
   },
-  {
-    "description": "Allows the app to read and write certification authority information without a signed-in user.",
-    "displayName": "Read and write Microsoft Cloud PKI objects",
-    "id": "f15eb2ba-ef8a-4f70-991d-da5d045154e2",
-    "origin": "Application (Microsoft Graph)",
-    "value": "DeviceManagementCloudCA.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read all audit logs for events that contain information about custom security attributes, without a signed-in user.",
-    "displayName": "Read all custom security attribute audit logs",
-    "id": "2a4f026d-e829-4e84-bdbf-d981a2703059",
-    "origin": "Application (Microsoft Graph)",
-    "value": "CustomSecAttributeAuditLogs.Read.All"
-  },
   {
     "description": "Allows the app to read custom security attribute definitions for the tenant without a signed in user.",
     "displayName": "Read custom security attribute definitions",
@@ -11003,13 +11010,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "DelegatedAdminRelationship.Read.All"
   },
-  {
-    "description": "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.",
-    "displayName": "Read all chat messages",
-    "id": "6b7d71aa-70aa-4810-a8d9-5d9fb2830017",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Chat.Read.All"
-  },
   {
     "description": "Allows the app to manage (create-update-terminate) Delegated Admin relationships with customers and role assignments to security groups for active Delegated Admin relationships without a signed-in user.",
     "displayName": "Manage Delegated Admin relationships with customers",
@@ -11018,11 +11018,18 @@
     "value": "DelegatedAdminRelationship.ReadWrite.All"
   },
   {
-    "description": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), without a signed-in user.",
-    "displayName": "Manage all delegated permission grants",
-    "id": "8e8e4742-1d95-4f68-9d56-6ee75648c72a",
+    "description": "Allows the app to read all one-to-one or group chat messages in Microsoft Teams for chats where the associated Teams application is installed, without a signed-in user.",
+    "displayName": "Read all chat messages for chats where the associated Teams application is installed.",
+    "id": "1c1b4c8e-3cc7-4c58-8470-9b92c9d5848b",
     "origin": "Application (Microsoft Graph)",
-    "value": "DelegatedPermissionGrant.ReadWrite.All"
+    "value": "Chat.Read.WhereInstalled"
+  },
+  {
+    "description": "Allows the app to read all delegated permission grants, without a signed-in user.",
+    "displayName": "Read all delegated permission grants",
+    "id": "81b4724a-58aa-41c1-8a55-84ef97466587",
+    "origin": "Application (Microsoft Graph)",
+    "value": "DelegatedPermissionGrant.Read.All"
   },
   {
     "description": "Allows the app to read your organization's devices' configuration information without a signed-in user.",
@@ -11067,11 +11074,25 @@
     "value": "DeviceManagementCloudCA.Read.All"
   },
   {
-    "description": "Allows the app to read all delegated permission grants, without a signed-in user.",
-    "displayName": "Read all delegated permission grants",
-    "id": "81b4724a-58aa-41c1-8a55-84ef97466587",
+    "description": "Allows the app to read and write certification authority information without a signed-in user.",
+    "displayName": "Read and write Microsoft Cloud PKI objects",
+    "id": "f15eb2ba-ef8a-4f70-991d-da5d045154e2",
     "origin": "Application (Microsoft Graph)",
-    "value": "DelegatedPermissionGrant.Read.All"
+    "value": "DeviceManagementCloudCA.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to manage permission grants for delegated permissions exposed by any API (including Microsoft Graph), without a signed-in user.",
+    "displayName": "Manage all delegated permission grants",
+    "id": "8e8e4742-1d95-4f68-9d56-6ee75648c72a",
+    "origin": "Application (Microsoft Graph)",
+    "value": "DelegatedPermissionGrant.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read all 1-to-1 or group chat messages in Microsoft Teams.",
+    "displayName": "Read all chat messages",
+    "id": "6b7d71aa-70aa-4810-a8d9-5d9fb2830017",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Chat.Read.All"
   },
   {
     "description": "Allows the app to delete and recover deleted chats, without a signed-in user.",
@@ -11087,20 +11108,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "Chat.Create"
   },
-  {
-    "description": "Read and write the names, descriptions, and settings of all channels, without a signed-in user.",
-    "displayName": "Read and write the names, descriptions, and settings of all channels",
-    "id": "243cded2-bd16-4fd6-a953-ff8177894c3d",
-    "origin": "Application (Microsoft Graph)",
-    "value": "ChannelSettings.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user",
-    "displayName": "Read audit logs data from Endpoint Data Loss Prevention workload",
-    "id": "0bc85aed-7b0b-437a-bac8-3b29a1b84c99",
-    "origin": "Application (Microsoft Graph)",
-    "value": "AuditLogsQuery-Endpoint.Read.All"
-  },
   {
     "description": "Allows the app to read and query audit logs from Entra (Azure AD) workload, without a signed-in user",
     "displayName": "Read audit logs data from Entra (Azure AD) workload",
@@ -11213,6 +11220,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "BitlockerKey.Read.All"
   },
+  {
+    "description": "Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.",
+    "displayName": "Read all BitLocker keys basic information",
+    "id": "f690d423-6b29-4d04-98c6-694c42282419",
+    "origin": "Application (Microsoft Graph)",
+    "value": "BitlockerKey.ReadBasic.All"
+  },
+  {
+    "description": "Allows the app to read and query audit logs from Endpoint Data Loss Prevention workload, without a signed-in user",
+    "displayName": "Read audit logs data from Endpoint Data Loss Prevention workload",
+    "id": "0bc85aed-7b0b-437a-bac8-3b29a1b84c99",
+    "origin": "Application (Microsoft Graph)",
+    "value": "AuditLogsQuery-Endpoint.Read.All"
+  },
   {
     "description": "Allows the app to read and query audit logs from Dynamics CRM workload, without a signed-in user",
     "displayName": "Read audit logs data from Dynamics CRM workload",
@@ -11234,20 +11255,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "AuditLog.Read.All"
   },
-  {
-    "description": "Allows the application to upload bulk activity audit logs to the audit store.",
-    "displayName": "Upload activity audit logs to the audit store.",
-    "id": "f6318678-2713-4bb6-b123-233e7336c1bd",
-    "origin": "Application (Microsoft Graph)",
-    "value": "AuditActivity.Write"
-  },
-  {
-    "description": "Allows the app to read and write terms of use agreements, without a signed in user.",
-    "displayName": "Read and write all terms of use agreements",
-    "id": "c9090d00-6101-42f0-a729-c41074260d47",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Agreement.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read terms of use acceptance statuses, without a signed in user.",
     "displayName": "Read all terms of use acceptance statuses",
@@ -11292,17 +11299,10 @@
   },
   {
     "description": "Allows the app to read all applications and service principals without a signed-in user.",
-    "displayName": "Read all applications",
-    "id": "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Application.Read.All"
-  },
-  {
-    "description": "Allows an app to read basic BitLocker key properties for all devices, without a signed-in user. Does not allow read of the recovery key.",
-    "displayName": "Read all BitLocker keys basic information",
-    "id": "f690d423-6b29-4d04-98c6-694c42282419",
+    "displayName": "Read all applications",
+    "id": "9a5d68dd-52b0-4cc2-bd40-abcf44ac3a30",
     "origin": "Application (Microsoft Graph)",
-    "value": "BitlockerKey.ReadBasic.All"
+    "value": "Application.Read.All"
   },
   {
     "description": "Allows the app to read and update all apps in your organization, without a signed-in user.",
@@ -11312,11 +11312,18 @@
     "value": "Application.ReadUpdate.All"
   },
   {
-    "description": "Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of.",
-    "displayName": "Manage apps that this app creates or owns",
-    "id": "18a4783c-866b-4cc7-a460-3d5e5662c884",
+    "description": "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.",
+    "displayName": "Manage bookings information",
+    "id": "6b22000a-1228-42ec-88db-b8c00399aecb",
     "origin": "Application (Microsoft Graph)",
-    "value": "Application.ReadWrite.OwnedBy"
+    "value": "Bookings.Manage.All"
+  },
+  {
+    "description": "Allows the app to create, read, update and delete applications and service principals without a signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.",
+    "displayName": "Read and write all applications",
+    "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Application.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and write the remote desktop security configuration for all apps in your organization, without a signed-in user.",
@@ -11368,39 +11375,39 @@
     "value": "AuditActivity.Read"
   },
   {
-    "description": "Allows the app to create, read, update and delete applications and service principals without a signed-in user. Allows management of app role assignments, except those exposed by Microsoft Graph. Does not allow management of delegated permission grants.",
-    "displayName": "Read and write all applications",
-    "id": "1bfefb4e-e0b5-418b-a88f-73c46d2cc8e9",
+    "description": "Allows the application to upload bulk activity audit logs to the audit store.",
+    "displayName": "Upload activity audit logs to the audit store.",
+    "id": "f6318678-2713-4bb6-b123-233e7336c1bd",
     "origin": "Application (Microsoft Graph)",
-    "value": "Application.ReadWrite.All"
+    "value": "AuditActivity.Write"
   },
   {
-    "description": "This allows app to run ppe tenant userscope in DLS",
-    "displayName": "UserScope-PPE.ReadWrite.All",
-    "id": "60f89623-e4c0-4fbd-84c6-a7f1e4108959",
-    "origin": "Application (DirectoryLookupService)",
-    "value": "UserScope-PPE.ReadWrite.All"
+    "description": "Allows the app to create other applications, and fully manage those applications (read, update, update application secrets and delete), without a signed-in user.  It cannot update any apps that it is not an owner of.",
+    "displayName": "Manage apps that this app creates or owns",
+    "id": "18a4783c-866b-4cc7-a460-3d5e5662c884",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Application.ReadWrite.OwnedBy"
   },
   {
-    "description": "Allows an app to read, write and manage bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user.",
-    "displayName": "Manage bookings information",
-    "id": "6b22000a-1228-42ec-88db-b8c00399aecb",
+    "description": "Allows the app to read terms of use agreements, without a signed in user.",
+    "displayName": "Read all terms of use agreements",
+    "id": "2f3e6f8c-093b-4c57-a58b-ba5ce494a169",
     "origin": "Application (Microsoft Graph)",
-    "value": "Bookings.Manage.All"
+    "value": "Agreement.Read.All"
   },
   {
-    "description": "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.",
-    "displayName": "Read and write bookings information",
-    "id": "0c4b2d20-7919-468d-8668-c54b09d4dee8",
+    "description": "Allows an app to read Bookings appointments, businesses, customers, services, and staff without a signed-in user.  ",
+    "displayName": "Read all Bookings related resources.",
+    "id": "6e98f277-b046-4193-a4f2-6bf6a78cd491",
     "origin": "Application (Microsoft Graph)",
-    "value": "Bookings.ReadWrite.All"
+    "value": "Bookings.Read.All"
   },
   {
-    "description": "Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user.",
-    "displayName": "Initiate outgoing 1 to 1 calls from the app",
-    "id": "284383ee-7f6e-4e40-a2a8-e85dcb029101",
+    "description": "Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user.",
+    "displayName": "Read and write all Bookings related resources.",
+    "id": "9769393e-5a9f-4302-9e3d-7e018ecb64a7",
     "origin": "Application (Microsoft Graph)",
-    "value": "Calls.Initiate.All"
+    "value": "BookingsAppointment.ReadWrite.All"
   },
   {
     "description": "Allows the app to place outbound calls to multiple users and add participants to meetings in your organization, without a signed-in user.",
@@ -11514,6 +11521,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "ChannelSettings.Read.All"
   },
+  {
+    "description": "Read and write the names, descriptions, and settings of all channels, without a signed-in user.",
+    "displayName": "Read and write the names, descriptions, and settings of all channels",
+    "id": "243cded2-bd16-4fd6-a953-ff8177894c3d",
+    "origin": "Application (Microsoft Graph)",
+    "value": "ChannelSettings.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to place outbound calls to a single user and transfer calls to users in your organization’s directory, without a signed-in user.",
+    "displayName": "Initiate outgoing 1 to 1 calls from the app",
+    "id": "284383ee-7f6e-4e40-a2a8-e85dcb029101",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Calls.Initiate.All"
+  },
   {
     "description": "Allows the app to get direct access to media streams in a call, without a signed-in user.",
     "displayName": "Access media streams in a call as an app",
@@ -11535,20 +11556,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "CallRecord-PstnCalls.Read.All"
   },
-  {
-    "description": "Allows the app to read call recordings for all calls without a signed-in user.",
-    "displayName": "Read all call recordings",
-    "id": "ce8fb1f1-5e1f-44a0-b102-4ec28454d0dc",
-    "origin": "Application (Microsoft Graph)",
-    "value": "CallRecordings.Read.All"
-  },
-  {
-    "description": "Allows an app to read and write Bookings appointments and customers, and additionally allows reading businesses, services, and staff without a signed-in user.",
-    "displayName": "Read and write all Bookings related resources.",
-    "id": "9769393e-5a9f-4302-9e3d-7e018ecb64a7",
-    "origin": "Application (Microsoft Graph)",
-    "value": "BookingsAppointment.ReadWrite.All"
-  },
   {
     "description": "Allows an app to read all bookmarks without a signed-in user.",
     "displayName": "Read all bookmarks",
@@ -11599,18 +11606,18 @@
     "value": "BusinessScenarioData.ReadWrite.OwnedBy"
   },
   {
-    "description": "Allows an app to read Bookings appointments, businesses, customers, services, and staff without a signed-in user.  ",
-    "displayName": "Read all Bookings related resources.",
-    "id": "6e98f277-b046-4193-a4f2-6bf6a78cd491",
+    "description": "Allows an app to read and write bookings appointments, businesses, customers, services, and staff on behalf of the signed-in user. Does not allow create, delete and publish of booking businesses.",
+    "displayName": "Read and write bookings information",
+    "id": "0c4b2d20-7919-468d-8668-c54b09d4dee8",
     "origin": "Application (Microsoft Graph)",
-    "value": "Bookings.Read.All"
+    "value": "Bookings.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user.",
-    "displayName": "Read basic details of calendars in all mailboxes ",
-    "id": "8ba4a692-bc31-4128-9094-475872af8a53",
+    "description": "Allows the app to read work hours and locations settings, recurrences, and occurrences for all users in the organization, without a signed-in user.",
+    "displayName": "Read all users' work hours and locations",
+    "id": "470229df-a15a-4b08-9d95-8c534862b362",
     "origin": "Application (Microsoft Graph)",
-    "value": "Calendars.ReadBasic.All"
+    "value": "Calendars.Read.All"
   },
   {
     "description": "Allows the app to read, create, update, and delete work hours and locations settings, recurrences, and occurrences for all users in the organization, without a signed-in user.",
@@ -11655,11 +11662,25 @@
     "value": "CallEvents-Emergency.Read.All"
   },
   {
-    "description": "Allows the app to read work hours and locations settings, recurrences, and occurrences for all users in the organization, without a signed-in user.",
-    "displayName": "Read all users' work hours and locations",
-    "id": "470229df-a15a-4b08-9d95-8c534862b362",
+    "description": "Allows the app to read call recordings for all calls without a signed-in user.",
+    "displayName": "Read all call recordings",
+    "id": "ce8fb1f1-5e1f-44a0-b102-4ec28454d0dc",
     "origin": "Application (Microsoft Graph)",
-    "value": "Calendars.Read.All"
+    "value": "CallRecordings.Read.All"
+  },
+  {
+    "description": "Allows the app to read events of all calendars, except for properties such as body, attachments, and extensions, without a signed-in user.",
+    "displayName": "Read basic details of calendars in all mailboxes ",
+    "id": "8ba4a692-bc31-4128-9094-475872af8a53",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Calendars.ReadBasic.All"
+  },
+  {
+    "description": "Allows the app to read and write all domain properties without a signed in user.  Also allows the app to add,  verify and remove domains.",
+    "displayName": "Read and write domains",
+    "id": "7e05723c-0bb0-42da-be95-ae9f08a6e53c",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Domain.ReadWrite.All"
   },
   {
     "description": "Allows calling debugging APIs",
@@ -11668,13 +11689,6 @@
     "origin": "Application (DirectoryLookupService)",
     "value": "UserScope-PPE.Debug.All"
   },
-  {
-    "description": "This allows app to run test tenant userscope in DLS",
-    "displayName": "UserScope-Dev.ReadWrite.All",
-    "id": "dc532015-4941-4351-b852-8781cf87c6e5",
-    "origin": "Application (DirectoryLookupService)",
-    "value": "UserScope-Dev.ReadWrite.All"
-  },
   {
     "description": "Allows calling debugging APIs",
     "displayName": "UserScope-Dev.Debug.All",
@@ -12831,11 +12845,11 @@
     "value": "vso.build"
   },
   {
-    "description": "Allows the app to read all domain properties without a signed-in user.",
-    "displayName": "Read domains",
-    "id": "dbb9058a-0e50-45d7-ae91-66909b5d4664",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Domain.Read.All"
+    "description": "This allows app to run test tenant userscope in DLS",
+    "displayName": "UserScope-Dev.ReadWrite.All",
+    "id": "dc532015-4941-4351-b852-8781cf87c6e5",
+    "origin": "Application (DirectoryLookupService)",
+    "value": "UserScope-Dev.ReadWrite.All"
   },
   {
     "description": "Allows user to read Device resources in their own compartment.",
@@ -13950,13 +13964,6 @@
     "origin": "Delegated (Azure Time Series Insights)",
     "value": "user_impersonation"
   },
-  {
-    "description": "Allows the app to read and write all domain properties without a signed in user.  Also allows the app to add,  verify and remove domains.",
-    "displayName": "Read and write domains",
-    "id": "7e05723c-0bb0-42da-be95-ae9f08a6e53c",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Domain.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read internal federation configuration for a domain.",
     "displayName": "Read internal federation configuration for a domain.",
@@ -13972,11 +13979,11 @@
     "value": "Domain-InternalFederation.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo.",
-    "displayName": "Read all users' basic profiles",
-    "id": "97235f07-e226-4f63-ace3-39588e11d3a1",
+    "description": "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.",
+    "displayName": "Read all eDiscovery objects",
+    "id": "50180013-6191-4d1e-a373-e590ff4e66af",
     "origin": "Application (Microsoft Graph)",
-    "value": "User.ReadBasic.All"
+    "value": "eDiscovery.Read.All"
   },
   {
     "description": "Allows the app to read and update users, without a signed-in user.",
@@ -14076,13 +14083,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "UserAuthMethod-HardwareOATH.Read.All"
   },
-  {
-    "description": "Allows the app to read, update and delete identities that are associated with a user's account, without a signed in user. This controls the identities users can sign-in with.",
-    "displayName": "Manage all users' identities",
-    "id": "c529cfca-c91b-489c-af2b-d92990b66ce6",
-    "origin": "Application (Microsoft Graph)",
-    "value": "User.ManageIdentities.All"
-  },
   {
     "description": "Allows the application to read and write HardwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
     "displayName": "Read and write all users' HardwareOATH authentication methods",
@@ -14091,32 +14091,32 @@
     "value": "UserAuthMethod-HardwareOATH.ReadWrite.All"
   },
   {
-    "description": "Allows the app to invite guest users to the organization, without a signed-in user.",
-    "displayName": "Invite guest users to the organization",
-    "id": "09850681-111b-4a89-9bed-3f2cae46d706",
+    "description": "Allows the application to delete Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify Microsoft Authentication methods.",
+    "displayName": "Delete all users' Microsoft Authentication methods",
+    "id": "ae494ca6-9612-417a-972a-ef52efaf2de3",
     "origin": "Application (Microsoft Graph)",
-    "value": "User.Invite.All"
+    "value": "UserAuthMethod-MicrosoftAuthApp.Delete.All"
   },
   {
-    "description": "Allows the app to enable and disable users' accounts, without a signed-in user.",
-    "displayName": "Enable and disable user accounts",
-    "id": "3011c876-62b7-4ada-afa2-506cbbecc68c",
+    "description": "Allows the app to read a basic set of profile properties of other users in your organization without a signed-in user. Includes display name, first and last name, email address, open extensions, and photo.",
+    "displayName": "Read all users' basic profiles",
+    "id": "97235f07-e226-4f63-ace3-39588e11d3a1",
     "origin": "Application (Microsoft Graph)",
-    "value": "User.EnableDisableAccount.All"
+    "value": "User.ReadBasic.All"
   },
   {
-    "description": "Allows the application to list and read all Tenant Governance relationships without a signed-in user.",
-    "displayName": "Read Tenant Governance relationships",
-    "id": "41c250d0-8793-44e1-a130-5fdbd5bccd0a",
+    "description": "Allows the app to read Microsoft authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' Microsoft authentication methods",
+    "id": "a9c5f16e-e5ca-4e33-89ad-903fcfc01c23",
     "origin": "Application (Microsoft Graph)",
-    "value": "TenantGovernance-Relationship.Read.All"
+    "value": "UserAuthMethod-MicrosoftAuthApp.Read.All"
   },
   {
-    "description": "Allows the application to list and read all Tenant Governance requests without a signed-in user.",
-    "displayName": "Read Tenant Governance requests",
-    "id": "294294d5-2b81-4cf1-837c-28fc22bc3290",
+    "description": "Allows the app to invite guest users to the organization, without a signed-in user.",
+    "displayName": "Invite guest users to the organization",
+    "id": "09850681-111b-4a89-9bed-3f2cae46d706",
     "origin": "Application (Microsoft Graph)",
-    "value": "TenantGovernance-Request.Read.All"
+    "value": "User.Invite.All"
   },
   {
     "description": "Allows the application to read Tenant Governance settings without a signed-in user.",
@@ -14224,18 +14224,18 @@
     "value": "User.DeleteRestore.All"
   },
   {
-    "description": "Allows the application to delete Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify Microsoft Authentication methods.",
-    "displayName": "Delete all users' Microsoft Authentication methods",
-    "id": "ae494ca6-9612-417a-972a-ef52efaf2de3",
+    "description": "Allows the app to enable and disable users' accounts, without a signed-in user.",
+    "displayName": "Enable and disable user accounts",
+    "id": "3011c876-62b7-4ada-afa2-506cbbecc68c",
     "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-MicrosoftAuthApp.Delete.All"
+    "value": "User.EnableDisableAccount.All"
   },
   {
-    "description": "Allows the app to read Microsoft authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' Microsoft authentication methods",
-    "id": "a9c5f16e-e5ca-4e33-89ad-903fcfc01c23",
+    "description": "Allows the app to read, update and delete identities that are associated with a user's account, without a signed in user. This controls the identities users can sign-in with.",
+    "displayName": "Manage all users' identities",
+    "id": "c529cfca-c91b-489c-af2b-d92990b66ce6",
     "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-MicrosoftAuthApp.Read.All"
+    "value": "User.ManageIdentities.All"
   },
   {
     "description": "Allows the application to read and write Microsoft Authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
@@ -14245,18 +14245,18 @@
     "value": "UserAuthMethod-MicrosoftAuthApp.ReadWrite.All"
   },
   {
-    "description": "Allows the application to read and write Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write all users' Temporary Access Pass methods",
-    "id": "627169a8-8c15-451c-861a-5b80e383de5c",
+    "description": "Allows the application to delete passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify passkey authentication methods.",
+    "displayName": "Delete all users' passkey authentication methods",
+    "id": "9563fbd0-03a7-466e-8042-63d668b7d1a3",
     "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-TAP.ReadWrite.All"
+    "value": "UserAuthMethod-Passkey.Delete.All"
   },
   {
-    "description": "Allows the application to delete Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify Windows Hello authentication methods.",
-    "displayName": "Delete all users' Windows Hello authentication methods",
-    "id": "f3197110-aa7f-4acd-a0fd-71981ad68d42",
+    "description": "Allows the app to read passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' passkey authentication methods",
+    "id": "72e00c1d-3e3d-43bb-a0b9-c435611bb1d2",
     "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-WindowsHello.Delete.All"
+    "value": "UserAuthMethod-Passkey.Read.All"
   },
   {
     "description": "Allows the app to read Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
@@ -14361,7 +14361,35 @@
     "displayName": "Read all virtual appointments for users, as authorized by online meetings application access policy",
     "id": "d4f67ec2-59b5-4bdc-b4af-d78f6f9c1954",
     "origin": "Application (Microsoft Graph)",
-    "value": "VirtualAppointment.Read.All"
+    "value": "VirtualAppointment.Read.All"
+  },
+  {
+    "description": "Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.",
+    "displayName": "Read-write all virtual appointments for users, as authorized by online meetings app access policy",
+    "id": "bf46a256-f47d-448f-ab78-f226fff08d40",
+    "origin": "Application (Microsoft Graph)",
+    "value": "VirtualAppointment.ReadWrite.All"
+  },
+  {
+    "description": "Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user's data by the online meetings application access policy.",
+    "displayName": "Send notification regarding virtual appointments as any user",
+    "id": "97e45b36-1250-48e4-bd70-2df6dab7e94a",
+    "origin": "Application (Microsoft Graph)",
+    "value": "VirtualAppointmentNotification.Send"
+  },
+  {
+    "description": "Allows the application to delete Windows Hello authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify Windows Hello authentication methods.",
+    "displayName": "Delete all users' Windows Hello authentication methods",
+    "id": "f3197110-aa7f-4acd-a0fd-71981ad68d42",
+    "origin": "Application (Microsoft Graph)",
+    "value": "UserAuthMethod-WindowsHello.Delete.All"
+  },
+  {
+    "description": "Allows the application to read and write Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write all users' Temporary Access Pass methods",
+    "id": "627169a8-8c15-451c-861a-5b80e383de5c",
+    "origin": "Application (Microsoft Graph)",
+    "value": "UserAuthMethod-TAP.ReadWrite.All"
   },
   {
     "description": "Allows the app to read Temporary Access Pass authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
@@ -14377,34 +14405,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "UserAuthMethod-TAP.Delete.All"
   },
-  {
-    "description": "Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read and write all users' SoftwareOATH methods",
-    "id": "787442d4-3c6e-4e99-aa95-8ccca20a48ff",
-    "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-SoftwareOATH.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' SoftwareOATH methods",
-    "id": "a6b423df-a0c8-411d-a809-a4a5985d2939",
-    "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-SoftwareOATH.Read.All"
-  },
-  {
-    "description": "Allows the application to delete passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify passkey authentication methods.",
-    "displayName": "Delete all users' passkey authentication methods",
-    "id": "9563fbd0-03a7-466e-8042-63d668b7d1a3",
-    "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-Passkey.Delete.All"
-  },
-  {
-    "description": "Allows the app to read passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' passkey authentication methods",
-    "id": "72e00c1d-3e3d-43bb-a0b9-c435611bb1d2",
-    "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-Passkey.Read.All"
-  },
   {
     "description": "Allows the application to read and write passkey authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods",
     "displayName": "Read and write all users' passkey authentication methods",
@@ -14447,13 +14447,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "UserAuthMethod-Phone.ReadWrite.All"
   },
-  {
-    "description": "Allows the application to list and read related tenants information without a signed-in user.",
-    "displayName": "Read related tenants",
-    "id": "7ced9a83-8e7c-46df-b3e0-6b45a6ecedcd",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TenantGovernance-RelatedTenant.Read.All"
-  },
   {
     "description": "Allows the application to delete platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify platform credentials methods.",
     "displayName": "Delete all users' platform credentials methods",
@@ -14461,6 +14454,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "UserAuthMethod-PlatformCred.Delete.All"
   },
+  {
+    "description": "Allows the app to read platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' platform credentials methods",
+    "id": "07c0b1e4-15bd-442f-834b-30f8291388d1",
+    "origin": "Application (Microsoft Graph)",
+    "value": "UserAuthMethod-PlatformCred.Read.All"
+  },
+  {
+    "description": "Allows the application to list and read all Tenant Governance requests without a signed-in user.",
+    "displayName": "Read Tenant Governance requests",
+    "id": "294294d5-2b81-4cf1-837c-28fc22bc3290",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TenantGovernance-Request.Read.All"
+  },
   {
     "description": "Allows the application to read and write platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
     "displayName": "Read and write all users' platform credentials methods",
@@ -14468,13 +14475,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "UserAuthMethod-PlatformCred.ReadWrite.All"
   },
-  {
-    "description": "Allows the application to delete QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify QR authentication methods.",
-    "displayName": "Delete all users' QR authentication methods",
-    "id": "e1c34213-26ac-400b-9548-a749f1b1a4e0",
-    "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-QR.Delete.All"
-  },
   {
     "description": "Allows the app to read QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
     "displayName": "Read all users' QR methods",
@@ -14518,46 +14518,46 @@
     "value": "UserAuthMethod-SoftwareOATH.Delete.All"
   },
   {
-    "description": "Allows the app to read platform credentials methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
-    "displayName": "Read all users' platform credentials methods",
-    "id": "07c0b1e4-15bd-442f-834b-30f8291388d1",
+    "description": "Allows the app to read SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read all users' SoftwareOATH methods",
+    "id": "a6b423df-a0c8-411d-a809-a4a5985d2939",
     "origin": "Application (Microsoft Graph)",
-    "value": "UserAuthMethod-PlatformCred.Read.All"
+    "value": "UserAuthMethod-SoftwareOATH.Read.All"
   },
   {
-    "description": "Allows the application to list and read all Tenant Governance policy templates without a signed-in user.",
-    "displayName": "Read Tenant Governance policy templates",
-    "id": "eb9465d8-e7c0-4301-8e51-927f34ee3134",
+    "description": "Allows the application to read and write SoftwareOATH authentication methods of all users in your organization, without a signed-in user. This does not allow the app to see secret information like passwords, or to sign-in or otherwise use the authentication methods.",
+    "displayName": "Read and write all users' SoftwareOATH methods",
+    "id": "787442d4-3c6e-4e99-aa95-8ccca20a48ff",
     "origin": "Application (Microsoft Graph)",
-    "value": "TenantGovernance-PolicyTemplate.Read.All"
+    "value": "UserAuthMethod-SoftwareOATH.ReadWrite.All"
   },
   {
-    "description": "Allows the application to list and read all Tenant Governance invitations without a signed-in user.",
-    "displayName": "Read Tenant Governance invitations",
-    "id": "3f4f98e9-6faf-4e5f-814b-ed2ed8a4ec9e",
+    "description": "Allows the application to delete QR authentication methods of all users in your organization, without a signed-in user. This does not allow the app to read, create, or modify QR authentication methods.",
+    "displayName": "Delete all users' QR authentication methods",
+    "id": "e1c34213-26ac-400b-9548-a749f1b1a4e0",
     "origin": "Application (Microsoft Graph)",
-    "value": "TenantGovernance-Invitation.Read.All"
+    "value": "UserAuthMethod-QR.Delete.All"
   },
   {
-    "description": "Allows the app to read all group chat or channel targeted messages in Microsoft Teams.",
-    "displayName": "Read all targeted messages of group chat or channel",
-    "id": "b0cfd829-be18-4b31-bb0e-ec1df8197ba3",
+    "description": "Allows the application to list and read all Tenant Governance relationships without a signed-in user.",
+    "displayName": "Read Tenant Governance relationships",
+    "id": "41c250d0-8793-44e1-a130-5fdbd5bccd0a",
     "origin": "Application (Microsoft Graph)",
-    "value": "TeamworkTargetedMessage.Read.All"
+    "value": "TenantGovernance-Relationship.Read.All"
   },
   {
-    "description": "Get a list of all teams, without a signed-in user.",
-    "displayName": "Get a list of all teams",
-    "id": "2280dda6-0bfd-44ee-a2f4-cb867cfc4c1e",
+    "description": "Allows the application to list and read related tenants information without a signed-in user.",
+    "displayName": "Read related tenants",
+    "id": "7ced9a83-8e7c-46df-b3e0-6b45a6ecedcd",
     "origin": "Application (Microsoft Graph)",
-    "value": "Team.ReadBasic.All"
+    "value": "TenantGovernance-RelatedTenant.Read.All"
   },
   {
-    "description": "Read the members of all teams, without a signed-in user.",
-    "displayName": "Read the members of all teams",
-    "id": "660b7406-55f1-41ca-a0ed-0b035e182f3e",
+    "description": "Allows the application to list and read all Tenant Governance policy templates without a signed-in user.",
+    "displayName": "Read Tenant Governance policy templates",
+    "id": "eb9465d8-e7c0-4301-8e51-927f34ee3134",
     "origin": "Application (Microsoft Graph)",
-    "value": "TeamMember.Read.All"
+    "value": "TenantGovernance-PolicyTemplate.Read.All"
   },
   {
     "description": "Add and remove members from all teams, without a signed-in user. Also allows changing a team member's role, for example from owner to non-owner.",
@@ -14665,46 +14665,46 @@
     "value": "TeamsAppInstallation.ReadWriteAndConsentForChat.All"
   },
   {
-    "description": "Allows the app to create teams without a signed-in user. ",
-    "displayName": "Create teams",
-    "id": "23fc2474-f741-46ce-8465-674744c5c361",
+    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams' data.",
+    "displayName": "Manage installation and permission grants of Teams apps for all teams",
+    "id": "b0c13be0-8e20-4bc5-8c55-963c23a39ce9",
     "origin": "Application (Microsoft Graph)",
-    "value": "Team.Create"
+    "value": "TeamsAppInstallation.ReadWriteAndConsentForTeam.All"
   },
   {
-    "description": "Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user",
-    "displayName": "Read and write all users’ tasks and tasklists",
-    "id": "44e666d1-d276-445b-a5fc-8815eeb81d55",
+    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.",
+    "displayName": "Manage installation and permission grants of Teams apps in a user account",
+    "id": "32ca478f-f89e-41d0-aaf8-101deb7da510",
     "origin": "Application (Microsoft Graph)",
-    "value": "Tasks.ReadWrite.All"
+    "value": "TeamsAppInstallation.ReadWriteAndConsentForUser.All"
   },
   {
-    "description": "Allows the app to read all users’ tasks and task lists in your organization, without a signed-in user.",
-    "displayName": "Read all users’ tasks and tasklist",
-    "id": "f10e1f91-74ed-437f-a6fd-d6ae88e26c1f",
+    "description": "Read the members of all teams, without a signed-in user.",
+    "displayName": "Read the members of all teams",
+    "id": "660b7406-55f1-41ca-a0ed-0b035e182f3e",
     "origin": "Application (Microsoft Graph)",
-    "value": "Tasks.Read.All"
+    "value": "TeamMember.Read.All"
   },
   {
-    "description": "Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user.",
-    "displayName": "Upload user data to the identity sync service for apps that this application creates or owns",
-    "id": "25c32ff3-849a-494b-b94f-20a8ac4e6774",
+    "description": "Get a list of all teams, without a signed-in user.",
+    "displayName": "Get a list of all teams",
+    "id": "2280dda6-0bfd-44ee-a2f4-cb867cfc4c1e",
     "origin": "Application (Microsoft Graph)",
-    "value": "SynchronizationData-User.Upload.OwnedBy"
+    "value": "Team.ReadBasic.All"
   },
   {
-    "description": "Allows the app to read, create, edit, and delete all the short notes without a signed-in user.",
-    "displayName": "Read, create, edit, and delete all users' short notes",
-    "id": "842c284c-763d-4a97-838d-79787d129bab",
+    "description": "Allows the app to create teams without a signed-in user. ",
+    "displayName": "Create teams",
+    "id": "23fc2474-f741-46ce-8465-674744c5c361",
     "origin": "Application (Microsoft Graph)",
-    "value": "ShortNotes.ReadWrite.All"
+    "value": "Team.Create"
   },
   {
-    "description": "Allows the app to read your organization's sign-in identifiers, without a signed-in user.",
-    "displayName": "Read all sign-in identifiers",
-    "id": "28e1fe78-598f-4df4-b55e-18bf34218925",
+    "description": "Allows the app to create, read, update and delete all users’ tasks and task lists in your organization, without a signed-in user",
+    "displayName": "Read and write all users’ tasks and tasklists",
+    "id": "44e666d1-d276-445b-a5fc-8815eeb81d55",
     "origin": "Application (Microsoft Graph)",
-    "value": "SignInIdentifier.Read.All"
+    "value": "Tasks.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and write your organization's sign-in identifiers, without a signed-in user.",
@@ -14748,13 +14748,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "Sites.Read.All"
   },
-  {
-    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Gives the ability to manage permission grants for accessing those specific teams' data.",
-    "displayName": "Manage installation and permission grants of Teams apps for all teams",
-    "id": "b0c13be0-8e20-4bc5-8c55-963c23a39ce9",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteAndConsentForTeam.All"
-  },
   {
     "description": "Allows the app to create, read, update, and delete documents and list items in all site collections without a signed in user.",
     "displayName": "Read and write items in all site collections",
@@ -14762,6 +14755,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "Sites.ReadWrite.All"
   },
+  {
+    "description": "Allow the application to access a subset of site collections without a signed in user.  The specific site collections and the permissions granted will be configured in SharePoint Online.",
+    "displayName": "Access selected site collections",
+    "id": "883ea226-0bf2-4a8f-9f9d-92c9162a727d",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Sites.Selected"
+  },
+  {
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats' data.",
+    "displayName": "Allow the Teams app to manage itself and its permission grants for all chats",
+    "id": "ba1ba90b-2d8f-487e-9f16-80728d85bb5c",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForChat.All"
+  },
   {
     "description": "Allows the app to read your organization's SPIFFE trust domains and child resources without a signed in user.",
     "displayName": "Read SPIFFE trust domains and child resources",
@@ -14769,13 +14776,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "SpiffeTrustDomain.Read.All"
   },
-  {
-    "description": "Allows the app to read and write your organization's SPIFFE trust domains and child resources without a signed in user.",
-    "displayName": "Read and write SPIFFE trust domains and child resources",
-    "id": "17b78cfd-eeff-447d-8bab-2795af00055a",
-    "origin": "Application (Microsoft Graph)",
-    "value": "SpiffeTrustDomain.ReadWrite.All"
-  },
   {
     "description": "Allows the app to modify Viva Engage storylines, read all storylines properties, update storyline properties, and delete storyline properties without a signed-in user.",
     "displayName": "Read and write all Viva Engage storylines",
@@ -14819,25 +14819,32 @@
     "value": "SynchronizationData-User.Upload"
   },
   {
-    "description": "Allow the application to access a subset of site collections without a signed in user.  The specific site collections and the permissions granted will be configured in SharePoint Online.",
-    "displayName": "Access selected site collections",
-    "id": "883ea226-0bf2-4a8f-9f9d-92c9162a727d",
+    "description": "Allows the application to upload bulk user data to the identity synchronization service for apps that this application creates or owns, without a signed-in user.",
+    "displayName": "Upload user data to the identity sync service for apps that this application creates or owns",
+    "id": "25c32ff3-849a-494b-b94f-20a8ac4e6774",
     "origin": "Application (Microsoft Graph)",
-    "value": "Sites.Selected"
+    "value": "SynchronizationData-User.Upload.OwnedBy"
   },
   {
-    "description": "Allows the application to read and write virtual appointments for all users, without a signed-in user. The app must also be authorized to access an individual user’s data by the online meetings application access policy.",
-    "displayName": "Read-write all virtual appointments for users, as authorized by online meetings app access policy",
-    "id": "bf46a256-f47d-448f-ab78-f226fff08d40",
+    "description": "Allows the app to read all users’ tasks and task lists in your organization, without a signed-in user.",
+    "displayName": "Read all users’ tasks and tasklist",
+    "id": "f10e1f91-74ed-437f-a6fd-d6ae88e26c1f",
     "origin": "Application (Microsoft Graph)",
-    "value": "VirtualAppointment.ReadWrite.All"
+    "value": "Tasks.Read.All"
   },
   {
-    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in any user account, without a signed-in user. Gives the ability to manage permission grants for accessing those specific users' data.",
-    "displayName": "Manage installation and permission grants of Teams apps in a user account",
-    "id": "32ca478f-f89e-41d0-aaf8-101deb7da510",
+    "description": "Allows the app to read and write your organization's SPIFFE trust domains and child resources without a signed in user.",
+    "displayName": "Read and write SPIFFE trust domains and child resources",
+    "id": "17b78cfd-eeff-447d-8bab-2795af00055a",
     "origin": "Application (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteAndConsentForUser.All"
+    "value": "SpiffeTrustDomain.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read all virtual events without a signed-in user.",
+    "displayName": "Read all users' virtual events",
+    "id": "1dccb351-c4e4-4e09-a8d1-7a9ecbf027cc",
+    "origin": "Application (Microsoft Graph)",
+    "value": "VirtualEvent.Read.All"
   },
   {
     "description": "Allows a Teams app to read, install, upgrade, and uninstall itself for any team, without a signed-in user, and manage its permission grants for accessing those specific teams' data.",
@@ -14847,18 +14854,11 @@
     "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForTeam.All"
   },
   {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any user, without a signed-in user.",
-    "displayName": "Allow the Teams app to manage only its own tabs for all users",
-    "id": "3c42dec6-49e8-4a0a-b469-36cff0d9da93",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamsTab.ReadWriteSelfForUser.All"
-  },
-  {
-    "description": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
-    "displayName": "Read Tenant-Acquired Telephone Number Details",
-    "id": "39b17d18-680c-41f4-b9c2-5f30629e7cb6",
+    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
+    "displayName": "Manage Teams apps for all chats",
+    "id": "9e19bae1-2623-4c4f-ab6e-2664615ff9a0",
     "origin": "Application (Microsoft Graph)",
-    "value": "TeamsTelephoneNumber.Read.All"
+    "value": "TeamsAppInstallation.ReadWriteForChat.All"
   },
   {
     "description": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
@@ -14956,14 +14956,42 @@
     "displayName": "Read tags in Teams",
     "id": "b74fd6c4-4bde-488e-9695-eeb100e4907f",
     "origin": "Application (Microsoft Graph)",
-    "value": "TeamworkTag.Read.All"
+    "value": "TeamworkTag.Read.All"
+  },
+  {
+    "description": "Allows the app to read and write tags in Teams without a signed-in user.",
+    "displayName": "Read and write tags in Teams",
+    "id": "a3371ca5-911d-46d6-901c-42c8c7a937d8",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TeamworkTag.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read all group chat or channel targeted messages in Microsoft Teams.",
+    "displayName": "Read all targeted messages of group chat or channel",
+    "id": "b0cfd829-be18-4b31-bb0e-ec1df8197ba3",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TeamworkTargetedMessage.Read.All"
+  },
+  {
+    "description": "Allows the application to list and read all Tenant Governance invitations without a signed-in user.",
+    "displayName": "Read Tenant Governance invitations",
+    "id": "3f4f98e9-6faf-4e5f-814b-ed2ed8a4ec9e",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TenantGovernance-Invitation.Read.All"
+  },
+  {
+    "description": "Allows the app to read your tenant's acquired telephone number details, without a signed-in user. Acquired telephone numbers may include attributes related to assigned object, emergency location, network site, etc.",
+    "displayName": "Read Tenant-Acquired Telephone Number Details",
+    "id": "39b17d18-680c-41f4-b9c2-5f30629e7cb6",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TeamsTelephoneNumber.Read.All"
   },
   {
-    "description": "Allows the app to read and write tags in Teams without a signed-in user.",
-    "displayName": "Read and write tags in Teams",
-    "id": "a3371ca5-911d-46d6-901c-42c8c7a937d8",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs for any user, without a signed-in user.",
+    "displayName": "Allow the Teams app to manage only its own tabs for all users",
+    "id": "3c42dec6-49e8-4a0a-b469-36cff0d9da93",
     "origin": "Application (Microsoft Graph)",
-    "value": "TeamworkTag.ReadWrite.All"
+    "value": "TeamsTab.ReadWriteSelfForUser.All"
   },
   {
     "description": "Allows a Teams app to read, install, upgrade, and uninstall its own tabs in any team, without a signed-in user.",
@@ -14979,34 +15007,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "TeamsTab.ReadWriteSelfForChat.All"
   },
-  {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user.",
-    "displayName": "Allow the app to manage all tabs for all users",
-    "id": "425b4b59-d5af-45c8-832f-bb0b7402348a",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamsTab.ReadWriteForUser.All"
-  },
-  {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user.",
-    "displayName": "Allow the Teams app to manage all tabs for all teams",
-    "id": "6163d4f4-fbf8-43da-a7b4-060fe85ed148",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamsTab.ReadWriteForTeam.All"
-  },
-  {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users' data.",
-    "displayName": "Allow the Teams app to manage itself and its permission grants in all user accounts",
-    "id": "a87076cf-6abd-4e56-8559-4dbdf41bef96",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForUser.All"
-  },
-  {
-    "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in any chat, without a signed-in user. Does not give the ability to read application-specific settings.",
-    "displayName": "Manage Teams apps for all chats",
-    "id": "9e19bae1-2623-4c4f-ab6e-2664615ff9a0",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteForChat.All"
-  },
   {
     "description": "Allows the app to read, install, upgrade, and uninstall Teams apps in any team, without a signed-in user. Does not give the ability to read application-specific settings.",
     "displayName": "Manage Teams apps for all teams",
@@ -15049,13 +15049,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "TeamsAppInstallation.ReadWriteSelfForChat.All"
   },
-  {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself for any chat, without a signed-in user, and manage its permission grants for accessing those specific chats' data.",
-    "displayName": "Allow the Teams app to manage itself and its permission grants for all chats",
-    "id": "ba1ba90b-2d8f-487e-9f16-80728d85bb5c",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForChat.All"
-  },
   {
     "description": "Allows a Teams app to read, install, upgrade, and uninstall itself in any team, without a signed-in user.",
     "displayName": "Allow the Teams app to manage itself for all teams",
@@ -15063,6 +15056,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "TeamsAppInstallation.ReadWriteSelfForTeam.All"
   },
+  {
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user.",
+    "displayName": "Allow the app to manage itself for all users",
+    "id": "908de74d-f8b2-4d6b-a9ed-2a17b3b78179",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TeamsAppInstallation.ReadWriteSelfForUser.All"
+  },
+  {
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself for any user account, without a signed-in user, and manage its permission grants for accessing those specific users' data.",
+    "displayName": "Allow the Teams app to manage itself and its permission grants in all user accounts",
+    "id": "a87076cf-6abd-4e56-8559-4dbdf41bef96",
+    "origin": "Application (Microsoft Graph)",
+    "value": "TeamsAppInstallation.ReadWriteAndConsentSelfForUser.All"
+  },
   {
     "description": "Read all team's settings, without a signed-in user.",
     "displayName": "Read all teams' settings",
@@ -15070,13 +15077,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "TeamSettings.Read.All"
   },
-  {
-    "description": "Read and change all teams' settings, without a signed-in user.",
-    "displayName": "Read and change all teams' settings",
-    "id": "bdd80a03-d9bc-451d-b7c4-ce7c63fe3c8f",
-    "origin": "Application (Microsoft Graph)",
-    "value": "TeamSettings.ReadWrite.All"
-  },
   {
     "description": "Allow the app to read or write/update the policy assignment and unassigment for Teams users for all policy type categories.",
     "displayName": "Read and Write Teams policy user assignment and unassigment for all policy types.",
@@ -15120,25 +15120,32 @@
     "value": "TeamsTab.ReadWriteForChat.All"
   },
   {
-    "description": "Allows a Teams app to read, install, upgrade, and uninstall itself to any user, without a signed-in user.",
-    "displayName": "Allow the app to manage itself for all users",
-    "id": "908de74d-f8b2-4d6b-a9ed-2a17b3b78179",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall all tabs in any team, without a signed-in user.",
+    "displayName": "Allow the Teams app to manage all tabs for all teams",
+    "id": "6163d4f4-fbf8-43da-a7b4-060fe85ed148",
     "origin": "Application (Microsoft Graph)",
-    "value": "TeamsAppInstallation.ReadWriteSelfForUser.All"
+    "value": "TeamsTab.ReadWriteForTeam.All"
   },
   {
-    "description": "Allows the app to read all the short notes without a signed-in user.",
-    "displayName": "Read all users' short notes",
-    "id": "0c7d31ec-31ca-4f58-b6ec-9950b6b0de69",
+    "description": "Allows a Teams app to read, install, upgrade, and uninstall all tabs for any user, without a signed-in user.",
+    "displayName": "Allow the app to manage all tabs for all users",
+    "id": "425b4b59-d5af-45c8-832f-bb0b7402348a",
     "origin": "Application (Microsoft Graph)",
-    "value": "ShortNotes.Read.All"
+    "value": "TeamsTab.ReadWriteForUser.All"
   },
   {
-    "description": "Allows the application to send notification regarding virtual appointments as any user, without a signed-in user. The app must also be authorized to access an individual user's data by the online meetings application access policy.",
-    "displayName": "Send notification regarding virtual appointments as any user",
-    "id": "97e45b36-1250-48e4-bd70-2df6dab7e94a",
+    "description": "Read and change all teams' settings, without a signed-in user.",
+    "displayName": "Read and change all teams' settings",
+    "id": "bdd80a03-d9bc-451d-b7c4-ce7c63fe3c8f",
     "origin": "Application (Microsoft Graph)",
-    "value": "VirtualAppointmentNotification.Send"
+    "value": "TeamSettings.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read your organization's sign-in identifiers, without a signed-in user.",
+    "displayName": "Read all sign-in identifiers",
+    "id": "28e1fe78-598f-4df4-b55e-18bf34218925",
+    "origin": "Application (Microsoft Graph)",
+    "value": "SignInIdentifier.Read.All"
   },
   {
     "description": "Allows the app to read and write anonymous users' virtual event registrations, without a signed-in user",
@@ -15148,18 +15155,11 @@
     "value": "VirtualEventRegistration-Anon.ReadWrite.All"
   },
   {
-    "description": "Allows the app to create, read, update, and delete events in user calendars.",
-    "displayName": "Have full access to user calendars ",
-    "id": "1ec239c2-d7c9-4623-a91a-a9775856bb36",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Calendars.ReadWrite"
-  },
-  {
-    "description": "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.",
-    "displayName": "Read and write user and shared calendars",
-    "id": "12466101-c9b8-439a-8589-dd09ee67e8e9",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Calendars.ReadWrite.Shared"
+    "description": "Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user.",
+    "displayName": "Read and write all Windows update deployment settings",
+    "id": "7dd1be58-6e76-4401-bf8d-31d1e8180d5b",
+    "origin": "Application (Microsoft Graph)",
+    "value": "WindowsUpdates.ReadWrite.All"
   },
   {
     "description": "Allows the app to read all AI Insights for calls, on behalf of the signed-in user.",
@@ -15266,13 +15266,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "ChannelMessage.Edit"
   },
-  {
-    "description": "Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions.",
-    "displayName": "Read basic details of user calendars",
-    "id": "662d75ba-a364-42ad-adee-f5f880ea4878",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Calendars.ReadBasic"
-  },
   {
     "description": "Allows an app to read a channel's messages in Microsoft Teams, on behalf of the signed-in user.",
     "displayName": "Read user channel messages",
@@ -15281,32 +15274,39 @@
     "value": "ChannelMessage.Read.All"
   },
   {
-    "description": "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.",
-    "displayName": "Read user and shared calendars",
-    "id": "2b9c4092-424d-4249-948d-b43879977640",
+    "description": "Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn't allow the app to edit the policyViolation of a channel message.",
+    "displayName": "Read and write user channel messages",
+    "id": "5922d31f-46c8-4404-9eaf-2117e390a8a4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Calendars.Read.Shared"
+    "value": "ChannelMessage.ReadWrite"
   },
   {
-    "description": "Allows the app to fully manage all data associated with the business scenarios it owns. Data access and changes will be attributed to the signed-in user.",
-    "displayName": "Read and write all data for business scenarios this app creates or owns",
-    "id": "19932d57-2952-4c60-8634-3655c79fc527",
+    "description": "Allows the app to create, read, update and delete events in all calendars in the organization user has permissions to access. This includes delegate and shared calendars.",
+    "displayName": "Read and write user and shared calendars",
+    "id": "12466101-c9b8-439a-8589-dd09ee67e8e9",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "BusinessScenarioData.ReadWrite.OwnedBy"
+    "value": "Calendars.ReadWrite.Shared"
   },
   {
-    "description": "Allows the app to search the backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, on behalf of the signed in user.",
-    "displayName": "Read restore sessions and start restore sessions from backups",
-    "id": "9f89e109-94b9-4c9b-b4fc-98cdaa54f574",
+    "description": "Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user.",
+    "displayName": "Send channel messages",
+    "id": "ebf0f66e-9fb1-49e4-a278-222f76911cf4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "BackupRestore-Restore.ReadWrite.All"
+    "value": "ChannelMessage.Send"
   },
   {
-    "description": "Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user.",
-    "displayName": "Search for metadata properties in backup snapshots",
-    "id": "2b24830f-f435-446f-ab5a-b1e70d9a2eb5",
+    "description": "Allows the app to create, read, update, and delete events in user calendars.",
+    "displayName": "Have full access to user calendars ",
+    "id": "1ec239c2-d7c9-4623-a91a-a9775856bb36",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "BackupRestore-Search.Read.All"
+    "value": "Calendars.ReadWrite"
+  },
+  {
+    "description": "Allows the app to read events in all calendars that the user can access, including delegate and shared calendars.",
+    "displayName": "Read user and shared calendars",
+    "id": "2b9c4092-424d-4249-948d-b43879977640",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "Calendars.Read.Shared"
   },
   {
     "description": "Allows the app to read and write the billing configuration on all applications on behalf of the signed-in user.",
@@ -15413,6 +15413,13 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "BusinessScenarioData.Read.OwnedBy"
   },
+  {
+    "description": "Allows the app to fully manage all data associated with the business scenarios it owns. Data access and changes will be attributed to the signed-in user.",
+    "displayName": "Read and write all data for business scenarios this app creates or owns",
+    "id": "19932d57-2952-4c60-8634-3655c79fc527",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "BusinessScenarioData.ReadWrite.OwnedBy"
+  },
   {
     "description": "Allows the app to read events in user calendars.",
     "displayName": "Read user calendars ",
@@ -15421,18 +15428,11 @@
     "value": "Calendars.Read"
   },
   {
-    "description": "Allows the app to read and write channel messages, on behalf of the signed-in user. This doesn't allow the app to edit the policyViolation of a channel message.",
-    "displayName": "Read and write user channel messages",
-    "id": "5922d31f-46c8-4404-9eaf-2117e390a8a4",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "ChannelMessage.ReadWrite"
-  },
-  {
-    "description": "Allows an app to send channel messages in Microsoft Teams, on behalf of the signed-in user.",
-    "displayName": "Send channel messages",
-    "id": "ebf0f66e-9fb1-49e4-a278-222f76911cf4",
+    "description": "Allows the app to read events in user calendars, except for properties such as body, attachments, and extensions.",
+    "displayName": "Read basic details of user calendars",
+    "id": "662d75ba-a364-42ad-adee-f5f880ea4878",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ChannelMessage.Send"
+    "value": "Calendars.ReadBasic"
   },
   {
     "description": "Read all channel names, channel descriptions, and channel settings, on behalf of the signed-in user.",
@@ -15442,18 +15442,18 @@
     "value": "ChannelSettings.Read.All"
   },
   {
-    "description": "Allows the app to read app consent requests and approvals, and deny or approve those requests on behalf of the signed-in user.",
-    "displayName": "Read and write consent requests",
-    "id": "497d9dfa-3bd1-481a-baab-90895e54568c",
+    "description": "Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.",
+    "displayName": "Read and write the names, descriptions, and settings of channels",
+    "id": "d649fb7c-72b4-4eec-b2b4-b15acf79e378",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ConsentRequest.ReadWrite.All"
+    "value": "ChannelSettings.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read user contacts.  ",
-    "displayName": "Read user contacts ",
-    "id": "ff74d97f-43af-4b68-9f2a-b77ee6968c5d",
+    "description": "Allows the app to create chats on behalf of the signed-in user.",
+    "displayName": "Create chats",
+    "id": "38826093-1258-4dea-98f0-00003be2b8d0",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Contacts.Read"
+    "value": "Chat.Create"
   },
   {
     "description": "Allows the app to read contacts a user has permissions to access, including their own and shared contacts.",
@@ -15561,46 +15561,46 @@
     "value": "CopilotSettings-LimitedMode.Read"
   },
   {
-    "description": "Allows the app to read and approve consent requests on behalf of the signed in user.",
-    "displayName": "Read and approve consent requests",
-    "id": "e694a3a1-7878-46d8-8c29-3d195f6589f4",
+    "description": "Allows the app to read and write organization-wide copilot limited mode setting on behalf of the signed-in user.",
+    "displayName": "Read and write organization-wide copilot limited mode setting",
+    "id": "4704e5b2-0ada-4aa0-b18c-00ad7525bc06",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ConsentRequest.ReadApprove.All"
+    "value": "CopilotSettings-LimitedMode.ReadWrite"
   },
   {
-    "description": "Allows the app to read consent requests and approvals on behalf of the signed-in user.",
-    "displayName": "Read consent requests",
-    "id": "f3bfad56-966e-4590-a536-82ecf548ac1e",
+    "description": "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on behalf of the signed-in user.",
+    "displayName": "Read cross-tenant basic information",
+    "id": "81594d25-e88e-49cf-ac8c-fecbff49f994",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ConsentRequest.Read.All"
+    "value": "CrossTenantInformation.ReadBasic.All"
   },
   {
-    "description": "Allows the app to read consent requests and approvals created by the signed-in user, on behalf of the signed-in user.",
-    "displayName": "Read consent requests created by the user",
-    "id": "5942b2f6-5a7b-40af-aa37-4b6ea5447506",
+    "description": "Allows the app to read user contacts.  ",
+    "displayName": "Read user contacts ",
+    "id": "ff74d97f-43af-4b68-9f2a-b77ee6968c5d",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ConsentRequest.Read"
+    "value": "Contacts.Read"
   },
   {
-    "description": "Allows the app to read create consent requests on behalf of the signed-in user.",
-    "displayName": "Create consent requests",
-    "id": "f2143d35-9b4b-480d-951c-d083e69eeb2c",
+    "description": "Allows the app to read app consent requests and approvals, and deny or approve those requests on behalf of the signed-in user.",
+    "displayName": "Read and write consent requests",
+    "id": "497d9dfa-3bd1-481a-baab-90895e54568c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ConsentRequest.Create"
+    "value": "ConsentRequest.ReadWrite.All"
   },
   {
-    "description": "Read and write the names, descriptions, and settings of all channels, on behalf of the signed-in user.",
-    "displayName": "Read and write the names, descriptions, and settings of channels",
-    "id": "d649fb7c-72b4-4eec-b2b4-b15acf79e378",
+    "description": "Allows the app to read and approve consent requests on behalf of the signed in user.",
+    "displayName": "Read and approve consent requests",
+    "id": "e694a3a1-7878-46d8-8c29-3d195f6589f4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ChannelSettings.ReadWrite.All"
+    "value": "ConsentRequest.ReadApprove.All"
   },
   {
-    "description": "Allows the app to create chats on behalf of the signed-in user.",
-    "displayName": "Create chats",
-    "id": "38826093-1258-4dea-98f0-00003be2b8d0",
+    "description": "Allows the app to read consent requests and approvals on behalf of the signed-in user.",
+    "displayName": "Read consent requests",
+    "id": "f3bfad56-966e-4590-a536-82ecf548ac1e",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Chat.Create"
+    "value": "ConsentRequest.Read.All"
   },
   {
     "description": "Allows the app to delete and recover deleted chats, on behalf of the signed-in user.",
@@ -15640,16 +15640,9 @@
   {
     "description": "Read the members of chats, on behalf of the signed-in user.",
     "displayName": "Read the members of chats",
-    "id": "c5a9e2b1-faf6-41d4-8875-d381aa549b24",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "ChatMember.Read"
-  },
-  {
-    "description": "Allows the app to read restore sessions, on behalf of the signed in user.",
-    "displayName": "Read restore sessions",
-    "id": "94b36f78-434f-4904-8c08-421d9a9c1dc2",
+    "id": "c5a9e2b1-faf6-41d4-8875-d381aa549b24",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "BackupRestore-Restore.Read.All"
+    "value": "ChatMember.Read"
   },
   {
     "description": "Add and remove members from chats, on behalf of the signed-in user.",
@@ -15658,6 +15651,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "ChatMember.ReadWrite"
   },
+  {
+    "description": "Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user.",
+    "displayName": "Read user chat messages",
+    "id": "cdcdac3a-fd45-410d-83ef-554db620e5c7",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "ChatMessage.Read"
+  },
+  {
+    "description": "Allows the app to search the backup snapshots for Microsoft 365 resources, on behalf of the signed in user.",
+    "displayName": "Search for metadata properties in backup snapshots",
+    "id": "2b24830f-f435-446f-ab5a-b1e70d9a2eb5",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "BackupRestore-Search.Read.All"
+  },
   {
     "description": "Allows an app to send one-to-one and group chat messages in Microsoft Teams, on behalf of the signed-in user.",
     "displayName": "Send user chat messages",
@@ -15665,13 +15672,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "ChatMessage.Send"
   },
-  {
-    "description": "Allows the app to read details of discovered cloud apps in the organization, on behalf of the signed in user.",
-    "displayName": "Read discovered cloud applications data",
-    "id": "ad46d60e-1027-4b75-af88-7c14ccf43a19",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "CloudApp-Discovery.Read.All"
-  },
   {
     "description": "Allows the app to read the properties of Cloud PCs on behalf of the signed-in user.",
     "displayName": "Read Cloud PCs",
@@ -15715,46 +15715,46 @@
     "value": "ConfigurationMonitoring.ReadWrite.All"
   },
   {
-    "description": "Allows an app to read one-to-one and group chat messages, on behalf of the signed-in user.",
-    "displayName": "Read user chat messages",
-    "id": "cdcdac3a-fd45-410d-83ef-554db620e5c7",
+    "description": "Allows the app to read create consent requests on behalf of the signed-in user.",
+    "displayName": "Create consent requests",
+    "id": "f2143d35-9b4b-480d-951c-d083e69eeb2c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ChatMessage.Read"
+    "value": "ConsentRequest.Create"
   },
   {
-    "description": "Allows the app to monitor backup and restore jobs, view quota usage and billing details, on behalf of the signed in user.",
-    "displayName": "Read monitoring, quota and billing information for the tenant",
-    "id": "b4e98de1-4600-4e90-b5e1-7c1dfef04e5c",
+    "description": "Allows the app to read consent requests and approvals created by the signed-in user, on behalf of the signed-in user.",
+    "displayName": "Read consent requests created by the user",
+    "id": "5942b2f6-5a7b-40af-aa37-4b6ea5447506",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "BackupRestore-Monitor.Read.All"
+    "value": "ConsentRequest.Read"
   },
   {
-    "description": "Allows the app to update or read the status of M365 backup service (enable/disable), on behalf of the signed in user.",
-    "displayName": "Update or read the status of the M365 backup service",
-    "id": "96d46335-d92d-41b8-bc9f-273a692381ea",
+    "description": "Allows the app to read details of discovered cloud apps in the organization, on behalf of the signed in user.",
+    "displayName": "Read discovered cloud applications data",
+    "id": "ad46d60e-1027-4b75-af88-7c14ccf43a19",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "BackupRestore-Control.ReadWrite.All"
+    "value": "CloudApp-Discovery.Read.All"
   },
   {
-    "description": "Allows the app to read the status of M365 backup service (enable/disable), on behalf of the signed in user.",
-    "displayName": "Read the status of the M365 backup service",
-    "id": "af598c63-4292-4437-b925-e996354d3854",
+    "description": "Allows the app to search the backup snapshots for Microsoft 365 resources, and restore Microsoft 365 resources from a backed-up snapshot, on behalf of the signed in user.",
+    "displayName": "Read restore sessions and start restore sessions from backups",
+    "id": "9f89e109-94b9-4c9b-b4fc-98cdaa54f574",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "BackupRestore-Control.Read.All"
+    "value": "BackupRestore-Restore.ReadWrite.All"
   },
   {
-    "description": "Allows the client to create agent identities on behalf of the signed-in user, even if the client is not the parent agent identity blueprint.",
-    "displayName": "Create agent identities without an agent blueprint parent",
-    "id": "e75eeac6-d759-4ba3-ae5c-773a27efafba",
+    "description": "Allows the app to read restore sessions, on behalf of the signed in user.",
+    "displayName": "Read restore sessions",
+    "id": "94b36f78-434f-4904-8c08-421d9a9c1dc2",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentIdentity.Create.All"
+    "value": "BackupRestore-Restore.Read.All"
   },
   {
-    "description": "Allows the client to delete and restore agent identities on behalf of the signed-in user.",
-    "displayName": "Delete and restore agent identities",
-    "id": "c8ee41e5-35e7-4fe9-8ecb-93493adcac5b",
+    "description": "Allows the app to monitor backup and restore jobs, view quota usage and billing details, on behalf of the signed in user.",
+    "displayName": "Read monitoring, quota and billing information for the tenant",
+    "id": "b4e98de1-4600-4e90-b5e1-7c1dfef04e5c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentIdentity.DeleteRestore.All"
+    "value": "BackupRestore-Monitor.Read.All"
   },
   {
     "description": "Allows the client to enable or disable agent identities on behalf of the signed-in user.",
@@ -15862,46 +15862,46 @@
     "value": "AgentIdentityBlueprintPrincipal.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and update the communication configuration of agent blueprints on behalf of the signed-in user.",
-    "displayName": "Read and write agent communication configuration",
-    "id": "15e0db35-0641-4175-b014-c2cb39286338",
+    "description": "Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users, delete and restore agent users in your organization, and read basic company properties, on behalf of the signed-in user.",
+    "displayName": "Read and write all agent ID users' full profiles",
+    "id": "ad57fb88-4658-4fd6-ab7d-e43184b08e4e",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentCommunicationConfiguration.ReadWrite"
+    "value": "AgentIdUser.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read the communication configuration of agent blueprints on behalf of the signed-in user.",
-    "displayName": "Read agent communication configuration",
-    "id": "57ff8075-2fb3-4879-8693-5d51ee8d5e9e",
+    "description": "Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users in your organization, delete and restore agent users under an agent blueprint, and read basic company properties, on behalf of the signed-in user.",
+    "displayName": "Read and write full profiles of agent ID users under an agent blueprint",
+    "id": "52a417d9-0b3c-4466-9a3b-66960de73d74",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentCommunicationConfiguration.Read"
+    "value": "AgentIdUser.ReadWrite.IdentityParentedBy"
   },
   {
-    "description": "Allows the app to read and update quarantined collection and manage its membership in your organization's Agent Registry on behalf of the signed-in user.",
-    "displayName": "Read and write quarantined collection in Agent Registry",
-    "id": "ae331cc9-9f51-484b-a90b-124f2e4a6398",
+    "description": "Allows the client to delete and restore agent identities on behalf of the signed-in user.",
+    "displayName": "Delete and restore agent identities",
+    "id": "c8ee41e5-35e7-4fe9-8ecb-93493adcac5b",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentCollection.ReadWrite.Quarantined"
+    "value": "AgentIdentity.DeleteRestore.All"
   },
   {
-    "description": "Allows the app to read and update global collection and manage its membership in your organization's Agent Registry on behalf of the signed-in user.",
-    "displayName": "Read and write global collection in Agent Registry",
-    "id": "c001dd65-8a6b-4349-ab0c-4e8a410d28d2",
+    "description": "Allows the client to create agent identities on behalf of the signed-in user, even if the client is not the parent agent identity blueprint.",
+    "displayName": "Create agent identities without an agent blueprint parent",
+    "id": "e75eeac6-d759-4ba3-ae5c-773a27efafba",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentCollection.ReadWrite.Global"
+    "value": "AgentIdentity.Create.All"
   },
   {
-    "description": "Allows the app to read all Windows update deployment settings for the organization without a signed-in user.",
-    "displayName": "Read all Windows update deployment settings",
-    "id": "50a8bf5f-b06a-4ac7-881f-3ca0c4be7550",
-    "origin": "Application (Microsoft Graph)",
-    "value": "WindowsUpdates.Read.All"
+    "description": "Allows the app to read and update the communication configuration of agent blueprints on behalf of the signed-in user.",
+    "displayName": "Read and write agent communication configuration",
+    "id": "15e0db35-0641-4175-b014-c2cb39286338",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "AgentCommunicationConfiguration.ReadWrite"
   },
   {
-    "description": "Allows the app to read and write all Windows update deployment settings for the organization without a signed-in user.",
-    "displayName": "Read and write all Windows update deployment settings",
-    "id": "7dd1be58-6e76-4401-bf8d-31d1e8180d5b",
-    "origin": "Application (Microsoft Graph)",
-    "value": "WindowsUpdates.ReadWrite.All"
+    "description": "Allows the app to read the communication configuration of agent blueprints on behalf of the signed-in user.",
+    "displayName": "Read agent communication configuration",
+    "id": "57ff8075-2fb3-4879-8693-5d51ee8d5e9e",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "AgentCommunicationConfiguration.Read"
   },
   {
     "description": "Allows the app to read workforce integrations without a signed-in user.",
@@ -15945,13 +15945,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "Acronym.Read.All"
   },
-  {
-    "description": "Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users, delete and restore agent users in your organization, and read basic company properties, on behalf of the signed-in user.",
-    "displayName": "Read and write all agent ID users' full profiles",
-    "id": "ad57fb88-4658-4fd6-ab7d-e43184b08e4e",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentIdUser.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read administrative units and administrative unit membership on behalf of the signed-in user.",
     "displayName": "Read administrative units",
@@ -15959,6 +15952,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "AdministrativeUnit.Read.All"
   },
+  {
+    "description": "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on behalf of the signed-in user.",
+    "displayName": "Read and write administrative units",
+    "id": "7b8a2d34-6b3f-4542-a343-54651608ad81",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "AdministrativeUnit.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read agent instances and their related collections in your organization's Agent Registry on behalf of the signed-in user.",
+    "displayName": "Read all agent instances in Agent Registry",
+    "id": "4c3c738a-2df0-4877-bf4a-f796950ff34c",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "AgentInstance.Read.All"
+  },
   {
     "description": "Allows the app to read agent cards and their skills in your organization's Agent Registry on behalf of the signed-in user.",
     "displayName": "Read agent cards in Agent Registry",
@@ -15966,13 +15973,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "AgentCard.Read.All"
   },
-  {
-    "description": "Allows the app to create, read, update, and delete agent cards and manage their skills in your organization's Agent Registry on behalf of the signed-in user.",
-    "displayName": "Read and write agent cards in Agent Registry",
-    "id": "b0f726a8-0fa2-4ce2-937b-fd17a446261f",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentCard.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read agent card manifests in your organization's Agent Registry on behalf of the signed-in user.",
     "displayName": "Read all agent card manifests in Agent Registry",
@@ -16016,25 +16016,32 @@
     "value": "AgentCollection.ReadWrite.All"
   },
   {
-    "description": "Allows the app to create, read, update, and delete administrative units and manage administrative unit membership on behalf of the signed-in user.",
-    "displayName": "Read and write administrative units",
-    "id": "7b8a2d34-6b3f-4542-a343-54651608ad81",
+    "description": "Allows the app to read and update global collection and manage its membership in your organization's Agent Registry on behalf of the signed-in user.",
+    "displayName": "Read and write global collection in Agent Registry",
+    "id": "c001dd65-8a6b-4349-ab0c-4e8a410d28d2",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AdministrativeUnit.ReadWrite.All"
+    "value": "AgentCollection.ReadWrite.Global"
   },
   {
-    "description": "Allows the app to read all virtual events without a signed-in user.",
-    "displayName": "Read all users' virtual events",
-    "id": "1dccb351-c4e4-4e09-a8d1-7a9ecbf027cc",
-    "origin": "Application (Microsoft Graph)",
-    "value": "VirtualEvent.Read.All"
+    "description": "Allows the app to read and update quarantined collection and manage its membership in your organization's Agent Registry on behalf of the signed-in user.",
+    "displayName": "Read and write quarantined collection in Agent Registry",
+    "id": "ae331cc9-9f51-484b-a90b-124f2e4a6398",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "AgentCollection.ReadWrite.Quarantined"
   },
   {
-    "description": "Allows the app to create agent users, read and write the full set of profile properties, reports, and managers of agent ID users in your organization, delete and restore agent users under an agent blueprint, and read basic company properties, on behalf of the signed-in user.",
-    "displayName": "Read and write full profiles of agent ID users under an agent blueprint",
-    "id": "52a417d9-0b3c-4466-9a3b-66960de73d74",
+    "description": "Allows the app to create, read, update, and delete agent cards and manage their skills in your organization's Agent Registry on behalf of the signed-in user.",
+    "displayName": "Read and write agent cards in Agent Registry",
+    "id": "b0f726a8-0fa2-4ce2-937b-fd17a446261f",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentIdUser.ReadWrite.IdentityParentedBy"
+    "value": "AgentCard.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read all Windows update deployment settings for the organization without a signed-in user.",
+    "displayName": "Read all Windows update deployment settings",
+    "id": "50a8bf5f-b06a-4ac7-881f-3ca0c4be7550",
+    "origin": "Application (Microsoft Graph)",
+    "value": "WindowsUpdates.Read.All"
   },
   {
     "description": "Allows the app to create, read, update, and delete agent instances in your organization's Agent Registry on behalf of the signed-in user.",
@@ -16044,18 +16051,11 @@
     "value": "AgentInstance.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and respond to approvals on behalf of the signed-in user.",
-    "displayName": "Read and respond to approvals assigned to the current user",
-    "id": "89d944f2-2011-44ad-830c-aa9bf5ef2319",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "ApprovalSolutionResponse.ReadWrite"
-  },
-  {
-    "description": "Allows the app to read attack simulation and training data for an organization for the signed-in user.",
-    "displayName": "Read attack simulation data of an organization",
-    "id": "104a7a4b-ca76-4677-b7e7-2f4bc482f381",
+    "description": "Allows the user to read and write all agent registration information",
+    "displayName": "Read and write all agent registrations",
+    "id": "20f263bf-7d50-4e66-912c-16b4b4194fd4",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AttackSimulation.Read.All"
+    "value": "AgentRegistration.ReadWrite.All"
   },
   {
     "description": "Allows the app to read, create, and update attack simulation and training data for an organization for the signed-in user.",
@@ -16163,46 +16163,46 @@
     "value": "BackupRestore-Configuration.ReadWrite.All"
   },
   {
-    "description": "Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user.",
-    "displayName": "Read, create, and respond to approvals",
-    "id": "6768d3af-4562-48ff-82d2-c5e19eb21b9c",
+    "description": "Allows the app to read the status of M365 backup service (enable/disable), on behalf of the signed in user.",
+    "displayName": "Read the status of the M365 backup service",
+    "id": "af598c63-4292-4437-b925-e996354d3854",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ApprovalSolution.ReadWrite"
+    "value": "BackupRestore-Control.Read.All"
   },
   {
-    "description": "Allows the app to read approvals on behalf of the signed-in user.",
-    "displayName": "Read approvals",
-    "id": "b0df437d-d341-4df0-aa3e-89ca81a1207f",
+    "description": "Allows the app to update or read the status of M365 backup service (enable/disable), on behalf of the signed in user.",
+    "displayName": "Update or read the status of the M365 backup service",
+    "id": "96d46335-d92d-41b8-bc9f-273a692381ea",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "ApprovalSolution.Read"
+    "value": "BackupRestore-Control.ReadWrite.All"
   },
   {
-    "description": "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
-    "displayName": "Manage app permission grants and app role assignments",
-    "id": "84bccea3-f856-4a8a-967b-dbe0a3d53a64",
+    "description": "Allows the app to read attack simulation and training data for an organization for the signed-in user.",
+    "displayName": "Read attack simulation data of an organization",
+    "id": "104a7a4b-ca76-4677-b7e7-2f4bc482f381",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AppRoleAssignment.ReadWrite.All"
+    "value": "AttackSimulation.Read.All"
   },
   {
-    "description": "Allows the app to read and write other apps' remote desktop security configuration, on behalf of the signed-in user.",
-    "displayName": "Read and write the remote desktop security configuration for apps",
-    "id": "ffa91d43-2ad8-45cc-b592-09caddeb24bb",
+    "description": "Allows the app to read and respond to approvals on behalf of the signed-in user.",
+    "displayName": "Read and respond to approvals assigned to the current user",
+    "id": "89d944f2-2011-44ad-830c-aa9bf5ef2319",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "Application-RemoteDesktopConfig.ReadWrite.All"
+    "value": "ApprovalSolutionResponse.ReadWrite"
   },
   {
-    "description": "Allows the user to read all agent registration information",
-    "displayName": "Read all agent registrations",
-    "id": "ef96ce0b-b2ea-4ae4-a783-108212d8ecee",
+    "description": "Allows the app to provision, read, create, and respond to approvals on behalf of the signed-in user.",
+    "displayName": "Read, create, and respond to approvals",
+    "id": "6768d3af-4562-48ff-82d2-c5e19eb21b9c",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentRegistration.Read.All"
+    "value": "ApprovalSolution.ReadWrite"
   },
   {
-    "description": "Allows the user to read and write all agent registration information",
-    "displayName": "Read and write all agent registrations",
-    "id": "20f263bf-7d50-4e66-912c-16b4b4194fd4",
+    "description": "Allows the app to read approvals on behalf of the signed-in user.",
+    "displayName": "Read approvals",
+    "id": "b0df437d-d341-4df0-aa3e-89ca81a1207f",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentRegistration.ReadWrite.All"
+    "value": "ApprovalSolution.Read"
   },
   {
     "description": "Allows the app to read terms of use agreements on behalf of the signed-in user.",
@@ -16242,16 +16242,9 @@
   {
     "description": "Allows the app to read the signed-in user's activity statistics, such as how much time the user has spent on emails, in meetings, or in chat sessions.",
     "displayName": "Read user activity statistics",
-    "id": "e03cf23f-8056-446a-8994-7d93dfc8b50e",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "Analytics.Read"
-  },
-  {
-    "description": "Allows the app to read agent instances and their related collections in your organization's Agent Registry on behalf of the signed-in user.",
-    "displayName": "Read all agent instances in Agent Registry",
-    "id": "4c3c738a-2df0-4877-bf4a-f796950ff34c",
+    "id": "e03cf23f-8056-446a-8994-7d93dfc8b50e",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "AgentInstance.Read.All"
+    "value": "Analytics.Read"
   },
   {
     "description": "Allows the app to read the API connectors used in user authentication flows, on behalf of the signed-in user.",
@@ -16260,6 +16253,20 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "APIConnectors.Read.All"
   },
+  {
+    "description": "Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user.",
+    "displayName": "Read and write API connectors for authentication flows",
+    "id": "c67b52c5-7c69-48b6-9d48-7b3af3ded914",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "APIConnectors.ReadWrite.All"
+  },
+  {
+    "description": "Allows the user to read all agent registration information",
+    "displayName": "Read all agent registrations",
+    "id": "ef96ce0b-b2ea-4ae4-a783-108212d8ecee",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "AgentRegistration.Read.All"
+  },
   {
     "description": "Allows the app to read the apps in the app catalogs.",
     "displayName": "Read all app catalogs",
@@ -16267,13 +16274,6 @@
     "origin": "Delegated (Microsoft Graph)",
     "value": "AppCatalog.Read.All"
   },
-  {
-    "description": "Allows the app to create, read, update, and delete apps in the app catalogs.",
-    "displayName": "Read and write to all app catalogs",
-    "id": "1ca167d5-1655-44a1-8adf-1414072e1ef9",
-    "origin": "Delegated (Microsoft Graph)",
-    "value": "AppCatalog.ReadWrite.All"
-  },
   {
     "description": "Allows the app to submit application packages to the catalog and cancel submissions that are pending review on behalf of the signed-in user.",
     "displayName": "Submit application packages to the catalog and cancel pending submissions",
@@ -16317,39 +16317,46 @@
     "value": "Application.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read, create and manage the API connectors used in user authentication flows, on behalf of the signed-in user.",
-    "displayName": "Read and write API connectors for authentication flows",
-    "id": "c67b52c5-7c69-48b6-9d48-7b3af3ded914",
+    "description": "Allows the app to read and write other apps' remote desktop security configuration, on behalf of the signed-in user.",
+    "displayName": "Read and write the remote desktop security configuration for apps",
+    "id": "ffa91d43-2ad8-45cc-b592-09caddeb24bb",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "APIConnectors.ReadWrite.All"
+    "value": "Application-RemoteDesktopConfig.ReadWrite.All"
   },
   {
-    "description": "Allows the application to obtain basic tenant information about another target tenant within the Azure AD ecosystem on behalf of the signed-in user.",
-    "displayName": "Read cross-tenant basic information",
-    "id": "81594d25-e88e-49cf-ac8c-fecbff49f994",
+    "description": "Allows the app to manage permission grants for application permissions to any API (including Microsoft Graph) and application assignments for any app, on behalf of the signed-in user.",
+    "displayName": "Manage app permission grants and app role assignments",
+    "id": "84bccea3-f856-4a8a-967b-dbe0a3d53a64",
     "origin": "Delegated (Microsoft Graph)",
-    "value": "CrossTenantInformation.ReadBasic.All"
+    "value": "AppRoleAssignment.ReadWrite.All"
   },
   {
-    "description": "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user.",
-    "displayName": "Read and change SharePoint and OneDrive tenant settings",
-    "id": "19b94e34-907c-4f43-bde9-38b1909ed408",
+    "description": "Allows the app to create, read, update, and delete apps in the app catalogs.",
+    "displayName": "Read and write to all app catalogs",
+    "id": "1ca167d5-1655-44a1-8adf-1414072e1ef9",
+    "origin": "Delegated (Microsoft Graph)",
+    "value": "AppCatalog.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read, create, edit, and delete all the short notes without a signed-in user.",
+    "displayName": "Read, create, edit, and delete all users' short notes",
+    "id": "842c284c-763d-4a97-838d-79787d129bab",
     "origin": "Application (Microsoft Graph)",
-    "value": "SharePointTenantSettings.ReadWrite.All"
+    "value": "ShortNotes.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read your tenant's SharePoint Cross-Tenant migration settings and tasks, without a signed-in user.",
-    "displayName": "Read SharePoint Cross-Tenant migration settings and tasks",
-    "id": "f5fa52a5-b9ab-4dc3-885e-9e5b4a67068e",
+    "description": "Allows the app to read all the short notes without a signed-in user.",
+    "displayName": "Read all users' short notes",
+    "id": "0c7d31ec-31ca-4f58-b6ec-9950b6b0de69",
     "origin": "Application (Microsoft Graph)",
-    "value": "SharePointCrossTenantMigration.Read.All"
+    "value": "ShortNotes.Read.All"
   },
   {
-    "description": "Allows an app to manage license assignments for users and groups, without a signed-in user.",
-    "displayName": "Manage all license assignments",
-    "id": "5facf0c1-8979-4e95-abcf-ff3d079771c0",
+    "description": "Allows the application to read and change the tenant-level settings of SharePoint and OneDrive, without a signed-in user.",
+    "displayName": "Read and change SharePoint and OneDrive tenant settings",
+    "id": "19b94e34-907c-4f43-bde9-38b1909ed408",
     "origin": "Application (Microsoft Graph)",
-    "value": "LicenseAssignment.ReadWrite.All"
+    "value": "SharePointTenantSettings.ReadWrite.All"
   },
   {
     "description": "Allows the app to read identity lifecycle policies for agent identities in the organization, without a signed-in user.",
@@ -16456,6 +16463,13 @@
     "origin": "Application (Microsoft Graph)",
     "value": "Mail.ReadBasic.All"
   },
+  {
+    "description": "Allows an app to manage license assignments for users and groups, without a signed-in user.",
+    "displayName": "Manage all license assignments",
+    "id": "5facf0c1-8979-4e95-abcf-ff3d079771c0",
+    "origin": "Application (Microsoft Graph)",
+    "value": "LicenseAssignment.ReadWrite.All"
+  },
   {
     "description": "Allows an app to read license assignments for users and groups, without a signed-in user.",
     "displayName": "Read all license assignments.",
@@ -16464,25 +16478,11 @@
     "value": "LicenseAssignment.Read.All"
   },
   {
-    "description": "Allows the app to create, update, read and delete all self-initiated courses in the organization's directory, without a signed-in user.",
-    "displayName": "Read and write all self-initiated courses",
-    "id": "7654ed61-8965-4025-846a-0856ec02b5b0",
-    "origin": "Application (Microsoft Graph)",
-    "value": "LearningSelfInitiatedCourse.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to manage all learning content in the organization's directory, without a signed-in user.",
-    "displayName": "Manage all learning content",
-    "id": "444d6fcb-b738-41e5-b103-ac4f2a2628a3",
-    "origin": "Application (Microsoft Graph)",
-    "value": "LearningContent.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read and write outbound data flows without a signed-in user.",
-    "displayName": "Manage outbound flow definitions",
-    "id": "24a65b4a-e501-47e2-8849-d679517887f0",
+    "description": "Allows the app to read data for all self-initiated courses in the organization's directory, without a signed-in user.",
+    "displayName": "Read all self-initiated courses",
+    "id": "467524fc-ed22-4356-a910-af61191e3503",
     "origin": "Application (Microsoft Graph)",
-    "value": "IndustryData-OutboundFlow.ReadWrite.All"
+    "value": "LearningSelfInitiatedCourse.Read.All"
   },
   {
     "description": "Allows the app to read reference definitions without a signed-in user.",
@@ -16597,11 +16597,18 @@
     "value": "LearningContent.Read.All"
   },
   {
-    "description": "Allows the app to read data for all self-initiated courses in the organization's directory, without a signed-in user.",
-    "displayName": "Read all self-initiated courses",
-    "id": "467524fc-ed22-4356-a910-af61191e3503",
+    "description": "Allows the app to manage all learning content in the organization's directory, without a signed-in user.",
+    "displayName": "Manage all learning content",
+    "id": "444d6fcb-b738-41e5-b103-ac4f2a2628a3",
     "origin": "Application (Microsoft Graph)",
-    "value": "LearningSelfInitiatedCourse.Read.All"
+    "value": "LearningContent.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to create, update, read and delete all self-initiated courses in the organization's directory, without a signed-in user.",
+    "displayName": "Read and write all self-initiated courses",
+    "id": "7654ed61-8965-4025-846a-0856ec02b5b0",
+    "origin": "Application (Microsoft Graph)",
+    "value": "LearningSelfInitiatedCourse.ReadWrite.All"
   },
   {
     "description": "Allows the app to create, read, update, and delete all email, including contents of non-draft emails in user mailboxes, without a signed-in user. Does not include permission to send mail.",
@@ -16618,11 +16625,11 @@
     "value": "MailboxConfigItem.Read"
   },
   {
-    "description": "Allows the app to read all network access reports without a signed-in user.",
-    "displayName": "Read all network access reports",
-    "id": "40049381-3cc1-42af-94ec-5ce755db4b0d",
+    "description": "Allows the app to create, read, update and delete all users' UserConfiguration objects.",
+    "displayName": "Read and write all users' UserConfiguration objects",
+    "id": "aa6d92d4-b25a-4640-aefe-3e3231e5e736",
     "origin": "Application (Microsoft Graph)",
-    "value": "NetworkAccess-Reports.Read.All"
+    "value": "MailboxConfigItem.ReadWrite"
   },
   {
     "description": "Allows the app to read all the OneNote notebooks in your organization, without a signed-in user.",
@@ -16736,6 +16743,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "OrganizationalBranding.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read all organizational contacts without a signed-in user.  These contacts are managed by the organization and are different from a user's personal contacts.",
+    "displayName": "Read organizational contacts",
+    "id": "e1a88a34-94c4-4418-be12-c87b00e26bea",
+    "origin": "Application (Microsoft Graph)",
+    "value": "OrgContact.Read.All"
+  },
+  {
+    "description": "Allows the app to read all network access reports without a signed-in user.",
+    "displayName": "Read all network access reports",
+    "id": "40049381-3cc1-42af-94ec-5ce755db4b0d",
+    "origin": "Application (Microsoft Graph)",
+    "value": "NetworkAccess-Reports.Read.All"
+  },
   {
     "description": "Allows the app to read and write your organization's network access policies, without a signed-in user.",
     "displayName": "Read and write all security and routing policies for network access",
@@ -16757,20 +16778,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "NetworkAccessBranch.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read your organization's network access branches, without a signed-in user.",
-    "displayName": "Read properties of all branches for network access",
-    "id": "39ae4a24-1ef0-49e8-9d63-2a66f5c39edd",
-    "origin": "Application (Microsoft Graph)",
-    "value": "NetworkAccessBranch.Read.All"
-  },
-  {
-    "description": "Allows the app to create, read, update and delete all users' UserConfiguration objects.",
-    "displayName": "Read and write all users' UserConfiguration objects",
-    "id": "aa6d92d4-b25a-4640-aefe-3e3231e5e736",
-    "origin": "Application (Microsoft Graph)",
-    "value": "MailboxConfigItem.ReadWrite"
-  },
   {
     "description": "Allows the app to read all the users' mailbox folders, without signed-in user.",
     "displayName": "Read all the users' mailbox folders",
@@ -16820,13 +16827,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "MailboxSettings.Read"
   },
-  {
-    "description": "Allows the app to read outbound data flows without a signed-in user.",
-    "displayName": "View outbound flow definitions",
-    "id": "61d0354c-5d88-483c-b974-a37ec3395a2c",
-    "origin": "Application (Microsoft Graph)",
-    "value": "IndustryData-OutboundFlow.Read.All"
-  },
   {
     "description": "Allows the app to create, read, update, and delete user's mailbox settings without a signed-in user. Does not include permission to send mail.",
     "displayName": "Read and write all user mailbox settings",
@@ -16835,11 +16835,18 @@
     "value": "MailboxSettings.ReadWrite"
   },
   {
-    "description": "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.",
-    "displayName": "Read all hidden memberships",
-    "id": "658aa5d8-239f-45c4-aa12-864f4fc7e490",
+    "description": "Allows the app to read and write outbound data flows without a signed-in user.",
+    "displayName": "Manage outbound flow definitions",
+    "id": "24a65b4a-e501-47e2-8849-d679517887f0",
     "origin": "Application (Microsoft Graph)",
-    "value": "Member.Read.Hidden"
+    "value": "IndustryData-OutboundFlow.ReadWrite.All"
+  },
+  {
+    "description": "Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
+    "displayName": "Read mail tips for all users",
+    "id": "a2c9652d-4d7f-4e4e-9d75-ac32fdc6f413",
+    "origin": "Application (Microsoft Graph)",
+    "value": "MailTips.ReadBasic.All"
   },
   {
     "description": "Allows the app to read all multi-tenant organization details and tenants, without a signed-in user.",
@@ -16891,11 +16898,25 @@
     "value": "NetworkAccess.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read mail tips for all users in the organization without a signed-in user. Mail tips include automatic replies, mailbox status, custom tips, and delivery information.",
-    "displayName": "Read mail tips for all users",
-    "id": "a2c9652d-4d7f-4e4e-9d75-ac32fdc6f413",
+    "description": "Allows the app to read your organization's network access branches, without a signed-in user.",
+    "displayName": "Read properties of all branches for network access",
+    "id": "39ae4a24-1ef0-49e8-9d63-2a66f5c39edd",
     "origin": "Application (Microsoft Graph)",
-    "value": "MailTips.ReadBasic.All"
+    "value": "NetworkAccessBranch.Read.All"
+  },
+  {
+    "description": "Allows the app to read the memberships of hidden groups and administrative units without a signed-in user.",
+    "displayName": "Read all hidden memberships",
+    "id": "658aa5d8-239f-45c4-aa12-864f4fc7e490",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Member.Read.Hidden"
+  },
+  {
+    "description": "Allows the app to read outbound data flows without a signed-in user.",
+    "displayName": "View outbound flow definitions",
+    "id": "61d0354c-5d88-483c-b974-a37ec3395a2c",
+    "origin": "Application (Microsoft Graph)",
+    "value": "IndustryData-OutboundFlow.Read.All"
   },
   {
     "description": "Allows the app to read and write inbound data flows without a signed-in user.",
@@ -16911,20 +16932,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "IndustryData-InboundFlow.Read.All"
   },
-  {
-    "description": "Allows the app to upload data files to a data connector without a signed-in user.",
-    "displayName": "Upload files to a data connector",
-    "id": "9334c44b-a7c6-4350-8036-6bf8e02b4c1f",
-    "origin": "Application (Microsoft Graph)",
-    "value": "IndustryData-DataConnector.Upload"
-  },
-  {
-    "description": "Allows the app to list all Viva Engage roles and role memberships without a signed-in user.",
-    "displayName": "Read all Viva Engage roles and role memberships",
-    "id": "30614864-4114-45ef-bdd9-0dd7894a1cc4",
-    "origin": "Application (Microsoft Graph)",
-    "value": "EngagementRole.Read.All"
-  },
   {
     "description": "Allows the app to assign Viva Engage role to a user, and remove a Viva Engage role from a user without a signed-in user.",
     "displayName": "Modify Viva Engage role membership",
@@ -17030,6 +17037,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "FileIngestion.Ingest"
   },
+  {
+    "description": "Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user.",
+    "displayName": "Manage onboarding for a Hybrid Cloud tenant",
+    "id": "766c601b-c009-4438-8290-c8b05fa00c4b",
+    "origin": "Application (Microsoft Graph)",
+    "value": "FileIngestionHybridOnboarding.Manage"
+  },
+  {
+    "description": "Allows the app to list all Viva Engage roles and role memberships without a signed-in user.",
+    "displayName": "Read all Viva Engage roles and role memberships",
+    "id": "30614864-4114-45ef-bdd9-0dd7894a1cc4",
+    "origin": "Application (Microsoft Graph)",
+    "value": "EngagementRole.Read.All"
+  },
   {
     "description": "Allows the app to list Viva Engage Teams QA conversations, and to read their properties without a signed-in user.",
     "displayName": "Read all Viva Engage Teams QA conversations",
@@ -17051,20 +17072,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "EngagementConversation.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to list Viva Engage conversations, and to read their properties without a signed-in user.",
-    "displayName": "Read all Viva Engage conversations",
-    "id": "2c495153-cd0e-41b4-9980-3bcecf1ca22f",
-    "origin": "Application (Microsoft Graph)",
-    "value": "EngagementConversation.Read.All"
-  },
-  {
-    "description": "Allows the app to read eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.",
-    "displayName": "Read all eDiscovery objects",
-    "id": "50180013-6191-4d1e-a373-e590ff4e66af",
-    "origin": "Application (Microsoft Graph)",
-    "value": "eDiscovery.Read.All"
-  },
   {
     "description": "Allows the app to read and write eDiscovery objects such as cases, custodians, review sets and other related objects without a signed-in user.",
     "displayName": "Read and write all eDiscovery objects",
@@ -17114,13 +17121,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "EduAssignments.ReadWriteBasic.All"
   },
-  {
-    "description": "Allows the app to manage onboarding for a Hybrid Cloud tenant, without a signed-in user.",
-    "displayName": "Manage onboarding for a Hybrid Cloud tenant",
-    "id": "766c601b-c009-4438-8290-c8b05fa00c4b",
-    "origin": "Application (Microsoft Graph)",
-    "value": "FileIngestionHybridOnboarding.Manage"
-  },
   {
     "description": "Allows the app to read all modules and resources, without a signed-in user.",
     "displayName": "Read all class modules and resources",
@@ -17129,11 +17129,18 @@
     "value": "EduCurricula.Read.All"
   },
   {
-    "description": "Allows the app to read all tenant users reading assignments submissions data without a signed-in user.",
-    "displayName": "Read all tenant reading assignments submissions data",
-    "id": "ad248c30-1919-40c8-b3d2-304481894e88",
+    "description": "Allows the app to read all files in all site collections without a signed in user.",
+    "displayName": "Read files in all site collections",
+    "id": "01d4889c-1287-42c6-ac1f-5d1e02578ef6",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Files.Read.All"
+  },
+  {
+    "description": "Allows the app to read and write all modules and resources, without a signed-in user.",
+    "displayName": "Read and write all class modules and resources",
+    "id": "6a0c2318-d59d-4c7d-bf2e-5f3902dc2593",
     "origin": "Application (Microsoft Graph)",
-    "value": "EduReports-Reading.Read.All"
+    "value": "EduCurricula.ReadWrite.All"
   },
   {
     "description": "Allows the app to read all tenant users reading assignments submissions data (excludes student-identifying information) without a signed-in user.",
@@ -17185,39 +17192,39 @@
     "value": "EngagementConversation.Migration.All"
   },
   {
-    "description": "Allows the app to read and write all modules and resources, without a signed-in user.",
-    "displayName": "Read and write all class modules and resources",
-    "id": "6a0c2318-d59d-4c7d-bf2e-5f3902dc2593",
+    "description": "Allows the app to list Viva Engage conversations, and to read their properties without a signed-in user.",
+    "displayName": "Read all Viva Engage conversations",
+    "id": "2c495153-cd0e-41b4-9980-3bcecf1ca22f",
     "origin": "Application (Microsoft Graph)",
-    "value": "EduCurricula.ReadWrite.All"
+    "value": "EngagementConversation.Read.All"
   },
   {
-    "description": "Allows the app to read all organizational contacts without a signed-in user.  These contacts are managed by the organization and are different from a user's personal contacts.",
-    "displayName": "Read organizational contacts",
-    "id": "e1a88a34-94c4-4418-be12-c87b00e26bea",
+    "description": "Allows the app to read all tenant users reading assignments submissions data without a signed-in user.",
+    "displayName": "Read all tenant reading assignments submissions data",
+    "id": "ad248c30-1919-40c8-b3d2-304481894e88",
     "origin": "Application (Microsoft Graph)",
-    "value": "OrgContact.Read.All"
+    "value": "EduReports-Reading.Read.All"
   },
   {
-    "description": "Allows the app to read all files in all site collections without a signed in user.",
-    "displayName": "Read files in all site collections",
-    "id": "01d4889c-1287-42c6-ac1f-5d1e02578ef6",
+    "description": "Allows the app to read organization-wide apps and services settings, without a signed-in user.",
+    "displayName": "Read organization-wide apps and services settings",
+    "id": "56c84fa9-ea1f-4a15-90f2-90ef41ece2c9",
     "origin": "Application (Microsoft Graph)",
-    "value": "Files.Read.All"
+    "value": "OrgSettings-AppsAndServices.Read.All"
   },
   {
-    "description": "Allows the app to read, create, update and delete files in the application's folder without a signed in user.",
-    "displayName": "Have full access to the application's folder without a signed in user.",
-    "id": "b47b160b-1054-4efd-9ca0-e2f614696086",
+    "description": "Allows the app to read, create, update and delete all files in all site collections without a signed in user.",
+    "displayName": "Read and write files in all site collections",
+    "id": "75359482-378d-4052-8f01-80520e7db3cd",
     "origin": "Application (Microsoft Graph)",
-    "value": "Files.ReadWrite.AppFolder"
+    "value": "Files.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read identity notification settings, email templates, and prerequisites without a signed-in user.",
-    "displayName": "Read all identity notification settings and templates",
-    "id": "52ced3dd-dbb6-41a0-9ce5-61a056be97b8",
+    "description": "Allow the application to access a subset of files without a signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.",
+    "displayName": "Access selected Files without a signed in user.",
+    "id": "bd61925e-3bf4-4d62-bc0b-06b06c96d95c",
     "origin": "Application (Microsoft Graph)",
-    "value": "IdentityNotifications.Read.All"
+    "value": "Files.SelectedOperations.Selected"
   },
   {
     "description": "Allows the app to read and write identity notification settings, customize email templates, and send test emails without a signed-in user.",
@@ -17331,6 +17338,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "IndustryData-DataConnector.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to upload data files to a data connector without a signed-in user.",
+    "displayName": "Upload files to a data connector",
+    "id": "9334c44b-a7c6-4350-8036-6bf8e02b4c1f",
+    "origin": "Application (Microsoft Graph)",
+    "value": "IndustryData-DataConnector.Upload"
+  },
+  {
+    "description": "Allows the app to read identity notification settings, email templates, and prerequisites without a signed-in user.",
+    "displayName": "Read all identity notification settings and templates",
+    "id": "52ced3dd-dbb6-41a0-9ce5-61a056be97b8",
+    "origin": "Application (Microsoft Graph)",
+    "value": "IdentityNotifications.Read.All"
+  },
   {
     "description": "Allows the app to start identity diagnostic processes for all users in the organization, without a signed-in user.",
     "displayName": "Start identity diagnostics for all users",
@@ -17352,20 +17373,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "HealthMonitoringAlertConfig.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read all scenario health monitoring alert configurations, without a signed-in user.",
-    "displayName": "Read all scenario health monitoring alert configurations",
-    "id": "bb424d73-e898-4c97-9d42-688c32810003",
-    "origin": "Application (Microsoft Graph)",
-    "value": "HealthMonitoringAlertConfig.Read.All"
-  },
-  {
-    "description": "Allow the application to access a subset of files without a signed in user.  The specific files and the permissions granted will be configured in SharePoint Online or OneDrive.",
-    "displayName": "Access selected Files without a signed in user.",
-    "id": "bd61925e-3bf4-4d62-bc0b-06b06c96d95c",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Files.SelectedOperations.Selected"
-  },
   {
     "description": "Allows the application to utilize the file storage container platform to manage containers, without a signed-in user. The specific file storage containers and the permissions granted to them will be configured in Microsoft 365 by the developer of each container type.",
     "displayName": "Access selected file storage containers",
@@ -17415,13 +17422,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "Group-Conversation.Read.All"
   },
-  {
-    "description": "Allows the app to read, create, update and delete all files in all site collections without a signed in user.",
-    "displayName": "Read and write files in all site collections",
-    "id": "75359482-378d-4052-8f01-80520e7db3cd",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Files.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read and write conversations of the groups this app has access to without a signed-in user.",
     "displayName": "Read and write all group conversations",
@@ -17430,11 +17430,18 @@
     "value": "Group-Conversation.ReadWrite.All"
   },
   {
-    "description": "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.",
-    "displayName": "Read and write all group memberships",
-    "id": "dbaae8cf-10b5-4b86-a4a1-f871c94c6695",
+    "description": "Allows the app to read, create, update and delete files in the application's folder without a signed in user.",
+    "displayName": "Have full access to the application's folder without a signed in user.",
+    "id": "b47b160b-1054-4efd-9ca0-e2f614696086",
     "origin": "Application (Microsoft Graph)",
-    "value": "GroupMember.ReadWrite.All"
+    "value": "Files.ReadWrite.AppFolder"
+  },
+  {
+    "description": "Allows the app to read memberships and basic group properties for all groups without a signed-in user.",
+    "displayName": "Read all group memberships",
+    "id": "98830695-27a2-44f7-8c18-0c3ebc9698f6",
+    "origin": "Application (Microsoft Graph)",
+    "value": "GroupMember.Read.All"
   },
   {
     "description": "Allows the app to read and write groups' disableNesting property without a signed-in user.",
@@ -17486,25 +17493,25 @@
     "value": "HealthMonitoringAlert.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read memberships and basic group properties for all groups without a signed-in user.",
-    "displayName": "Read all group memberships",
-    "id": "98830695-27a2-44f7-8c18-0c3ebc9698f6",
+    "description": "Allows the app to read all scenario health monitoring alert configurations, without a signed-in user.",
+    "displayName": "Read all scenario health monitoring alert configurations",
+    "id": "bb424d73-e898-4c97-9d42-688c32810003",
     "origin": "Application (Microsoft Graph)",
-    "value": "GroupMember.Read.All"
+    "value": "HealthMonitoringAlertConfig.Read.All"
   },
   {
-    "description": "Allows the application to read the tenant-level settings of SharePoint and OneDrive, without a signed-in user.",
-    "displayName": "Read SharePoint and OneDrive tenant settings",
-    "id": "83d4163d-a2d8-4d3b-9695-4ae3ca98f888",
+    "description": "Allows the app to list groups, read basic properties, read and update the membership of the groups this app has access to without a signed-in user. Group properties and owners cannot be updated and groups cannot be deleted.",
+    "displayName": "Read and write all group memberships",
+    "id": "dbaae8cf-10b5-4b86-a4a1-f871c94c6695",
     "origin": "Application (Microsoft Graph)",
-    "value": "SharePointTenantSettings.Read.All"
+    "value": "GroupMember.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read organization-wide apps and services settings, without a signed-in user.",
-    "displayName": "Read organization-wide apps and services settings",
-    "id": "56c84fa9-ea1f-4a15-90f2-90ef41ece2c9",
+    "description": "Allows the app to read and write organization-wide apps and services settings, without a signed-in user.",
+    "displayName": "Read and write organization-wide apps and services settings",
+    "id": "4a8e4191-c1c8-45f8-b801-f9a1a5ee6ad3",
     "origin": "Application (Microsoft Graph)",
-    "value": "OrgSettings-AppsAndServices.Read.All"
+    "value": "OrgSettings-AppsAndServices.ReadWrite.All"
   },
   {
     "description": "Allows the app to read organization-wide Dynamics customer voice settings, without a signed-in user.",
@@ -17514,18 +17521,11 @@
     "value": "OrgSettings-DynamicsVoice.Read.All"
   },
   {
-    "description": "Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments.",
-    "displayName": "Read role management data for all RBAC providers",
-    "id": "c7fbd983-d9aa-4fa7-84b8-17382c103bc4",
-    "origin": "Application (Microsoft Graph)",
-    "value": "RoleManagement.Read.All"
-  },
-  {
-    "description": "Allows the app to read the Cloud PC role-based access control (RBAC) settings, without a signed-in user.",
-    "displayName": "Read Cloud PC RBAC settings",
-    "id": "031a549a-bb80-49b6-8032-2068448c6a3c",
+    "description": "Allows the app to read and write organization-wide Dynamics customer voice settings, without a signed-in user.",
+    "displayName": "Read and write organization-wide Dynamics customer voice settings",
+    "id": "c3f1cc32-8bbd-4ab6-bd33-f270e0d9e041",
     "origin": "Application (Microsoft Graph)",
-    "value": "RoleManagement.Read.CloudPC"
+    "value": "OrgSettings-DynamicsVoice.ReadWrite.All"
   },
   {
     "description": "Allows the app to read the role-based access control (RBAC) settings for your company's directory, without a signed-in user.",
@@ -17632,13 +17632,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "RoleManagementPolicy.ReadWrite.EntraAppRole"
   },
-  {
-    "description": "Delete all eligible privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.",
-    "displayName": "Delete all eligible role assignments of your company's directory",
-    "id": "79c7e69c-0d9f-4eff-97a8-49170a5a08ba",
-    "origin": "Application (Microsoft Graph)",
-    "value": "RoleEligibilitySchedule.Remove.Directory"
-  },
   {
     "description": "Allows the app to read all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.",
     "displayName": "Read all schedule items",
@@ -17647,25 +17640,39 @@
     "value": "Schedule.Read.All"
   },
   {
-    "description": "Allows the app to read and manage the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.",
-    "displayName": "Read, update, and delete all eligible role assignments and schedules for your company's directory",
-    "id": "fee28b28-e1f3-4841-818e-2704dc62245f",
+    "description": "Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.",
+    "displayName": "Read and write all schedule items",
+    "id": "b7760610-0545-4e8a-9ec3-cce9e63db01c",
     "origin": "Application (Microsoft Graph)",
-    "value": "RoleEligibilitySchedule.ReadWrite.Directory"
+    "value": "Schedule.ReadWrite.All"
   },
   {
-    "description": "Delete all active privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.",
-    "displayName": "Delete all active role assignments of your company's directory",
-    "id": "d3495511-98b7-4df3-b317-4e35c19f6129",
+    "description": "Allows the app to read the Cloud PC role-based access control (RBAC) settings, without a signed-in user.",
+    "displayName": "Read Cloud PC RBAC settings",
+    "id": "031a549a-bb80-49b6-8032-2068448c6a3c",
     "origin": "Application (Microsoft Graph)",
-    "value": "RoleAssignmentSchedule.Remove.Directory"
+    "value": "RoleManagement.Read.CloudPC"
   },
   {
-    "description": "Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
-    "displayName": "Read and write all certificate based authentication configurations",
-    "id": "a2b63618-5350-462d-b1b3-ba6eb3684e26",
+    "description": "Allows the app to read role-based access control (RBAC) settings for all RBAC providers without a signed-in user. This includes reading role definitions and role assignments.",
+    "displayName": "Read role management data for all RBAC providers",
+    "id": "c7fbd983-d9aa-4fa7-84b8-17382c103bc4",
     "origin": "Application (Microsoft Graph)",
-    "value": "PublicKeyInfrastructure.ReadWrite.All"
+    "value": "RoleManagement.Read.All"
+  },
+  {
+    "description": "Delete all eligible privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.",
+    "displayName": "Delete all eligible role assignments of your company's directory",
+    "id": "79c7e69c-0d9f-4eff-97a8-49170a5a08ba",
+    "origin": "Application (Microsoft Graph)",
+    "value": "RoleEligibilitySchedule.Remove.Directory"
+  },
+  {
+    "description": "Allows the app to read and manage the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes managing eligible directory role membership, and reading directory role templates, directory roles and eligible memberships.",
+    "displayName": "Read, update, and delete all eligible role assignments and schedules for your company's directory",
+    "id": "fee28b28-e1f3-4841-818e-2704dc62245f",
+    "origin": "Application (Microsoft Graph)",
+    "value": "RoleEligibilitySchedule.ReadWrite.Directory"
   },
   {
     "description": "Allows the application to read pull-print printers without a signed-in user. ",
@@ -17723,6 +17730,13 @@
     "origin": "Application (Microsoft Graph)",
     "value": "ReportSettings.Read.All"
   },
+  {
+    "description": "Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user.",
+    "displayName": "Read/Write schedule permissions for a role",
+    "id": "7239b71d-b402-4150-b13d-78ecfe8df441",
+    "origin": "Application (Microsoft Graph)",
+    "value": "SchedulePermissions.ReadWrite.All"
+  },
   {
     "description": "Allows the app to read and update all admin report settings, such as whether to display concealed information in reports, without a signed-in user.",
     "displayName": "Read and write all admin report settings",
@@ -17730,13 +17744,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "ReportSettings.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read the resource specific permissions granted on the chat without a signed-in user.",
-    "displayName": "Read resource specific permissions granted on a chat",
-    "id": "2ff643d8-43e4-4a9b-88c1-86cb4a4b4c2f",
-    "origin": "Application (Microsoft Graph)",
-    "value": "ResourceSpecificPermissionGrant.ReadForChat.All"
-  },
   {
     "description": "Allows the app to read the resource specific permissions granted on the team without a signed-in user.",
     "displayName": "Read resource specific permissions granted on a team",
@@ -17779,6 +17786,13 @@
     "origin": "Application (Microsoft Graph)",
     "value": "RoleAssignmentSchedule.ReadWrite.Directory"
   },
+  {
+    "description": "Delete all active privileged role-based access control (RBAC) assignments of your company's directory, without a signed-in user.",
+    "displayName": "Delete all active role assignments of your company's directory",
+    "id": "d3495511-98b7-4df3-b317-4e35c19f6129",
+    "origin": "Application (Microsoft Graph)",
+    "value": "RoleAssignmentSchedule.Remove.Directory"
+  },
   {
     "description": "Allows the app to read the eligible role-based access control (RBAC) assignments and schedules for your company's directory, without a signed-in user. This includes reading directory role templates, and directory roles.",
     "displayName": "Read all eligible role assignments and role schedules for your company's directory",
@@ -17787,18 +17801,18 @@
     "value": "RoleEligibilitySchedule.Read.Directory"
   },
   {
-    "description": "Allows the app to manage all schedules, schedule groups, shifts and associated entities in the Teams or Shifts application without a signed-in user.",
-    "displayName": "Read and write all schedule items",
-    "id": "b7760610-0545-4e8a-9ec3-cce9e63db01c",
+    "description": "Allows the app to read the resource specific permissions granted on the chat without a signed-in user.",
+    "displayName": "Read resource specific permissions granted on a chat",
+    "id": "2ff643d8-43e4-4a9b-88c1-86cb4a4b4c2f",
     "origin": "Application (Microsoft Graph)",
-    "value": "Schedule.ReadWrite.All"
+    "value": "ResourceSpecificPermissionGrant.ReadForChat.All"
   },
   {
-    "description": "Allows the app to read/write schedule permissions for a specific role in Shifts application without a signed-in user.",
-    "displayName": "Read/Write schedule permissions for a role",
-    "id": "7239b71d-b402-4150-b13d-78ecfe8df441",
+    "description": "Allows the application to read and write certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
+    "displayName": "Read and write all certificate based authentication configurations",
+    "id": "a2b63618-5350-462d-b1b3-ba6eb3684e26",
     "origin": "Application (Microsoft Graph)",
-    "value": "SchedulePermissions.ReadWrite.All"
+    "value": "PublicKeyInfrastructure.ReadWrite.All"
   },
   {
     "description": "Allows the app to trigger the working time policies and read the working time status for other users in your organization, without a signed-in user.",
@@ -17808,18 +17822,11 @@
     "value": "Schedule-WorkingTime.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write identity security available user actions without a signed-in user.",
-    "displayName": "Read and perform all identity security available user actions",
-    "id": "b4146a3a-dd4f-4af4-8d91-7cc0eef3d041",
-    "origin": "Application (Microsoft Graph)",
-    "value": "SecurityIdentitiesUserActions.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read all security incidents, without a signed-in user.",
-    "displayName": "Read all security incidents",
-    "id": "45cc0394-e837-488b-a098-1918f48d186c",
+    "description": "Allows the app to read and write search configurations, without a signed-in user.",
+    "displayName": "Read and write your organization's search configuration",
+    "id": "0e778b85-fefa-466d-9eec-750569d92122",
     "origin": "Application (Microsoft Graph)",
-    "value": "SecurityIncident.Read.All"
+    "value": "SearchConfiguration.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and write to all security incidents, without a signed-in user.",
@@ -17927,46 +17934,46 @@
     "value": "SharePointCrossTenantMigration.Manage.All"
   },
   {
-    "description": "Allows the app to read all the identity security available user actions without a signed-in user.",
-    "displayName": "Read all identity security available user actions",
-    "id": "3e5d0bee-973f-4736-a123-4e1ab146f3a8",
+    "description": "Allows the app to read your tenant's SharePoint Cross-Tenant migration settings and tasks, without a signed-in user.",
+    "displayName": "Read SharePoint Cross-Tenant migration settings and tasks",
+    "id": "f5fa52a5-b9ab-4dc3-885e-9e5b4a67068e",
     "origin": "Application (Microsoft Graph)",
-    "value": "SecurityIdentitiesUserActions.Read.All"
+    "value": "SharePointCrossTenantMigration.Read.All"
   },
   {
-    "description": "Allows the app to read and write identity security sensors without a signed-in user.",
-    "displayName": "Read and write all identity security sensors",
-    "id": "d4dcee6d-0774-412a-b06c-aeabbd99e816",
+    "description": "Allows the application to read the tenant-level settings of SharePoint and OneDrive, without a signed-in user.",
+    "displayName": "Read SharePoint and OneDrive tenant settings",
+    "id": "83d4163d-a2d8-4d3b-9695-4ae3ca98f888",
     "origin": "Application (Microsoft Graph)",
-    "value": "SecurityIdentitiesSensors.ReadWrite.All"
+    "value": "SharePointTenantSettings.Read.All"
   },
   {
-    "description": "Allows the app to read all the identity security sensors without a signed-in user.",
-    "displayName": "Read all identity security sensors",
-    "id": "5f0ffea2-f474-4cf2-9834-61cda2bcea5c",
+    "description": "Allows the app to read all security incidents, without a signed-in user.",
+    "displayName": "Read all security incidents",
+    "id": "45cc0394-e837-488b-a098-1918f48d186c",
     "origin": "Application (Microsoft Graph)",
-    "value": "SecurityIdentitiesSensors.Read.All"
+    "value": "SecurityIncident.Read.All"
   },
   {
-    "description": "Allows the app to read and write identity security sensor migration without a signed-in user.",
-    "displayName": "Read and write all identity security sensor migration",
-    "id": "afd28a5a-707f-4edf-85c2-c446291e63da",
+    "description": "Allows the app to read and write identity security available user actions without a signed-in user.",
+    "displayName": "Read and perform all identity security available user actions",
+    "id": "b4146a3a-dd4f-4af4-8d91-7cc0eef3d041",
     "origin": "Application (Microsoft Graph)",
-    "value": "SecurityIdentitiesMigration.ReadWrite.All"
+    "value": "SecurityIdentitiesUserActions.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read search configurations, without a signed-in user.",
-    "displayName": "Read your organization's search configuration",
-    "id": "ada977a5-b8b1-493b-9a91-66c206d76ecf",
+    "description": "Allows the app to read all the identity security available user actions without a signed-in user.",
+    "displayName": "Read all identity security available user actions",
+    "id": "3e5d0bee-973f-4736-a123-4e1ab146f3a8",
     "origin": "Application (Microsoft Graph)",
-    "value": "SearchConfiguration.Read.All"
+    "value": "SecurityIdentitiesUserActions.Read.All"
   },
   {
-    "description": "Allows the app to read and write search configurations, without a signed-in user.",
-    "displayName": "Read and write your organization's search configuration",
-    "id": "0e778b85-fefa-466d-9eec-750569d92122",
+    "description": "Allows the app to read and write identity security sensors without a signed-in user.",
+    "displayName": "Read and write all identity security sensors",
+    "id": "d4dcee6d-0774-412a-b06c-aeabbd99e816",
     "origin": "Application (Microsoft Graph)",
-    "value": "SearchConfiguration.ReadWrite.All"
+    "value": "SecurityIdentitiesSensors.ReadWrite.All"
   },
   {
     "description": "Allows the app to read security actions, without a signed-in user.",
@@ -18010,13 +18017,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "SecurityAnalyzedMessage.Read.All"
   },
-  {
-    "description": "Allows the application to read  certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
-    "displayName": "Read all certificate based authentication configurations",
-    "id": "214fda0c-514a-4650-b037-b562b1a66124",
-    "origin": "Application (Microsoft Graph)",
-    "value": "PublicKeyInfrastructure.Read.All"
-  },
   {
     "description": "Read email metadata and security detection details, and execute remediation actions like deleting an email, without a signed-in user.",
     "displayName": "Read metadata, detection details, and execute remediation actions on all emails in your organization",
@@ -18024,6 +18024,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "SecurityAnalyzedMessage.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to read your organization’s security events without a signed-in user.",
+    "displayName": "Read your organization’s security events",
+    "id": "bf394140-e372-4bf9-a898-299cfc7564e5",
+    "origin": "Application (Microsoft Graph)",
+    "value": "SecurityEvents.Read.All"
+  },
+  {
+    "description": "Allows the app to read search configurations, without a signed-in user.",
+    "displayName": "Read your organization's search configuration",
+    "id": "ada977a5-b8b1-493b-9a91-66c206d76ecf",
+    "origin": "Application (Microsoft Graph)",
+    "value": "SearchConfiguration.Read.All"
+  },
   {
     "description": "Allows the app to read your organization’s security events without a signed-in user. Also allows the app to update editable properties in security events.",
     "displayName": "Read and update your organization’s security events",
@@ -18031,13 +18045,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "SecurityEvents.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read all the identity security available identity accounts without a signed-in user.",
-    "displayName": "Read all identity security available identity accounts",
-    "id": "c5bc96f5-b4a1-4cfc-8189-d5f0d772278f",
-    "origin": "Application (Microsoft Graph)",
-    "value": "SecurityIdentitiesAccount.Read.All"
-  },
   {
     "description": "Allows the app to read and write identity security available actions without a signed-in user.",
     "displayName": "Read and perform all identity security available actions",
@@ -18081,39 +18088,46 @@
     "value": "SecurityIdentitiesMigration.Read.All"
   },
   {
-    "description": "Allows the app to read your organization’s security events without a signed-in user.",
-    "displayName": "Read your organization’s security events",
-    "id": "bf394140-e372-4bf9-a898-299cfc7564e5",
+    "description": "Allows the app to read and write identity security sensor migration without a signed-in user.",
+    "displayName": "Read and write all identity security sensor migration",
+    "id": "afd28a5a-707f-4edf-85c2-c446291e63da",
     "origin": "Application (Microsoft Graph)",
-    "value": "SecurityEvents.Read.All"
+    "value": "SecurityIdentitiesMigration.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and query your provisioning log activities, without a signed-in user.",
-    "displayName": "Read all provisioning log data",
-    "id": "091937d3-3e38-47a1-8649-b2f99d3035f1",
+    "description": "Allows the app to read all the identity security sensors without a signed-in user.",
+    "displayName": "Read all identity security sensors",
+    "id": "5f0ffea2-f474-4cf2-9834-61cda2bcea5c",
     "origin": "Application (Microsoft Graph)",
-    "value": "ProvisioningLog.Read.All"
+    "value": "SecurityIdentitiesSensors.Read.All"
   },
   {
-    "description": "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user.",
-    "displayName": "Compute Purview policies for an individual user",
-    "id": "fe696d63-5e1f-4515-8232-cccc316903c6",
+    "description": "Allows the app to read all the identity security available identity accounts without a signed-in user.",
+    "displayName": "Read all identity security available identity accounts",
+    "id": "c5bc96f5-b4a1-4cfc-8189-d5f0d772278f",
     "origin": "Application (Microsoft Graph)",
-    "value": "ProtectionScopes.Compute.User"
+    "value": "SecurityIdentitiesAccount.Read.All"
   },
   {
-    "description": "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.",
-    "displayName": "Compute Purview policies at tenant scope",
-    "id": "e5a76501-dbb0-492c-ab55-5d09e8837263",
+    "description": "Access Microsoft Teams and Skype for Business data as the signed in user",
+    "displayName": "Access Microsoft Teams and Skype for Business data based on the user's role membership",
+    "id": "e60370c1-e451-437e-aa6e-d76df38e5f15",
+    "origin": "Delegated (Skype and Teams Tenant Admin API)",
+    "value": "user_impersonation"
+  },
+  {
+    "description": "Allows the application to read  certificate-based authentication configuration such as all public key infrastructures (PKI) and certificate authorities (CA) configured for the organization, without a signed-in user.",
+    "displayName": "Read all certificate based authentication configurations",
+    "id": "214fda0c-514a-4650-b037-b562b1a66124",
     "origin": "Application (Microsoft Graph)",
-    "value": "ProtectionScopes.Compute.All"
+    "value": "PublicKeyInfrastructure.Read.All"
   },
   {
-    "description": "Allows the app to read all your organization's B2BManagement policies without a signed in user.",
-    "displayName": "Read your organization's B2BManagement policies",
-    "id": "227900ff-df89-40f8-90e2-8157cf6995d5",
+    "description": "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for an individual user.",
+    "displayName": "Compute Purview policies for an individual user",
+    "id": "fe696d63-5e1f-4515-8232-cccc316903c6",
     "origin": "Application (Microsoft Graph)",
-    "value": "Policy.Read.B2BManagementPolicy"
+    "value": "ProtectionScopes.Compute.User"
   },
   {
     "description": "Allows the app to read your organization's conditional access policies, without a signed-in user.",
@@ -18227,6 +18241,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "Policy.ReadWrite.CrossTenantCapability"
   },
+  {
+    "description": "Allows the application to read and write your organization's device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
+    "displayName": "Read and write your organization's device configuration policies",
+    "id": "230fb2d5-aa21-49c1-bfa7-ae1be179d867",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Policy.ReadWrite.DeviceConfiguration"
+  },
+  {
+    "description": "Allows the app to read all your organization's B2BManagement policies without a signed in user.",
+    "displayName": "Read your organization's B2BManagement policies",
+    "id": "227900ff-df89-40f8-90e2-8157cf6995d5",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Policy.Read.B2BManagementPolicy"
+  },
   {
     "description": "Allows the app to read all authentication method policies for the tenant, without a signed-in user. ",
     "displayName": "Read authentication method policies",
@@ -18248,20 +18276,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "PlaceDeviceTelemetry.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read and write all workplace devices, without a signed-in user.",
-    "displayName": "Read and write all workplace devices",
-    "id": "2d510721-5c4e-43cd-bfdb-ac0f8819fb92",
-    "origin": "Application (Microsoft Graph)",
-    "value": "PlaceDevice.ReadWrite.All"
-  },
-  {
-    "description": "Allows the app to read and write organization-wide Dynamics customer voice settings, without a signed-in user.",
-    "displayName": "Read and write organization-wide Dynamics customer voice settings",
-    "id": "c3f1cc32-8bbd-4ab6-bd33-f270e0d9e041",
-    "origin": "Application (Microsoft Graph)",
-    "value": "OrgSettings-DynamicsVoice.ReadWrite.All"
-  },
   {
     "description": "Allows the app to read organization-wide Microsoft Forms settings, without a signed-in user.",
     "displayName": "Read organization-wide Microsoft Forms settings",
@@ -18311,13 +18325,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "PartnerBilling.Read.All"
   },
-  {
-    "description": "Allows the application to read and write your organization's device configuration policies without a signed-in user.  For example, device registration policy can limit initial provisioning controls using quota restrictions, additional authentication and authorization checks.",
-    "displayName": "Read and write your organization's device configuration policies",
-    "id": "230fb2d5-aa21-49c1-bfa7-ae1be179d867",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Policy.ReadWrite.DeviceConfiguration"
-  },
   {
     "description": "Allows the app to read security alerts of customer with CSP relationship, without a signed-in user.",
     "displayName": "Read security alerts of customer with CSP relationship",
@@ -18326,11 +18333,18 @@
     "value": "PartnerSecurity.Read.All"
   },
   {
-    "description": "Allows the app to read available properties of pending external user profiles, without a signed-in user.",
-    "displayName": "Read all pending external user profiles",
-    "id": "bdfb26d9-bb36-49be-9b4c-b8cbf4b05808",
+    "description": "Allows the application to read and update the organization's external identities policy without a signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.",
+    "displayName": "Read and write your organization's external identities policy",
+    "id": "03cc4f92-788e-4ede-b93f-199424d144a5",
     "origin": "Application (Microsoft Graph)",
-    "value": "PendingExternalUserProfile.Read.All"
+    "value": "Policy.ReadWrite.ExternalIdentities"
+  },
+  {
+    "description": "Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user.",
+    "displayName": "Read security alerts and update status of security alerts of customer with CSP relationship",
+    "id": "04a2c935-5b4b-474a-be42-11f53111f271",
+    "origin": "Application (Microsoft Graph)",
+    "value": "PartnerSecurity.ReadWrite.All"
   },
   {
     "description": "Allows the app to read and write available properties of pending external user profiles, without a signed-in user.",
@@ -18382,39 +18396,39 @@
     "value": "PlaceDevice.Read.All"
   },
   {
-    "description": "Allows the app to read security alerts and update status of alerts of customer with CSP relationship, without a signed-in user.",
-    "displayName": "Read security alerts and update status of security alerts of customer with CSP relationship",
-    "id": "04a2c935-5b4b-474a-be42-11f53111f271",
+    "description": "Allows the app to read and write all workplace devices, without a signed-in user.",
+    "displayName": "Read and write all workplace devices",
+    "id": "2d510721-5c4e-43cd-bfdb-ac0f8819fb92",
     "origin": "Application (Microsoft Graph)",
-    "value": "PartnerSecurity.ReadWrite.All"
+    "value": "PlaceDevice.ReadWrite.All"
   },
   {
-    "description": "Allows the app to read and write organization-wide apps and services settings, without a signed-in user.",
-    "displayName": "Read and write organization-wide apps and services settings",
-    "id": "4a8e4191-c1c8-45f8-b801-f9a1a5ee6ad3",
+    "description": "Allows the app to read available properties of pending external user profiles, without a signed-in user.",
+    "displayName": "Read all pending external user profiles",
+    "id": "bdfb26d9-bb36-49be-9b4c-b8cbf4b05808",
     "origin": "Application (Microsoft Graph)",
-    "value": "OrgSettings-AppsAndServices.ReadWrite.All"
+    "value": "PendingExternalUserProfile.Read.All"
   },
   {
-    "description": "Allows the application to read and update the organization's external identities policy without a signed-in user.  For example, external identities policy controls if users invited to access resources in your organization via B2B collaboration or B2B direct connect are allowed to self-service leave.",
-    "displayName": "Read and write your organization's external identities policy",
-    "id": "03cc4f92-788e-4ede-b93f-199424d144a5",
+    "description": "Allows the app to read and query your provisioning log activities, without a signed-in user.",
+    "displayName": "Read all provisioning log data",
+    "id": "091937d3-3e38-47a1-8649-b2f99d3035f1",
     "origin": "Application (Microsoft Graph)",
-    "value": "Policy.ReadWrite.ExternalIdentities"
+    "value": "ProvisioningLog.Read.All"
   },
   {
-    "description": "Allows the application to read and update the organization's federated token validation policy without a signed-in user.",
-    "displayName": "Read and write your organization's federated token validation policy",
-    "id": "90bbca0b-227c-4cdc-8083-1c6cfb95bac6",
+    "description": "Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.",
+    "displayName": "Read and write feature rollout policies",
+    "id": "2044e4f1-e56c-435b-925c-44cd8f6ba89a",
     "origin": "Application (Microsoft Graph)",
-    "value": "Policy.ReadWrite.FedTokenValidation"
+    "value": "Policy.ReadWrite.FeatureRollout"
   },
   {
-    "description": "Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user.",
-    "displayName": "Read and write privileged access to Azure resources",
-    "id": "6f9d5abc-2db6-400b-a267-7de22a40fb87",
+    "description": "Allows the app to read and write your organization’s identity protection policy without a signed-in user.",
+    "displayName": "Read and write your organization’s identity protection policy ",
+    "id": "2dcf8603-09eb-4078-b1ec-d30a1a76b873",
     "origin": "Application (Microsoft Graph)",
-    "value": "PrivilegedAccess.ReadWrite.AzureResources"
+    "value": "Policy.ReadWrite.IdentityProtection"
   },
   {
     "description": "Allows the app to read Privileged Access (PIM) custom extensions for your organization, without a signed-in user.",
@@ -18528,6 +18542,20 @@
     "origin": "Application (Microsoft Graph)",
     "value": "ProgramControl.ReadWrite.All"
   },
+  {
+    "description": "Allows the app to identify Purview data protection, compliance and governance policy scopes defined for all users across tenant.",
+    "displayName": "Compute Purview policies at tenant scope",
+    "id": "e5a76501-dbb0-492c-ab55-5d09e8837263",
+    "origin": "Application (Microsoft Graph)",
+    "value": "ProtectionScopes.Compute.All"
+  },
+  {
+    "description": "Allows the app to request and manage time-based assignment and just-in-time elevation of Azure resources (like your subscriptions, resource groups, storage, compute) in your organization, without a signed-in user.",
+    "displayName": "Read and write privileged access to Azure resources",
+    "id": "6f9d5abc-2db6-400b-a267-7de22a40fb87",
+    "origin": "Application (Microsoft Graph)",
+    "value": "PrivilegedAccess.ReadWrite.AzureResources"
+  },
   {
     "description": "Allows the app to request and manage time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.",
     "displayName": "Read and write privileged access to Azure AD groups",
@@ -18549,20 +18577,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "PrivilegedAccess.Read.AzureResources"
   },
-  {
-    "description": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.",
-    "displayName": "Read privileged access to Azure AD groups",
-    "id": "01e37dc9-c035-40bd-b438-b2879c4870a6",
-    "origin": "Application (Microsoft Graph)",
-    "value": "PrivilegedAccess.Read.AzureADGroup"
-  },
-  {
-    "description": "Allows the app to read and write your organization’s identity protection policy without a signed-in user.",
-    "displayName": "Read and write your organization’s identity protection policy ",
-    "id": "2dcf8603-09eb-4078-b1ec-d30a1a76b873",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Policy.ReadWrite.IdentityProtection"
-  },
   {
     "description": "Allows the app to manage policies related to consent and permission grants for applications, without a signed-in user.",
     "displayName": "Manage consent and permission grant policies",
@@ -18612,13 +18626,6 @@
     "origin": "Application (Microsoft Graph)",
     "value": "Presence.ReadWrite.All"
   },
-  {
-    "description": "Allows the app to read and write feature rollout policies without a signed-in user. Includes abilities to assign and remove users and groups to rollout of a specific feature.",
-    "displayName": "Read and write feature rollout policies",
-    "id": "2044e4f1-e56c-435b-925c-44cd8f6ba89a",
-    "origin": "Application (Microsoft Graph)",
-    "value": "Policy.ReadWrite.FeatureRollout"
-  },
   {
     "description": "Allows the application to read printers without a signed-in user. ",
     "displayName": "Read printers",
@@ -18627,11 +18634,18 @@
     "value": "Printer.Read.All"
   },
   {
-    "description": "Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs.",
-    "displayName": "Perform advanced operations on print jobs",
-    "id": "58a52f47-9e36-4b17-9ebe-ce4ef7f3e6c8",
+    "description": "Allows the application to read and update the organization's federated token validation policy without a signed-in user.",
+    "displayName": "Read and write your organization's federated token validation policy",
+    "id": "90bbca0b-227c-4cdc-8083-1c6cfb95bac6",
     "origin": "Application (Microsoft Graph)",
-    "value": "PrintJob.Manage.All"
+    "value": "Policy.ReadWrite.FedTokenValidation"
+  },
+  {
+    "description": "Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.",
+    "displayName": "Read and update printers",
+    "id": "f5b3f73d-6247-44df-a74c-866173fddab0",
+    "origin": "Application (Microsoft Graph)",
+    "value": "Printer.ReadWrite.All"
   },
   {
     "description": "Allows the application to read the metadata and document content of print jobs without a signed-in user. ",
@@ -18683,17 +18697,24 @@
     "value": "PrivilegedAccess.Read.AzureAD"
   },
   {
-    "description": "Allows the application to read and update printers without a signed-in user. Does not allow creating (registering) or deleting (unregistering) printers.",
-    "displayName": "Read and update printers",
-    "id": "f5b3f73d-6247-44df-a74c-866173fddab0",
+    "description": "Allows the app to read time-based assignment and just-in-time elevation (including scheduled elevation) of Azure AD groups in your organization, without a signed-in user.",
+    "displayName": "Read privileged access to Azure AD groups",
+    "id": "01e37dc9-c035-40bd-b438-b2879c4870a6",
     "origin": "Application (Microsoft Graph)",
-    "value": "Printer.ReadWrite.All"
+    "value": "PrivilegedAccess.Read.AzureADGroup"
   },
   {
-    "description": "Access Microsoft Teams and Skype for Business data as the signed in user",
-    "displayName": "Access Microsoft Teams and Skype for Business data based on the user's role membership",
-    "id": "e60370c1-e451-437e-aa6e-d76df38e5f15",
-    "origin": "Delegated (Skype and Teams Tenant Admin API)",
-    "value": "user_impersonation"
+    "description": "Allows the application to perform advanced operations like redirecting a print job to another printer without a signed-in user. Also allows the application to read and update the metadata of print jobs.",
+    "displayName": "Perform advanced operations on print jobs",
+    "id": "58a52f47-9e36-4b17-9ebe-ce4ef7f3e6c8",
+    "origin": "Application (Microsoft Graph)",
+    "value": "PrintJob.Manage.All"
+  },
+  {
+    "description": "Allows the app to read and write organization-wide Microsoft Planner settings, without a signed-in user.",
+    "displayName": "Read and write organization-wide Microsoft Planner settings",
+    "id": "68067c9d-a1be-4603-b095-3eaf54a42510",
+    "origin": "Application (ProjectWorkManagement)",
+    "value": "OrgSettings-Planner.ReadWrite.All"
   }
 ]
diff --git a/Config/ReportSamples/baseline.json b/Config/ReportSamples/baseline.json
new file mode 100644
index 0000000000000..682b1477243cc
--- /dev/null
+++ b/Config/ReportSamples/baseline.json
@@ -0,0 +1,1229 @@
+{
+  "sectionConfig": {
+    "alreadyAligned": true,
+    "rolloutStages": true
+  },
+  "tenant": {
+    "displayName": "contoso.onmicrosoft.com",
+    "tenantFilter": "contoso.onmicrosoft.com",
+    "rows": [
+      {
+        "standardName": "ConditionalAccessTemplate#live1",
+        "standardLabel": "Conditional Access Template - CA00 - Block legacy authentication",
+        "status": "Compliant",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "displayName": "CA00 - Block legacy authentication",
+          "state": "enabled",
+          "conditions": {
+            "clientAppTypes": [
+              "exchangeActiveSync",
+              "other"
+            ],
+            "users": {
+              "includeUsers": [
+                "All"
+              ],
+              "excludeUsers": [
+                "BreakGlass Admin"
+              ]
+            }
+          },
+          "grantControls": {
+            "builtInControls": [
+              "block"
+            ]
+          }
+        },
+        "currentValue": {
+          "displayName": "CA00 - Block legacy authentication",
+          "state": "enabled"
+        }
+      },
+      {
+        "standardName": "IntuneTemplate#live2",
+        "standardLabel": "Intune Template - Windows - Defender Antivirus",
+        "status": "Compliant",
+        "templateId": "tpl-devices",
+        "expectedValue": {
+          "displayName": "Windows - Defender Antivirus"
+        },
+        "currentValue": {
+          "displayName": "Windows - Defender Antivirus"
+        }
+      },
+      {
+        "standardName": "AuditLog",
+        "standardLabel": "Enable the Unified Audit Log",
+        "status": "Compliant",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "UnifiedAuditLogIngestionEnabled": true
+        },
+        "currentValue": {
+          "UnifiedAuditLogIngestionEnabled": true
+        }
+      },
+      {
+        "standardName": "EnableMailTips",
+        "standardLabel": "Enable all MailTips",
+        "status": "Compliant",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "MailTipsAllTipsEnabled": true,
+          "MailTipsExternalRecipientsTipsEnabled": true,
+          "MailTipsGroupMetricsEnabled": true,
+          "MailTipsLargeAudienceThreshold": 25
+        },
+        "currentValue": {
+          "MailTipsAllTipsEnabled": true,
+          "MailTipsExternalRecipientsTipsEnabled": true,
+          "MailTipsGroupMetricsEnabled": true,
+          "MailTipsLargeAudienceThreshold": 25
+        }
+      },
+      {
+        "standardName": "ConditionalAccessTemplate#abc123",
+        "standardLabel": "Conditional Access Template - CA01 - Require MFA for all users",
+        "status": "Drift",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "displayName": "CA01 - Require MFA for all users",
+          "state": "enabled",
+          "conditions": {
+            "locations": {
+              "includeLocations": [
+                "AllTrusted"
+              ]
+            },
+            "signInRiskLevels": [
+              "high",
+              "medium"
+            ],
+            "users": {
+              "includeUsers": [
+                "All"
+              ],
+              "excludeGroups": [
+                "CA Exclusions",
+                "Service Accounts",
+                "Break Glass",
+                "Directory Sync"
+              ],
+              "excludeRoles": [
+                "Directory Synchronization Accounts"
+              ],
+              "excludeGuestsOrExternalUsers": {
+                "guestOrExternalUserTypes": "b2bCollaborationGuest",
+                "externalTenants": {
+                  "membershipKind": "all"
+                }
+              }
+            }
+          },
+          "grantControls": {
+            "builtInControls": [
+              "mfa"
+            ]
+          }
+        },
+        "currentValue": null
+      },
+      {
+        "standardName": "IntuneTemplate#9f9f9f",
+        "standardLabel": "Intune Template - Windows - Baseline Security",
+        "status": "Drift",
+        "templateId": "tpl-devices",
+        "expectedValue": {
+          "displayName": "Windows - Baseline Security"
+        },
+        "currentValue": null
+      },
+      {
+        "standardName": "OutBoundSpamAlert",
+        "standardLabel": "Set Outbound Spam Alert e-mail",
+        "status": "Drift",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "NotifyOutboundSpam": true,
+          "NotifyOutboundSpamRecipients": [
+            "security@contoso.com"
+          ],
+          "BccSuspiciousOutboundMail": false
+        },
+        "currentValue": {
+          "Identity": "Default",
+          "NotifyOutboundSpam": false,
+          "NotifyOutboundSpamRecipients": [],
+          "BccSuspiciousOutboundMail": false
+        }
+      },
+      {
+        "standardName": "TeamsGlobalMeetingPolicy",
+        "standardLabel": "Define Global Meeting Policy for Teams",
+        "status": "Drift",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "AllowAnonymousUsersToJoinMeeting": false,
+          "AllowAnonymousUsersToStartMeeting": false,
+          "AutoAdmittedUsers": "EveryoneInCompanyExcludingGuests",
+          "AllowPSTNUsersToBypassLobby": false,
+          "MeetingChatEnabledType": "EnabledExceptAnonymous",
+          "DesignatedPresenterRoleMode": "OrganizerOnlyUserOverride",
+          "AllowExternalParticipantGiveRequestControl": false,
+          "AllowParticipantGiveRequestControl": false,
+          "AllowExternalNonTrustedMeetingChat": false,
+          "AllowCloudRecording": false
+        },
+        "currentValue": {
+          "AllowAnonymousUsersToJoinMeeting": true,
+          "AllowAnonymousUsersToStartMeeting": false,
+          "AutoAdmittedUsers": "Everyone",
+          "AllowPSTNUsersToBypassLobby": true,
+          "MeetingChatEnabledType": "Enabled",
+          "DesignatedPresenterRoleMode": "EveryoneUserOverride",
+          "AllowExternalParticipantGiveRequestControl": false,
+          "AllowParticipantGiveRequestControl": true,
+          "AllowExternalNonTrustedMeetingChat": true,
+          "AllowCloudRecording": true
+        }
+      },
+      {
+        "standardName": "DisableGuestDirectory",
+        "standardLabel": "Restrict guest user access to directory objects",
+        "status": "Denied - Remediate Pending",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "guestUserRoleId": "2af84b1e-32c8-42b7-82bc-daa82404023b"
+        },
+        "currentValue": {
+          "guestUserRoleId": "a0b1b346-4d3e-4e8b-98f8-753987be4970"
+        }
+      },
+      {
+        "standardName": "PWdisplayAppInformationRequiredState",
+        "standardLabel": "Enable Passwordless with Location information and Number Matching",
+        "status": "Partially Accepted",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "state": "enabled",
+          "featureSettings": {
+            "displayAppInformationRequiredState": {
+              "state": "enabled"
+            }
+          }
+        },
+        "currentValue": {
+          "state": "enabled",
+          "featureSettings": {
+            "displayAppInformationRequiredState": {
+              "state": "default"
+            }
+          }
+        }
+      },
+      {
+        "standardName": "PerUserMFA",
+        "standardLabel": "Enables per user MFA for all users.",
+        "status": "Accepted",
+        "templateId": "tpl-core",
+        "deviationReason": "Customer keeps per-user MFA until their migration completes in Q2."
+      },
+      {
+        "standardName": "AnonReportDisable",
+        "standardLabel": "Enable Usernames instead of pseudo anonymised names in reports",
+        "status": "Accepted",
+        "templateId": "tpl-core",
+        "deviationReason": null
+      },
+      {
+        "standardName": "DisableSelfServiceLicenses",
+        "standardLabel": "Disable Self Service Licensing",
+        "status": "No Data",
+        "templateId": "tpl-core",
+        "expectedValue": null,
+        "currentValue": null
+      },
+      {
+        "standardName": "EnableCustomerLockbox",
+        "standardLabel": "Enable Customer Lockbox",
+        "status": "No Data",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "CustomerLockBoxEnabled": true
+        },
+        "currentValue": null
+      },
+      {
+        "standardName": "DisableAppCreation",
+        "standardLabel": "Disable App creation by users",
+        "status": "No Data",
+        "templateId": "tpl-core",
+        "expectedValue": null,
+        "currentValue": null
+      },
+      {
+        "standardName": "ConditionalAccessTemplate#pend1",
+        "standardLabel": "Conditional Access Template - CA05 - Require MFA for admins",
+        "status": "No Data",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "displayName": "guid-ca-pend.CATemplate.json",
+          "state": "enabledForReportingButNotEnforced"
+        },
+        "currentValue": null
+      },
+      {
+        "standardName": "SecurityDefaults",
+        "standardLabel": "Enable Security Defaults",
+        "status": "Failed",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "isEnabled": true
+        },
+        "currentValue": null
+      },
+      {
+        "standardName": "ConditionalAccessTemplate#nolic",
+        "standardLabel": "Conditional Access Template - CA20 - Block high-risk users",
+        "status": "Skipped - No License",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "displayName": "guid-ca-risk.CATemplate.json"
+        },
+        "currentValue": null
+      },
+      {
+        "standardName": "LegacyRetiredSetting",
+        "standardLabel": "Legacy retired setting",
+        "status": "Skipped - Not applicable",
+        "templateId": "tpl-core",
+        "expectedValue": null,
+        "currentValue": null
+      },
+      {
+        "standardName": "sharingCapability",
+        "standardLabel": "Set Sharing Level for OneDrive and SharePoint",
+        "status": "Conflict",
+        "templateId": "tpl-core",
+        "expectedValue": {
+          "SharingCapability": 1
+        },
+        "currentValue": {
+          "SharingCapability": 2
+        }
+      }
+    ]
+  },
+  "stageStates": [
+    {
+      "tenantFilter": "contoso.onmicrosoft.com",
+      "tenantName": "Contoso",
+      "templateId": "tpl-core",
+      "templateName": "Core Security Baseline",
+      "currentStage": 1,
+      "totalStages": 3,
+      "stageName": "Foundations",
+      "enteredStageAt": 1790164800,
+      "nextStageName": "Hardening",
+      "estimatedAdvanceAt": 1791374400,
+      "manualAdvance": true,
+      "alignedPercentage": 67,
+      "nextStage": {
+        "name": "Hardening",
+        "logic": "or",
+        "conditions": [
+          {
+            "type": "time",
+            "days": 14,
+            "unit": "days"
+          },
+          {
+            "type": "manual"
+          }
+        ],
+        "standards": [
+          "IntuneTemplate#stage2a",
+          "IntuneTemplate#stage2b",
+          "SecurityDefaults",
+          "DisableGuestDirectory",
+          "EnableMailTips"
+        ]
+      }
+    },
+    {
+      "tenantFilter": "contoso.onmicrosoft.com",
+      "tenantName": "Contoso",
+      "templateId": "tpl-devices",
+      "templateName": "Device Baseline",
+      "currentStage": 2,
+      "totalStages": 2,
+      "stageName": "Rollout",
+      "enteredStageAt": 1789560000,
+      "nextStageName": null,
+      "estimatedAdvanceAt": null,
+      "manualAdvance": false,
+      "alignedPercentage": 50,
+      "nextStage": null
+    }
+  ],
+  "assignedTemplates": [
+    {
+      "GUID": "tpl-core",
+      "templateName": "Core Security Baseline",
+      "stages": [
+        {
+          "name": "Foundations",
+          "logic": "and",
+          "conditions": [],
+          "standards": [
+            "AuditLog",
+            "ConditionalAccessTemplate#abc123",
+            "ConditionalAccessTemplate#live1",
+            "ConditionalAccessTemplate#pend1",
+            "DisableAppCreation",
+            "DisableSelfServiceLicenses",
+            "EnableCustomerLockbox"
+          ],
+          "standardsConfig": [
+            {
+              "standard": "AuditLog",
+              "instance": "AuditLog",
+              "variables": {
+                "enabled": true
+              }
+            },
+            {
+              "standard": "ConditionalAccessTemplate",
+              "instance": "ConditionalAccessTemplate#pend1",
+              "variables": {
+                "caTemplate": {
+                  "label": "CA05 - Require MFA for admins",
+                  "value": "guid-ca-pend"
+                },
+                "state": {
+                  "label": "Report only",
+                  "value": "enabledForReportingButNotEnforced"
+                }
+              }
+            },
+            {
+              "standard": "DisableAppCreation",
+              "instance": "DisableAppCreation",
+              "variables": {
+                "allowAppCreation": false
+              }
+            },
+            {
+              "standard": "DisableSelfServiceLicenses",
+              "instance": "DisableSelfServiceLicenses",
+              "variables": {}
+            },
+            {
+              "standard": "EnableCustomerLockbox",
+              "instance": "EnableCustomerLockbox",
+              "variables": {
+                "enabled": true
+              }
+            }
+          ]
+        },
+        {
+          "name": "Hardening",
+          "logic": "or",
+          "conditions": [
+            {
+              "type": "time",
+              "days": 14,
+              "unit": "days"
+            },
+            {
+              "type": "manual"
+            }
+          ],
+          "standards": [
+            "DisableGuestDirectory",
+            "EnableMailTips",
+            "IntuneTemplate#stage2a",
+            "IntuneTemplate#stage2b",
+            "SecurityDefaults"
+          ],
+          "standardsConfig": []
+        },
+        {
+          "name": "Lockdown",
+          "logic": "and",
+          "conditions": [
+            {
+              "type": "group",
+              "group": "grp-1",
+              "groupName": "Premium customers"
+            }
+          ],
+          "standards": [
+            "TeamsGlobalMeetingPolicy"
+          ],
+          "standardsConfig": []
+        }
+      ]
+    },
+    {
+      "GUID": "tpl-devices",
+      "templateName": "Device Baseline",
+      "stages": [
+        {
+          "name": "Pilot",
+          "logic": "and",
+          "conditions": [],
+          "standards": [
+            "IntuneTemplate#live2"
+          ],
+          "standardsConfig": []
+        },
+        {
+          "name": "Rollout",
+          "logic": "and",
+          "conditions": [
+            {
+              "type": "time",
+              "days": 1,
+              "unit": "weeks"
+            }
+          ],
+          "standards": [
+            "IntuneTemplate#9f9f9f"
+          ],
+          "standardsConfig": []
+        }
+      ]
+    }
+  ],
+  "simulatedTemplates": [
+    {
+      "GUID": "tpl-zero-trust",
+      "templateName": "Zero Trust",
+      "stages": [
+        {
+          "name": "Default",
+          "logic": "and",
+          "conditions": [],
+          "standards": [
+            "AuditLog",
+            "ConditionalAccessTemplate#sim1",
+            "DefaultSharingLink",
+            "IntuneTemplate#sim3",
+            "IntuneTemplatePackage#sim2"
+          ],
+          "standardsConfig": [
+            {
+              "standard": "AuditLog",
+              "instance": "AuditLog",
+              "variables": {
+                "enabled": true
+              }
+            },
+            {
+              "standard": "ConditionalAccessTemplate",
+              "instance": "ConditionalAccessTemplate#sim1",
+              "variables": {
+                "caTemplate": {
+                  "label": "CA10 - Require phishing-resistant MFA for admins",
+                  "value": "guid-ca-sim"
+                },
+                "state": "enabled"
+              }
+            },
+            {
+              "standard": "DefaultSharingLink",
+              "instance": "DefaultSharingLink",
+              "variables": {}
+            },
+            {
+              "standard": "IntuneTemplate",
+              "instance": "IntuneTemplate#sim3",
+              "variables": {
+                "intuneTemplate": {
+                  "label": "Windows - BitLocker",
+                  "value": "guid-intune-bitlocker"
+                }
+              }
+            },
+            {
+              "standard": "IntuneTemplatePackage",
+              "instance": "IntuneTemplatePackage#sim2",
+              "variables": {
+                "intuneTemplatePackage": {
+                  "label": "Windows Hardening (4 Templates)",
+                  "value": "Windows Hardening"
+                }
+              }
+            }
+          ]
+        },
+        {
+          "name": "Guests",
+          "logic": "and",
+          "conditions": [
+            {
+              "type": "time",
+              "days": 7,
+              "unit": "days"
+            }
+          ],
+          "standards": [
+            "sharingCapability",
+            "SPDirectSharing"
+          ],
+          "standardsConfig": [
+            {
+              "standard": "sharingCapability",
+              "instance": "sharingCapability",
+              "variables": {
+                "sharingCapability": 0
+              }
+            },
+            {
+              "standard": "SPDirectSharing",
+              "instance": "SPDirectSharing",
+              "variables": {}
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "resolvers": {
+    "caByGuid": {
+      "guid-ca-pend": {
+        "displayName": "CA05 - Require MFA for admins",
+        "state": "enabled",
+        "conditions": {
+          "users": {
+            "includeRoles": [
+              "Global Administrator",
+              "Security Administrator"
+            ],
+            "excludeUsers": [
+              "BreakGlass Admin"
+            ]
+          }
+        },
+        "grantControls": {
+          "builtInControls": [
+            "mfa"
+          ]
+        }
+      },
+      "guid-ca-sim": {
+        "displayName": "CA10 - Require phishing-resistant MFA for admins",
+        "state": "enabledForReportingButNotEnforced",
+        "conditions": {
+          "users": {
+            "includeRoles": [
+              "Global Administrator",
+              "Security Administrator",
+              "Exchange Administrator",
+              "SharePoint Administrator"
+            ],
+            "excludeUsers": [
+              "BreakGlass Admin"
+            ]
+          }
+        },
+        "grantControls": {
+          "authenticationStrength": {
+            "displayName": "Phishing-resistant MFA"
+          }
+        },
+        "sessionControls": {
+          "signInFrequency": {
+            "isEnabled": true,
+            "value": 4,
+            "type": "hours"
+          }
+        }
+      }
+    },
+    "intuneByGuid": {
+      "guid-intune-bitlocker": {
+        "displayName": "Windows - BitLocker"
+      }
+    }
+  },
+  "catalog": [
+    {
+      "name": "ConditionalAccessTemplate",
+      "label": "Conditional Access Template",
+      "helpText": "Manage conditional access policies for better security.",
+      "executiveText": "Deploys standardized conditional access policies that automatically enforce security requirements based on user location, device compliance, and risk factors.",
+      "impact": "High Impact",
+      "recommendedBy": [
+        "CIS",
+        "Microsoft",
+        "CIPP"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (5.2.2.1)",
+        "SMB1001 (2.5)"
+      ],
+      "expected": null,
+      "variables": {
+        "caTemplate": {
+          "type": "autoComplete",
+          "label": "Select Conditional Access Template"
+        },
+        "state": {
+          "type": "autoComplete",
+          "label": "What state should we deploy this template in?",
+          "options": [
+            {
+              "label": "Do not change state",
+              "value": "donotchange"
+            },
+            {
+              "label": "Report only",
+              "value": "enabledForReportingButNotEnforced"
+            },
+            {
+              "label": "Enabled",
+              "value": "enabled"
+            },
+            {
+              "label": "Disabled",
+              "value": "disabled"
+            }
+          ],
+          "default": "enabledForReportingButNotEnforced",
+          "recommended": "enabled"
+        }
+      }
+    },
+    {
+      "name": "IntuneTemplate",
+      "label": "Intune Template",
+      "executiveText": "Deploys standardized device management configurations across all corporate devices.",
+      "impact": "High Impact",
+      "recommendedBy": [
+        "CIPP"
+      ],
+      "tag": [
+        "SMB1001 (1.2)"
+      ],
+      "expected": {
+        "displayName": "%intuneTemplate%"
+      },
+      "variables": {
+        "intuneTemplate": {
+          "type": "autoComplete",
+          "label": "Select Intune Template"
+        }
+      }
+    },
+    {
+      "name": "IntuneTemplatePackage",
+      "label": "Intune Template Package",
+      "executiveText": "Deploys every Intune template tagged with a package in one step.",
+      "impact": "High Impact",
+      "recommendedBy": [
+        "CIPP"
+      ],
+      "tag": [
+        "HighImpact"
+      ],
+      "expected": null,
+      "variables": {
+        "intuneTemplatePackage": {
+          "type": "autoComplete",
+          "label": "Select a package of Intune Templates"
+        }
+      }
+    },
+    {
+      "name": "AuditLog",
+      "label": "Enable the Unified Audit Log",
+      "executiveText": "Turns on the audit log that records who did what across Microsoft 365, which every security investigation depends on.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS",
+        "CIPP"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (3.1.1)",
+        "mip_search_auditlog"
+      ],
+      "expected": {
+        "UnifiedAuditLogIngestionEnabled": "%enabled%"
+      },
+      "variables": {
+        "enabled": {
+          "type": "switch",
+          "label": "Unified Audit Log ingestion enabled",
+          "default": true,
+          "recommended": true
+        }
+      }
+    },
+    {
+      "name": "EnableMailTips",
+      "label": "Enable all MailTips",
+      "executiveText": "Shows senders a warning before they email large groups or people outside the company, which cuts down misdirected mail.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS",
+        "CIPP"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (6.5.2)",
+        "exo_mailtipsenabled"
+      ],
+      "expected": {
+        "MailTipsAllTipsEnabled": "%mailTipsEnabled%",
+        "MailTipsExternalRecipientsTipsEnabled": "%mailTipsEnabled%",
+        "MailTipsGroupMetricsEnabled": "%mailTipsEnabled%",
+        "MailTipsLargeAudienceThreshold": "%largeAudienceThreshold%"
+      },
+      "variables": {
+        "mailTipsEnabled": {
+          "type": "switch",
+          "label": "All MailTips enabled",
+          "default": true,
+          "recommended": true
+        },
+        "largeAudienceThreshold": {
+          "type": "number",
+          "label": "Number of recipients to trigger the large audience MailTip (Default is 25)",
+          "default": 25,
+          "recommended": 25
+        }
+      }
+    },
+    {
+      "name": "OutBoundSpamAlert",
+      "label": "Set Outbound Spam Alert e-mail",
+      "executiveText": "Sends an alert to a mailbox you choose whenever one of your accounts starts sending spam, an early sign of a broken-into account.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (2.1.6)",
+        "mdo_spam_notifications_only_for_admins"
+      ],
+      "expected": {
+        "NotifyOutboundSpam": "%NotifyOutboundSpam%",
+        "NotifyOutboundSpamRecipients": [
+          "%OutboundSpamContact%"
+        ],
+        "BccSuspiciousOutboundMail": "%BccSuspiciousOutboundMail%"
+      },
+      "variables": {
+        "NotifyOutboundSpam": {
+          "type": "switch",
+          "label": "Notify on outbound spam",
+          "default": true,
+          "recommended": true
+        },
+        "OutboundSpamContact": {
+          "type": "textField",
+          "label": "Outbound spam contact"
+        },
+        "BccSuspiciousOutboundMail": {
+          "type": "switch",
+          "label": "BCC suspicious outbound mail to a mailbox"
+        }
+      }
+    },
+    {
+      "name": "TeamsGlobalMeetingPolicy",
+      "label": "Define Global Meeting Policy for Teams",
+      "executiveText": "Establishes security-focused default settings for Teams meetings, controlling who can join meetings, present content, and participate in chats.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (8.5.1)",
+        "CIS M365 7.0.0 (8.5.2)"
+      ],
+      "expected": {
+        "AllowAnonymousUsersToJoinMeeting": "%AllowAnonymousUsersToJoinMeeting%",
+        "AllowAnonymousUsersToStartMeeting": "%AllowAnonymousUsersToStartMeeting%",
+        "AutoAdmittedUsers": "%AutoAdmittedUsers%",
+        "AllowPSTNUsersToBypassLobby": "%AllowPSTNUsersToBypassLobby%",
+        "MeetingChatEnabledType": "%MeetingChatEnabledType%",
+        "DesignatedPresenterRoleMode": "%DesignatedPresenterRoleMode%",
+        "AllowExternalParticipantGiveRequestControl": "%AllowExternalParticipantGiveRequestControl%",
+        "AllowParticipantGiveRequestControl": "%AllowParticipantGiveRequestControl%",
+        "AllowExternalNonTrustedMeetingChat": "%AllowExternalNonTrustedMeetingChat%",
+        "AllowCloudRecording": "%AllowCloudRecording%"
+      },
+      "variables": {
+        "DesignatedPresenterRoleMode": {
+          "label": "Default value of the `Who can present?`",
+          "options": [
+            {
+              "label": "Everyone",
+              "value": "EveryoneUserOverride"
+            },
+            {
+              "label": "People in my organization",
+              "value": "EveryoneInCompanyUserOverride"
+            },
+            {
+              "label": "Only organizer",
+              "value": "OrganizerOnlyUserOverride"
+            }
+          ]
+        },
+        "AllowAnonymousUsersToJoinMeeting": {
+          "label": "Allow anonymous users to join meeting"
+        },
+        "AllowAnonymousUsersToStartMeeting": {
+          "label": "Allow anonymous users to start meeting"
+        },
+        "AutoAdmittedUsers": {
+          "label": "Who can bypass the lobby?",
+          "options": [
+            {
+              "label": "Keep the tenant's current value",
+              "value": ""
+            },
+            {
+              "label": "Only organizers and co-organizers",
+              "value": "OrganizerOnly"
+            },
+            {
+              "label": "People in organization excluding guests",
+              "value": "EveryoneInCompanyExcludingGuests"
+            },
+            {
+              "label": "Everyone",
+              "value": "Everyone"
+            }
+          ]
+        },
+        "AllowPSTNUsersToBypassLobby": {
+          "label": "Allow dial-in users to bypass lobby"
+        },
+        "MeetingChatEnabledType": {
+          "label": "Meeting chat policy",
+          "options": [
+            {
+              "label": "On for everyone",
+              "value": "Enabled"
+            },
+            {
+              "label": "On for everyone but anonymous users",
+              "value": "EnabledExceptAnonymous"
+            },
+            {
+              "label": "Off for everyone",
+              "value": "Disabled"
+            }
+          ]
+        },
+        "AllowParticipantGiveRequestControl": {
+          "label": "Participants can give or request control"
+        },
+        "AllowExternalParticipantGiveRequestControl": {
+          "label": "External participants can give or request control"
+        },
+        "AllowExternalNonTrustedMeetingChat": {
+          "label": "External meeting chat",
+          "options": [
+            {
+              "label": "Keep the tenant's current value",
+              "value": ""
+            },
+            {
+              "label": "Off (CIS recommended)",
+              "value": false
+            },
+            {
+              "label": "On",
+              "value": true
+            }
+          ]
+        },
+        "AllowCloudRecording": {
+          "label": "Meeting cloud recording",
+          "options": [
+            {
+              "label": "Keep the tenant's current value",
+              "value": ""
+            },
+            {
+              "label": "Off (CIS recommended)",
+              "value": false
+            },
+            {
+              "label": "On",
+              "value": true
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "DisableGuestDirectory",
+      "label": "Restrict guest user access to directory objects",
+      "executiveText": "Stops guest accounts from browsing your staff directory, so an outside contact cannot map out who works for you.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIPP"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (5.1.6.2)",
+        "CISA (MS.AAD.5.1v1)"
+      ],
+      "expected": {
+        "guestUserRoleId": "%guestUserRoleId%"
+      },
+      "variables": {
+        "guestUserRoleId": {
+          "label": "Guest user access level",
+          "options": [
+            {
+              "label": "Restricted access (guests can only see their own profile)",
+              "value": "2af84b1e-32c8-42b7-82bc-daa82404023b"
+            },
+            {
+              "label": "Limited access (guests can see membership of non-hidden groups)",
+              "value": "10dae51f-b6af-4016-8d66-8c2a99b929b3"
+            },
+            {
+              "label": "Same access as member users",
+              "value": "a0b1b346-4d3e-4e8b-98f8-753987be4970"
+            }
+          ],
+          "default": "2af84b1e-32c8-42b7-82bc-daa82404023b",
+          "recommended": "2af84b1e-32c8-42b7-82bc-daa82404023b"
+        }
+      }
+    },
+    {
+      "name": "PWdisplayAppInformationRequiredState",
+      "label": "Enable Passwordless with Location information and Number Matching",
+      "helpText": "Enables the MS authenticator app to display information about the app that is requesting authentication.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (5.2.3.1)",
+        "EIDSCA.AM03"
+      ],
+      "expected": {
+        "state": "enabled",
+        "featureSettings": {
+          "displayAppInformationRequiredState": {
+            "state": "enabled"
+          }
+        }
+      },
+      "variables": {}
+    },
+    {
+      "name": "PerUserMFA",
+      "label": "Enables per user MFA for all users.",
+      "executiveText": "Requires every user to confirm their sign-in with a second factor.",
+      "impact": "High Impact",
+      "recommendedBy": [],
+      "tag": [
+        "CISA (MS.AAD.1.1v1)"
+      ],
+      "expected": {
+        "offenders": []
+      },
+      "variables": {}
+    },
+    {
+      "name": "AnonReportDisable",
+      "label": "Enable Usernames instead of pseudo anonymised names in reports",
+      "executiveText": "Shows real user names in usage reports so activity can be traced to a person.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIPP"
+      ],
+      "tag": [],
+      "expected": {
+        "displayConcealedNames": false
+      },
+      "variables": {}
+    },
+    {
+      "name": "DisableSelfServiceLicenses",
+      "label": "Disable Self Service Licensing",
+      "executiveText": "Stops staff from buying or trialling Microsoft licenses on their own, so every license is approved and paid for centrally.",
+      "impact": "Medium Impact",
+      "recommendedBy": [],
+      "tag": [],
+      "expected": null,
+      "variables": {
+        "Exclusions": {
+          "label": "Excluded product IDs, comma or semicolon separated (stay enabled)"
+        },
+        "DisableTrials": {
+          "label": "Also disable trial autoclaim",
+          "default": false
+        }
+      }
+    },
+    {
+      "name": "EnableCustomerLockbox",
+      "label": "Enable Customer Lockbox",
+      "executiveText": "Makes Microsoft ask for your approval before its engineers can look at your data during a support case.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (1.3.6)",
+        "CustomerLockBoxEnabled"
+      ],
+      "expected": {
+        "CustomerLockBoxEnabled": "%enabled%"
+      },
+      "variables": {
+        "enabled": {
+          "label": "Customer Lockbox enabled",
+          "default": true,
+          "recommended": true
+        }
+      }
+    },
+    {
+      "name": "DisableAppCreation",
+      "label": "Disable App creation by users",
+      "executiveText": "Only administrators can register new applications, which closes a common route for consent-phishing attacks.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS",
+        "CIPP",
+        "SMB1001"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (5.1.2.2)",
+        "CISA (MS.AAD.4.1v1)"
+      ],
+      "expected": {
+        "allowedToCreateApps": "%allowAppCreation%"
+      },
+      "variables": {
+        "allowAppCreation": {
+          "label": "Allow users to create app registrations",
+          "default": false,
+          "recommended": false
+        }
+      }
+    },
+    {
+      "name": "SecurityDefaults",
+      "label": "Enable Security Defaults",
+      "executiveText": "Turns on Microsoft's baseline sign-in protections for tenants without Conditional Access.",
+      "impact": "High Impact",
+      "recommendedBy": [],
+      "tag": [
+        "CISA (MS.AAD.11.1v1)",
+        "SMB1001 (2.5)"
+      ],
+      "expected": {
+        "isEnabled": true
+      },
+      "variables": {}
+    },
+    {
+      "name": "sharingCapability",
+      "label": "Set Sharing Level for OneDrive and SharePoint",
+      "helpText": "Sets the default sharing level for OneDrive and SharePoint.",
+      "executiveText": "Defines the organization's default policy for sharing files and folders in SharePoint and OneDrive, balancing collaboration needs with security requirements.",
+      "impact": "High Impact",
+      "recommendedBy": [
+        "CIS",
+        "CIPP"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (7.2.3)",
+        "CIS M365 7.0.0 (7.2.4)"
+      ],
+      "expected": {
+        "SharingCapability": "%sharingCapability%"
+      },
+      "variables": {
+        "sharingCapability": {
+          "label": "Select Sharing Level",
+          "options": [
+            {
+              "label": "Users can share only with people in the organization. No external sharing is allowed.",
+              "value": 0
+            },
+            {
+              "label": "Users can share with new and existing guests. Guests must sign in or provide a verification code.",
+              "value": 1
+            },
+            {
+              "label": "Users can share with anyone by using links that do not require sign-in.",
+              "value": 2
+            },
+            {
+              "label": "Users can share with existing guests (those already in the directory of the organization).",
+              "value": 3
+            }
+          ],
+          "recommended": 1
+        }
+      }
+    },
+    {
+      "name": "DefaultSharingLink",
+      "label": "Set Default Sharing Link Settings",
+      "executiveText": "Configures SharePoint default sharing links to implement the principle of least privilege for document sharing.",
+      "impact": "Low Impact",
+      "recommendedBy": [
+        "CIS",
+        "CIPP"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (7.2.7)",
+        "CIS M365 7.0.0 (7.2.11)"
+      ],
+      "expected": {
+        "DefaultSharingLinkType": "%sharingLinkType%",
+        "DefaultLinkPermission": 1
+      },
+      "variables": {
+        "sharingLinkType": {
+          "label": "Default Sharing Link Type",
+          "options": [
+            {
+              "label": "Direct - Only the people the user specifies",
+              "value": 1
+            },
+            {
+              "label": "Internal - Only people in your organization",
+              "value": 2
+            }
+          ],
+          "default": 2
+        }
+      }
+    },
+    {
+      "name": "SPDirectSharing",
+      "label": "Default sharing to Direct users",
+      "executiveText": "New sharing links default to named people rather than the whole organisation.",
+      "impact": "Medium Impact",
+      "recommendedBy": [
+        "CIS"
+      ],
+      "tag": [
+        "CIS M365 7.0.0 (7.2.7)"
+      ],
+      "expected": {
+        "DefaultSharingLinkType": "Direct",
+        "SiteUrl": "https://%tenantname%.sharepoint.com"
+      },
+      "variables": {}
+    }
+  ]
+}
diff --git a/Config/ReportSamples/bec.json b/Config/ReportSamples/bec.json
new file mode 100644
index 0000000000000..e536639709525
--- /dev/null
+++ b/Config/ReportSamples/bec.json
@@ -0,0 +1,343 @@
+{
+  "userData": {
+    "displayName": "Sample User",
+    "userPrincipalName": "sample.user@example.com"
+  },
+  "becData": {
+    "ExtractedAt": "2026-08-05T09:00:00Z",
+    "ExtractResult": "Successfully extracted logs from auditlog",
+    "AnalysisWindowDays": 7,
+    "NewRules": [
+      {
+        "Name": "Sample forwarding rule",
+        "Description": "Move messages from billing@example.com to folder RSS Feeds",
+        "MoveToFolder": "RSS Feeds",
+        "RecentlyChanged": true
+      }
+    ],
+    "InboxRuleChanges": [
+      {
+        "Operation": "New-InboxRule",
+        "UserKey": "sample.user@example.com",
+        "RuleName": "Sample forwarding rule",
+        "Parameters": "MoveToFolder=RSS Feeds; MarkAsRead=True",
+        "Date": "2026-08-03T11:24:00Z",
+        "ClientIP": "203.0.113.10",
+        "Country": "NG",
+        "City": "Lagos",
+        "ForeignLocation": true
+      }
+    ],
+    "NewUsers": [
+      {
+        "displayName": "Sample Contractor",
+        "userPrincipalName": "sample.contractor@example.com",
+        "createdDateTime": "2026-08-02T08:00:00Z"
+      }
+    ],
+    "AddedApps": [
+      {
+        "displayName": "Sample OAuth app",
+        "appId": "00000000-0000-0000-0000-000000000001",
+        "publisher": "Sample Publisher",
+        "createdDateTime": "2026-08-01T10:00:00Z",
+        "MaliciousMatch": null
+      }
+    ],
+    "MaliciousSPs": [
+      {
+        "displayName": "Sample Mail Sync Tool",
+        "appId": "00000000-0000-0000-0000-000000000002",
+        "accountEnabled": true,
+        "createdDateTime": "2026-07-30T09:30:00Z",
+        "CatalogName": "Sample Mail Sync Tool",
+        "Categories": [
+          "Mailbox exfiltration",
+          "Business Email Compromise"
+        ],
+        "Description": "Sample catalog entry used for preview data."
+      }
+    ],
+    "MailboxPermissionChanges": [
+      {
+        "Operation": "Add-MailboxPermission",
+        "UserKey": "admin@example.com",
+        "ObjectId": "sample.user@example.com",
+        "Permissions": "FullAccess",
+        "TargetsSuspect": true
+      }
+    ],
+    "SentMessages": [
+      {
+        "MessageTraceId": "00000000-0000-0000-0000-000000000003",
+        "Status": "Delivered",
+        "Subject": "Sample invoice",
+        "RecipientAddress": "supplier@example.net",
+        "Received": "2026-08-04 15:02:11Z",
+        "FromIP": "203.0.113.10",
+        "Country": "NG",
+        "City": "Lagos",
+        "ForeignLocation": true
+      }
+    ],
+    "SentMessageAnalysis": {
+      "TotalMessages": 47,
+      "TotalRecipients": 212,
+      "RepeatedSubjects": [
+        {
+          "Subject": "Sample invoice",
+          "MessageCount": 38,
+          "RecipientCount": 190,
+          "FirstSent": "2026-08-04 14:55:00Z",
+          "LastSent": "2026-08-04 15:20:00Z",
+          "Flagged": true
+        }
+      ],
+      "FlaggedSubjectCount": 1,
+      "Bursts": [
+        {
+          "WindowStart": "2026-08-04 15:00:00Z",
+          "WindowMinutes": 10,
+          "MessageCount": 31,
+          "RecipientCount": 160,
+          "TopSubject": "Sample invoice"
+        }
+      ],
+      "Flagged": true
+    },
+    "MFADevices": [
+      {
+        "@odata.type": "#microsoft.graph.microsoftAuthenticatorAuthenticationMethod",
+        "displayName": "Sample phone",
+        "createdDateTime": "2026-08-03T12:00:00Z"
+      }
+    ],
+    "ChangedPasswords": [
+      {
+        "displayName": "Sample User",
+        "userPrincipalName": "sample.user@example.com",
+        "lastPasswordChangeDateTime": "2026-08-03T12:05:00Z"
+      }
+    ],
+    "TrustedSenders": [
+      "trusted@example.net",
+      "example-partner.com"
+    ],
+    "BlockedSenders": [
+      "security-alerts@example.org"
+    ],
+    "SafelistChanges": [
+      {
+        "Operation": "Set-MailboxJunkEmailConfiguration",
+        "UserKey": "sample.user@example.com",
+        "Date": "2026-08-03T11:30:00Z",
+        "ClientIP": "203.0.113.10",
+        "Country": "NG",
+        "City": "Lagos",
+        "ForeignLocation": true,
+        "Trusted": [
+          "attacker-domain.example"
+        ],
+        "Blocked": null
+      }
+    ],
+    "SharingChanges": [
+      {
+        "Operation": "AnonymousLinkCreated",
+        "UserKey": "sample.user@example.com",
+        "Date": "2026-08-04T10:15:00Z",
+        "Workload": "OneDrive",
+        "FileName": "Payroll Q3.xlsx",
+        "ItemUrl": "https://example-my.sharepoint.com/personal/sample_user/Documents/Payroll Q3.xlsx",
+        "Target": null,
+        "TargetType": null,
+        "ClientIP": "203.0.113.10",
+        "Country": "NG",
+        "City": "Lagos",
+        "ForeignLocation": true
+      }
+    ],
+    "IntuneDevices": [
+      {
+        "id": "00000000-0000-0000-0000-000000000004",
+        "deviceName": "SAMPLE-VM01",
+        "operatingSystem": "Windows",
+        "osVersion": "10.0.26100",
+        "complianceState": "noncompliant",
+        "enrolledDateTime": "2026-08-03T13:00:00Z",
+        "lastSyncDateTime": "2026-08-05T08:00:00Z",
+        "deviceEnrollmentType": "windowsAzureADJoin",
+        "serialNumber": "SAMPLE1234"
+      }
+    ],
+    "SuspectUserSignIns": [
+      {
+        "CreatedDateTime": "2026-08-04T22:14:00Z",
+        "AppDisplayName": "Office 365 Exchange Online",
+        "ClientAppUsed": "Browser",
+        "Status": "Success",
+        "IPAddress": "203.0.113.10",
+        "Country": "NG",
+        "City": "Lagos",
+        "ForeignLocation": true
+      },
+      {
+        "CreatedDateTime": "2026-08-04T09:02:00Z",
+        "AppDisplayName": "Microsoft Teams",
+        "ClientAppUsed": "Mobile Apps and Desktop clients",
+        "Status": "Success",
+        "IPAddress": "198.51.100.24",
+        "Country": "US",
+        "City": "Seattle",
+        "ForeignLocation": false
+      }
+    ],
+    "LocationAnalysis": {
+      "UsageLocation": "US",
+      "UserRegisteredCountry": "United States",
+      "SignInCountries": [
+        {
+          "Country": "US",
+          "Count": 41
+        },
+        {
+          "Country": "NG",
+          "Count": 9
+        }
+      ],
+      "ForeignSignInCount": 9,
+      "ForeignSuccessfulSignInCount": 8,
+      "ForeignRuleChangeCount": 1,
+      "ForeignSafelistChangeCount": 1,
+      "ForeignSharingChangeCount": 1,
+      "ForeignSentMessageCount": 1,
+      "Note": null
+    },
+    "UserPrincipalName": "sample.user@example.com",
+    "IPVerdicts": [
+      {
+        "IP": "198.51.100.23",
+        "Verdict": "LikelyAttacker",
+        "Score": 9,
+        "Source": "Heuristics",
+        "Reasons": [
+          {
+            "Code": "HostingOrProxy",
+            "Weight": 3,
+            "Text": "Proxy/VPN network"
+          },
+          {
+            "Code": "Foreign",
+            "Weight": 2,
+            "Text": "Outside the usage location"
+          },
+          {
+            "Code": "NewToUser",
+            "Weight": 2,
+            "Text": "Never used by the user"
+          }
+        ],
+        "Country": "NG",
+        "City": "Lagos",
+        "SuccessfulSignIns": 3,
+        "FailedSignIns": 1,
+        "Activities": 12
+      },
+      {
+        "IP": "203.0.113.10",
+        "Verdict": "LikelyUser",
+        "Score": -5,
+        "Source": "Heuristics",
+        "Reasons": [],
+        "Country": "US",
+        "City": "Chicago",
+        "SuccessfulSignIns": 40,
+        "FailedSignIns": 0,
+        "Activities": 3
+      }
+    ],
+    "AttackerMailActivity": [
+      {
+        "When": "2026-08-04T02:10:00Z",
+        "Operation": "MailItemsAccessed",
+        "AccessType": "Bind",
+        "Folder": "Inbox",
+        "Subject": "Invoice 4471 - updated bank details",
+        "InternetMessageId": "<a1@example.com>",
+        "MailboxOwner": "sample.user@example.com",
+        "IP": "198.51.100.23",
+        "IPVerdict": "LikelyAttacker"
+      },
+      {
+        "When": "2026-08-04T02:20:00Z",
+        "Operation": "Send",
+        "Folder": "Sent Items",
+        "Subject": "RE: Invoice 4471",
+        "InternetMessageId": "<a2@example.com>",
+        "MailboxOwner": "sample.user@example.com",
+        "IP": "198.51.100.23",
+        "IPVerdict": "LikelyAttacker"
+      }
+    ],
+    "AttackerFileActivity": [
+      {
+        "When": "2026-08-04T02:30:00Z",
+        "Operation": "FileDownloaded",
+        "File": "Payroll 2026.xlsx",
+        "Url": "https://example.sharepoint.com/sites/finance/Payroll 2026.xlsx",
+        "Site": "https://example.sharepoint.com/sites/finance",
+        "IP": "198.51.100.23",
+        "IPVerdict": "LikelyAttacker"
+      }
+    ],
+    "FormsActivity": [
+      {
+        "When": "2026-08-04T03:00:00Z",
+        "Operation": "CreateForm",
+        "FormName": "Microsoft 365 account verification",
+        "FormId": "form-1",
+        "IP": "198.51.100.23",
+        "IPVerdict": "LikelyAttacker",
+        "Flagged": true
+      }
+    ],
+    "FormsSummary": {
+      "FlaggedActions": 1,
+      "Forms": [
+        {
+          "FormId": "form-1",
+          "FormName": "Microsoft 365 account verification",
+          "Responses": 4,
+          "AnonymousResponses": 4,
+          "Views": 37,
+          "PhishingFlagged": false
+        }
+      ]
+    },
+    "DelegatedAccess": [
+      {
+        "Mailbox": "accounts@example.com",
+        "AccessRights": "FullAccess",
+        "KnownFrom": "Permission cache",
+        "AttackerOpened": 6,
+        "AttackerSynced": 0,
+        "AttackerSent": 0,
+        "Flagged": true
+      }
+    ],
+    "BlastRadius": [
+      {
+        "UserPrincipalName": "finance.lead@example.com",
+        "UserId": "22222222-2222-2222-2222-222222222222",
+        "Reached": true,
+        "AttackerIPs": "198.51.100.23",
+        "SuccessfulSignIns": 1,
+        "FailedSignIns": 2,
+        "Actions": 4,
+        "Operations": "MailItemsAccessed x4",
+        "FirstSeen": "2026-08-04T04:00:00Z",
+        "LastSeen": "2026-08-04T04:20:00Z"
+      }
+    ]
+  }
+}
diff --git a/Config/ReportSamples/executive.json b/Config/ReportSamples/executive.json
new file mode 100644
index 0000000000000..fa10f17dd7548
--- /dev/null
+++ b/Config/ReportSamples/executive.json
@@ -0,0 +1,183 @@
+{
+  "UserStats": {
+    "licensedUsers": 128,
+    "unlicensedUsers": 12,
+    "guests": 9,
+    "globalAdmins": 3,
+    "permanentGlobalAdmins": 2,
+    "eligibleGlobalAdmins": 1,
+    "pimCapable": true
+  },
+  "SecureScore": {
+    "currentScore": 61,
+    "maxScore": 100,
+    "percentageCurrent": 61,
+    "percentageVsSimilar": 54,
+    "percentageVsAllTenants": 49,
+    "trend": [
+      {
+        "label": "Jul 29",
+        "value": 50
+      },
+      {
+        "label": "Jul 30",
+        "value": 52
+      },
+      {
+        "label": "Jul 31",
+        "value": 55
+      },
+      {
+        "label": "Aug 1",
+        "value": 57
+      },
+      {
+        "label": "Aug 2",
+        "value": 58
+      },
+      {
+        "label": "Aug 3",
+        "value": 60
+      },
+      {
+        "label": "Aug 4",
+        "value": 61
+      }
+    ]
+  },
+  "Licenses": [
+    {
+      "name": "Microsoft 365 E3",
+      "used": "88",
+      "available": "12",
+      "total": "100"
+    },
+    {
+      "name": "Exchange Online (Plan 1)",
+      "used": "27",
+      "available": "3",
+      "total": "30"
+    },
+    {
+      "name": "Microsoft Defender for Office 365",
+      "used": "64",
+      "available": "36",
+      "total": "100"
+    }
+  ],
+  "Devices": [
+    {
+      "name": "SAMPLE-LT-001",
+      "os": "Windows",
+      "compliance": "compliant",
+      "compliant": true,
+      "lastSync": "Aug 5, 2026",
+      "encrypted": true
+    },
+    {
+      "name": "SAMPLE-LT-002",
+      "os": "Windows",
+      "compliance": "noncompliant",
+      "compliant": false,
+      "lastSync": "Jul 28, 2026",
+      "encrypted": false
+    },
+    {
+      "name": "SAMPLE-MB-003",
+      "os": "iOS",
+      "compliance": "compliant",
+      "compliant": true,
+      "lastSync": "Aug 5, 2026",
+      "encrypted": true
+    },
+    {
+      "name": "SAMPLE-MB-004",
+      "os": "Android",
+      "compliance": "compliant",
+      "compliant": true,
+      "lastSync": "Aug 4, 2026",
+      "encrypted": true
+    },
+    {
+      "name": "CPC-SAMPLE-005",
+      "os": "Windows",
+      "compliance": "compliant",
+      "compliant": true,
+      "lastSync": "Aug 5, 2026",
+      "encrypted": true
+    }
+  ],
+  "CAPolicies": [
+    {
+      "name": "Require MFA for all users",
+      "state": "enabled",
+      "controls": [
+        "mfa"
+      ],
+      "controlsText": "MFA",
+      "applications": "All"
+    },
+    {
+      "name": "Block legacy authentication",
+      "state": "enabled",
+      "controls": [
+        "block"
+      ],
+      "controlsText": "Block",
+      "applications": "All"
+    },
+    {
+      "name": "Require compliant device for Exchange",
+      "state": "enabledForReportingButNotEnforced",
+      "controls": [
+        "compliantDevice"
+      ],
+      "controlsText": "Compliant Device",
+      "applications": "Exchange Online"
+    }
+  ],
+  "SecurityControls": [
+    {
+      "name": "Anti-Phishing Policy",
+      "description": "Protects users from impersonation and spoofing attempts in email.",
+      "tags": "Exchange, Defender",
+      "status": "Compliant"
+    },
+    {
+      "name": "Safe Links Policy",
+      "description": "Rewrites and scans links in mail and Office documents at click time.",
+      "tags": "Exchange, Defender",
+      "status": "Compliant"
+    },
+    {
+      "name": "Unified Audit Log",
+      "description": "Records tenant activity so incidents can be investigated after the fact.",
+      "tags": "Compliance",
+      "status": "Compliant"
+    },
+    {
+      "name": "Guest Access Restrictions",
+      "description": "Limits what guest accounts can see and do in the directory.",
+      "tags": "Identity",
+      "status": "Review"
+    },
+    {
+      "name": "Password Expiry Disabled",
+      "description": "Removes forced rotation in favour of strong, unique passwords.",
+      "tags": "Identity",
+      "status": "Compliant"
+    },
+    {
+      "name": "Disable Basic Authentication",
+      "description": "Blocks legacy protocols that cannot enforce multi-factor authentication.",
+      "tags": "Exchange, Identity",
+      "status": "Review"
+    },
+    {
+      "name": "Windows Device Compliance",
+      "description": "Intune compliance policy requiring encryption, updates and a supported OS.",
+      "tags": "Intune",
+      "status": "Compliant"
+    }
+  ]
+}
diff --git a/Config/ReportSamples/licensing.json b/Config/ReportSamples/licensing.json
new file mode 100644
index 0000000000000..90576fc4c7a4e
--- /dev/null
+++ b/Config/ReportSamples/licensing.json
@@ -0,0 +1,913 @@
+{
+  "Summary": {
+    "Tenant": "contoso.onmicrosoft.com",
+    "Currency": "USD",
+    "GeneratedAt": "2026-09-23T09:00:00.0000000+00:00",
+    "ReportPeriodDays": 90,
+    "InactiveDays": 90,
+    "TenureMonths": 6,
+    "RecommendDowngrades": true,
+    "RecommendUpgrades": true,
+    "RecommendTerms": true,
+    "ProtectSecurityFeatures": true,
+    "MonthlySpend": 2433.75,
+    "AssignedSeats": 130,
+    "TotalSeats": 202,
+    "LicensedUsers": 96,
+    "PriceCoverage": 0.992,
+    "ReclaimableMonthly": 412.75,
+    "ReclaimableSeats": 27,
+    "SignInDataAvailable": true,
+    "DowngradeMonthly": 301.75,
+    "DowngradeSeats": 30,
+    "ConsolidationMonthly": 3.5,
+    "TermMonthly": 120.3,
+    "ProtectInvestmentMonthly": 123.75,
+    "ProtectSeats": 13,
+    "TotalPotentialMonthly": 838.3,
+    "TotalPotentialAnnual": 10059.6,
+    "MonthlyCommitmentUplift": 0.2,
+    "SuggestionCount": 71,
+    "AnonymizedReports": false,
+    "DataAvailable": true,
+    "UsageDataAvailable": true,
+    "AppUsageDataAvailable": true,
+    "MailboxUsageDataAvailable": true,
+    "Sources": {
+      "Licenses": "Cache",
+      "Users": "Cache",
+      "ActivityDetail": "Cache",
+      "AppUsage": "Cache",
+      "MailboxUsage": "Cache",
+      "CopilotUsage": "Cache"
+    }
+  },
+  "Suggestions": [],
+  "Optimization": {
+    "Summary": {
+      "MonthlySpend": 2433.75,
+      "AssignedSeats": 130,
+      "PriceCoverage": 0.992
+    },
+    "Opportunities": [
+      {
+        "Tier": "UnassignedSeats",
+        "FindingLabel": "Unassigned",
+        "License": "Microsoft 365 Business Premium",
+        "skuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+        "Seats": 8,
+        "UnitCost": 22,
+        "MonthlySaving": 176,
+        "SuggestedAction": "Reduce seat count",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "UnassignedSeats",
+        "FindingLabel": "Unassigned",
+        "License": "Microsoft 365 E3",
+        "skuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
+        "Seats": 2,
+        "UnitCost": 36,
+        "MonthlySaving": 72,
+        "SuggestedAction": "Reduce seat count",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "DisabledAccount",
+        "FindingLabel": "Disabled user",
+        "License": "Microsoft 365 Business Premium",
+        "skuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+        "Seats": 2,
+        "UnitCost": 22,
+        "MonthlySaving": 44,
+        "SuggestedAction": "Remove license",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "UnassignedSeats",
+        "FindingLabel": "Unassigned",
+        "License": "Microsoft 365 Business Standard",
+        "skuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+        "Seats": 3,
+        "UnitCost": 12.5,
+        "MonthlySaving": 37.5,
+        "SuggestedAction": "Reduce seat count",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "UnassignedSeats",
+        "FindingLabel": "Unassigned",
+        "License": "Microsoft 365 Business Basic",
+        "skuId": "3b555118-da6a-4418-894f-7df1e2096870",
+        "Seats": 6,
+        "UnitCost": 6,
+        "MonthlySaving": 36,
+        "SuggestedAction": "Reduce seat count",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "Inactive",
+        "FindingLabel": "Inactive 90d+",
+        "License": "Microsoft 365 Business Standard",
+        "skuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+        "Seats": 2,
+        "UnitCost": 12.5,
+        "MonthlySaving": 25,
+        "SuggestedAction": "Review / remove",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "UnassignedSeats",
+        "FindingLabel": "Unassigned",
+        "License": "Microsoft 365 Apps for business",
+        "skuId": "cdd28e44-67e3-425e-be4c-737fab2899d3",
+        "Seats": 1,
+        "UnitCost": 8.25,
+        "MonthlySaving": 8.25,
+        "SuggestedAction": "Reduce seat count",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "Overlap",
+        "FindingLabel": "Redundant",
+        "License": "Exchange Online (Plan 1)",
+        "skuId": "4b9405b0-7788-4568-add1-99614e613b69",
+        "Seats": 1,
+        "UnitCost": 4,
+        "MonthlySaving": 4,
+        "SuggestedAction": "Remove redundant license",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "UnassignedSeats",
+        "FindingLabel": "Unassigned",
+        "License": "Exchange Online (Plan 1)",
+        "skuId": "4b9405b0-7788-4568-add1-99614e613b69",
+        "Seats": 1,
+        "UnitCost": 4,
+        "MonthlySaving": 4,
+        "SuggestedAction": "Reduce seat count",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "Downgrade",
+        "FindingLabel": "Mailbox-only",
+        "License": "Microsoft 365 E3",
+        "skuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
+        "Seats": 1,
+        "UnitCost": 36,
+        "MonthlySaving": 0,
+        "SuggestedAction": "Review: only using email",
+        "Users": [],
+        "PriceKnown": true
+      },
+      {
+        "Tier": "UnassignedSeats",
+        "FindingLabel": "Unassigned",
+        "License": "Microsoft Teams Rooms Pro",
+        "skuId": "4fb214cb-a430-4a91-9c91-4976763aa78f",
+        "Seats": 1,
+        "UnitCost": null,
+        "MonthlySaving": 0,
+        "SuggestedAction": "Reduce seat count",
+        "Users": [],
+        "PriceKnown": false
+      }
+    ]
+  },
+  "Downgrades": [
+    {
+      "FromLicense": "Microsoft 365 Copilot",
+      "FromSkuId": "639dec6b-bb19-468b-871c-c5c441c4b0cb",
+      "ToLicense": "No license",
+      "ToSkuId": null,
+      "Action": "Remove",
+      "Seats": 5,
+      "UnitCost": 30,
+      "TargetCost": 0,
+      "UnitSaving": 30,
+      "MonthlySaving": 150,
+      "Keeps": [],
+      "Loses": [
+        "Microsoft 365 Copilot"
+      ],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 Business Standard",
+      "FromSkuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+      "ToLicense": "Microsoft 365 Business Basic",
+      "ToSkuId": "3b555118-da6a-4418-894f-7df1e2096870",
+      "Action": "Downgrade",
+      "Seats": 9,
+      "UnitCost": 12.5,
+      "TargetCost": 6,
+      "UnitSaving": 6.5,
+      "MonthlySaving": 58.5,
+      "Keeps": [
+        "Email and calendar",
+        "File storage and sharing",
+        "Teams chat and meetings"
+      ],
+      "Loses": [
+        "Office desktop apps"
+      ],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 E3",
+      "FromSkuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
+      "ToLicense": "Microsoft 365 Business Premium",
+      "ToSkuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+      "Action": "Downgrade",
+      "Seats": 3,
+      "UnitCost": 36,
+      "TargetCost": 22,
+      "UnitSaving": 14,
+      "MonthlySaving": 42,
+      "Keeps": [
+        "Advanced sign-in security",
+        "Data protection and labelling",
+        "Device management",
+        "Device threat protection",
+        "Email and calendar",
+        "File storage and sharing",
+        "Large mailbox and archive",
+        "Office desktop apps",
+        "Teams chat and meetings",
+        "Windows upgrade rights"
+      ],
+      "Loses": [],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 Business Standard",
+      "FromSkuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+      "ToLicense": "No license",
+      "ToSkuId": null,
+      "Action": "Remove",
+      "Seats": 1,
+      "UnitCost": 12.5,
+      "TargetCost": 0,
+      "UnitSaving": 12.5,
+      "MonthlySaving": 12.5,
+      "Keeps": [],
+      "Loses": [
+        "Email and calendar",
+        "File storage and sharing",
+        "Office desktop apps",
+        "Teams chat and meetings"
+      ],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 Business Standard",
+      "FromSkuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+      "ToLicense": "Microsoft 365 Apps for business",
+      "ToSkuId": "cdd28e44-67e3-425e-be4c-737fab2899d3",
+      "Action": "Downgrade",
+      "Seats": 2,
+      "UnitCost": 12.5,
+      "TargetCost": 8.25,
+      "UnitSaving": 4.25,
+      "MonthlySaving": 8.5,
+      "Keeps": [
+        "File storage and sharing",
+        "Office desktop apps"
+      ],
+      "Loses": [
+        "Email and calendar",
+        "Teams chat and meetings"
+      ],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 Apps for business",
+      "FromSkuId": "cdd28e44-67e3-425e-be4c-737fab2899d3",
+      "ToLicense": "No license",
+      "ToSkuId": null,
+      "Action": "Remove",
+      "Seats": 1,
+      "UnitCost": 8.25,
+      "TargetCost": 0,
+      "UnitSaving": 8.25,
+      "MonthlySaving": 8.25,
+      "Keeps": [],
+      "Loses": [
+        "File storage and sharing",
+        "Office desktop apps"
+      ],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 Business Basic",
+      "FromSkuId": "3b555118-da6a-4418-894f-7df1e2096870",
+      "ToLicense": "Exchange Online (Plan 1)",
+      "ToSkuId": "4b9405b0-7788-4568-add1-99614e613b69",
+      "Action": "Downgrade",
+      "Seats": 4,
+      "UnitCost": 6,
+      "TargetCost": 4,
+      "UnitSaving": 2,
+      "MonthlySaving": 8,
+      "Keeps": [
+        "Email and calendar"
+      ],
+      "Loses": [
+        "File storage and sharing",
+        "Teams chat and meetings"
+      ],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 Business Basic",
+      "FromSkuId": "3b555118-da6a-4418-894f-7df1e2096870",
+      "ToLicense": "No license",
+      "ToSkuId": null,
+      "Action": "Remove",
+      "Seats": 1,
+      "UnitCost": 6,
+      "TargetCost": 0,
+      "UnitSaving": 6,
+      "MonthlySaving": 6,
+      "Keeps": [],
+      "Loses": [
+        "Email and calendar",
+        "File storage and sharing",
+        "Teams chat and meetings"
+      ],
+      "Users": []
+    },
+    {
+      "FromLicense": "Exchange Online (Plan 1)",
+      "FromSkuId": "4b9405b0-7788-4568-add1-99614e613b69",
+      "ToLicense": "Exchange Online Kiosk",
+      "ToSkuId": "80b2d799-d2ba-4d2a-8842-fb0d0f3a4b82",
+      "Action": "Downgrade",
+      "Seats": 2,
+      "UnitCost": 4,
+      "TargetCost": 2,
+      "UnitSaving": 2,
+      "MonthlySaving": 4,
+      "Keeps": [
+        "Email and calendar"
+      ],
+      "Loses": [],
+      "Users": []
+    },
+    {
+      "FromLicense": "Microsoft 365 Business Basic",
+      "FromSkuId": "3b555118-da6a-4418-894f-7df1e2096870",
+      "ToLicense": "Microsoft Teams Essentials",
+      "ToSkuId": "3f4d6b3c-4a8c-4aaf-9bb7-1e3d9a3b1f7c",
+      "Action": "Downgrade",
+      "Seats": 2,
+      "UnitCost": 6,
+      "TargetCost": 4,
+      "UnitSaving": 2,
+      "MonthlySaving": 4,
+      "Keeps": [
+        "Teams chat and meetings"
+      ],
+      "Loses": [
+        "Email and calendar",
+        "File storage and sharing"
+      ],
+      "Users": []
+    }
+  ],
+  "Upgrades": [
+    {
+      "Type": "Consolidate",
+      "FromLicenses": [
+        "Microsoft 365 Apps for business",
+        "Microsoft 365 Business Basic"
+      ],
+      "FromSkuIds": [
+        "cdd28e44-67e3-425e-be4c-737fab2899d3",
+        "3b555118-da6a-4418-894f-7df1e2096870"
+      ],
+      "ToLicense": "Microsoft 365 Business Standard",
+      "ToSkuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+      "Seats": 2,
+      "UnitCost": 14.25,
+      "TargetCost": 12.5,
+      "UnitDelta": -1.75,
+      "MonthlyDelta": -3.5,
+      "Gains": [],
+      "Users": []
+    },
+    {
+      "Type": "Protect",
+      "FromLicenses": [
+        "Exchange Online (Plan 1)",
+        "Microsoft 365 Apps for business"
+      ],
+      "FromSkuIds": [
+        "4b9405b0-7788-4568-add1-99614e613b69",
+        "cdd28e44-67e3-425e-be4c-737fab2899d3"
+      ],
+      "ToLicense": "Microsoft 365 Business Premium",
+      "ToSkuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+      "Seats": 1,
+      "UnitCost": 12.25,
+      "TargetCost": 22,
+      "UnitDelta": 9.75,
+      "MonthlyDelta": 9.75,
+      "Gains": [
+        "Advanced sign-in security",
+        "Data protection and labelling",
+        "Device management",
+        "Device threat protection",
+        "Teams chat and meetings"
+      ],
+      "Users": []
+    },
+    {
+      "Type": "Protect",
+      "FromLicenses": [
+        "Microsoft 365 Business Standard"
+      ],
+      "FromSkuIds": [
+        "f245ecc8-75af-4f8e-b61f-27d8114de5f3"
+      ],
+      "ToLicense": "Microsoft 365 Business Premium",
+      "ToSkuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+      "Seats": 12,
+      "UnitCost": 12.5,
+      "TargetCost": 22,
+      "UnitDelta": 9.5,
+      "MonthlyDelta": 114,
+      "Gains": [
+        "Advanced email threat protection",
+        "Advanced sign-in security",
+        "Data protection and labelling",
+        "Device management",
+        "Device threat protection"
+      ],
+      "Users": []
+    }
+  ],
+  "Terms": [
+    {
+      "License": "Microsoft 365 Business Premium",
+      "skuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+      "TotalSeats": 68,
+      "AssignedSeats": 60,
+      "StableSeats": 52,
+      "MonthlySeats": 30,
+      "YearlySeats": 38,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 52,
+      "RecommendedMonthly": 8,
+      "ConvertibleSeats": 14,
+      "UnitCost": 22,
+      "MonthlySaving": 61.6,
+      "LockedUnusedSeats": 0,
+      "NextRenewalDays": 120,
+      "PriceKnown": true
+    },
+    {
+      "License": "Microsoft 365 Business Standard",
+      "skuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+      "TotalSeats": 25,
+      "AssignedSeats": 22,
+      "StableSeats": 15,
+      "MonthlySeats": 25,
+      "YearlySeats": 0,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 15,
+      "RecommendedMonthly": 7,
+      "ConvertibleSeats": 15,
+      "UnitCost": 12.5,
+      "MonthlySaving": 37.5,
+      "LockedUnusedSeats": 0,
+      "NextRenewalDays": 12,
+      "PriceKnown": true
+    },
+    {
+      "License": "Microsoft 365 Copilot",
+      "skuId": "639dec6b-bb19-468b-871c-c5c441c4b0cb",
+      "TotalSeats": 8,
+      "AssignedSeats": 8,
+      "StableSeats": 2,
+      "MonthlySeats": 8,
+      "YearlySeats": 0,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 2,
+      "RecommendedMonthly": 6,
+      "ConvertibleSeats": 2,
+      "UnitCost": 30,
+      "MonthlySaving": 12,
+      "LockedUnusedSeats": 0,
+      "NextRenewalDays": 20,
+      "PriceKnown": true
+    },
+    {
+      "License": "Visio Plan 2",
+      "skuId": "c5928f49-12ba-48f7-ada3-0d743a3601d5",
+      "TotalSeats": 2,
+      "AssignedSeats": 2,
+      "StableSeats": 2,
+      "MonthlySeats": 2,
+      "YearlySeats": 0,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 2,
+      "RecommendedMonthly": 0,
+      "ConvertibleSeats": 2,
+      "UnitCost": 15,
+      "MonthlySaving": 6,
+      "LockedUnusedSeats": 0,
+      "NextRenewalDays": 8,
+      "PriceKnown": true
+    },
+    {
+      "License": "Exchange Online (Plan 1)",
+      "skuId": "4b9405b0-7788-4568-add1-99614e613b69",
+      "TotalSeats": 5,
+      "AssignedSeats": 4,
+      "StableSeats": 4,
+      "MonthlySeats": 5,
+      "YearlySeats": 0,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 4,
+      "RecommendedMonthly": 0,
+      "ConvertibleSeats": 4,
+      "UnitCost": 4,
+      "MonthlySaving": 3.2,
+      "LockedUnusedSeats": 0,
+      "NextRenewalDays": 8,
+      "PriceKnown": true
+    },
+    {
+      "License": "Microsoft 365 E3",
+      "skuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
+      "TotalSeats": 12,
+      "AssignedSeats": 10,
+      "StableSeats": 9,
+      "MonthlySeats": 0,
+      "YearlySeats": 12,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 9,
+      "RecommendedMonthly": 1,
+      "ConvertibleSeats": 0,
+      "UnitCost": 36,
+      "MonthlySaving": 0,
+      "LockedUnusedSeats": 2,
+      "NextRenewalDays": 200,
+      "PriceKnown": true
+    },
+    {
+      "License": "Microsoft 365 Business Basic",
+      "skuId": "3b555118-da6a-4418-894f-7df1e2096870",
+      "TotalSeats": 20,
+      "AssignedSeats": 14,
+      "StableSeats": 10,
+      "MonthlySeats": 0,
+      "YearlySeats": 20,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 10,
+      "RecommendedMonthly": 4,
+      "ConvertibleSeats": 0,
+      "UnitCost": 6,
+      "MonthlySaving": 0,
+      "LockedUnusedSeats": 6,
+      "NextRenewalDays": 45,
+      "PriceKnown": true
+    },
+    {
+      "License": "Power BI Pro",
+      "skuId": "f8a1db68-be16-40ed-86d5-cb42ce701560",
+      "TotalSeats": 6,
+      "AssignedSeats": 6,
+      "StableSeats": 6,
+      "MonthlySeats": 0,
+      "YearlySeats": 0,
+      "UnknownTermSeats": 6,
+      "TermKnown": false,
+      "RecommendedAnnual": 6,
+      "RecommendedMonthly": 0,
+      "ConvertibleSeats": null,
+      "UnitCost": 14,
+      "MonthlySaving": 0,
+      "LockedUnusedSeats": 0,
+      "NextRenewalDays": null,
+      "PriceKnown": true
+    },
+    {
+      "License": "Microsoft 365 Apps for business",
+      "skuId": "cdd28e44-67e3-425e-be4c-737fab2899d3",
+      "TotalSeats": 4,
+      "AssignedSeats": 3,
+      "StableSeats": 3,
+      "MonthlySeats": 0,
+      "YearlySeats": 4,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 3,
+      "RecommendedMonthly": 0,
+      "ConvertibleSeats": 0,
+      "UnitCost": 8.25,
+      "MonthlySaving": 0,
+      "LockedUnusedSeats": 1,
+      "NextRenewalDays": null,
+      "PriceKnown": true
+    },
+    {
+      "License": "Microsoft Teams Rooms Pro",
+      "skuId": "4fb214cb-a430-4a91-9c91-4976763aa78f",
+      "TotalSeats": 2,
+      "AssignedSeats": 1,
+      "StableSeats": 1,
+      "MonthlySeats": 0,
+      "YearlySeats": 2,
+      "UnknownTermSeats": 0,
+      "TermKnown": true,
+      "RecommendedAnnual": 1,
+      "RecommendedMonthly": 0,
+      "ConvertibleSeats": 0,
+      "UnitCost": null,
+      "MonthlySaving": 0,
+      "LockedUnusedSeats": 1,
+      "NextRenewalDays": 300,
+      "PriceKnown": false
+    }
+  ],
+  "Products": [
+    {
+      "License": "Microsoft 365 Business Premium",
+      "skuId": "cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46",
+      "Family": null,
+      "TotalSeats": 68,
+      "AssignedSeats": 60,
+      "UnusedSeats": 8,
+      "TenantLevel": false,
+      "UnitCost": 22,
+      "MonthlySpend": 1320,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Microsoft 365 E3",
+      "skuId": "05e9a617-0261-4cee-bb44-138d3ef5d965",
+      "Family": null,
+      "TotalSeats": 12,
+      "AssignedSeats": 10,
+      "UnusedSeats": 2,
+      "TenantLevel": false,
+      "UnitCost": 36,
+      "MonthlySpend": 360,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Microsoft 365 Business Standard",
+      "skuId": "f245ecc8-75af-4f8e-b61f-27d8114de5f3",
+      "Family": null,
+      "TotalSeats": 25,
+      "AssignedSeats": 22,
+      "UnusedSeats": 3,
+      "TenantLevel": false,
+      "UnitCost": 12.5,
+      "MonthlySpend": 275,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Microsoft 365 Copilot",
+      "skuId": "639dec6b-bb19-468b-871c-c5c441c4b0cb",
+      "Family": null,
+      "TotalSeats": 8,
+      "AssignedSeats": 8,
+      "UnusedSeats": 0,
+      "TenantLevel": false,
+      "UnitCost": 30,
+      "MonthlySpend": 240,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Microsoft 365 Business Basic",
+      "skuId": "3b555118-da6a-4418-894f-7df1e2096870",
+      "Family": null,
+      "TotalSeats": 20,
+      "AssignedSeats": 14,
+      "UnusedSeats": 6,
+      "TenantLevel": false,
+      "UnitCost": 6,
+      "MonthlySpend": 84,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Power BI Pro",
+      "skuId": "f8a1db68-be16-40ed-86d5-cb42ce701560",
+      "Family": null,
+      "TotalSeats": 6,
+      "AssignedSeats": 6,
+      "UnusedSeats": 0,
+      "TenantLevel": false,
+      "UnitCost": 14,
+      "MonthlySpend": 84,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Visio Plan 2",
+      "skuId": "c5928f49-12ba-48f7-ada3-0d743a3601d5",
+      "Family": null,
+      "TotalSeats": 2,
+      "AssignedSeats": 2,
+      "UnusedSeats": 0,
+      "TenantLevel": false,
+      "UnitCost": 15,
+      "MonthlySpend": 30,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Microsoft 365 Apps for business",
+      "skuId": "cdd28e44-67e3-425e-be4c-737fab2899d3",
+      "Family": null,
+      "TotalSeats": 4,
+      "AssignedSeats": 3,
+      "UnusedSeats": 1,
+      "TenantLevel": false,
+      "UnitCost": 8.25,
+      "MonthlySpend": 24.75,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Exchange Online (Plan 1)",
+      "skuId": "4b9405b0-7788-4568-add1-99614e613b69",
+      "Family": null,
+      "TotalSeats": 5,
+      "AssignedSeats": 4,
+      "UnusedSeats": 1,
+      "TenantLevel": false,
+      "UnitCost": 4,
+      "MonthlySpend": 16,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Office 365 Extra File Storage",
+      "skuId": "99049c9c-6011-4908-bf17-15f496e6519d",
+      "Family": null,
+      "TotalSeats": 50,
+      "AssignedSeats": 0,
+      "UnusedSeats": 0,
+      "TenantLevel": true,
+      "UnitCost": 0.2,
+      "MonthlySpend": 0,
+      "PriceKnown": true,
+      "Capabilities": []
+    },
+    {
+      "License": "Microsoft Teams Rooms Pro",
+      "skuId": "4fb214cb-a430-4a91-9c91-4976763aa78f",
+      "Family": null,
+      "TotalSeats": 2,
+      "AssignedSeats": 1,
+      "UnusedSeats": 1,
+      "TenantLevel": false,
+      "UnitCost": null,
+      "MonthlySpend": null,
+      "PriceKnown": false,
+      "Capabilities": []
+    }
+  ],
+  "Capabilities": [
+    {
+      "id": "email",
+      "label": "Email and calendar",
+      "description": "A business mailbox with calendar and contacts.",
+      "measurable": true
+    },
+    {
+      "id": "largeMailbox",
+      "label": "Large mailbox and archive",
+      "description": "A 100 GB mailbox with an unlimited email archive. Only needed when a mailbox is near the 50 GB limit or uses an archive.",
+      "measurable": true
+    },
+    {
+      "id": "desktopApps",
+      "label": "Office desktop apps",
+      "description": "Word, Excel, PowerPoint and Outlook installed on a PC or Mac.",
+      "measurable": true
+    },
+    {
+      "id": "teams",
+      "label": "Teams chat and meetings",
+      "description": "Microsoft Teams for chat, calls and online meetings.",
+      "measurable": true
+    },
+    {
+      "id": "files",
+      "label": "File storage and sharing",
+      "description": "OneDrive and SharePoint for storing and sharing documents.",
+      "measurable": true
+    },
+    {
+      "id": "copilot",
+      "label": "Microsoft 365 Copilot",
+      "description": "The AI assistant inside Word, Excel, Outlook and Teams.",
+      "measurable": true
+    },
+    {
+      "id": "deviceManagement",
+      "label": "Device management",
+      "description": "Intune: enrolling, securing and wiping company laptops and phones.",
+      "measurable": false
+    },
+    {
+      "id": "signInSecurity",
+      "label": "Advanced sign-in security",
+      "description": "Entra ID P1: Conditional Access rules that decide who can sign in from where.",
+      "measurable": false
+    },
+    {
+      "id": "identityRisk",
+      "label": "Identity risk protection",
+      "description": "Entra ID P2: automatic detection of risky sign-ins and privileged access controls.",
+      "measurable": false
+    },
+    {
+      "id": "identityGovernance",
+      "label": "Identity governance",
+      "description": "Access reviews and lifecycle workflows for user access.",
+      "measurable": false
+    },
+    {
+      "id": "endpointSecurity",
+      "label": "Device threat protection",
+      "description": "Microsoft Defender for Business or Endpoint: antivirus and attack detection on devices.",
+      "measurable": false
+    },
+    {
+      "id": "emailSecurity",
+      "label": "Advanced email threat protection",
+      "description": "Defender for Office 365: safe links, safe attachments and phishing protection.",
+      "measurable": false
+    },
+    {
+      "id": "cloudAppSecurity",
+      "label": "Cloud app security",
+      "description": "Defender for Cloud Apps: visibility and control over cloud services staff use.",
+      "measurable": false
+    },
+    {
+      "id": "informationProtection",
+      "label": "Data protection and labelling",
+      "description": "Purview sensitivity labels and rights management for confidential documents.",
+      "measurable": false
+    },
+    {
+      "id": "compliance",
+      "label": "Advanced compliance",
+      "description": "eDiscovery, advanced audit, insider risk and customer lockbox.",
+      "measurable": false
+    },
+    {
+      "id": "phone",
+      "label": "Teams Phone",
+      "description": "Making and receiving regular phone calls through Teams.",
+      "measurable": false
+    },
+    {
+      "id": "audioConferencing",
+      "label": "Dial-in meetings",
+      "description": "Phone dial-in numbers for Teams meetings.",
+      "measurable": false
+    },
+    {
+      "id": "analytics",
+      "label": "Power BI reporting",
+      "description": "Building and sharing interactive business reports.",
+      "measurable": false
+    },
+    {
+      "id": "windows",
+      "label": "Windows upgrade rights",
+      "description": "Upgrading Windows Pro to Enterprise or Business edition.",
+      "measurable": false
+    }
+  ]
+}
diff --git a/Config/ReportSamples/mailFlow.json b/Config/ReportSamples/mailFlow.json
new file mode 100644
index 0000000000000..0253b7165d416
--- /dev/null
+++ b/Config/ReportSamples/mailFlow.json
@@ -0,0 +1,188 @@
+{
+  "days": 14,
+  "totals": {
+    "GoodMail": 48210,
+    "TransportRules": 1340,
+    "SpamDetections": 6120,
+    "EdgeBlockSpam": 3980,
+    "EmailPhish": 412,
+    "EmailMalware": 37
+  },
+  "directionTotals": {
+    "Inbound": 39280,
+    "Outbound": 8940,
+    "IntraOrg": 11879
+  },
+  "daily": [
+    {
+      "date": "2026-08-04",
+      "GoodMail": 3410,
+      "TransportRules": 96,
+      "SpamDetections": 430,
+      "EdgeBlockSpam": 281,
+      "EmailPhish": 29,
+      "EmailMalware": 3
+    },
+    {
+      "date": "2026-08-05",
+      "GoodMail": 3688,
+      "TransportRules": 104,
+      "SpamDetections": 468,
+      "EdgeBlockSpam": 302,
+      "EmailPhish": 33,
+      "EmailMalware": 2
+    },
+    {
+      "date": "2026-08-06",
+      "GoodMail": 3572,
+      "TransportRules": 88,
+      "SpamDetections": 451,
+      "EdgeBlockSpam": 295,
+      "EmailPhish": 31,
+      "EmailMalware": 4
+    },
+    {
+      "date": "2026-08-07",
+      "GoodMail": 3740,
+      "TransportRules": 112,
+      "SpamDetections": 502,
+      "EdgeBlockSpam": 318,
+      "EmailPhish": 38,
+      "EmailMalware": 1
+    },
+    {
+      "date": "2026-08-08",
+      "GoodMail": 3495,
+      "TransportRules": 97,
+      "SpamDetections": 476,
+      "EdgeBlockSpam": 304,
+      "EmailPhish": 35,
+      "EmailMalware": 3
+    },
+    {
+      "date": "2026-08-09",
+      "GoodMail": 1180,
+      "TransportRules": 21,
+      "SpamDetections": 268,
+      "EdgeBlockSpam": 174,
+      "EmailPhish": 12,
+      "EmailMalware": 0
+    },
+    {
+      "date": "2026-08-10",
+      "GoodMail": 1042,
+      "TransportRules": 18,
+      "SpamDetections": 251,
+      "EdgeBlockSpam": 166,
+      "EmailPhish": 10,
+      "EmailMalware": 1
+    },
+    {
+      "date": "2026-08-11",
+      "GoodMail": 3820,
+      "TransportRules": 118,
+      "SpamDetections": 529,
+      "EdgeBlockSpam": 341,
+      "EmailPhish": 41,
+      "EmailMalware": 5
+    },
+    {
+      "date": "2026-08-12",
+      "GoodMail": 3903,
+      "TransportRules": 121,
+      "SpamDetections": 544,
+      "EdgeBlockSpam": 352,
+      "EmailPhish": 44,
+      "EmailMalware": 4
+    },
+    {
+      "date": "2026-08-13",
+      "GoodMail": 3766,
+      "TransportRules": 109,
+      "SpamDetections": 511,
+      "EdgeBlockSpam": 329,
+      "EmailPhish": 36,
+      "EmailMalware": 2
+    },
+    {
+      "date": "2026-08-14",
+      "GoodMail": 3841,
+      "TransportRules": 114,
+      "SpamDetections": 498,
+      "EdgeBlockSpam": 321,
+      "EmailPhish": 34,
+      "EmailMalware": 3
+    },
+    {
+      "date": "2026-08-15",
+      "GoodMail": 3612,
+      "TransportRules": 102,
+      "SpamDetections": 470,
+      "EdgeBlockSpam": 303,
+      "EmailPhish": 30,
+      "EmailMalware": 4
+    },
+    {
+      "date": "2026-08-16",
+      "GoodMail": 1214,
+      "TransportRules": 22,
+      "SpamDetections": 264,
+      "EdgeBlockSpam": 172,
+      "EmailPhish": 20,
+      "EmailMalware": 3
+    },
+    {
+      "date": "2026-08-17",
+      "GoodMail": 1127,
+      "TransportRules": 18,
+      "SpamDetections": 258,
+      "EdgeBlockSpam": 322,
+      "EmailPhish": 19,
+      "EmailMalware": 2
+    }
+  ],
+  "topSenders": [
+    {
+      "Name": "notifications@sample-crm.example.com",
+      "Count": 4820
+    },
+    {
+      "Name": "billing@example.com",
+      "Count": 3115
+    },
+    {
+      "Name": "scanner-3f@example.com",
+      "Count": 2064
+    },
+    {
+      "Name": "sample.user@example.com",
+      "Count": 1893
+    },
+    {
+      "Name": "helpdesk@example.com",
+      "Count": 1477
+    }
+  ],
+  "topSpamRecipients": [
+    {
+      "Name": "info@example.com",
+      "Count": 1840
+    },
+    {
+      "Name": "sales@example.com",
+      "Count": 1226
+    },
+    {
+      "Name": "sample.user@example.com",
+      "Count": 744
+    },
+    {
+      "Name": "accounts@example.com",
+      "Count": 517
+    },
+    {
+      "Name": "careers@example.com",
+      "Count": 388
+    }
+  ]
+}
diff --git a/Config/ReportSamples/permissions.json b/Config/ReportSamples/permissions.json
new file mode 100644
index 0000000000000..4a0fd7256873d
--- /dev/null
+++ b/Config/ReportSamples/permissions.json
@@ -0,0 +1,27 @@
+{
+  "summary": {
+    "sitesScanned": 12,
+    "librariesScanned": 34,
+    "totalAssignments": 156,
+    "broadClaimGrants": 2,
+    "externalGrants": 5,
+    "directFullControlGrants": 3,
+    "uniquePermissionLibraries": 7
+  },
+  "assignments": [
+    {
+      "siteName": "Sample Marketing",
+      "libraryName": "Documents",
+      "principal": "Everyone except external users",
+      "permission": "Edit",
+      "type": "Broad claim"
+    },
+    {
+      "siteName": "Sample Finance",
+      "libraryName": "Documents",
+      "principal": "partner@example.com",
+      "permission": "Full Control",
+      "type": "External"
+    }
+  ]
+}
diff --git a/Config/ReportSamples/reportBuilder.json b/Config/ReportSamples/reportBuilder.json
new file mode 100644
index 0000000000000..d00cea8b06bb9
--- /dev/null
+++ b/Config/ReportSamples/reportBuilder.json
@@ -0,0 +1,259 @@
+{
+  "blocks": [
+    {
+      "type": "cover",
+      "title": "Quarterly Security",
+      "coverAccent": "Review",
+      "subtitle": "How the tenant stood this quarter, what changed, and what comes next.",
+      "coverLabel": "Security Review",
+      "static": true
+    },
+    {
+      "id": "sample-1",
+      "type": "blank",
+      "title": "Summary",
+      "static": true,
+      "content": "<p>This preview uses <strong>sample data</strong> so you can see how your branding lands before running a report against a real tenant.</p>"
+    },
+    {
+      "type": "infobox",
+      "title": "Why this matters",
+      "content": "Identity is the perimeter: **every** control in this report starts with who can sign in, and from where.",
+      "static": true
+    },
+    {
+      "type": "richbullets",
+      "title": "Key points",
+      "items": [
+        {
+          "label": "MFA is enforced.",
+          "text": "All 128 licensed users are covered by a Conditional Access policy."
+        },
+        {
+          "label": "Legacy authentication is blocked.",
+          "text": "No sign-ins over IMAP, POP or SMTP AUTH in the last 30 days."
+        }
+      ],
+      "static": true
+    },
+    {
+      "type": "note",
+      "content": "Figures are taken from the last completed sync, not read live.",
+      "static": true
+    },
+    {
+      "type": "page",
+      "title": "Findings in detail",
+      "subtitle": "What we found, and what to do about it",
+      "static": true
+    },
+    {
+      "id": "sample-2",
+      "type": "scorecard",
+      "title": "Environment Overview",
+      "static": true,
+      "stats": [
+        {
+          "label": "Licensed Users",
+          "value": "128"
+        },
+        {
+          "label": "Devices",
+          "value": "96"
+        },
+        {
+          "label": "Global Admins",
+          "value": "3",
+          "caption": "Target: 2–4"
+        },
+        {
+          "label": "Guests",
+          "value": "9"
+        }
+      ]
+    },
+    {
+      "id": "sample-3",
+      "type": "chart",
+      "title": "Device Compliance",
+      "static": true,
+      "chartKind": "donut",
+      "chartCentreLabel": "Devices",
+      "chartData": [
+        {
+          "label": "Compliant",
+          "value": 78
+        },
+        {
+          "label": "Non-compliant",
+          "value": 14
+        },
+        {
+          "label": "Not evaluated",
+          "value": 4
+        }
+      ]
+    },
+    {
+      "id": "sample-4",
+      "type": "chart",
+      "title": "Secure Score Trend",
+      "static": true,
+      "chartKind": "trend",
+      "chartMax": 100,
+      "chartCaption": "Current: 61 / 100 (61%)",
+      "chartData": [
+        {
+          "label": "Jul 29",
+          "value": 50
+        },
+        {
+          "label": "Jul 31",
+          "value": 55
+        },
+        {
+          "label": "Aug 2",
+          "value": 58
+        },
+        {
+          "label": "Aug 4",
+          "value": 61
+        }
+      ]
+    },
+    {
+      "id": "sample-5",
+      "type": "progress",
+      "title": "Control Coverage",
+      "static": true,
+      "items": [
+        {
+          "label": "MFA enforced",
+          "value": 92,
+          "max": 100
+        },
+        {
+          "label": "Disk encryption",
+          "value": 78,
+          "max": 100
+        },
+        {
+          "label": "Defender onboarded",
+          "value": 64,
+          "max": 100
+        }
+      ]
+    },
+    {
+      "type": "richtable",
+      "title": "Top findings",
+      "columns": [
+        {
+          "header": "Finding",
+          "key": "c1"
+        },
+        {
+          "header": "Impact",
+          "key": "c2"
+        },
+        {
+          "header": "Owner",
+          "key": "c3"
+        }
+      ],
+      "rows": [
+        {
+          "c1": "3 stale guest accounts",
+          "c2": "Medium",
+          "c3": "IT"
+        },
+        {
+          "c1": "2 devices out of compliance",
+          "c2": "Low",
+          "c3": "Service desk"
+        }
+      ],
+      "static": true
+    },
+    {
+      "type": "infoboxcolumns",
+      "columns": 2,
+      "items": [
+        {
+          "title": "Done this quarter",
+          "content": "Passwordless sign-in rolled out to 40% of staff."
+        },
+        {
+          "title": "Next quarter",
+          "content": "Extend it to the remaining sites and the shared mailboxes."
+        }
+      ],
+      "static": true
+    },
+    {
+      "id": "sample-6",
+      "type": "pagebreak",
+      "title": "",
+      "static": true
+    },
+    {
+      "id": "sample-7",
+      "type": "hero",
+      "title": "seconds",
+      "static": true,
+      "heroHighlight": "39",
+      "heroSubText": "a business falls victim to ransomware",
+      "heroFooterText": "Proactive defense beats reactive recovery",
+      "heroImage": "/reportImages/working.jpg"
+    },
+    {
+      "id": "sample-8",
+      "type": "test",
+      "title": "Multi-factor authentication",
+      "status": "Failed",
+      "static": false,
+      "content": "14 of 128 accounts can still sign in without a second factor.\n\n## Results\n\n| Account | Method | Last sign-in |\n| --- | --- | --- |\n| sample.one@example.com | None | 2 days ago |\n| sample.two@example.com | None | 9 days ago |\n"
+    },
+    {
+      "id": "sample-9",
+      "type": "chart",
+      "title": "Devices by Platform",
+      "static": true,
+      "chartKind": "bar",
+      "chartData": [
+        {
+          "label": "Windows",
+          "value": 62
+        },
+        {
+          "label": "macOS",
+          "value": 18
+        },
+        {
+          "label": "iOS",
+          "value": 12
+        },
+        {
+          "label": "Android",
+          "value": 4
+        }
+      ]
+    },
+    {
+      "id": "sample-10",
+      "type": "database",
+      "title": "Query Results",
+      "static": true,
+      "format": "text",
+      "content": "| Policy | Identifier | State |\n| --- | --- | --- |\n| Baseline | 8f2a1c4e-6b3d-4f5a-9e7c-1d2b3a4c5e6f | Enabled |\n| Hardened | Microsoft_Defender_for_Business_Servers | Report only |\n"
+    },
+    {
+      "id": "sample-11",
+      "type": "database",
+      "title": "Raw Response",
+      "static": true,
+      "format": "json",
+      "content": "{\n  \"tenant\": \"contoso.com\",\n  \"policies\": 191,\n  \"enabled\": 5\n}"
+    }
+  ]
+}
diff --git a/Config/ReportSamples/shadowAI.json b/Config/ReportSamples/shadowAI.json
new file mode 100644
index 0000000000000..c5a4f9f6fcede
--- /dev/null
+++ b/Config/ReportSamples/shadowAI.json
@@ -0,0 +1,103 @@
+{
+  "summary": {
+    "aiToolsDetected": 18,
+    "deviceInstalls": 36,
+    "consentedAiApps": 5,
+    "highRiskTools": 3,
+    "sanctionedTools": 2
+  },
+  "byRisk": [
+    {
+      "risk": "High",
+      "tools": 3
+    },
+    {
+      "risk": "Medium",
+      "tools": 7
+    },
+    {
+      "risk": "Low",
+      "tools": 6
+    },
+    {
+      "risk": "Informational",
+      "tools": 2
+    }
+  ],
+  "topTools": [
+    {
+      "tool": "Sample AI Assistant",
+      "category": "Chat",
+      "status": "Unsanctioned",
+      "devices": 22,
+      "users": 18
+    },
+    {
+      "tool": "Sample Code Helper",
+      "category": "Development",
+      "status": "Unsanctioned",
+      "devices": 14,
+      "users": 9
+    },
+    {
+      "tool": "Sample Notetaker",
+      "category": "Meetings",
+      "status": "Sanctioned",
+      "devices": 11,
+      "users": 24
+    }
+  ],
+  "detectedApps": [
+    {
+      "application": "Sample AI Assistant Desktop",
+      "aiTool": "Sample AI Assistant",
+      "vendor": "Example Corp",
+      "category": "Chat",
+      "risk": "High",
+      "status": "Unsanctioned",
+      "deviceCount": 22
+    },
+    {
+      "application": "Sample Code Helper",
+      "aiTool": "Sample Code Helper",
+      "vendor": "Example Labs",
+      "category": "Development",
+      "risk": "Medium",
+      "status": "Unsanctioned",
+      "deviceCount": 14
+    },
+    {
+      "application": "Sample Notetaker",
+      "aiTool": "Sample Notetaker",
+      "vendor": "Example Corp",
+      "category": "Meetings",
+      "risk": "Informational",
+      "status": "Sanctioned",
+      "deviceCount": 11
+    }
+  ],
+  "consentedApps": [
+    {
+      "applicationId": "00000000-0000-0000-0000-000000000001",
+      "application": "Sample AI Connector",
+      "aiTool": "Sample AI Assistant",
+      "vendor": "Example Corp",
+      "category": "Chat",
+      "risk": "High",
+      "status": "Unsanctioned",
+      "activeUsersLast7Days": 18,
+      "firstConsentedDateTime": "2026-06-11T10:22:00Z"
+    },
+    {
+      "applicationId": "00000000-0000-0000-0000-000000000002",
+      "application": "Sample Meeting Notes",
+      "aiTool": "Sample Notetaker",
+      "vendor": "Example Corp",
+      "category": "Meetings",
+      "risk": "Informational",
+      "status": "Sanctioned",
+      "activeUsersLast7Days": 24,
+      "firstConsentedDateTime": "2026-03-02T14:05:00Z"
+    }
+  ]
+}
diff --git a/Config/ReportSamples/sharing.json b/Config/ReportSamples/sharing.json
new file mode 100644
index 0000000000000..d7f89977f75d3
--- /dev/null
+++ b/Config/ReportSamples/sharing.json
@@ -0,0 +1,53 @@
+{
+  "summary": {
+    "totalLinks": 24,
+    "itemsShared": 18,
+    "externalRecipients": 6,
+    "anonymousLinks": 4,
+    "anonymousEditLinks": 1,
+    "neverExpiringAnonymous": 2,
+    "folderShares": 3,
+    "externalLinks": 6,
+    "sharePointSites": 5,
+    "teamsSites": 3,
+    "oneDriveAccounts": 12
+  },
+  "links": [
+    {
+      "itemName": "Sample Proposal.docx",
+      "siteName": "Sample Marketing",
+      "linkType": "Anonymous",
+      "scope": "Edit",
+      "expires": "Never",
+      "recipients": "Anyone with the link"
+    },
+    {
+      "itemName": "Sample Budget.xlsx",
+      "siteName": "Sample Finance",
+      "linkType": "External",
+      "scope": "View",
+      "expires": "2026-12-31",
+      "recipients": "partner@example.com"
+    }
+  ],
+  "topRecipients": [
+    {
+      "recipient": "partner@example.com",
+      "links": 5
+    },
+    {
+      "recipient": "supplier@example.net",
+      "links": 3
+    }
+  ],
+  "topLibraries": [
+    {
+      "library": "Sample Marketing / Documents",
+      "links": 9
+    },
+    {
+      "library": "Sample Finance / Documents",
+      "links": 6
+    }
+  ]
+}
diff --git a/Config/SAMManifest.json b/Config/SAMManifest.json
index b4f29624ddd64..1ebb413e38985 100644
--- a/Config/SAMManifest.json
+++ b/Config/SAMManifest.json
@@ -743,6 +743,15 @@
           "type": "Scope"
         }
       ]
+    },
+    {
+      "resourceAppId": "09abbdfd-ed23-44ee-a2d9-a627aa1c90f3",
+      "resourceAccess": [
+        {
+          "id": "68067c9d-a1be-4603-b095-3eaf54a42510",
+          "type": "Role"
+        }
+      ]
     }
   ],
   "servicePrincipalLockConfiguration": {
diff --git a/Config/SecuritySimulations/CAAnalysis/AppDescriptions.json b/Config/SecuritySimulations/CAAnalysis/AppDescriptions.json
new file mode 100644
index 0000000000000..fdd07d236aa58
--- /dev/null
+++ b/Config/SecuritySimulations/CAAnalysis/AppDescriptions.json
@@ -0,0 +1,33 @@
+[
+  { "appId": "00000002-0000-0000-c000-000000000000", "displayName": "Windows Azure Active Directory", "purpose": "The older directory service interface, used by legacy applications to read and write users, groups and applications.", "commonExclusionReason": "Sometimes exempted so older applications that have not moved to Microsoft Graph keep working. Exempting it also lets every user read basic profile details without meeting the policy.", "exclusionRisk": "critical" },
+  { "appId": "00000003-0000-0000-c000-000000000000", "displayName": "Microsoft Graph", "purpose": "The main interface to all Microsoft 365 services. Almost every Microsoft and third-party application uses it to reach mail, files, users, groups and Teams.", "commonExclusionReason": "Rarely has a valid reason to be exempt. Exempting it lets every application read basic profile and directory details without meeting the policy.", "exclusionRisk": "critical" },
+  { "appId": "0000000c-0000-0000-c000-000000000000", "displayName": "Microsoft App Access Panel", "purpose": "The My Apps portal where people discover and launch the applications assigned to them.", "commonExclusionReason": "Exempted so people can browse their application list without a multifactor prompt. Low risk, because opening an application still triggers that application's own policy.", "exclusionRisk": "low" },
+  { "appId": "2793995e-0a7d-40d7-bd35-6968ba142197", "displayName": "My Apps", "purpose": "The newer My Apps experience for finding and launching assigned applications.", "commonExclusionReason": "Exempted for the same reason as the App Access Panel. Launching an application still triggers that application's own policy.", "exclusionRisk": "low" },
+  { "appId": "8c59ead7-d703-4a27-9e55-c96a0054c8d2", "displayName": "My Profile", "purpose": "The My Account portal where people manage their profile, sign-in methods, devices and privacy settings.", "commonExclusionReason": "Exempted so people can update their sign-in methods without being blocked. Without the exemption some people cannot register multifactor methods at all.", "exclusionRisk": "medium" },
+  { "appId": "797f4846-ba00-4fd7-ba43-dac1f8f63013", "displayName": "Azure Resource Manager", "purpose": "The management layer for all Azure resources. Every portal, command-line and automation operation in Azure goes through it.", "commonExclusionReason": "Exempted so automation and service accounts can manage Azure resources. High risk, because a stolen credential then gives control of the entire Azure estate.", "exclusionRisk": "critical" },
+  { "appId": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "displayName": "Azure Portal", "purpose": "The Azure management website that gives visual access to every Azure service.", "commonExclusionReason": "Rarely exempted. Because the portal works through Azure Resource Manager, a policy on that service already covers the portal.", "exclusionRisk": "critical" },
+  { "appId": "372140e0-b3b7-4226-8ef9-d57986796201", "displayName": "Azure Windows VM Sign-In", "purpose": "Lets people sign in to Azure Windows virtual machines with their Microsoft Entra account over remote desktop instead of local credentials.", "commonExclusionReason": "Exempted from multifactor policies because remote desktop sign-in to a virtual machine cannot show an interactive prompt. Microsoft documents this as a known limitation; protect the machines with network controls instead.", "exclusionRisk": "medium" },
+  { "appId": "00000002-0000-0ff1-ce00-000000000000", "displayName": "Office 365 Exchange Online", "purpose": "Email, calendars and contacts, used by Outlook, mobile mail apps and third-party mail clients.", "commonExclusionReason": "Exempted to keep older mail protocols working. Blocking the older sign-in methods is the better answer than exempting mail.", "exclusionRisk": "high" },
+  { "appId": "00000003-0000-0ff1-ce00-000000000000", "displayName": "Office 365 SharePoint Online", "purpose": "SharePoint and OneDrive, which hold all Microsoft 365 files, team sites and document libraries.", "commonExclusionReason": "Exempted to keep file-sync clients or third-party integrations working. High risk, because it exposes every corporate document.", "exclusionRisk": "high" },
+  { "appId": "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe", "displayName": "Microsoft Teams Services", "purpose": "Chat, meetings, calling and collaboration in Microsoft Teams.", "commonExclusionReason": "Exempted to avoid prompts during meetings or to keep meeting-room devices working. A managed-device requirement is usually the better answer.", "exclusionRisk": "high" },
+  { "appId": "0000000a-0000-0000-c000-000000000000", "displayName": "Microsoft Intune", "purpose": "Device and app management, covering device compliance, app deployment and configuration.", "commonExclusionReason": "Exempted so devices can enroll before their compliance can be judged; without it, a device cannot enroll because it is not yet compliant.", "exclusionRisk": "medium" },
+  { "appId": "d4ebce55-015a-49b5-a083-c84d1797ae8c", "displayName": "Microsoft Intune Enrollment", "purpose": "Handles device enrollment into Intune during Autopilot, personal-device enrollment and device registration.", "commonExclusionReason": "Exempted so devices can complete their first enrollment before compliance rules apply. A common and generally accepted exemption.", "exclusionRisk": "low" },
+  { "appId": "0000000f-0000-0000-c000-000000000000", "displayName": "Microsoft Intune API", "purpose": "The management interface for Intune, used by admin tools, scripts and automation.", "commonExclusionReason": "Exempted so scripts and management tools can work with Intune. A dedicated automation identity with limited permissions is usually the better answer.", "exclusionRisk": "medium" },
+  { "appId": "fc780465-2017-40d4-a0c5-307022471b92", "displayName": "WindowsDefenderATP", "purpose": "Microsoft Defender for Endpoint, which provides threat detection, investigation and vulnerability management.", "commonExclusionReason": "Exempted so Defender agents can report without a multifactor prompt. Generally low risk as machine-to-service traffic, but confirm it is the agent and not portal access.", "exclusionRisk": "medium" },
+  { "appId": "ea890292-c8c8-4433-b5ea-b09d0668e1a6", "displayName": "Azure Credential Configuration Endpoint Service", "purpose": "Manages the federated credentials and certificates that automation identities such as build pipelines use to sign in without a secret.", "commonExclusionReason": "Exempted so that keyless sign-in from build and deployment pipelines keeps working.", "exclusionRisk": "low" },
+  { "appId": "00000012-0000-0000-c000-000000000000", "displayName": "Microsoft Rights Management Services", "purpose": "Encrypts and protects documents and email through sensitivity labels in Office, Outlook and SharePoint.", "commonExclusionReason": "Exempted to avoid a multifactor prompt every time a protected document or email is opened, which otherwise breaks the reading experience.", "exclusionRisk": "low" },
+  { "appId": "65d91a3d-ab74-42e6-8a2f-0add61688c74", "displayName": "Microsoft Approval Management", "purpose": "Runs approval workflows across Microsoft 365, including Teams, Power Automate and SharePoint approvals.", "commonExclusionReason": "Exempted so approval requests and responses flow without interruption. Blocking it can stop approval workflows from completing.", "exclusionRisk": "low" },
+  { "appId": "1b912ec3-a9dd-4c4d-a53e-76aa7adb28d7", "displayName": "AADReporting", "purpose": "The reporting service behind sign-in logs, audit logs and usage reports.", "commonExclusionReason": "Exempted so monitoring tools and log collectors can pull reports without triggering a policy.", "exclusionRisk": "low" },
+  { "appId": "00000007-0000-0000-c000-000000000000", "displayName": "Dataverse", "purpose": "The data platform behind Power Apps, Power Automate and Dynamics 365.", "commonExclusionReason": "Exempted so Power Platform apps and flows can reach their data. Dedicated automation identities are usually the better answer.", "exclusionRisk": "medium" },
+  { "appId": "7df0a125-d3be-4c96-aa54-591f83ff541c", "displayName": "Microsoft Flow Service", "purpose": "Power Automate, which runs automated workflows across hundreds of services.", "commonExclusionReason": "Exempted so cloud flows can run on behalf of people without an interactive prompt. Flows that use personal connections fail if it is blocked.", "exclusionRisk": "medium" },
+  { "appId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "displayName": "Microsoft Azure CLI", "purpose": "The Azure command-line tool used by engineers and administrators for scripting and automation.", "commonExclusionReason": "Exempted so scripts can sign in. It can reach a very wide range of services; automation should use a dedicated identity instead of an exemption.", "exclusionRisk": "high" },
+  { "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "displayName": "Microsoft Azure PowerShell", "purpose": "The Azure PowerShell tooling used for administration and automation, with the widest reach of any standard Microsoft client.", "commonExclusionReason": "Exempted so PowerShell automation can sign in. Very high risk given its reach; automation should use a dedicated identity instead.", "exclusionRisk": "critical" },
+  { "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "displayName": "Azure Active Directory PowerShell", "purpose": "The older directory PowerShell tooling for managing users and groups, being replaced by Microsoft Graph PowerShell.", "commonExclusionReason": "Exempted for older automation scripts. Those scripts should move to Microsoft Graph PowerShell with a dedicated identity.", "exclusionRisk": "high" },
+  { "appId": "aebc6443-996d-45c2-90f0-388ff96faa56", "displayName": "Visual Studio Code", "purpose": "The VS Code editor, whose Azure extensions use this identity to reach Azure resources, repositories and Copilot.", "commonExclusionReason": "Exempted so developers can use the Azure extensions. It supports multifactor authentication, so requiring it is preferable to an exemption.", "exclusionRisk": "medium" },
+  { "appId": "cb1056e2-e479-49de-ae31-7812af012ed8", "displayName": "Microsoft Azure Active Directory Connect", "purpose": "Entra Connect, which synchronizes on-premises Active Directory with Microsoft Entra ID.", "commonExclusionReason": "Exempted so the synchronization service can run without an interactive prompt. Keep the exemption limited to the dedicated synchronization account.", "exclusionRisk": "medium" },
+  { "appId": "dd762716-544d-4aeb-a526-687b73838a22", "displayName": "Microsoft Device Registration Client", "purpose": "Handles device registration and joining, needed for workplace join, hybrid join and Autopilot.", "commonExclusionReason": "Exempted so devices can register. Only a multifactor requirement applies to this service anyway; network and managed-device conditions are ignored by design.", "exclusionRisk": "medium" },
+  { "appId": "de50c81f-5f80-4771-b66b-cebd28ccdfc1", "displayName": "Device Management Client", "purpose": "An internal Windows component for device management, with access to more services than any other application in a tenant.", "commonExclusionReason": "Exempted for device management flows. Extremely high risk because of its reach.", "exclusionRisk": "critical" },
+  { "appId": "1b3c667f-cde3-4090-b60b-3d2abd0117f0", "displayName": "Windows Spotlight", "purpose": "Delivers lock-screen images, tips and suggestions on Windows devices.", "commonExclusionReason": "Exempted because the lock screen makes background calls that fail with a multifactor prompt. Low sensitivity, as it only fetches display content.", "exclusionRisk": "low" },
+  { "appId": "826870f9-9fbb-4f23-81b8-3a957080dfa2", "displayName": "Security Copilot", "purpose": "Microsoft's security assistant for threat investigation, incident response and query writing.", "commonExclusionReason": "Exempted so analysts are not interrupted during incident response. A managed-device requirement is usually the better answer.", "exclusionRisk": "high" },
+  { "appId": "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9", "displayName": "Device Registration Service", "purpose": "The backend service for device registration, join and Autopilot.", "commonExclusionReason": "Exempted because only a multifactor requirement applies to this service; network and managed-device conditions are ignored by design.", "exclusionRisk": "medium" }
+]
diff --git a/Config/SecuritySimulations/CAAnalysis/BypassApps.json b/Config/SecuritySimulations/CAAnalysis/BypassApps.json
new file mode 100644
index 0000000000000..190013e333515
--- /dev/null
+++ b/Config/SecuritySimulations/CAAnalysis/BypassApps.json
@@ -0,0 +1,50 @@
+{
+  "immuneResources": [
+    { "resourceId": "26a4ae64-5862-427f-a9b0-044e62572a4f", "displayName": "Microsoft Intune Checkin" },
+    { "resourceId": "04436913-cf0d-4d2a-9cc6-2ffe7f1d3d1c", "displayName": "Windows Notification Service" },
+    { "resourceId": "0a5f63c0-b750-4f38-a71c-4fc0d58b89e2", "displayName": "Microsoft Mobile Application Management" },
+    { "resourceId": "1f5530b3-261a-47a9-b357-ded261e17918", "displayName": "Azure Multi-Factor Auth Connector" },
+    { "resourceId": "c2ada927-a9e2-4564-aae2-70775a2fa0af", "displayName": "OCaaS Client Interaction Service" },
+    { "resourceId": "ff9ebd75-fe62-434a-a6ce-b3f0a8592eaf", "displayName": "Authenticator App" }
+  ],
+  "bypassApps": [
+    { "appId": "04b07795-8ddb-461a-bbee-02f9e1bf7b46", "displayName": "Microsoft Azure CLI", "description": "The Azure command-line tool, with access to a very wide range of services. A public client that can sidestep Conditional Access." },
+    { "appId": "1950a258-227b-4e31-a9cf-717495945fc2", "displayName": "Microsoft Azure PowerShell", "description": "The Azure PowerShell tooling, with the widest service reach of any standard Microsoft client." },
+    { "appId": "1b730954-1685-4b74-9bfd-dac224a7b894", "displayName": "Azure Active Directory PowerShell", "description": "The older directory PowerShell tooling, with broad directory access." },
+    { "appId": "cb1056e2-e479-49de-ae31-7812af012ed8", "displayName": "Microsoft Azure Active Directory Connect", "description": "Hybrid identity synchronization, with broad access." },
+    { "appId": "aebc6443-996d-45c2-90f0-388ff96faa56", "displayName": "Visual Studio Code", "description": "The VS Code editor, whose Azure extensions reach Azure resources." },
+    { "appId": "fc0f3af4-6835-4174-b806-f7db311fd2f3", "displayName": "Microsoft Intune Windows Agent", "description": "The Intune agent; device enrollment sidesteps a managed-device requirement." },
+    { "appId": "dd762716-544d-4aeb-a526-687b73838a22", "displayName": "Microsoft Device Registration Client", "description": "Device registration; network conditions do not apply to it and only a multifactor requirement protects it." },
+    { "appId": "de50c81f-5f80-4771-b66b-cebd28ccdfc1", "displayName": "Device Management Client", "description": "A device management component with access to more services than any other application." },
+    { "appId": "a672d62c-fc7b-4e81-a576-e60dc46e951d", "displayName": "Microsoft Power Query for Excel", "description": "Data connection tooling for Excel, with broad access." },
+    { "appId": "cf710c6e-dfcc-4fa8-a093-d47294e44c66", "displayName": "Azure Analysis Services Client", "description": "Client tooling for Azure Analysis Services." },
+    { "appId": "c58637bb-e2e1-4312-8a00-04b5ffcd3403", "displayName": "SharePoint Online Client Extensibility", "description": "Extensibility client for SharePoint Online." },
+    { "appId": "268761a2-03f3-40df-8a8b-c3db24145b6b", "displayName": "Universal Store Native Client", "description": "The Windows Store client." },
+    { "appId": "1b3c667f-cde3-4090-b60b-3d2abd0117f0", "displayName": "Windows Spotlight", "description": "The Windows lock-screen content client." }
+  ],
+  "deviceRegistrationResource": { "resourceId": "01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9", "displayName": "Device Registration Service" },
+  "wellKnownApps": [
+    { "appId": "00000003-0000-0000-c000-000000000000", "displayName": "Microsoft Graph" },
+    { "appId": "00000002-0000-0000-c000-000000000000", "displayName": "Azure AD Graph (Legacy)" },
+    { "appId": "797f4846-ba00-4fd7-ba43-dac1f8f63013", "displayName": "Azure Resource Manager" },
+    { "appId": "0000000a-0000-0000-c000-000000000000", "displayName": "Microsoft Intune" },
+    { "appId": "00000002-0000-0ff1-ce00-000000000000", "displayName": "Office 365 Exchange Online" },
+    { "appId": "00000003-0000-0ff1-ce00-000000000000", "displayName": "Office 365 SharePoint Online" },
+    { "appId": "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe", "displayName": "Microsoft Teams Services" },
+    { "appId": "fc780465-2017-40d4-a0c5-307022471b92", "displayName": "WindowsDefenderATP" },
+    { "appId": "826870f9-9fbb-4f23-81b8-3a957080dfa2", "displayName": "Security Copilot" },
+    { "appId": "00000007-0000-0000-c000-000000000000", "displayName": "Dataverse" },
+    { "appId": "7df0a125-d3be-4c96-aa54-591f83ff541c", "displayName": "Microsoft Flow Service" }
+  ],
+  "highValueApps": [
+    { "appId": "797f4846-ba00-4fd7-ba43-dac1f8f63013", "name": "Azure Management", "description": "the Azure portal, command line and automation tooling", "risk": "critical" },
+    { "appId": "00000002-0000-0ff1-ce00-000000000000", "name": "Office 365 Exchange Online", "description": "email, calendars and contacts", "risk": "high" },
+    { "appId": "00000003-0000-0ff1-ce00-000000000000", "name": "Office 365 SharePoint Online", "description": "SharePoint and OneDrive files", "risk": "high" },
+    { "appId": "00000003-0000-0000-c000-000000000000", "name": "Microsoft Graph", "description": "programmatic access to all Microsoft 365 data", "risk": "critical" },
+    { "appId": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c", "name": "Azure Portal", "description": "web-based Azure management", "risk": "critical" }
+  ],
+  "appGroupAliases": {
+    "office365": { "displayName": "Office 365 (app group)", "purpose": "Built-in Conditional Access application group covering the core Office 365 services (Exchange Online, SharePoint Online, Teams, and related apps)." },
+    "microsoftadminportals": { "displayName": "Microsoft Admin Portals (app group)", "purpose": "Built-in Conditional Access application group covering the Microsoft admin portals (Microsoft Entra admin center, Microsoft 365 admin center, Azure portal, and others)." }
+  }
+}
diff --git a/Config/SecuritySimulations/CAAnalysis/CoverageControls.json b/Config/SecuritySimulations/CAAnalysis/CoverageControls.json
new file mode 100644
index 0000000000000..6d254a70e6653
--- /dev/null
+++ b/Config/SecuritySimulations/CAAnalysis/CoverageControls.json
@@ -0,0 +1,10 @@
+{
+  "RequireMfa": { "label": "Multifactor authentication", "description": "Without it, a stolen or guessed password is enough to sign in as one of them." },
+  "PhishingResistantMfa": { "label": "Phishing-resistant authentication", "description": "Without it, their multifactor prompt can be captured by a convincing phishing page." },
+  "RequireCompliantDevice": { "label": "Managed device", "description": "Without it, they can sign in from any device, including unmanaged or infected ones." },
+  "BlockLegacyAuth": { "label": "Legacy authentication blocked", "description": "Without it, older sign-in methods that cannot use multifactor authentication remain available to them." },
+  "SignInRisk": { "label": "Sign-in risk response", "description": "Without it, a sign-in that Microsoft rates as suspicious goes through without any extra check." },
+  "UserRisk": { "label": "User risk response", "description": "Without it, an account that Microsoft rates as likely compromised keeps working until someone notices." },
+  "SessionControls": { "label": "Session limits", "description": "Without it, a session on a shared or lost device stays valid indefinitely." },
+  "BlockCountries": { "label": "Location restrictions", "description": "Without it, sign-ins are accepted from any country or network." }
+}
diff --git a/Config/SecuritySimulations/CAAnalysis/FociFamilies.json b/Config/SecuritySimulations/CAAnalysis/FociFamilies.json
new file mode 100644
index 0000000000000..a5f15b4f1d271
--- /dev/null
+++ b/Config/SecuritySimulations/CAAnalysis/FociFamilies.json
@@ -0,0 +1,47 @@
+[
+  { "appId": "1fec8e78-bce4-4aaf-ab1b-5451cc387264", "displayName": "Microsoft Teams" },
+  { "appId": "d3590ed6-52b3-4102-aeff-aad2292ab01c", "displayName": "Microsoft Office" },
+  { "appId": "27922004-5251-4030-b22d-91ecd9a37ea4", "displayName": "Outlook Mobile" },
+  { "appId": "4e291c71-d680-4d0e-9640-0a3358e31177", "displayName": "PowerApps" },
+  { "appId": "d326c1ce-6cc6-4de2-bebc-4591e5e13ef0", "displayName": "SharePoint" },
+  { "appId": "ab9b8c07-8f02-4f72-87fa-80105867a763", "displayName": "OneDrive SyncEngine" },
+  { "appId": "af124e86-4e96-495a-b70a-90f90ab96707", "displayName": "OneDrive iOS App" },
+  { "appId": "b26aadf8-566f-4478-926f-589f601d9c74", "displayName": "OneDrive" },
+  { "appId": "c0d2a505-13b8-4ae0-aa9e-cddd5eab0b12", "displayName": "Microsoft Power BI" },
+  { "appId": "4813382a-8fa7-425e-ab75-3b753aab3abb", "displayName": "Microsoft Authenticator App" },
+  { "appId": "0ec893e0-5785-4de6-99da-4ed124e5296c", "displayName": "Microsoft 365 Copilot" },
+  { "appId": "57fcbcfa-7cee-4eb1-8b25-12d2030b4ee0", "displayName": "Microsoft Flow Mobile" },
+  { "appId": "66375f6b-983f-4c2c-9701-d680650f588f", "displayName": "Microsoft Planner" },
+  { "appId": "9ba1a5c7-f17a-4de9-a1f1-6178c8d51223", "displayName": "Microsoft Intune Company Portal" },
+  { "appId": "22098786-6e16-43cc-a27d-191a01a1e3b5", "displayName": "Microsoft To-Do client" },
+  { "appId": "0922ef46-e1b9-4f7e-9134-9ad00547eb41", "displayName": "Loop" },
+  { "appId": "26a7ee05-5602-4d76-a7ba-eae8b7b67941", "displayName": "Windows Search" },
+  { "appId": "f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34", "displayName": "Microsoft Edge" },
+  { "appId": "e9c51622-460d-4d3d-952d-966a5b1da34c", "displayName": "Microsoft Edge" },
+  { "appId": "872cd9fa-d31f-45e0-9eab-6e460a02d1f1", "displayName": "Visual Studio - Legacy" },
+  { "appId": "cf36b471-5b44-428c-9ce7-313bf84528de", "displayName": "Microsoft Bing Search" },
+  { "appId": "844cca35-0656-46ce-b636-13f48b0eecbd", "displayName": "Microsoft Stream Mobile Native" },
+  { "appId": "87749df4-7ccf-48f8-aa87-704bad0e0e16", "displayName": "Microsoft Teams - Device Admin Agent" },
+  { "appId": "a569458c-7f2b-45cb-bab9-b7dee514d112", "displayName": "Yammer iPhone" },
+  { "appId": "e9cee14e-f26a-4349-886f-10048e3ef4b8", "displayName": "Yammer Android" },
+  { "appId": "b87b6fc6-536c-411d-9005-110ee6db77dc", "displayName": "Yammer iPad" },
+  { "appId": "c1c74fed-04c9-4704-80dc-9f79a2e515cb", "displayName": "Yammer Web" },
+  { "appId": "a40d7d7d-59aa-447e-a655-679a4107e548", "displayName": "Accounts Control UI" },
+  { "appId": "a670efe7-64b6-454f-9ae9-4f1cf27aba58", "displayName": "Microsoft Lists App on Android" },
+  { "appId": "540d4ff4-b4c0-44c1-bd06-cab1782d582a", "displayName": "ODSP Mobile Lists App" },
+  { "appId": "dd47d17a-3194-4d86-bfd5-c6ae6f5651e3", "displayName": "Microsoft Defender for Mobile" },
+  { "appId": "f05ff7c9-f75a-4acd-a3b5-f4b6a870245d", "displayName": "SharePoint Android" },
+  { "appId": "d7b530a4-7680-4c23-a8bf-c52c121d2e87", "displayName": "Microsoft Edge Enterprise New Tab Page" },
+  { "appId": "e9b154d0-7658-433b-bb25-6b8e0a8a7c59", "displayName": "Outlook Lite" },
+  { "appId": "cab96880-db5b-4e15-90a7-f3f1d62ffe39", "displayName": "Microsoft Defender Platform" },
+  { "appId": "be1918be-3fe3-4be9-b32b-b542fc27f02e", "displayName": "M365 Compliance Drive Client" },
+  { "appId": "8ec6bc83-69c8-4392-8f08-b3c986009232", "displayName": "Microsoft Teams-T4L" },
+  { "appId": "eb20f3e3-3dce-4d2c-b721-ebb8d4414067", "displayName": "Managed Meeting Rooms" },
+  { "appId": "14638111-3389-403d-b206-a6a71d9f8f16", "displayName": "Copilot App" },
+  { "appId": "038ddad9-5bbe-4f64-b0cd-12434d1e633b", "displayName": "ZTNA Network Access Client" },
+  { "appId": "760282b4-0cfc-4952-b467-c8e0298fee16", "displayName": "ZTNA Network Access Client -- Private" },
+  { "appId": "d5e23a82-d7e1-4886-af25-27037a0fdc2a", "displayName": "ZTNA Network Access Client -- M365" },
+  { "appId": "ca01d00c-bfd6-46d6-ae7d-be5b5267d037", "displayName": "ZTNA Policy Service Client" },
+  { "appId": "cde6adac-58fd-4b78-8d6d-9beaf1b0d668", "displayName": "Global Secure Access Client" },
+  { "appId": "00b41c95-dab0-4487-9791-b9d2c32c80f2", "displayName": "Office 365 Management" }
+]
diff --git a/Config/SecuritySimulations/CAAnalysis/MicrosoftGuidance.json b/Config/SecuritySimulations/CAAnalysis/MicrosoftGuidance.json
new file mode 100644
index 0000000000000..14890ed7a57d5
--- /dev/null
+++ b/Config/SecuritySimulations/CAAnalysis/MicrosoftGuidance.json
@@ -0,0 +1,173 @@
+[
+  {
+    "id": "TokenProtectionApps",
+    "title": "Token protection is applied to applications that do not support it",
+    "appliesWhen": "A policy turns on token protection.",
+    "requirement": "Token protection only works for Exchange Online, SharePoint Online, Teams, Azure Virtual Desktop, Windows 365 and Windows Cloud Login. Applying it more widely, including through the Office 365 application group, locks people out of tools that cannot support it.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/identity/conditional-access/concept-token-protection#deployment",
+    "remediation": "Limit the token-protection policy to the individual services that support it rather than a broad selection or the Office 365 application group."
+  },
+  {
+    "id": "TokenProtectionPlatforms",
+    "title": "Token protection is applied beyond Windows desktop apps",
+    "appliesWhen": "A policy turns on token protection.",
+    "requirement": "Token protection works only on Windows devices and only for desktop and mobile apps. Applying it to other platforms or to web browsers locks out people who cannot meet it.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/identity/conditional-access/concept-token-protection#deployment",
+    "remediation": "Limit the token-protection policy to Windows devices and to desktop and mobile apps, and leave web browsers out of scope."
+  },
+  {
+    "id": "TokenProtectionDevices",
+    "title": "Token protection does not exempt devices that cannot support it",
+    "appliesWhen": "A policy turns on token protection.",
+    "requirement": "Several device types cannot support token protection, including Surface Hub, Teams Rooms, Cloud PCs, virtual desktop hosts, self-deploying and bulk-enrolled devices and Azure virtual machines. Unless they are exempt, they are locked out.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/identity/conditional-access/concept-token-protection#known-limitations",
+    "remediation": "Exempt the unsupported device types from the token-protection policy through a device filter so they keep working."
+  },
+  {
+    "id": "BreakGlassMissing",
+    "title": "Tenant-wide policy has no emergency-access exemption",
+    "appliesWhen": "A policy that applies to every user requires multifactor authentication, blocks access, or requires a managed device.",
+    "requirement": "A policy that applies to every user should always exempt at least two emergency-access accounts, so that a mistake in the policy or a service outage cannot lock the whole organization out.",
+    "severity": "critical",
+    "docUrl": "https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access",
+    "remediation": "Exempt two dedicated emergency-access accounts from this policy and alert on any sign-in by them."
+  },
+  {
+    "id": "SurfaceHubMfa",
+    "title": "Surface Hub meeting rooms cannot meet this policy",
+    "appliesWhen": "A policy that applies to every user and every application asks for multifactor authentication, a managed device, an approved app or app protection.",
+    "requirement": "Surface Hub room accounts cannot complete multifactor authentication or meet device, app or password-change requirements. When a policy that applies to every user asks for any of these, the rooms stop signing in.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/surface-hub/conditional-access-for-surface-hub",
+    "remediation": "Exempt the Surface Hub room accounts, or a group containing them, from this policy."
+  },
+  {
+    "id": "TeamsRoomsMfa",
+    "title": "Teams Rooms devices cannot meet this policy",
+    "appliesWhen": "A policy that applies to every user and every application requires multifactor authentication or an authentication strength.",
+    "requirement": "Teams Rooms on Windows cannot complete multifactor authentication and Android room devices cannot meet an authentication strength. When a policy that applies to every user asks for these, the rooms stop signing in.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/microsoftteams/rooms/supported-ca-and-compliance-policies",
+    "remediation": "Exempt the Teams Rooms accounts from multifactor requirements and protect them with a managed-device requirement instead."
+  },
+  {
+    "id": "DeviceCodeTeamsDevices",
+    "title": "Blocking device-code sign-in breaks Teams device setup",
+    "appliesWhen": "A policy blocks the device-code sign-in flow.",
+    "requirement": "Teams phones, panels and Android room devices are signed in remotely through the device-code flow. Blocking that flow for everyone prevents these devices from being set up.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/microsoftteams/rooms/supported-ca-and-compliance-policies",
+    "remediation": "Exempt the Teams device accounts from the device-code block, or limit the block so it does not apply to Teams devices."
+  },
+  {
+    "id": "SignInFrequencyTeamsRooms",
+    "title": "Sign-in frequency signs Teams Rooms devices out",
+    "appliesWhen": "A policy that applies to every user and every application sets a sign-in frequency.",
+    "requirement": "Teams Rooms, phones and panels cannot handle a sign-in frequency. Applying one to every user makes these devices sign out periodically and disrupts meetings.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/microsoftteams/rooms/supported-ca-and-compliance-policies",
+    "remediation": "Exempt the Teams Rooms and shared-device accounts from the sign-in frequency, or apply it to administrator roles only."
+  },
+  {
+    "id": "DefenderMobileApps",
+    "title": "Defender mobile apps are caught by a blocking policy",
+    "appliesWhen": "A blocking policy covers every user and every application without exempting the Microsoft Defender mobile apps.",
+    "requirement": "The Microsoft Defender mobile app reports device health in the background. A blocking policy that covers every application can stop those reports, and devices then appear non-compliant for no real reason.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/defender-endpoint/mobile-resources-defender-endpoint#microsoft-defender-mobile-app-exclusion-from-conditional-access-ca-policies",
+    "remediation": "Exempt the two Microsoft Defender mobile applications from this policy so device health reporting keeps working."
+  },
+  {
+    "id": "AzureVmSignInMfa",
+    "title": "Remote desktop to Azure virtual machines may not meet this policy",
+    "appliesWhen": "A policy that applies to every user and every application requires multifactor authentication or a managed device without exempting virtual machine sign-in.",
+    "requirement": "Remote desktop sign-ins to Azure virtual machines can only satisfy a multifactor requirement from a device that supports Windows Hello for Business or a security key, and Windows Server devices can never count as compliant. Without an exemption, administrators may be unable to connect.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/entra/identity/devices/howto-vm-sign-in-azure-ad-windows#missing-application",
+    "remediation": "Exempt the Azure virtual machine sign-in application from multifactor and device requirements unless every administrator connects with Windows Hello for Business or a security key."
+  },
+  {
+    "id": "ContinuousAccessEvaluationDisabled",
+    "title": "Continuous access evaluation is switched off",
+    "appliesWhen": "A policy switches continuous access evaluation off.",
+    "requirement": "Continuous access evaluation ends a session the moment an account is disabled, its password changes or its location changes. With it switched off, sessions stay valid for up to an hour after such an event.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/identity/conditional-access/concept-continuous-access-evaluation",
+    "remediation": "Keep continuous access evaluation switched on unless a specific problem with it has been confirmed."
+  },
+  {
+    "id": "SignInFrequencyIndividualServices",
+    "title": "Sign-in frequency on individual services breaks Teams devices",
+    "appliesWhen": "A policy sets a sign-in frequency on individual Microsoft 365 services rather than on all applications.",
+    "requirement": "A sign-in frequency applied to individual Microsoft 365 services rather than all applications can interrupt or stop the Teams device sign-in flow and is not supported by Microsoft.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/microsoftteams/rooms/supported-ca-and-compliance-policies",
+    "remediation": "Apply the sign-in frequency to all applications or to the Microsoft admin portals rather than to individual services."
+  },
+  {
+    "id": "ResilienceDefaultsDisabled",
+    "title": "Users lose access during a Microsoft outage",
+    "appliesWhen": "A policy switches resilience defaults off.",
+    "requirement": "With resilience defaults switched off, anyone whose session expires during a Microsoft sign-in service outage is denied access until the service recovers.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/entra/identity/conditional-access/resilience-defaults",
+    "remediation": "Keep resilience defaults switched on unless strict real-time evaluation is a firm requirement."
+  },
+  {
+    "id": "AllResourcesAppExclusion",
+    "title": "Basic directory permissions need their own coverage",
+    "appliesWhen": "A policy covers every application but exempts some.",
+    "requirement": "Microsoft used to exempt basic profile and directory permissions from a tenant-wide policy that had any application exemption. That exemption has been removed and those permissions are now enforced through the directory service itself, so a policy should cover that service to keep the baseline intact.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-cloud-apps#conditional-access-behavior-when-an-all-resources-policy-has-an-app-exclusion",
+    "remediation": "Cover the directory service with a policy that requires multifactor authentication from all users, so basic permissions stay protected even where other applications are exempt."
+  },
+  {
+    "id": "DirectorySyncAccountMfa",
+    "title": "Directory synchronization exemption may no longer be needed",
+    "appliesWhen": "A multifactor policy for every user exempts the directory synchronization role.",
+    "requirement": "The synchronization account used to be exempt from multifactor requirements because it could not perform them. Recent versions of Entra Connect let the synchronization service sign in as an application instead, which removes the need for the exemption.",
+    "severity": "medium",
+    "docUrl": "https://learn.microsoft.com/entra/identity/hybrid/connect/reference-connect-version-history",
+    "remediation": "Upgrade Entra Connect to a version that supports application-based sign-in, switch to it, and remove the synchronization role exemption from multifactor policies."
+  },
+  {
+    "id": "ExternalAuthMethodGuests",
+    "title": "External authentication provider may block guests and partners",
+    "appliesWhen": "A policy for every user or for administrators relies on an external authentication provider.",
+    "requirement": "When a policy requires an external authentication provider such as Duo or RSA, guests, partners and service providers cannot meet it because they are not enrolled with that provider. They are locked out even though Microsoft's own multifactor authentication would have been enough.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/identity/authentication/how-to-authentication-external-method-manage",
+    "remediation": "Limit the external-provider requirement to internal users enrolled with it, and let guests and partners meet the policy with Microsoft's own multifactor authentication."
+  },
+  {
+    "id": "ApprovedClientAppRetirement",
+    "title": "Approved-client-app requirement is being retired",
+    "appliesWhen": "A policy relies on the approved-client-app requirement.",
+    "requirement": "Microsoft is retiring the approved-client-app requirement. Policies that rely on it must move to the app protection policy requirement, or accept either of the two, to keep protecting data in mobile apps.",
+    "severity": "critical",
+    "docUrl": "https://learn.microsoft.com/entra/identity/conditional-access/migrate-approved-client-app",
+    "remediation": "Replace the approved-client-app requirement with the app protection policy requirement, accepting either during the transition if needed."
+  },
+  {
+    "id": "UserRiskPasswordChangeRetired",
+    "title": "Risky users are asked for a password change that not everyone can complete",
+    "appliesWhen": "A user risk policy relies on the password-change requirement.",
+    "requirement": "The password-change requirement for risky users has been retired. People who sign in without a password cannot complete it and stay locked out once flagged. The newer risk-remediation requirement chooses the right recovery path for each person.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/id-protection/concept-identity-protection-policies",
+    "remediation": "Replace the password-change requirement with the risk-remediation requirement."
+  },
+  {
+    "id": "UserRiskRemediationExternalProvider",
+    "title": "Risk remediation cannot be completed by users of an external provider",
+    "appliesWhen": "A user risk policy pairs risk remediation with an authentication strength.",
+    "requirement": "When risk remediation is paired with an authentication strength, people who use an external provider such as Duo, Okta or Ping cannot complete it, because authentication strengths do not accept external providers. Without a companion policy that accepts plain multifactor authentication for them, they stay locked out.",
+    "severity": "high",
+    "docUrl": "https://learn.microsoft.com/entra/id-protection/concept-identity-protection-policies",
+    "remediation": "Add a companion risk policy for the users of the external provider that requires plain multifactor authentication together with risk remediation, and keep the stronger requirement for everyone else."
+  }
+]
diff --git a/Config/SecuritySimulations/CAAnalysis/Reference.json b/Config/SecuritySimulations/CAAnalysis/Reference.json
new file mode 100644
index 0000000000000..a57fda0a8dfe1
--- /dev/null
+++ b/Config/SecuritySimulations/CAAnalysis/Reference.json
@@ -0,0 +1,93 @@
+{
+  "registerDeviceAction": "urn:user:registerdevice",
+  "registerSecurityInfoAction": "urn:user:registersecurityinfo",
+  "windowsAzureAdResource": "00000002-0000-0000-c000-000000000000",
+  "legacyMfaTrustedIpsLocation": "00000000-0000-0000-0000-000000000000",
+  "directorySyncRoleTemplateId": "d29b2b05-8046-44ba-8758-1e26182fcf32",
+  "equivalentStrengthGroups": {
+    "compliantDevice": "DeviceTrust",
+    "domainJoinedDevice": "DeviceTrust",
+    "approvedApplication": "AppProtection",
+    "compliantApplication": "AppProtection"
+  },
+  "grantControlLabels": {
+    "mfa": "multifactor authentication",
+    "compliantDevice": "a compliant device",
+    "domainJoinedDevice": "a Microsoft Entra hybrid joined device",
+    "approvedApplication": "an approved client app",
+    "compliantApplication": "an app protection policy",
+    "passwordChange": "a password change"
+  },
+  "guestTypeLabels": {
+    "internalGuest": "Internal guest users",
+    "b2bCollaborationGuest": "Collaboration guests",
+    "b2bCollaborationMember": "Collaboration members",
+    "b2bDirectConnectUser": "Direct connect users",
+    "otherExternalUser": "Other external users",
+    "serviceProvider": "Service provider users"
+  },
+  "guestTypeOrder": ["internalGuest", "b2bCollaborationGuest", "b2bCollaborationMember", "b2bDirectConnectUser", "otherExternalUser", "serviceProvider"],
+  "managedPolicyPatterns": [
+    { "keyword": "block legacy authentication" },
+    { "keyword": "block device code flow" },
+    { "keyword": "multifactor authentication for admins" },
+    { "keyword": "multifactor authentication for all users" },
+    { "keyword": "multifactor authentication for per-user" },
+    { "keyword": "reauthentication for risky sign-ins" },
+    { "keyword": "block access for high-risk users" },
+    { "keyword": "block all high risk agents" }
+  ],
+  "phishingResistant": {
+    "builtInStrengthId": "00000000-0000-0000-0000-000000000004",
+    "methodTokens": ["fido2", "windowshelloforbusiness", "x509certificatemultifactor", "x509certificatesinglefactor", "deviceboundpasskey", "hardwareoath"],
+    "nameRegex": "phishing.?resistant|fido2|windows hello|certificate.?based",
+    "policyNameRegex": "phishing.?resistant"
+  },
+  "servicePlanIds": {
+    "entraIdP1": "41781fb2-bc02-4b7c-bd55-b576c07bb09d",
+    "entraIdP2": "eec0eb4f-6444-4f95-aba0-50c24d67f998",
+    "intunePlan1": "c1ec4a95-1f05-45b3-a911-aa3fa01094f5",
+    "workloadIdPremiumP1": "84c289f0-efcb-486f-8581-07f44fc9efad",
+    "workloadIdPremiumP2": "7dc0e92d-bf15-401d-907e-0884efe7c760"
+  },
+  "guidanceAppIds": {
+    "exchangeOnline": "00000002-0000-0ff1-ce00-000000000000",
+    "sharePointOnline": "00000003-0000-0ff1-ce00-000000000000",
+    "teamsService": "cc15fd57-2c6c-4117-a88c-83b1d56b4bbe",
+    "office365Group": "Office365",
+    "azureVirtualDesktop": "9cdead84-a844-4324-93f2-b2e6bb768d07",
+    "windows365": "0af06dc6-e4b5-4f28-818e-e78e62d137a5",
+    "defenderAtpXplat": "a0e84e36-b067-4d5c-ab4a-3db38e598ae2",
+    "defenderTvm": "e724aa31-0f56-4018-b8be-f8cb82ca1196",
+    "windowsCloudLogin": "372140e0-b3b7-4226-8ef9-d57986796201"
+  },
+  "tokenProtectionDeviceFilterPatterns": [
+    { "pattern": "cloudpc", "label": "Cloud PCs" },
+    { "pattern": "azurevirtualdesktop", "label": "Azure Virtual Desktop" },
+    { "pattern": "powerapautomate", "label": "Power Automate hosted machines" },
+    { "pattern": "autopilot", "label": "Autopilot self-deploying devices" },
+    { "pattern": "securevm", "label": "Azure virtual machines" }
+  ],
+  "templates": {
+    "mfaAllUsers": "Require multifactor authentication for all users",
+    "mfaAllAdmins": "Require multifactor authentication for administrators",
+    "mfaGuests": "Require multifactor authentication for guest access",
+    "mfaB2BGuest": "Require multifactor authentication for guest access",
+    "mfaMixedGuests": "Require multifactor authentication for guest access",
+    "phishingResistantAdmins": "Require phishing-resistant multifactor authentication for administrators",
+    "registerSecurityInfo": "Secure security information registration",
+    "signInRisk": "Require multifactor authentication for medium and high sign-in risk",
+    "userRisk": "Require a secure password change for high user risk",
+    "blockCountries": "Block sign-ins from countries outside the allowed list",
+    "blockLegacyAuth": "Block legacy authentication",
+    "blockUnsupportedPlatforms": "Block unsupported device platforms",
+    "blockDeviceCode": "Block device code flow sign-ins",
+    "blockHighRiskUsers": "Block high-risk users",
+    "blockHighRiskSignIns": "Block high-risk sign-ins",
+    "windowsAzureAdBaselineScopes": "Require multifactor authentication for basic directory access",
+    "riskRemediationHigh": "Require risk remediation for high user risk",
+    "riskRemediationEam": "Require risk remediation for external authentication method users",
+    "appProtectionMobile": "Require an approved client app or app protection policy on mobile",
+    "requireCompliantDevice": "Require a compliant or Microsoft Entra hybrid joined device"
+  }
+}
diff --git a/Config/SecuritySimulations/CASituations.json b/Config/SecuritySimulations/CASituations.json
new file mode 100644
index 0000000000000..0808686edaace
--- /dev/null
+++ b/Config/SecuritySimulations/CASituations.json
@@ -0,0 +1,265 @@
+[
+  {
+    "id": "AdminUnmanagedDevice",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · unmanaged device · known location",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No compliant-device requirement for administrators", "fix": { "caTemplate": "Require a compliant device for administrators" } }
+  },
+  {
+    "id": "AdminForeignCountry",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · sign-in from a foreign country",
+    "countryFromSelection": true,
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "country": "RU", "ipAddress": "45.132.1.20" },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No location policy for administrators", "fix": { "caTemplate": "Block sign-ins from countries outside the allowed list" } }
+  },
+  {
+    "id": "AdminHostingIp",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · sign-in from a hosting-provider address",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "country": "US", "ipAddress": "104.244.72.115" },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "Admin sign-ins from hosting-provider addresses are not blocked", "fix": { "caTemplate": "Block sign-ins from hosting-provider IP ranges" } }
+  },
+  {
+    "id": "AdminDeviceCode",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · device-code flow",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "authenticationFlow": { "transferMethod": "deviceCodeFlow" } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "Device code flow is not blocked for administrators", "fix": { "caTemplate": "Block device code flow sign-ins" } }
+  },
+  {
+    "id": "AdminLegacyAuth",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · legacy authentication client",
+    "conditions": { "clientAppType": "other", "devicePlatform": "windows" },
+    "attackerCanSatisfy": [],
+    "expected": "blocked",
+    "missingControl": { "text": "Legacy authentication is not blocked", "fix": { "caTemplate": "Block legacy authentication" } }
+  },
+  {
+    "id": "AdminHighSignInRisk",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · high sign-in risk",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "signInRiskLevel": "high" },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No sign-in risk policy for administrators", "fix": { "caTemplate": "Require multifactor authentication for medium and high sign-in risk" } }
+  },
+  {
+    "id": "AdminMacOsUnmanaged",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · unmanaged macOS device",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "macOS", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No compliant-device requirement for administrators", "fix": { "caTemplate": "Require a compliant device for administrators" } }
+  },
+  {
+    "id": "AdminDesktopClientUnmanaged",
+    "group": "Admin accounts",
+    "persona": "admin",
+    "title": "Global Admin · desktop client · unmanaged device",
+    "conditions": { "clientAppType": "mobileAppsAndDesktopClients", "devicePlatform": "windows", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No compliant-device requirement for administrators", "fix": { "caTemplate": "Require a compliant device for administrators" } }
+  },
+  {
+    "id": "UserUnmanagedDevice",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · unmanaged device · browser",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "mfa",
+    "missingControl": { "text": "No compliant-device requirement for standard users", "fix": { "caTemplate": "Require a compliant or Microsoft Entra hybrid joined device" } }
+  },
+  {
+    "id": "UserForeignCountry",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · sign-in from a foreign country",
+    "countryFromSelection": true,
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "country": "CN", "ipAddress": "223.5.5.5" },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No location policy for standard users", "fix": { "caTemplate": "Block sign-ins from countries outside the allowed list" } }
+  },
+  {
+    "id": "UserDeviceCode",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · device-code flow",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "authenticationFlow": { "transferMethod": "deviceCodeFlow" } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "Device code flow is not blocked", "fix": { "caTemplate": "Block device code flow sign-ins" } }
+  },
+  {
+    "id": "UserLegacyActiveSync",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · legacy Exchange ActiveSync",
+    "conditions": { "clientAppType": "exchangeActiveSync", "devicePlatform": "android" },
+    "attackerCanSatisfy": [],
+    "expected": "blocked",
+    "missingControl": { "text": "Legacy authentication is not blocked", "fix": { "caTemplate": "Block legacy authentication" } }
+  },
+  {
+    "id": "UserLegacyOther",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · other legacy client",
+    "conditions": { "clientAppType": "other", "devicePlatform": "windows" },
+    "attackerCanSatisfy": [],
+    "expected": "blocked",
+    "missingControl": { "text": "Legacy authentication is not blocked", "fix": { "caTemplate": "Block legacy authentication" } }
+  },
+  {
+    "id": "UserHighSignInRisk",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · high sign-in risk",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "signInRiskLevel": "high" },
+    "attackerCanSatisfy": [],
+    "expected": "blocked",
+    "missingControl": { "text": "No sign-in risk policy", "fix": { "caTemplate": "Require multifactor authentication for medium and high sign-in risk" } }
+  },
+  {
+    "id": "UserHighUserRisk",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · high user risk",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "userRiskLevel": "high" },
+    "attackerCanSatisfy": [],
+    "expected": "blocked",
+    "missingControl": { "text": "No user risk policy", "fix": { "caTemplate": "Require a secure password change for high user risk" } }
+  },
+  {
+    "id": "UserElevatedInsiderRisk",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · elevated insider risk",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "insiderRiskLevel": "elevated" },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No insider-risk policy", "fix": { "caTemplate": "Limit access for elevated insider risk" } }
+  },
+  {
+    "id": "UserAndroidUnmanaged",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · unmanaged Android device",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "android", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "mfa",
+    "missingControl": { "text": "No app protection or compliant-device requirement on mobile", "fix": { "caTemplate": "Require an approved client app or app protection policy on mobile" } }
+  },
+  {
+    "id": "UserIosUnmanaged",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · unmanaged iOS device",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "iOS", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "mfa",
+    "missingControl": { "text": "No app protection or compliant-device requirement on mobile", "fix": { "caTemplate": "Require an approved client app or app protection policy on mobile" } }
+  },
+  {
+    "id": "UserDesktopClientUnmanaged",
+    "group": "Standard users",
+    "persona": "user",
+    "title": "Standard user · desktop client · unmanaged device",
+    "conditions": { "clientAppType": "mobileAppsAndDesktopClients", "devicePlatform": "windows", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "mfa",
+    "missingControl": { "text": "No compliant-device requirement for standard users", "fix": { "caTemplate": "Require a compliant or Microsoft Entra hybrid joined device" } }
+  },
+  {
+    "id": "GuestBrowserAccess",
+    "group": "Guests",
+    "persona": "guest",
+    "title": "Guest · browser access · known location",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows" },
+    "attackerCanSatisfy": [],
+    "expected": "mfa",
+    "missingControl": { "text": "Guest access does not require MFA", "fix": { "caTemplate": "Require multifactor authentication for guest access" } }
+  },
+  {
+    "id": "GuestForeignCountry",
+    "group": "Guests",
+    "persona": "guest",
+    "title": "Guest · sign-in from a foreign country",
+    "countryFromSelection": true,
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "country": "RU", "ipAddress": "45.132.1.20" },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "No location policy for guests", "fix": { "caTemplate": "Block sign-ins from countries outside the allowed list" } }
+  },
+  {
+    "id": "GuestLegacyAuth",
+    "group": "Guests",
+    "persona": "guest",
+    "title": "Guest · legacy authentication client",
+    "conditions": { "clientAppType": "other", "devicePlatform": "windows" },
+    "attackerCanSatisfy": [],
+    "expected": "blocked",
+    "missingControl": { "text": "Legacy authentication is not blocked", "fix": { "caTemplate": "Block legacy authentication" } }
+  },
+  {
+    "id": "GuestUnmanagedDevice",
+    "group": "Guests",
+    "persona": "guest",
+    "title": "Guest · unmanaged device · browser",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "deviceInfo": { "isCompliant": false } },
+    "attackerCanSatisfy": [],
+    "expected": "mfa",
+    "missingControl": { "text": "Guest access does not require MFA or a compliant device", "fix": { "caTemplate": "Require multifactor authentication for guest access" } }
+  },
+  {
+    "id": "GuestDeviceCode",
+    "group": "Guests",
+    "persona": "guest",
+    "title": "Guest · device-code flow",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "authenticationFlow": { "transferMethod": "deviceCodeFlow" } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "Device code flow is not blocked", "fix": { "caTemplate": "Block device code flow sign-ins" } }
+  },
+  {
+    "id": "GuestHighSignInRisk",
+    "group": "Guests",
+    "persona": "guest",
+    "title": "Guest · high sign-in risk",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "signInRiskLevel": "high" },
+    "attackerCanSatisfy": [],
+    "expected": "blocked",
+    "missingControl": { "text": "No sign-in risk policy for guests", "fix": { "caTemplate": "Require multifactor authentication for medium and high sign-in risk" } }
+  },
+  {
+    "id": "GuestAuthTransfer",
+    "group": "Guests",
+    "persona": "guest",
+    "title": "Guest · authentication transfer",
+    "conditions": { "clientAppType": "browser", "devicePlatform": "windows", "authenticationFlow": { "transferMethod": "authenticationTransfer" } },
+    "attackerCanSatisfy": ["mfa"],
+    "expected": "blocked",
+    "missingControl": { "text": "Authentication transfer is not blocked", "fix": { "caTemplate": "Block authentication transfer" } }
+  }
+]
diff --git a/Config/SharePoint.BPATemplate.json b/Config/SharePoint.BPATemplate.json
deleted file mode 100644
index fd279d368fdac..0000000000000
--- a/Config/SharePoint.BPATemplate.json
+++ /dev/null
@@ -1,70 +0,0 @@
-{
-  "name": "CIPP SharePoint Report v1.0 - Table view",
-  "style": "Table",
-  "Fields": [
-    {
-      "name": "SharepointSettings",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/admin/sharepoint/settings",
-      "Parameters": {
-        "asApp": "True"
-      },
-      "ExtractFields": [
-        "sharingCapability",
-        "isMacSyncAppEnabled",
-        "isResharingByExternalUsersEnabled",
-        "isUnmanagedSyncAppForTenantRestricted",
-        "isSiteCreationEnabled",
-        "deletedUserPersonalSiteRetentionPeriodInDays"
-      ],
-      "StoreAs": "JSON",
-      "FrontendFields": [
-        {
-          "name": "Sharing capability",
-          "value": "SharepointSettings.sharingCapability",
-          "formatter": "string"
-        },
-        {
-          "name": "Mac Sync Enabled",
-          "value": "SharepointSettings.isMacSyncAppEnabled",
-          "formatter": "warnBool"
-        },
-        {
-          "name": "Resharing by external users",
-          "value": "SharepointSettings.isResharingByExternalUsersEnabled",
-          "formatter": "bool"
-        },
-        {
-          "name": "Allow users to sync from unmanaged devices",
-          "value": "SharepointSettings.isUnmanagedSyncAppForTenantRestricted",
-          "formatter": "reverseBool"
-        },
-        {
-          "name": "Site creation by standard users enabled",
-          "value": "SharepointSettings.isSiteCreationEnabled",
-          "formatter": "bool"
-        },
-        {
-          "name": "Deleted user data rention(days)",
-          "value": "SharepointSettings.deletedUserPersonalSiteRetentionPeriodInDays",
-          "formatter": "string"
-        }
-      ]
-    },
-    {
-      "name": "WebtimeOut",
-      "API": "Graph",
-      "URL": "https://graph.microsoft.com/beta/policies/activityBasedTimeoutPolicies",
-      "ExtractFields": ["definition"],
-      "StoreAs": "bool",
-      "where": "$_.definition -like '*WebSessionIdleTimeout*'",
-      "FrontendFields": [
-        {
-          "name": "Web Time-Out enabled",
-          "value": "WebtimeOut",
-          "formatter": "bool"
-        }
-      ]
-    }
-  ]
-}
diff --git a/Config/StandardsTable.BPATemplate.json b/Config/StandardsTable.BPATemplate.json
deleted file mode 100644
index 858b1b462fca1..0000000000000
--- a/Config/StandardsTable.BPATemplate.json
+++ /dev/null
@@ -1,534 +0,0 @@
-{
-  "name": "CIPP Standards v1.0 - Table view",
-  "style": "Table",
-  "Fields": [
-    {
-      "name": "ActivityBasedTimeout",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "ActivityBasedTimeout",
-          "value": "ActivityBasedTimeout"
-        }
-      ]
-    },
-    {
-      "name": "softwareOath",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "softwareOath",
-          "value": "softwareOath"
-        }
-      ]
-    },
-    {
-      "name": "MSAuthenticator",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "MSAuthenticator",
-          "value": "MSAuthenticator"
-        }
-      ]
-    },
-    {
-      "name": "AnonReport",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "AnonReport",
-          "value": "AnonReport"
-        }
-      ]
-    },
-    {
-      "name": "AuditLog",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "AuditLog",
-          "value": "AuditLog"
-        }
-      ]
-    },
-    {
-      "name": "AutoExpandingArchive",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "AutoExpandingArchive",
-          "value": "AutoExpandingArchive"
-        }
-      ]
-    },
-    {
-      "name": "DelegateSentItems",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "DelegateSentItems",
-          "value": "DelegateSentItems"
-        }
-      ]
-    },
-    {
-      "name": "DeletedUserRentention",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DeletedUserRentention",
-          "value": "DeletedUserRentention"
-        }
-      ]
-    },
-    {
-      "name": "DisableBasicAuthSMTP",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableBasicAuthSMTP",
-          "value": "DisableBasicAuthSMTP"
-        }
-      ]
-    },
-    {
-      "name": "DisableGuestDirectory",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableGuestDirectory",
-          "value": "DisableGuestDirectory"
-        }
-      ]
-    },
-    {
-      "name": "DisableGuests",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "DisableGuests",
-          "value": "DisableGuests"
-        }
-      ]
-    },
-    {
-      "name": "DisableM365GroupUsers",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableM365GroupUsers",
-          "value": "DisableM365GroupUsers"
-        }
-      ]
-    },
-    {
-      "name": "MacSync",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "MacSync",
-          "value": "MacSync"
-        }
-      ]
-    },
-    {
-      "name": "DisableReshare",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableReshare",
-          "value": "DisableReshare"
-        }
-      ]
-    },
-    {
-      "name": "DisableSecurityGroupUsers",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableSecurityGroupUsers",
-          "value": "DisableSecurityGroupUsers"
-        }
-      ]
-    },
-    {
-      "name": "DisableSharedMailbox",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "DisableSharedMailbox",
-          "value": "DisableSharedMailbox"
-        }
-      ]
-    },
-    {
-      "name": "DisableTenantCreation",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableTenantCreation",
-          "value": "DisableTenantCreation"
-        }
-      ]
-    },
-    {
-      "name": "DisableUserSiteCreate",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableUserSiteCreate",
-          "value": "DisableUserSiteCreate"
-        }
-      ]
-    },
-    {
-      "name": "DisableViva",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "DisableViva",
-          "value": "DisableViva"
-        }
-      ]
-    },
-    {
-      "name": "EnableAppConsentAdminRequests",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "EnableAppConsentAdminRequests",
-          "value": "EnableAppConsentAdminRequests"
-        }
-      ]
-    },
-    {
-      "name": "EnableFIDO2",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "EnableFIDO2",
-          "value": "EnableFIDO2"
-        }
-      ]
-    },
-    {
-      "name": "EnableOnlineArchiving",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "EnableOnlineArchiving",
-          "value": "EnableOnlineArchiving"
-        }
-      ]
-    },
-    {
-      "name": "ExcludedfileExt",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "ExcludedfileExt",
-          "value": "ExcludedfileExt"
-        }
-      ]
-    },
-    {
-      "name": "intuneDeviceReg",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "intuneDeviceReg",
-          "value": "intuneDeviceReg"
-        }
-      ]
-    },
-    {
-      "name": "intuneDeviceRetirementDays",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "intuneDeviceRetirementDays",
-          "value": "intuneDeviceRetirementDays"
-        }
-      ]
-    },
-    {
-      "name": "intuneRequireMFA",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "intuneRequireMFA",
-          "value": "intuneRequireMFA"
-        }
-      ]
-    },
-    {
-      "name": "laps",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "laps",
-          "value": "laps"
-        }
-      ]
-    },
-    {
-      "name": "MailContacts",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "MailContacts",
-          "value": "MailContacts"
-        }
-      ]
-    },
-    {
-      "name": "NudgeMFA",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "NudgeMFA",
-          "value": "NudgeMFA"
-        }
-      ]
-    },
-    {
-      "name": "OauthConsent",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "OauthConsent",
-          "value": "OauthConsent"
-        }
-      ]
-    },
-    {
-      "name": "OauthConsentLowSec",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "OauthConsentLowSec",
-          "value": "OauthConsentLowSec"
-        }
-      ]
-    },
-    {
-      "name": "OutboundSpamAlert",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "OutboundSpamAlert",
-          "value": "OutboundSpamAlert"
-        }
-      ]
-    },
-    {
-      "name": "PasswordExpireDisabled",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "PasswordExpireDisabled",
-          "value": "PasswordExpireDisabled"
-        }
-      ]
-    },
-    {
-      "name": "companionAppAllowedState",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "companionAppAllowedState",
-          "value": "companionAppAllowedState"
-        }
-      ]
-    },
-    {
-      "name": "PWdisplayAppInformationRequiredState",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "PWdisplayAppInformationRequiredState",
-          "value": "PWdisplayAppInformationRequiredState"
-        }
-      ]
-    },
-    {
-      "name": "DKIM",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "DKIM",
-          "value": "DKIM"
-        }
-      ]
-    },
-    {
-      "name": "SecurityDefaults",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "warnBool",
-          "name": "SecurityDefaults",
-          "value": "SecurityDefaults"
-        }
-      ]
-    },
-    {
-      "name": "SendFromAlias",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "bool",
-          "name": "SendFromAlias",
-          "value": "SendFromAlias"
-        }
-      ]
-    },
-    {
-      "name": "SendReceiveLimit",
-      "StoreAs": "json",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "table",
-          "name": "SendReceiveLimit",
-          "value": "SendReceiveLimit"
-        }
-      ]
-    },
-    {
-      "name": "sharingCapability",
-      "StoreAs": "string",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "string",
-          "name": "sharingCapability",
-          "value": "sharingCapability"
-        }
-      ]
-    },
-    {
-      "name": "SpoofingWarnings",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "warnBool",
-          "name": "SpoofingWarnings",
-          "value": "SpoofingWarnings"
-        }
-      ]
-    },
-    {
-      "name": "TemporaryAccessPass",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "warnBool",
-          "name": "TemporaryAccessPass",
-          "value": "TemporaryAccessPass"
-        }
-      ]
-    },
-    {
-      "name": "unmanagedSync",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "warnBool",
-          "name": "unmanagedSync",
-          "value": "unmanagedSync"
-        }
-      ]
-    },
-    {
-      "name": "UserSubmissionPolicy",
-      "StoreAs": "bool",
-      "UseExistingInfo": true,
-      "FrontendFields": [
-        {
-          "formatter": "warnBool",
-          "name": "UserSubmissionPolicy",
-          "value": "UserSubmissionPolicy"
-        }
-      ]
-    }
-  ]
-}
diff --git a/Config/openapi.json b/Config/openapi.json
index 7a37660c66dad..ce905e786a5c4 100644
--- a/Config/openapi.json
+++ b/Config/openapi.json
@@ -123,6 +123,9 @@
     {
       "name": "Tenant > Administration > Tenant"
     },
+    {
+      "name": "Tenant > AI"
+    },
     {
       "name": "Tenant > Conditional"
     },
@@ -132,6 +135,9 @@
     {
       "name": "Tenant > Reports"
     },
+    {
+      "name": "Tenant > SecuritySimulations"
+    },
     {
       "name": "Tenant > Standards"
     },
@@ -251,6 +257,13 @@
                   "AlertComment": {
                     "type": "string"
                   },
+                  "becActions": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/LabelValue"
+                    },
+                    "description": "Which containment actions the 'becremediate' action runs (ListBECRemediationActions ids); empty = the default six."
+                  },
                   "conditions": {
                     "type": "array",
                     "items": {
@@ -701,6 +714,10 @@
                   "description": {
                     "type": "string"
                   },
+                  "disableAlerts": {
+                    "type": "boolean",
+                    "description": "'Disable Alerts': deviations are still detected and shown, but no email, webhook or PSA notification fires for this baseline. Negative flag on purpose: rows saved before the column existed keep alerting, exactly right."
+                  },
                   "disableScheduledRuns": {
                     "type": "boolean",
                     "description": "'Disable Scheduled Runs': the baseline only executes when an operator runs it. Negative flag on purpose: rows saved before the column existed default to scheduled, exactly right."
@@ -712,6 +729,18 @@
                     },
                     "description": "The editor round-trips the tenant selector's own option objects ({label, value, type}) verbatim via assignedTo/excludedTo; the flat excludedTenants values keep the exclusion logic simple. Raw string values are accepted everywhere too."
                   },
+                  "GitHub": {
+                    "type": "object",
+                    "properties": {
+                      "FullName": {
+                        "type": "string"
+                      },
+                      "Message": {
+                        "type": "string"
+                      }
+                    },
+                    "description": "Optional. Pushes the saved baseline to a GitHub template repository after the save: FullName is the repository (owner/repo), Message is the commit message. Not stored on the baseline."
+                  },
                   "GUID": {
                     "type": "string"
                   },
@@ -754,13 +783,78 @@
               "application/json": {
                 "schema": {
                   "type": "object",
-                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                  "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "alertEmails": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "alertWebhookUrl": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "assignedTo": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "description": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "disableAlerts": {
+                      "type": "boolean",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "disableScheduledRuns": {
+                      "type": "boolean",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "ETag": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "excludedTenants": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "excludedTo": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "LocalChanges": {
+                      "type": "boolean",
+                      "x-cipp-field-source": "storage"
+                    },
                     "Metadata": {
                       "x-cipp-field-source": "backend"
                     },
+                    "PartitionKey": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "Results": {
                       "x-cipp-field-source": "backend"
+                    },
+                    "RowKey": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "SHA": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "Source": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "Stages": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "templateName": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "Timestamp": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "updatedAt": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "updatedBy": {
+                      "x-cipp-field-source": "storage"
                     }
                   }
                 }
@@ -788,60 +882,6 @@
         ]
       }
     },
-    "/api/AddBPATemplate": {
-      "post": {
-        "summary": "AddBPATemplate",
-        "operationId": "AddBPATemplate",
-        "tags": [
-          "Tenant > Standards"
-        ],
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "name": {
-                    "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "object",
-                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
-                  "properties": {
-                    "Results": {
-                      "x-cipp-field-source": "backend"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Tenant.BestPracticeAnalyser.ReadWrite"
-      }
-    },
     "/api/AddCAPolicy": {
       "post": {
         "summary": "AddCAPolicy",
@@ -1074,6 +1114,13 @@
                   "excludeGroup": {
                     "type": "string"
                   },
+                  "ExcludeGroupIds": {
+                    "type": "string"
+                  },
+                  "GroupIds": {
+                    "type": "string",
+                    "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped."
+                  },
                   "InstallAsSystem": {
                     "type": "string"
                   },
@@ -2215,6 +2262,13 @@
                   "excludeGroup": {
                     "type": "string"
                   },
+                  "ExcludeGroupIds": {
+                    "type": "string"
+                  },
+                  "GroupIds": {
+                    "type": "string",
+                    "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped."
+                  },
                   "IntuneBody": {
                     "type": "string"
                   },
@@ -4429,6 +4483,15 @@
                   "defaultUseRoles": {
                     "type": "boolean"
                   },
+                  "defaultVacationCAPolicy": {
+                    "type": "string"
+                  },
+                  "defaultVacationExcludeAuditAlerts": {
+                    "type": "boolean"
+                  },
+                  "defaultVacationMode": {
+                    "type": "boolean"
+                  },
                   "generateTAPByDefault": {
                     "type": "boolean"
                   },
@@ -4564,6 +4627,13 @@
                   "excludeGroup": {
                     "type": "string"
                   },
+                  "ExcludeGroupIds": {
+                    "type": "string"
+                  },
+                  "GroupIds": {
+                    "type": "string",
+                    "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped."
+                  },
                   "PackageName": {
                     "type": "string",
                     "description": "Build the install/uninstall command lines for this tenant. Get-CIPPMSPAppInstallCommand resolves each param whether it is a per-tenant keyed value (interactive deploy) or a flat value / %CIPP variable% (Application Template deploy)."
@@ -4770,6 +4840,13 @@
                   "excludeGroup": {
                     "type": "string"
                   },
+                  "ExcludeGroupIds": {
+                    "type": "string"
+                  },
+                  "GroupIds": {
+                    "type": "string",
+                    "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped."
+                  },
                   "IntuneBody": {
                     "type": "string",
                     "description": "A template saved from an existing app carries the full body: reuse it, minus the read-only properties Graph rejects on create."
@@ -4971,6 +5048,13 @@
                   "excludeGroup": {
                     "type": "string"
                   },
+                  "ExcludeGroupIds": {
+                    "type": "string"
+                  },
+                  "GroupIds": {
+                    "type": "string",
+                    "description": "Sent by the deploy drawer when a single tenant is selected and groups were picked by id. customGroup/excludeGroup still carry the display names for logging and as a fallback."
+                  },
                   "RAWJson": {
                     "type": "string"
                   },
@@ -5850,7 +5934,7 @@
           "Security > Compliance-SensitivityLabel"
         ],
         "requestBody": {
-          "required": false,
+          "required": true,
           "content": {
             "application/json": {
               "schema": {
@@ -5858,8 +5942,15 @@
                 "properties": {
                   "PowerShellCommand": {
                     "type": "string"
+                  },
+                  "tenantFilter": {
+                    "type": "string",
+                    "description": "Encryption rights granted to the source tenant's own domain would follow the template into every other tenant. Swap them for %defaultdomain% so each deploy resolves to the target tenant instead."
                   }
                 },
+                "required": [
+                  "tenantFilter"
+                ],
                 "additionalProperties": true,
                 "x-cipp-passthrough": true,
                 "description": "This endpoint forwards the request body onward rather than reading a fixed set of fields. The properties listed here are the ones it is known to read; others may be accepted."
@@ -5970,6 +6061,9 @@
               "schema": {
                 "type": "object",
                 "properties": {
+                  "isPublic": {
+                    "type": "boolean"
+                  },
                   "sensitivityLabel": {
                     "type": "string"
                   },
@@ -5977,7 +6071,12 @@
                     "type": "string"
                   },
                   "siteDesign": {
-                    "$ref": "#/components/schemas/LabelValue"
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "Optional. Only applies to the Team and Communication templates; omitted for TeamGroup."
                   },
                   "siteName": {
                     "type": "string"
@@ -6048,6 +6147,9 @@
                     "items": {
                       "type": "object",
                       "properties": {
+                        "isPublic": {
+                          "type": "string"
+                        },
                         "sensitivityLabel": {
                           "type": "string"
                         },
@@ -6055,7 +6157,8 @@
                           "type": "string"
                         },
                         "siteDesign": {
-                          "type": "string"
+                          "type": "string",
+                          "description": "Optional. Only applies to the Team and Communication templates; leave blank for TeamGroup."
                         },
                         "siteName": {
                           "type": "string"
@@ -6289,9 +6392,25 @@
                   "createdAt": {
                     "type": "string"
                   },
+                  "GitHub": {
+                    "type": "object",
+                    "properties": {
+                      "FullName": {
+                        "type": "string"
+                      },
+                      "Message": {
+                        "type": "string"
+                      }
+                    },
+                    "description": "Optional. Pushes the saved template to a GitHub template repository after the save: FullName is the repository (owner/repo), Message is the commit message. Not stored on the template."
+                  },
                   "GUID": {
                     "type": "string"
                   },
+                  "standards": {
+                    "type": "string",
+                    "description": "Drop standards toggled on but left with no instances (empty array) - e.g. a template standard whose last selection was removed in the editor, which leaves 'standards.<Name> = []' in the form. Persisting these produces phantom 'NOT FOUND' drift entries with no template to compare against."
+                  },
                   "templateName": {
                     "type": "string"
                   },
@@ -6368,6 +6487,16 @@
                   "description": {
                     "type": "string"
                   },
+                  "excludeGroup": {
+                    "type": "string"
+                  },
+                  "ExcludeGroupIds": {
+                    "type": "string"
+                  },
+                  "GroupIds": {
+                    "type": "string",
+                    "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped."
+                  },
                   "InstallAsSystem": {
                     "type": "boolean",
                     "description": "winGetAppInstallExperience only supports runAsAccount (no restart behavior). Default to system when the toggle is absent so older callers keep the previous behavior."
@@ -7248,6 +7377,13 @@
                     "type": "string",
                     "description": "Set-CIPPMailboxPermission takes a single level, so Full Access plus Send As means one task per level. They are separate Exchange operations anyway."
                   },
+                  "sharePointSiteRole": {
+                    "$ref": "#/components/schemas/LabelValue"
+                  },
+                  "sharePointSites": {
+                    "type": "string",
+                    "description": "SharePoint site membership is scheduled instead of run inline: a freshly created account cannot be resolved on a site (ensureuser) until it has replicated to SharePoint."
+                  },
                   "sherwebLicense": {
                     "$ref": "#/components/schemas/LabelValue"
                   },
@@ -7462,6 +7598,9 @@
                   "country": {
                     "type": "string"
                   },
+                  "defaultAttributes": {
+                    "type": "string"
+                  },
                   "defaultForTenant": {
                     "type": "string"
                   },
@@ -7536,6 +7675,13 @@
                   "sharedMailboxPermission": {
                     "type": "string"
                   },
+                  "sharePointSiteRole": {
+                    "$ref": "#/components/schemas/LabelValue"
+                  },
+                  "sharePointSites": {
+                    "type": "string",
+                    "description": "SharePoint sites new users are added to, with one role for all of them"
+                  },
                   "state": {
                     "type": "string"
                   },
@@ -7648,6 +7794,16 @@
                   "enforceSignatureCheck": {
                     "type": "boolean"
                   },
+                  "excludeGroup": {
+                    "type": "string"
+                  },
+                  "ExcludeGroupIds": {
+                    "type": "string"
+                  },
+                  "GroupIds": {
+                    "type": "string",
+                    "description": "Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still carry the display names for logging and as a fallback if the ids are ever dropped."
+                  },
                   "InstallAsSystem": {
                     "type": "string"
                   },
@@ -7721,45 +7877,6 @@
         "x-cipp-any-tenant": true
       }
     },
-    "/api/BestPracticeAnalyser_List": {
-      "get": {
-        "summary": "BestPracticeAnalyser_List",
-        "operationId": "BestPracticeAnalyser_List",
-        "tags": [
-          "Tenant > Standards"
-        ],
-        "description": "Returns the cached Best Practice Analyser results for every tenant. The BPA is populated by a scheduled job, so this reads the last run rather than evaluating anything; if it has never run, a single placeholder row saying so is returned.",
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
-                  }
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Tenant.BestPracticeAnalyser.Read",
-        "x-cipp-any-tenant": true
-      }
-    },
     "/api/CreateSafeLinksPolicyTemplate": {
       "post": {
         "summary": "CreateSafeLinksPolicyTemplate",
@@ -8512,6 +8629,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -8539,11 +8659,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -9323,6 +9447,15 @@
                   "defaultUseRoles": {
                     "type": "boolean"
                   },
+                  "defaultVacationCAPolicy": {
+                    "type": "string"
+                  },
+                  "defaultVacationExcludeAuditAlerts": {
+                    "type": "boolean"
+                  },
+                  "defaultVacationMode": {
+                    "type": "boolean"
+                  },
                   "generateTAPByDefault": {
                     "type": "boolean"
                   },
@@ -10382,6 +10515,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -10409,11 +10545,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -10785,6 +10925,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -10812,11 +10955,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -11433,7 +11580,7 @@
         "tags": [
           "CIPP > Settings"
         ],
-        "description": "Runs the CIPP deployment's self-diagnostics and returns the result. Type selects the check: 'Permissions' verifies the SAM application's Graph permissions, 'Tenants' tests access to each tenant, and 'GDAP' inspects the GDAP relationships and role mappings. Results are cached for an hour unless SkipCache is true.",
+        "description": "Runs the CIPP deployment's self-diagnostics and returns the result. Type selects the check: 'Permissions' verifies the SAM application's Graph permissions, 'Tenants' tests access to each tenant, and 'GDAP' inspects the GDAP relationships and role mappings. Results are cached for an hour and served from cache by default. Pass SkipCache to trigger a fresh run of the check; the run repopulates the cache and the response only acknowledges it started, so call again without SkipCache to read the updated results. For the 'Tenants' check, supplying TenantId returns just that tenant's cached result; add SkipCache to trigger a re-check of that single tenant.",
         "requestBody": {
           "required": false,
           "content": {
@@ -11443,11 +11590,11 @@
                 "properties": {
                   "SkipCache": {
                     "type": "string",
-                    "description": "Re-run the check instead of serving the cached result."
+                    "description": "Trigger a fresh run of the check instead of serving the cached result. The run repopulates the cache and the response only acknowledges it, so a follow-up call without SkipCache is what returns the updated result."
                   },
                   "TenantId": {
                     "type": "string",
-                    "description": "The tenant to (re)check for the 'Tenants' type. Query or body, for the same reason as Type."
+                    "description": "The tenant to read for the 'Tenants' type: returns just that tenant's cached result. Pair it with SkipCache to trigger a re-check of that one tenant, then read again without SkipCache to get the refreshed result. Query or body, as with Type."
                   },
                   "Type": {
                     "type": "string",
@@ -11462,7 +11609,7 @@
           {
             "name": "SkipCache",
             "in": "query",
-            "description": "Re-run the check instead of serving the cached result.",
+            "description": "Trigger a fresh run of the check instead of serving the cached result. The run repopulates the cache and the response only acknowledges it, so a follow-up call without SkipCache is what returns the updated result.",
             "required": false,
             "schema": {
               "type": "string"
@@ -11471,7 +11618,7 @@
           {
             "name": "TenantId",
             "in": "query",
-            "description": "The tenant to (re)check for the 'Tenants' type. Query or body, for the same reason as Type.",
+            "description": "The tenant to read for the 'Tenants' type: returns just that tenant's cached result. Pair it with SkipCache to trigger a re-check of that one tenant, then read again without SkipCache to get the refreshed result. Query or body, as with Type.",
             "required": false,
             "schema": {
               "type": "string"
@@ -12261,9 +12408,6 @@
                     "ExcludeUser": {
                       "x-cipp-field-source": "storage"
                     },
-                    "GraphErrorCount": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "hasAutoExtend": {
                       "x-cipp-field-source": "storage"
                     },
@@ -12322,11 +12466,12 @@
     },
     "/api/ExecAddTrustedIP": {
       "post": {
-        "summary": "ExecAddTrustedIP",
+        "summary": "Adds IP addresses or ranges to CIPP's IP allow/block list.",
         "operationId": "ExecAddTrustedIP",
         "tags": [
           "CIPP > Settings"
         ],
+        "description": "Sets each IP address or CIDR range (IPv4 or IPv6) to Trusted, Blocked or NotTrusted (neutral) for one tenant, or for every tenant with tenantfilter=AllTenants. A tenant entry overrides an AllTenants entry for the same range, and the most specific range decides an address. The audit-log alerts treat Trusted addresses as known; the BEC investigation uses Trusted and Blocked entries as confirmed-safe and confirmed-compromised IPs.",
         "requestBody": {
           "required": false,
           "content": {
@@ -12338,10 +12483,16 @@
                     "type": "array",
                     "items": {
                       "type": "string"
-                    }
+                    },
+                    "description": "IP addresses or CIDR ranges (IPv4 or IPv6); one entry may also hold several separated by commas or spaces"
+                  },
+                  "Note": {
+                    "type": "string",
+                    "description": "Optional note shown with the entry"
                   },
                   "State": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "Trusted, Blocked, or NotTrusted to make the entry neutral again"
                   }
                 }
               }
@@ -12715,7 +12866,13 @@
                   },
                   "MCPAllowed": {
                     "type": "string",
-                    "description": "When this client is MCP-enabled, configure its app registration as the MCP OAuth resource (host identifier URIs + v2 tokens) so the Claude connector flow can resolve it."
+                    "description": "When this client is MCP-enabled it becomes one of the OAuth client apps that AI connectors sign in as. Several MCPAllowed clients may coexist (each with its own role/IP/redirects/CA); the dedicated CIPP-MCP app is the shared protected resource. Configure this client (callbacks, public client flows, resource permissions + consent) and ensure the resource app exists (Set-CIPPMCPClientApp -> New-CIPPMcpResourceApp)."
+                  },
+                  "PublicRedirectUris": {
+                    "type": "string"
+                  },
+                  "RedirectUris": {
+                    "type": "string"
                   },
                   "RemoveAppReg": {
                     "type": "boolean"
@@ -12727,6 +12884,9 @@
                       }
                     ],
                     "description": "Authorize the role assignment BEFORE any side effects (app registration / secret creation). A caller may only assign a role whose effective permissions are a subset of their own, and may only modify an existing client whose current role is likewise within their grant. This blocks privilege escalation via the ApiClients table (e.g. editor -> superadmin)."
+                  },
+                  "WebRedirectUris": {
+                    "type": "string"
                   }
                 }
               }
@@ -12744,11 +12904,13 @@
                 "AddUpdate",
                 "Delete",
                 "GetAzureConfiguration",
+                "GetMcpAuth",
                 "List",
                 "ListAvailable",
                 "RepairUri",
                 "ResetSecret",
-                "SaveToAzure"
+                "SaveToAzure",
+                "SetMcpRedirectUris"
               ]
             }
           }
@@ -12760,7 +12922,7 @@
               "application/json": {
                 "schema": {
                   "type": "object",
-                  "description": "Derived from the Microsoft Graph entity it queries, and the fields written into the storage table it reads. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.",
+                  "description": "Derived from the Microsoft Graph entity it queries. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.",
                   "properties": {
                     "addIns": {
                       "type": "array",
@@ -12778,9 +12940,6 @@
                       "type": "string",
                       "x-cipp-field-source": "graph-entity"
                     },
-                    "AppName": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "appRoles": {
                       "type": "array",
                       "x-cipp-field-source": "graph-entity"
@@ -12821,13 +12980,6 @@
                       "type": "string",
                       "x-cipp-field-source": "graph-entity"
                     },
-                    "Enabled": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "ETag": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
                     "groupMembershipClaims": {
                       "type": "string",
                       "x-cipp-field-source": "graph-entity"
@@ -12844,9 +12996,6 @@
                       "type": "object",
                       "x-cipp-field-source": "graph-entity"
                     },
-                    "IPRange": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "isDeviceOnlyAuthSupported": {
                       "type": "boolean",
                       "x-cipp-field-source": "graph-entity"
@@ -12871,10 +13020,6 @@
                       "type": "array",
                       "x-cipp-field-source": "graph-entity"
                     },
-                    "MCPAllowed": {
-                      "type": "boolean",
-                      "x-cipp-field-source": "storage"
-                    },
                     "nativeAuthenticationApisEnabled": {
                       "type": "object",
                       "x-cipp-field-source": "graph-entity"
@@ -12895,9 +13040,6 @@
                       "type": "object",
                       "x-cipp-field-source": "graph-entity"
                     },
-                    "PartitionKey": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "passwordCredentials": {
                       "type": "array",
                       "x-cipp-field-source": "graph-entity"
@@ -12918,13 +13060,6 @@
                       "type": "array",
                       "x-cipp-field-source": "graph-entity"
                     },
-                    "Role": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
-                    "RowKey": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "samlMetadataUrl": {
                       "type": "string",
                       "x-cipp-field-source": "graph-entity"
@@ -12949,10 +13084,6 @@
                       "type": "array",
                       "x-cipp-field-source": "graph-entity"
                     },
-                    "Timestamp": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
                     "tokenEncryptionKeyId": {
                       "type": "string",
                       "x-cipp-field-source": "graph-entity"
@@ -13144,6 +13275,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -13174,11 +13308,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -13495,6 +13633,9 @@
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateId": {
                       "x-cipp-field-source": "backend"
                     },
@@ -14818,6 +14959,82 @@
         "x-cipp-any-tenant": true
       }
     },
+    "/api/ExecBaselineAddStandard": {
+      "post": {
+        "summary": "ExecBaselineAddStandard",
+        "operationId": "ExecBaselineAddStandard",
+        "tags": [
+          "Tenant > Standards"
+        ],
+        "description": "Adds one standard, with its configured settings, to a stage of an existing baseline. The baseline\nis read with Get-CIPPBaseline, the standard is appended to the stage (replacing an existing\nsingle-instance copy) and the whole baseline is saved again through New-CIPPBaseline, the same\nwrite path the baseline editor uses. Body: baselineId, stage (1-based, default 1), standard,\nvariables, remediateEnabled (default false), alertEnabled (default true).",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "alertEnabled": {
+                    "type": "string"
+                  },
+                  "baselineId": {
+                    "type": "string"
+                  },
+                  "remediateEnabled": {
+                    "type": "boolean"
+                  },
+                  "stage": {
+                    "type": "string"
+                  },
+                  "standard": {
+                    "type": "string"
+                  },
+                  "variables": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                  "properties": {
+                    "Metadata": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "Results": {
+                      "x-cipp-field-source": "backend"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Tenant.Baselines.ReadWrite"
+      }
+    },
     "/api/ExecBaselineMigrate": {
       "post": {
         "summary": "ExecBaselineMigrate",
@@ -15101,51 +15318,14 @@
         "x-cipp-role": "Tenant.Baselines.ReadWrite"
       }
     },
-    "/api/ExecBECCheck": {
+    "/api/ExecBECBulkCheck": {
       "get": {
-        "summary": "ExecBECCheck",
-        "operationId": "ExecBECCheck",
+        "summary": "Queues Business Email Compromise investigations for many users at once.",
+        "operationId": "ExecBECBulkCheck",
         "tags": [
           "Identity > Administration > Users"
         ],
-        "description": "Returns the business email compromise assessment for a user: sign-ins with a location analysis against the user's assigned usage location, mailbox rules and rule changes, trusted/blocked sender changes, OneDrive and SharePoint sharing link activity, added applications matched against the known-malicious catalog, MFA methods, Intune devices, sent mail, and tenant-wide password changes. If no cached result exists the check is queued as a background job and the response reports it as waiting, so poll rather than expecting results on the first call. Pass overwrite=true to force a fresh run.",
-        "parameters": [
-          {
-            "name": "GUID",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "overwrite",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "boolean"
-            }
-          },
-          {
-            "$ref": "#/components/parameters/tenantFilter"
-          },
-          {
-            "name": "userid",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "userName",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
+        "description": "Queues one BEC investigation per user as a single orchestration with a queue entry for progress. Accepts either an array of { UserIds, tenantFilter } items (the Users table bulk action) or one object with UserIds[]. Each run gets its own case id; results appear on the BEC Reports page and each user's Compromise Remediation tab.",
         "responses": {
           "200": {
             "description": "Success",
@@ -15153,42 +15333,7 @@
               "application/json": {
                 "schema": {
                   "type": "object",
-                  "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
-                  "properties": {
-                    "Batch": {
-                      "x-cipp-field-source": "backend"
-                    },
-                    "ETag": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
-                    "OrchestratorName": {
-                      "x-cipp-field-source": "backend"
-                    },
-                    "PartitionKey": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "Results": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
-                    "RowKey": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "SkipLog": {
-                      "x-cipp-field-source": "backend"
-                    },
-                    "Status": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "Timestamp": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
-                    "UserId": {
-                      "x-cipp-field-source": "storage"
-                    }
-                  }
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
                 }
               }
             }
@@ -15198,6 +15343,9 @@
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -15208,13 +15356,14 @@
         "x-cipp-role": "Identity.User.Read"
       }
     },
-    "/api/ExecBECRemediate": {
+    "/api/ExecBECCheck": {
       "post": {
-        "summary": "ExecBECRemediate",
-        "operationId": "ExecBECRemediate",
+        "summary": "Reads, polls or starts a Business Email Compromise investigation.",
+        "operationId": "ExecBECCheck",
         "tags": [
           "Identity > Administration > Users"
         ],
+        "description": "GET with GUID (or caseId) returns that run: while it is queued or running { Waiting = true, Progress } where Progress is the job status (queued until a worker picks it up, then running) and the per-step state the page renders; { Error, Progress } when it failed; otherwise the results payload with the server-side Score, per-collector Completeness and a Run block. A queued or running run whose progress has not moved for 20 minutes is marked failed by this poll (the worker restarted or the run was abandoned) and returned as { Error }. GET without a GUID returns the user's latest run as { GUID, Status } and starts nothing (GUID is null when the user has no runs). POST with tenantFilter, userid and userName queues a new run and returns its { GUID }. Every run is the full investigation and is kept in the BecReports table; metadata only, never message content.",
         "requestBody": {
           "required": true,
           "content": {
@@ -15226,10 +15375,12 @@
                     "type": "string"
                   },
                   "userid": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "Object id of the user to investigate"
                   },
-                  "username": {
-                    "type": "string"
+                  "userName": {
+                    "type": "string",
+                    "description": "The user's UPN (stored on the run and used by the collectors)"
                   }
                 },
                 "required": [
@@ -15239,6 +15390,47 @@
             }
           }
         },
+        "parameters": [
+          {
+            "name": "caseId",
+            "in": "query",
+            "description": "The run to read; GUID keeps the original poll contract",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "GUID",
+            "in": "query",
+            "description": "The run to read; GUID keeps the original poll contract",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          },
+          {
+            "name": "userid",
+            "in": "query",
+            "description": "Object id of the user to investigate",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "userName",
+            "in": "query",
+            "description": "The user's UPN (stored on the run and used by the collectors)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "Success",
@@ -15248,7 +15440,22 @@
                   "type": "object",
                   "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
                   "properties": {
-                    "Results": {
+                    "CaseId": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "Containment": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "ExtractedAt": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "RequestedAt": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "RequestedBy": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "Status": {
                       "x-cipp-field-source": "backend"
                     }
                   }
@@ -15271,70 +15478,309 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Identity.User.ReadWrite"
+        "x-cipp-role": "Identity.User.Read"
       }
     },
-    "/api/ExecBitlockerSearch": {
+    "/api/ExecBECEvidenceExport": {
       "post": {
-        "summary": "ExecBitlockerSearch",
-        "operationId": "ExecBitlockerSearch",
+        "summary": "Builds the evidence package for a Business Email Compromise run and returns it.",
+        "operationId": "ExecBECEvidenceExport",
         "tags": [
-          "Endpoint > MEM"
+          "Identity > Administration > Users"
         ],
-        "description": "Finds a BitLocker recovery key across every tenant the caller can access, by keyId or deviceId. Intended for the case where a user has a recovery key ID from the BitLocker prompt but the tenant is unknown.",
+        "description": "Collates the run's stored results, one CSV per finding set, the score, the containment history, every logbook entry stamped with the case id and the full and C-suite-summary report PDFs (rendered server-side) into a ZIP. Nothing is stored: the ZIP is returned base64-encoded (ZipBase64) for the browser to save. Metadata only - nothing in the package is message content.",
         "requestBody": {
-          "required": false,
+          "required": true,
           "content": {
             "application/json": {
               "schema": {
                 "type": "object",
                 "properties": {
-                  "deviceId": {
-                    "type": "string"
-                  },
-                  "keyId": {
-                    "type": "string",
-                    "description": "Get search parameters from query string or POST body"
-                  },
-                  "limit": {
+                  "caseId": {
                     "type": "string"
                   },
                   "tenantFilter": {
                     "type": "string"
                   }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                  "properties": {
+                    "Bytes": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "CaseId": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "FileCount": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "ZipBase64": {
+                      "x-cipp-field-source": "backend"
+                    }
+                  }
                 }
               }
             }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
-        "parameters": [
+        "security": [
           {
-            "name": "deviceId",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Identity.User.Read"
+      }
+    },
+    "/api/ExecBECIPReview": {
+      "post": {
+        "summary": "Re-judges the IP addresses of a BEC case with the investigator's overrides and chosen accounts.",
+        "operationId": "ExecBECIPReview",
+        "tags": [
+          "Identity > Administration > Users"
+        ],
+        "description": "Validates the request and queues a background re-run of the case's address-dependent sections: the investigator's overrides (an address or CIDR range marked Safe or Compromised, with an optional note) become the case's complete override set, the sign-ins of the chosen accounts are correlated with the case's addresses, the address lists are re-read, and mailbox activity, IP verdicts, attacker activity, delegated mailboxes and the score are recomputed for the original window. Returns a DeploymentId whose per-step progress ListOffboardingProgress returns. To make a verdict permanent for the tenant, add the address to CIPP's IP allow/block list (ExecAddTrustedIP).",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "CaseId": {
+                    "type": "string",
+                    "description": "The BEC case (run) to review"
+                  },
+                  "CorrelateUsers": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/LabelValue"
+                    },
+                    "description": "Object ids of other accounts whose sign-ins to correlate with the case's addresses"
+                  },
+                  "Overrides": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "IP": {
+                          "type": "string"
+                        },
+                        "Note": {
+                          "type": "string"
+                        },
+                        "Verdict": {
+                          "$ref": "#/components/schemas/LabelValue"
+                        }
+                      }
+                    },
+                    "description": "The complete set of overrides for the case: an address or CIDR range, Safe or Compromised, and a note. Auto drops the override."
+                  },
+                  "tenantFilter": {
+                    "$ref": "#/components/schemas/LabelValue"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                  "properties": {
+                    "resultText": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "state": {
+                      "x-cipp-field-source": "backend"
+                    }
+                  }
+                }
+              }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "404": {
+            "description": "Not found"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
           {
-            "name": "keyId",
-            "in": "query",
-            "description": "Get search parameters from query string or POST body",
-            "required": false,
-            "schema": {
-              "type": "string"
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Identity.User.ReadWrite"
+      }
+    },
+    "/api/ExecBECRemediate": {
+      "post": {
+        "summary": "Runs selectable Business Email Compromise containment for a user.",
+        "operationId": "ExecBECRemediate",
+        "tags": [
+          "Identity > Administration > Users"
+        ],
+        "description": "Runs the selected containment actions (see ListBECRemediationActions) for a user. With no Actions the default set runs (the DefaultSelected actions, configurable instance-wide from CIPP settings). Actions marked Critical require Confirmation to equal the user's UPN. With Async the request is validated, queued as a scheduled task that runs straight away, and answered with a DeploymentId whose per-action progress ListOffboardingProgress returns; without it the actions run inline and their results are returned. Pass CaseId to resolve default targets (flagged consents, delegations, rules, devices) from that BEC run and to record the outcome on it; Parameters carries explicit per-action targets (MfaMethodIds, GrantIds, AppRoleAssignmentIds, ServicePrincipalIds, RuleIds, Delegations, TransportRuleIds, AddInIds, Protocols, MobileDeviceIds, RegisteredDeviceIds, CAPolicy).",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "Actions": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/LabelValue"
+                    },
+                    "description": "Action ids from ListBECRemediationActions; empty runs the default set"
+                  },
+                  "Async": {
+                    "type": "boolean",
+                    "description": "run as a background scheduled task and report progress under the returned DeploymentId"
+                  },
+                  "CaseId": {
+                    "type": "string",
+                    "description": "the BEC run whose findings supply default targets and which records the outcome"
+                  },
+                  "Confirmation": {
+                    "type": "string",
+                    "description": "must equal the user's UPN when a Critical action is selected"
+                  },
+                  "Parameters": {
+                    "type": "string"
+                  },
+                  "tenantFilter": {
+                    "type": "string"
+                  },
+                  "userid": {
+                    "type": "string"
+                  },
+                  "username": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter",
+                  "userid",
+                  "username"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. The fields taken from Graph are the ones this endpoint selects, so they are what the response actually carries.",
+                  "properties": {
+                    "resultText": {
+                      "x-cipp-field-source": "backend"
+                    },
+                    "state": {
+                      "type": "string",
+                      "x-cipp-field-source": "graph,backend"
+                    }
+                  }
+                }
+              }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
           {
-            "name": "limit",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Identity.User.ReadWrite"
+      }
+    },
+    "/api/ExecBECRemediationDefaults": {
+      "post": {
+        "summary": "Gets or sets which BEC containment actions are selected by default.",
+        "operationId": "ExecBECRemediationDefaults",
+        "tags": [
+          "CIPP > Settings"
+        ],
+        "description": "GET with List=true returns the containment catalog (Id, Label, Description, Impact, DefaultSelected) with the instance-wide defaults applied. POST with DefaultActions saves the action ids that start selected in the BEC containment drawer and run when ExecBECRemediate is called without Actions.",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "DefaultActions": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/LabelValue"
+                    },
+                    "description": "Containment action ids (ListBECRemediationActions) that start selected"
+                  }
+                }
+              }
             }
-          },
+          }
+        },
+        "parameters": [
           {
-            "name": "tenantFilter",
+            "name": "List",
             "in": "query",
             "required": false,
             "schema": {
@@ -15371,17 +15817,81 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Endpoint.Device.Read",
+        "x-cipp-role": "CIPP.AppSettings.ReadWrite",
         "x-cipp-any-tenant": true
       }
     },
-    "/api/ExecBPA": {
+    "/api/ExecBECReport": {
       "post": {
-        "summary": "ExecBPA",
-        "operationId": "ExecBPA",
+        "summary": "Manages a stored Business Email Compromise run.",
+        "operationId": "ExecBECReport",
         "tags": [
-          "Tenant > Standards"
+          "Identity > Administration > Users"
+        ],
+        "description": "Action=Delete removes a BEC run permanently: its results payload, its evidence package and the run row. Runs are otherwise kept indefinitely.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "Action": {
+                    "type": "string",
+                    "description": "Currently only Delete"
+                  },
+                  "caseId": {
+                    "type": "string"
+                  },
+                  "tenantFilter": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
         ],
+        "x-cipp-role": "Identity.User.ReadWrite"
+      }
+    },
+    "/api/ExecBitlockerSearch": {
+      "post": {
+        "summary": "ExecBitlockerSearch",
+        "operationId": "ExecBitlockerSearch",
+        "tags": [
+          "Endpoint > MEM"
+        ],
+        "description": "Finds a BitLocker recovery key across every tenant the caller can access, by keyId or deviceId. Intended for the case where a user has a recovery key ID from the BitLocker prompt but the tenant is unknown.",
         "requestBody": {
           "required": false,
           "content": {
@@ -15389,8 +15899,18 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "tenantfilter": {
-                    "$ref": "#/components/schemas/LabelValue"
+                  "deviceId": {
+                    "type": "string"
+                  },
+                  "keyId": {
+                    "type": "string",
+                    "description": "Get search parameters from query string or POST body"
+                  },
+                  "limit": {
+                    "type": "string"
+                  },
+                  "tenantFilter": {
+                    "type": "string"
                   }
                 }
               }
@@ -15398,12 +15918,37 @@
           }
         },
         "parameters": [
+          {
+            "name": "deviceId",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "keyId",
+            "in": "query",
+            "description": "Get search parameters from query string or POST body",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "tenantFilter",
             "in": "query",
             "required": false,
             "schema": {
-              "$ref": "#/components/schemas/LabelValue"
+              "type": "string"
             }
           }
         ],
@@ -15413,22 +15958,22 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
-                  "properties": {
-                    "Results": {
-                      "x-cipp-field-source": "backend"
-                    }
-                  }
+                  "$ref": "#/components/schemas/StandardResults"
                 }
               }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
           "401": {
             "description": "Unauthorized - invalid or missing bearer token"
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -15436,7 +15981,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.BestPracticeAnalyser.ReadWrite",
+        "x-cipp-role": "Endpoint.Device.Read",
         "x-cipp-any-tenant": true
       }
     },
@@ -15482,7 +16027,8 @@
                     "type": "string"
                   },
                   "kind": {
-                    "type": "string"
+                    "type": "string",
+                    "description": "A name for a gallery image, so it can be picked by name where the image is offered elsewhere: the report builder lists uploaded covers as Infographic page backgrounds."
                   },
                   "logoImageId": {
                     "type": "string"
@@ -15509,6 +16055,10 @@
                   "showPageNumbers": {
                     "type": "boolean"
                   },
+                  "tenantLabel": {
+                    "type": "string",
+                    "description": "Which of the tenant's names the preset's reports print; see the Set action."
+                  },
                   "watermarkEnabled": {
                     "type": "boolean"
                   },
@@ -15719,7 +16269,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read"
+        "x-cipp-role": "CIPP.BreachLookup.Read"
       }
     },
     "/api/ExecBulkLicense": {
@@ -15895,7 +16445,7 @@
         "tags": [
           "Tenant > Conditional"
         ],
-        "description": "Runs a Conditional Access \"what if\" evaluation, reporting which policies would apply to a sign-in with the given user, application, device platform, location, client app type and risk levels. Evaluation only - no sign-in occurs and no policy is changed.",
+        "description": "Runs a Conditional Access \"what if\" evaluation, reporting which policies would apply to a sign-in with the given user, application, device platform, device compliance, location, client app type, authentication flow and risk levels. Evaluation only - no sign-in occurs and no policy is changed.",
         "requestBody": {
           "required": true,
           "content": {
@@ -15912,10 +16462,19 @@
                   "Country": {
                     "$ref": "#/components/schemas/LabelValue"
                   },
+                  "DeviceCompliant": {
+                    "$ref": "#/components/schemas/LabelValue"
+                  },
                   "DevicePlatform": {
                     "$ref": "#/components/schemas/LabelValue"
                   },
                   "IncludeApplications": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/LabelValue"
+                    }
+                  },
+                  "InsiderRiskLevel": {
                     "$ref": "#/components/schemas/LabelValue"
                   },
                   "IpAddress": {
@@ -15967,7 +16526,10 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.ConditionalAccess.Read"
+        "x-cipp-role": "Tenant.ConditionalAccess.Read",
+        "x-cipp-reads-via": [
+          "New-CIPPCAWhatIfRequest"
+        ]
       }
     },
     "/api/ExecCAExclusion": {
@@ -16678,6 +17240,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -16702,11 +17267,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -16767,19 +17336,71 @@
             }
           }
         },
-        "parameters": [
-          {
-            "name": "ID",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/StandardResults"
+                }
+              }
             }
           },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
           {
-            "$ref": "#/components/parameters/tenantFilter"
+            "bearerAuth": []
           }
         ],
+        "x-cipp-role": "Identity.User.ReadWrite"
+      }
+    },
+    "/api/ExecClrOnPremAttributes": {
+      "post": {
+        "summary": "ExecClrOnPremAttributes",
+        "operationId": "ExecClrOnPremAttributes",
+        "tags": [
+          "Identity > Administration > Users"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "Attributes": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/LabelValue"
+                    },
+                    "description": "On-premises attributes to clear (onPremisesImmutableId, onPremisesDistinguishedName, ...), as plain names or {label,value} objects. Omit to clear every clearable attribute."
+                  },
+                  "ID": {
+                    "type": "string",
+                    "description": "Object ID of the cloud-only user whose on-premises attributes should be cleared"
+                  },
+                  "tenantFilter": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
             "description": "Success",
@@ -16973,19 +17594,16 @@
                     "type": "boolean"
                   },
                   "FullName": {
-                    "type": "string",
-                    "description": "Pretty-printed, not compressed: repo files are hand-edited on GitHub."
+                    "type": "string"
                   },
                   "GUID": {
-                    "type": "string",
-                    "description": "A baseline is not a templates-table row: Export-CIPPBaselineTemplate assembles the portable set - the BaselineTemplate file plus one standard template file per referenced CA/Intune template (packages expanded to their current members). Related templates are separate files, exactly the shape UploadTemplate writes, so they import through the untouched path."
+                    "type": "string"
                   },
                   "Id": {
                     "type": "string"
                   },
                   "Message": {
-                    "type": "string",
-                    "description": "Pretty-printed, not compressed: repo files are hand-edited on GitHub."
+                    "type": "string"
                   },
                   "Path": {
                     "type": "string"
@@ -17022,7 +17640,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.ReadWrite",
+        "x-cipp-role": "CIPP.TemplateLibrary.ReadWrite",
         "x-cipp-any-tenant": true
       }
     },
@@ -17137,6 +17755,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -17161,11 +17782,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -17414,7 +18039,7 @@
         "summary": "ExecCopilotSettings",
         "operationId": "ExecCopilotSettings",
         "tags": [
-          "Tenant > Standards"
+          "Tenant > AI"
         ],
         "description": "Sets a single Microsoft 365 Copilot policy setting to Enabled (1), Disabled (0) or Not configured (cleared).",
         "requestBody": {
@@ -17487,7 +18112,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.ReadWrite"
+        "x-cipp-role": "Tenant.AI.ReadWrite"
       }
     },
     "/api/ExecCopyForSent": {
@@ -17970,6 +18595,10 @@
               "schema": {
                 "type": "object",
                 "properties": {
+                  "generatePwPushLink": {
+                    "type": "boolean",
+                    "description": "Opt-in: most TAPs are used directly by the admin, so the pass is returned in plain text unless the caller asks for a PwPush link. Same string-to-bool normalisation as above."
+                  },
                   "ID": {
                     "type": "string"
                   },
@@ -17996,6 +18625,15 @@
           }
         },
         "parameters": [
+          {
+            "name": "generatePwPushLink",
+            "in": "query",
+            "description": "Opt-in: most TAPs are used directly by the admin, so the pass is returned in plain text unless the caller asks for a PwPush link. Same string-to-bool normalisation as above.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
           {
             "name": "ID",
             "in": "query",
@@ -20393,6 +21031,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -20420,11 +21061,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -21051,9 +21696,6 @@
                     "ExcludeUser": {
                       "x-cipp-field-source": "storage,frontend"
                     },
-                    "GraphErrorCount": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "hasAutoExtend": {
                       "x-cipp-field-source": "storage"
                     },
@@ -22527,6 +23169,162 @@
             "$ref": "#/components/parameters/tenantFilter"
           }
         ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.ReportBuilder.ReadWrite"
+      }
+    },
+    "/api/ExecGeoIPLookup": {
+      "post": {
+        "summary": "ExecGeoIPLookup",
+        "operationId": "ExecGeoIPLookup",
+        "tags": [
+          "CIPP > Core"
+        ],
+        "description": "Resolves a single IP address to its geographic location using CIPP's bundled GeoIP database.",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "IP": {
+                    "type": "string"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "IP",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
+    "/api/ExecGetBaselineWhatIfReportPdf": {
+      "post": {
+        "summary": "ExecGetBaselineWhatIfReportPdf",
+        "operationId": "ExecGetBaselineWhatIfReportPdf",
+        "tags": [
+          "Tenant > Standards"
+        ],
+        "description": "Server-renders the Security Baseline report for a tenant as application/pdf bytes: where the\nassigned baselines stand today, what is already in place, the Conditional Access and Intune\npolicies and the settings the baseline will change (what each does, its value today, the value\nit will be set to and why), the rollout waves still to come and the agreed exceptions - plus,\noptionally, everything one or more simulated (not yet assigned) baselines would add. Reads the\nsame alignment, baseline and catalog data the Baselines page shows, composes it through the\nshared CIPPSharp component kit (Build-CippBaselineWhatIfReportTree) and returns the finished\nPDF. Nothing is changed by producing it.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "brandingPresetId": {
+                    "type": "string",
+                    "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding."
+                  },
+                  "sectionConfig": {
+                    "type": "object",
+                    "properties": {
+                      "alreadyAligned": {
+                        "type": "string",
+                        "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true."
+                      },
+                      "rolloutStages": {
+                        "type": "string",
+                        "description": "Optional. Show the \"How The Rollout Works\" section (the remaining waves and when they arrive). A boolean; defaults to true."
+                      }
+                    },
+                    "description": "Optional. Show the \"What Is Already In Place\" page (deployed policies and enforced settings, with their values). A boolean; defaults to true."
+                  },
+                  "simulatedTemplateIds": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "tenantFilter": {
+                    "type": "string",
+                    "description": "Required. The tenant (default domain) to report on."
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "brandingPresetId",
+            "in": "query",
+            "description": "Optional. The branding preset to render with; an unknown id falls back to the default branding.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
         "responses": {
           "200": {
             "description": "Success",
@@ -22536,42 +23334,296 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
-                    "Blocks": {
-                      "type": "string",
+                    "ContentHash": {
                       "x-cipp-field-source": "storage"
                     },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
                     },
-                    "GeneratedAt": {
-                      "type": "string",
+                    "GUID": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "JSON": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "Package": {
                       "x-cipp-field-source": "storage"
                     },
                     "PartitionKey": {
                       "x-cipp-field-source": "storage"
                     },
+                    "Permissions": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
                     "RowKey": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "SHA": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
                     },
-                    "Settings": {
+                    "Source": {
                       "x-cipp-field-source": "storage"
                     },
-                    "Status": {
+                    "SourcePath": {
                       "x-cipp-field-source": "storage"
                     },
                     "TemplateName": {
+                      "x-cipp-field-source": "storage"
+                    },
+                    "Timestamp": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "UpdatedBy": {
+                      "x-cipp-field-source": "storage"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Tenant.Baselines.Read"
+      }
+    },
+    "/api/ExecGetBecReportPdf": {
+      "post": {
+        "summary": "ExecGetBecReportPdf",
+        "operationId": "ExecGetBecReportPdf",
+        "tags": [
+          "Identity > Administration > Users"
+        ],
+        "description": "Server-renders a stored Business Email Compromise (BEC) run as application/pdf bytes. Reads the\nrun through Get-CIPPBecReport (the BecReports metadata row plus its BecResults payload) and\ncomposes it through the shared CIPPSharp component kit (Build-CippBecReportTree) - the server-side\nreplacement for the client react-pdf BECRemediationReportButton. A run is named by its caseId;\npass userId instead to render the user's newest completed run. The run must have completed - the\nreport reads its stored result, it does not trigger a new investigation.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "caseId": {
+                    "type": "string",
+                    "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run."
+                  },
+                  "tenantFilter": {
+                    "type": "string"
+                  },
+                  "userDisplayName": {
+                    "type": "string",
+                    "description": "The investigated user labels the cover and footer; the run stored who it was for."
+                  },
+                  "userId": {
+                    "type": "string"
+                  },
+                  "userName": {
+                    "type": "string"
+                  },
+                  "variant": {
+                    "type": "string",
+                    "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "caseId",
+            "in": "query",
+            "description": "The stored run to render. A caseId names it directly; a userId picks the user's newest completed run.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          },
+          {
+            "name": "userDisplayName",
+            "in": "query",
+            "description": "The investigated user labels the cover and footer; the run stored who it was for.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "userId",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "userName",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "variant",
+            "in": "query",
+            "description": "'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "404": {
+            "description": "Not found"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Identity.User.Read"
+      }
+    },
+    "/api/ExecGetExecutiveReportPdf": {
+      "post": {
+        "summary": "ExecGetExecutiveReportPdf",
+        "operationId": "ExecGetExecutiveReportPdf",
+        "tags": [
+          "Tenant > Standards"
+        ],
+        "description": "Server-renders the Executive Summary report as application/pdf bytes. Every figure is read from the\nnightly Reporting DB cache via New-CIPPDbRequest (Users/Guests/Roles for the environment overview,\nLicenseOverview, ManagedDevices, ConditionalAccessPolicies and SecureScore) plus the standards\ncomparison from the CippStandardsReports table resolved against the standards catalog - the same\ncached data the rest of CIPP reports from, with no live Graph or cross-endpoint HTTP calls. The\nshaped data is composed through the shared CIPPSharp component kit (Build-CippExecutiveReportTree),\nthe server-side replacement for the client react-pdf ExecutiveReportButton. Each source is gathered\ndefensively: a source with no cached data simply drops its section.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "brandingPresetId": {
+                    "type": "string",
+                    "description": "The branding preset a caller picked for this render, else the global branding settings."
+                  },
+                  "sectionConfig": {
+                    "type": "string"
+                  },
+                  "tenantFilter": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "brandingPresetId",
+            "in": "query",
+            "description": "The branding preset a caller picked for this render, else the global branding settings.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                  "properties": {
+                    "CurrentValue": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
                     },
-                    "TenantFilter": {
+                    "ExpectedValue": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "LicenseAvailable": {
+                      "type": "boolean",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "PartitionKey": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "RowKey": {
+                      "type": "string",
+                      "x-cipp-field-source": "storage"
+                    },
+                    "TemplateId": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Timestamp": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
+                    },
+                    "Value": {
+                      "x-cipp-field-source": "storage"
                     }
                   }
                 }
@@ -22586,6 +23638,9 @@
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -22593,40 +23648,158 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.ReadWrite"
+        "x-cipp-role": "Tenant.Standards.Read"
       }
     },
-    "/api/ExecGeoIPLookup": {
+    "/api/ExecGetLicenseReportPdf": {
       "post": {
-        "summary": "ExecGeoIPLookup",
-        "operationId": "ExecGeoIPLookup",
+        "summary": "ExecGetLicenseReportPdf",
+        "operationId": "ExecGetLicenseReportPdf",
         "tags": [
-          "CIPP > Core"
+          "Tenant > Reports"
         ],
-        "description": "Resolves a single IP address to its geographic location using CIPP's bundled GeoIP database.",
+        "description": "Server-renders the License Optimisation report as application/pdf bytes. Runs the same license\nrecommendation analysis the License Optimization page reads through ListLicenseRecommendations\n(Get-CIPPLicenseRecommendation, with the page's currency, thresholds and recommendation switches)\nand composes it through the shared CIPPSharp kit (Build-CippLicenseReportTree) - the server-side\nreplacement for the client react-pdf LicenseReportButton.",
         "requestBody": {
-          "required": false,
+          "required": true,
           "content": {
             "application/json": {
               "schema": {
                 "type": "object",
                 "properties": {
-                  "IP": {
+                  "brandingPresetId": {
+                    "type": "string",
+                    "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding."
+                  },
+                  "currency": {
+                    "type": "string",
+                    "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD."
+                  },
+                  "inactiveDays": {
+                    "type": "string",
+                    "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90."
+                  },
+                  "protectSecurityFeatures": {
                     "type": "string"
+                  },
+                  "recommendDowngrades": {
+                    "type": "string"
+                  },
+                  "recommendTerms": {
+                    "type": "string"
+                  },
+                  "recommendUpgrades": {
+                    "type": "string"
+                  },
+                  "sections": {
+                    "type": "object",
+                    "properties": {
+                      "downgrades": {
+                        "type": "boolean"
+                      },
+                      "method": {
+                        "type": "boolean"
+                      },
+                      "reclaim": {
+                        "type": "boolean"
+                      },
+                      "spend": {
+                        "type": "boolean"
+                      },
+                      "terms": {
+                        "type": "boolean"
+                      },
+                      "upgrades": {
+                        "type": "boolean"
+                      }
+                    }
+                  },
+                  "tenantFilter": {
+                    "type": "string",
+                    "description": "The tenant to report on. A single tenant; AllTenants is not supported."
+                  },
+                  "tenureMonths": {
+                    "type": "string",
+                    "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6."
                   }
-                }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
               }
             }
           }
         },
         "parameters": [
           {
-            "name": "IP",
+            "name": "brandingPresetId",
+            "in": "query",
+            "description": "The branding preset to render against (the Licensing Report default from the branding settings), else the global branding.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "currency",
+            "in": "query",
+            "description": "Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "inactiveDays",
+            "in": "query",
+            "description": "Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "protectSecurityFeatures",
             "in": "query",
             "required": false,
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "name": "recommendDowngrades",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "recommendTerms",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "recommendUpgrades",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          },
+          {
+            "name": "tenureMonths",
+            "in": "query",
+            "description": "Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -22641,11 +23814,17 @@
               }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
           "401": {
             "description": "Unauthorized - invalid or missing bearer token"
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -22653,8 +23832,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read",
-        "x-cipp-any-tenant": true
+        "x-cipp-role": "Tenant.Directory.Read"
       }
     },
     "/api/ExecGetLocalAdminPassword": {
@@ -22718,6 +23896,143 @@
         "x-cipp-role": "Endpoint.Device.Read"
       }
     },
+    "/api/ExecGetMailFlowReportPdf": {
+      "post": {
+        "summary": "ExecGetMailFlowReportPdf",
+        "operationId": "ExecGetMailFlowReportPdf",
+        "tags": [
+          "Email-Exchange > Reports"
+        ],
+        "description": "Server-renders the Exchange mail flow report as application/pdf bytes. Reads the same three Exchange\nreports the Mail Flow page uses (Get-MailFlowStatusReport plus the TopMailSender and\nTopSpamRecipient traffic summaries), aggregates the daily disposition rows the way the page does,\nand composes them through the shared CIPPSharp kit (Build-CippMailFlowReportTree) - the server-side\nreplacement for the client react-pdf MailFlowReportButton.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "tenantFilter": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "name": "days",
+            "in": "query",
+            "description": "Reporting window in days (1-90).",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Exchange.Mailbox.Read"
+      }
+    },
+    "/api/ExecGetPermissionsReportPdf": {
+      "post": {
+        "summary": "ExecGetPermissionsReportPdf",
+        "operationId": "ExecGetPermissionsReportPdf",
+        "tags": [
+          "Teams-Sharepoint"
+        ],
+        "description": "Server-renders the SharePoint Permissions report as application/pdf bytes. Gathers the same shaped\ndata the Permissions page uses (ListSharePointPermissions, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippPermissionsReportTree) and returns the\nfinished PDF - the server-side replacement for the client react-pdf PermissionsReportButton.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "tenantFilter": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Sharepoint.Site.Read"
+      }
+    },
     "/api/ExecGetRecoveryKey": {
       "post": {
         "summary": "ExecGetRecoveryKey",
@@ -22798,6 +24113,210 @@
         "x-cipp-role": "Endpoint.Device.Read"
       }
     },
+    "/api/ExecGetReportBuilderPdf": {
+      "get": {
+        "summary": "ExecGetReportBuilderPdf",
+        "operationId": "ExecGetReportBuilderPdf",
+        "tags": [
+          "Tools > Report-Builder"
+        ],
+        "description": "Returns the server-rendered PDF for a generated Report Builder report as application/pdf bytes.\nBacks both the in-app preview (shown in an iframe) and the download button on the view page.\nA report generated before server-side rendering (or whose render failed) is rendered from its\nstored blocks on first request and cached. 404 when the report does not exist, and also when\nthe report belongs to a tenant the caller cannot access.",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "query",
+            "description": "The generated report's GUID.",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "ReportGUID",
+            "in": "query",
+            "description": "The generated report's GUID.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                  "properties": {
+                    "PartitionKey": {
+                      "x-cipp-field-source": "backend"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "404": {
+            "description": "Not found"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.ReportBuilder.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
+    "/api/ExecGetShadowAIReportPdf": {
+      "post": {
+        "summary": "ExecGetShadowAIReportPdf",
+        "operationId": "ExecGetShadowAIReportPdf",
+        "tags": [
+          "Tenant > AI"
+        ],
+        "description": "Server-renders the Shadow AI report as application/pdf bytes. Gathers the same shaped data the\nShadow AI page uses (ListShadowAI) and composes it through the shared CIPPSharp component kit\n(Build-CippShadowAIReportTree) - the server-side replacement for the client react-pdf\nShadowAIReportButton.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "sectionConfig": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  },
+                  "tenantFilter": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Tenant.AI.Read"
+      }
+    },
+    "/api/ExecGetSharingReportPdf": {
+      "post": {
+        "summary": "ExecGetSharingReportPdf",
+        "operationId": "ExecGetSharingReportPdf",
+        "tags": [
+          "Teams-Sharepoint"
+        ],
+        "description": "Server-renders the SharePoint & OneDrive Sharing report as application/pdf bytes. Gathers the same\nshaped data the Sharing page uses (ListSharePointSharing, from the CIPP reporting cache), composes\nit through the shared CIPPSharp component kit (Build-CippSharingReportTree) and returns the finished\nPDF - the server-side replacement for the client react-pdf SharingReportButton.",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "tenantFilter": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Sharepoint.Site.Read"
+      }
+    },
     "/api/ExecGitHubAction": {
       "post": {
         "summary": "Invoke GitHub Action",
@@ -23904,7 +25423,7 @@
         "tags": [
           "Email-Exchange > Tools"
         ],
-        "description": "Enables or disables Microsoft Purview Message Encryption for a tenant by setting AzureRMSLicensingEnabled and the Outlook Encrypt button by setting SimplifiedClientAccessEnabled, or runs Test-IRMConfiguration to verify that encryption and decryption work end to end.",
+        "description": "Updates the Microsoft Purview Message Encryption configuration for a tenant (AzureRMSLicensingEnabled, SimplifiedClientAccessEnabled, EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled, TransportDecryptionSetting; only the settings present in the body are changed), or runs Test-IRMConfiguration to verify that encryption and decryption work end to end.",
         "requestBody": {
           "required": true,
           "content": {
@@ -23919,21 +25438,17 @@
                       "Test"
                     ]
                   },
-                  "AzureRMSLicensingEnabled": {
-                    "type": "string"
-                  },
                   "Recipient": {
                     "type": "string"
                   },
                   "Sender": {
                     "type": "string"
                   },
-                  "SimplifiedClientAccessEnabled": {
-                    "type": "string",
-                    "description": "Only touch the Encrypt button setting when the caller sent it, so an API client that posts just AzureRMSLicensingEnabled does not silently disable it."
-                  },
                   "tenantFilter": {
                     "type": "string"
+                  },
+                  "TransportDecryptionSetting": {
+                    "type": "string"
                   }
                 },
                 "required": [
@@ -28282,6 +29797,9 @@
                   },
                   "standardsExcludeAllTenants": {
                     "type": "boolean"
+                  },
+                  "tenantGroups": {
+                    "type": "string"
                   }
                 }
               }
@@ -28333,6 +29851,9 @@
                     "Status": {
                       "x-cipp-field-source": "storage,backend"
                     },
+                    "TenantGroups": {
+                      "x-cipp-field-source": "storage,backend"
+                    },
                     "Timestamp": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -28382,7 +29903,10 @@
                     "type": "string"
                   },
                   "UserPrincipalName": {
-                    "type": "string"
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
                   }
                 },
                 "required": [
@@ -28983,21 +30507,207 @@
         "x-cipp-role": "Identity.User.ReadWrite"
       }
     },
-    "/api/ExecPermissionRepair": {
+    "/api/ExecPermissionRepair": {
+      "post": {
+        "summary": "This endpoint will update the CIPP-SAM app permissions.",
+        "operationId": "ExecPermissionRepair",
+        "tags": [
+          "CIPP > Settings"
+        ],
+        "description": "Merges new permissions from the SAM manifest into the AppPermissions entry for CIPP-SAM.",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {}
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.AppSettings.ReadWrite"
+      }
+    },
+    "/api/ExecPerUserMFA": {
+      "post": {
+        "summary": "ExecPerUserMFA",
+        "operationId": "ExecPerUserMFA",
+        "tags": [
+          "Identity > Administration > Users"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "State": {
+                    "$ref": "#/components/schemas/LabelValue"
+                  },
+                  "tenantFilter": {
+                    "type": "string"
+                  },
+                  "userId": {
+                    "type": "string",
+                    "description": "Guest user handling"
+                  },
+                  "userPrincipalName": {
+                    "type": "string",
+                    "description": "Guest user handling"
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/StandardResults"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Identity.User.ReadWrite"
+      }
+    },
+    "/api/ExecPIMRoleAssignment": {
       "post": {
-        "summary": "This endpoint will update the CIPP-SAM app permissions.",
-        "operationId": "ExecPermissionRepair",
+        "summary": "Change a directory role assignment through PIM in the secure direction only.",
+        "operationId": "ExecPIMRoleAssignment",
         "tags": [
-          "CIPP > Settings"
+          "Identity > Administration > Roles"
         ],
-        "description": "Merges new permissions from the SAM manifest into the AppPermissions entry for CIPP-SAM.",
+        "description": "Converts a permanent assignment to eligible, grants a time-bound active assignment, extends or renews a time-bound assignment or eligibility, or removes an assignment. Every request must carry an expiration (a duration or an end date); permanent / no-expiration assignments are refused, as are changes to group-inherited rows, the CIPP-SAM application and the last active Global Administrator. Requires Entra ID P2.",
         "requestBody": {
-          "required": false,
+          "required": true,
           "content": {
             "application/json": {
               "schema": {
                 "type": "object",
-                "properties": {}
+                "properties": {
+                  "Action": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "ConvertToEligible | GrantActive | Extend | Renew | Remove"
+                  },
+                  "AssignmentType": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "The row's current assignment type: Permanent | Active | ActivatedFromEligible | Eligible"
+                  },
+                  "DirectoryScopeId": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "'/' for the whole directory or '/administrativeUnits/{id}'."
+                  },
+                  "Duration": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "ISO 8601 lifetime such as PT4H or P1Y. Use either Duration or EndDateTime, not both."
+                  },
+                  "EndDateTime": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "Absolute end (unix seconds or ISO 8601). Use either Duration or EndDateTime, not both."
+                  },
+                  "Justification": {
+                    "type": "string",
+                    "description": "Reason recorded on the PIM request and in the CIPP logbook."
+                  },
+                  "PrincipalId": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "Object id of the user, group or service principal."
+                  },
+                  "RoleDefinitionId": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "Role template id (roleDefinitionId as PIM reports it)."
+                  },
+                  "tenantFilter": {
+                    "$ref": "#/components/schemas/LabelValue"
+                  },
+                  "TimeZone": {
+                    "allOf": [
+                      {
+                        "$ref": "#/components/schemas/LabelValue"
+                      }
+                    ],
+                    "description": "IANA time zone of the browser (e.g. Australia/Perth); only used to word the end time in the result."
+                  }
+                },
+                "required": [
+                  "tenantFilter"
+                ]
               }
             }
           }
@@ -29008,12 +30718,14 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object",
-                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                  "$ref": "#/components/schemas/StandardResults"
                 }
               }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
           "401": {
             "description": "Unauthorized - invalid or missing bearer token"
           },
@@ -29026,41 +30738,43 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.AppSettings.ReadWrite"
+        "x-cipp-role": "Identity.Role.ReadWrite"
       }
     },
-    "/api/ExecPerUserMFA": {
+    "/api/ExecPreviewBrandingReportPdf": {
       "post": {
-        "summary": "ExecPerUserMFA",
-        "operationId": "ExecPerUserMFA",
+        "summary": "ExecPreviewBrandingReportPdf",
+        "operationId": "ExecPreviewBrandingReportPdf",
         "tags": [
-          "Identity > Administration > Users"
+          "CIPP > Settings"
         ],
+        "description": "Renders a sample report against a branding configuration - normally the unsaved state of the\nbranding editor - and returns it as application/pdf bytes, so a colour, logo, cover, footer or\nwatermark can be judged on every page of a real report before it is saved. Each report type has\na fixed sample of the data its builder needs (Config/ReportSamples/<type>.json); nothing is read\nfrom a tenant.",
         "requestBody": {
-          "required": true,
+          "required": false,
           "content": {
             "application/json": {
               "schema": {
                 "type": "object",
                 "properties": {
-                  "State": {
-                    "$ref": "#/components/schemas/LabelValue"
-                  },
-                  "tenantFilter": {
-                    "type": "string"
+                  "branding": {
+                    "type": "object",
+                    "properties": {
+                      "tenantLabel": {
+                        "type": "string",
+                        "description": "The sample tenant, named the way the branding under edit would name a real one."
+                      }
+                    },
+                    "description": "The branding to render against, in the shape Get-CIPPBrandingSettings returns: colours (flat or under roleColours), a data-URL logo and cover or a coverStock path, footer, watermark and tenantLabel. Omitted -> the saved branding settings."
                   },
-                  "userId": {
+                  "reportType": {
                     "type": "string",
-                    "description": "Guest user handling"
+                    "description": "Which report to preview: executive, reportBuilder, shadowAI, bec, becSummary, sharing, permissions, mailFlow, licensing or baseline."
                   },
-                  "userPrincipalName": {
+                  "tenantFilter": {
                     "type": "string",
-                    "description": "Guest user handling"
+                    "description": "Optional: the tenant whose %variables% (%cippurl%, custom variables) resolve in the footer and cover."
                   }
-                },
-                "required": [
-                  "tenantFilter"
-                ]
+                }
               }
             }
           }
@@ -29071,11 +30785,15 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/StandardResults"
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
                 }
               }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
           "401": {
             "description": "Unauthorized - invalid or missing bearer token"
           },
@@ -29091,17 +30809,18 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Identity.User.ReadWrite"
+        "x-cipp-role": "CIPP.AppSettings.Read",
+        "x-cipp-any-tenant": true
       }
     },
-    "/api/ExecPIMRoleAssignment": {
+    "/api/ExecPreviewReportBuilderPdf": {
       "post": {
-        "summary": "Change a directory role assignment through PIM in the secure direction only.",
-        "operationId": "ExecPIMRoleAssignment",
+        "summary": "ExecPreviewReportBuilderPdf",
+        "operationId": "ExecPreviewReportBuilderPdf",
         "tags": [
-          "Identity > Administration > Roles"
+          "Tools > Report-Builder"
         ],
-        "description": "Converts a permanent assignment to eligible, grants a time-bound active assignment, extends or renews a time-bound assignment or eligibility, or removes an assignment. Every request must carry an expiration (a duration or an end date); permanent / no-expiration assignments are refused, as are changes to group-inherited rows, the CIPP-SAM application and the last active Global Administrator. Requires Entra ID P2.",
+        "description": "Renders the current (unsaved) Report Builder state to a PDF and returns it as application/pdf\nbytes without persisting a generated-report row. Powers the builder's live preview and download.",
         "requestBody": {
           "required": true,
           "content": {
@@ -29109,104 +30828,54 @@
               "schema": {
                 "type": "object",
                 "properties": {
-                  "Action": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "ConvertToEligible | GrantActive | Extend | Renew | Remove"
-                  },
-                  "AssignmentType": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "The row's current assignment type: Permanent | Active | ActivatedFromEligible | Eligible"
-                  },
-                  "DirectoryScopeId": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "'/' for the whole directory or '/administrativeUnits/{id}'."
-                  },
-                  "Duration": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "ISO 8601 lifetime such as PT4H or P1Y. Use either Duration or EndDateTime, not both."
-                  },
-                  "EndDateTime": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "Absolute end (unix seconds or ISO 8601). Use either Duration or EndDateTime, not both."
-                  },
-                  "Justification": {
-                    "type": "string",
-                    "description": "Reason recorded on the PIM request and in the CIPP logbook."
+                  "Blocks": {
+                    "type": "string"
                   },
-                  "PrincipalId": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "Object id of the user, group or service principal."
+                  "Settings": {
+                    "type": "string"
                   },
-                  "RoleDefinitionId": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "Role template id (roleDefinitionId as PIM reports it)."
+                  "TemplateGUID": {
+                    "type": "string"
                   },
-                  "tenantFilter": {
-                    "$ref": "#/components/schemas/LabelValue"
+                  "TemplateName": {
+                    "type": "string"
                   },
-                  "TimeZone": {
-                    "allOf": [
-                      {
-                        "$ref": "#/components/schemas/LabelValue"
-                      }
-                    ],
-                    "description": "IANA time zone of the browser (e.g. Australia/Perth); only used to word the end time in the result."
+                  "TenantFilter": {
+                    "type": "string"
                   }
                 },
                 "required": [
-                  "tenantFilter"
+                  "TenantFilter"
                 ]
               }
             }
           }
         },
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
         "responses": {
           "200": {
             "description": "Success",
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/StandardResults"
+                  "type": "object",
+                  "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
                 }
               }
             }
           },
-          "400": {
-            "description": "Bad request - missing required field or invalid input"
-          },
           "401": {
             "description": "Unauthorized - invalid or missing bearer token"
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -29214,7 +30883,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Identity.Role.ReadWrite"
+        "x-cipp-role": "CIPP.ReportBuilder.ReadWrite"
       }
     },
     "/api/ExecQuarantineManagement": {
@@ -30470,9 +32139,6 @@
                     "ExcludeUser": {
                       "x-cipp-field-source": "storage"
                     },
-                    "GraphErrorCount": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "hasAutoExtend": {
                       "x-cipp-field-source": "storage"
                     },
@@ -30657,6 +32323,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -30681,11 +32350,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -30716,7 +32389,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.ReadWrite"
+        "x-cipp-role": "CIPP.ReportBuilder.ReadWrite"
       }
     },
     "/api/ExecReprocessUserLicenses": {
@@ -31611,6 +33284,9 @@
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -34507,6 +36183,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -34534,11 +36213,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -34894,7 +36577,7 @@
         "tags": [
           "Teams-Sharepoint"
         ],
-        "description": "Adds or removes a user in a SharePoint site role (Owners, Members or Visitors).\nGroup-connected sites manage Owners/Members through the backing M365 group via Graph;\nVisitors (and classic/communication sites entirely) are managed through the site's\nassociated SharePoint role groups via the SharePoint REST API using certificate\nauthentication. Removals sourced from ListSiteMembers carry the group and type of the\nselected entry, so users directly added to a role group on a group-connected site are\nremoved from that group rather than from the M365 group.",
+        "description": "Adds one or more users to, or removes a user from, a SharePoint site role (Owners, Members or Visitors).\nGroup-connected sites manage Owners/Members through the backing M365 group via Graph;\nVisitors (and classic/communication sites entirely) are managed through the site's\nassociated SharePoint role groups via the SharePoint REST API using certificate\nauthentication. Removals sourced from ListSiteMembers carry the group and type of the\nselected entry, so users directly added to a role group on a group-connected site are\nremoved from that group rather than from the M365 group.",
         "requestBody": {
           "required": true,
           "content": {
@@ -34909,8 +36592,7 @@
                     "type": "string"
                   },
                   "Role": {
-                    "type": "string",
-                    "description": "Role comes from the removal picker's selected entry when present, else from the form."
+                    "type": "string"
                   },
                   "SharePointType": {
                     "type": "string"
@@ -34919,8 +36601,7 @@
                     "type": "string"
                   },
                   "URL": {
-                    "type": "string",
-                    "description": "SharePoint role group management via REST with certificate auth."
+                    "type": "string"
                   },
                   "user": {
                     "type": "object",
@@ -34929,28 +36610,21 @@
                         "type": "object",
                         "properties": {
                           "Group": {
-                            "type": "string",
-                            "description": "Role comes from the removal picker's selected entry when present, else from the form."
+                            "type": "string"
                           },
                           "Type": {
                             "type": "string"
                           }
-                        },
-                        "description": "Role comes from the removal picker's selected entry when present, else from the form."
+                        }
                       },
                       "value": {
                         "type": "string"
                       }
-                    },
-                    "required": [
-                      "value"
-                    ],
-                    "description": "Role comes from the removal picker's selected entry when present, else from the form."
+                    }
                   }
                 },
                 "required": [
-                  "tenantFilter",
-                  "URL"
+                  "tenantFilter"
                 ]
               }
             }
@@ -35137,7 +36811,7 @@
         "summary": "ExecShadowAISanction",
         "operationId": "ExecShadowAISanction",
         "tags": [
-          "Tenant > Standards"
+          "Tenant > AI"
         ],
         "description": "Marks an AI tool from the Shadow AI catalog as company sanctioned for a tenant, or removes\nthat status. Sanctioned tools are stored per tenant in the ShadowAIConfig table and are\nreported by ListShadowAI with risk 'Informational' and status 'Sanctioned'; all other\ndetected AI tools report status 'Unsanctioned'.",
         "requestBody": {
@@ -35198,7 +36872,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.ReadWrite"
+        "x-cipp-role": "Tenant.AI.ReadWrite"
       }
     },
     "/api/ExecSharePointPerms": {
@@ -35371,6 +37045,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -35401,11 +37078,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -35753,6 +37434,7 @@
         "tags": [
           "CIPP > Core"
         ],
+        "description": "Snoozes one alert item so it stops notifying. Body: CmdletName, TenantFilter, AlertItem,\nand either Duration (7, 14, 30 or 90 days) or UntilResolved=true, which keeps the snooze\nuntil the alert stops reporting the item and is then removed automatically. KeepVisible=true\nleaves the item on the dashboard, marked as snoozed, rather than hiding it. Reason is an\noptional note. There is no indefinite snooze.",
         "requestBody": {
           "required": false,
           "content": {
@@ -35767,13 +37449,19 @@
                     "type": "string"
                   },
                   "Duration": {
-                    "type": "integer"
+                    "type": "string"
+                  },
+                  "KeepVisible": {
+                    "type": "string"
                   },
                   "Reason": {
                     "type": "string"
                   },
                   "TenantFilter": {
                     "type": "string"
+                  },
+                  "UntilResolved": {
+                    "type": "string"
                   }
                 }
               }
@@ -36063,6 +37751,9 @@
                   "type": "object",
                   "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                   "properties": {
+                    "ContentHash": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "ETag": {
                       "type": "string",
                       "x-cipp-field-source": "storage"
@@ -36090,11 +37781,15 @@
                       "x-cipp-field-source": "storage"
                     },
                     "SHA": {
+                      "type": "string",
                       "x-cipp-field-source": "storage"
                     },
                     "Source": {
                       "x-cipp-field-source": "storage"
                     },
+                    "SourcePath": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "TemplateName": {
                       "x-cipp-field-source": "storage"
                     },
@@ -37189,6 +38884,9 @@
                       "type": "string",
                       "x-cipp-field-source": "storage"
                     },
+                    "PendingVerification": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "Results": {
                       "x-cipp-field-source": "backend"
                     },
@@ -37367,47 +39065,10 @@
               "application/json": {
                 "schema": {
                   "type": "object",
-                  "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                  "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
                   "properties": {
-                    "APIKey": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "ApplicationId": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "ApplicationSecret": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "ETag": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
-                    "PartitionKey": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "RefreshToken": {
-                      "x-cipp-field-source": "storage"
-                    },
                     "Results": {
                       "x-cipp-field-source": "backend"
-                    },
-                    "RowKey": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
-                    "SASUrl": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "SecretValue": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
-                    },
-                    "TenantId": {
-                      "x-cipp-field-source": "storage"
-                    },
-                    "Timestamp": {
-                      "type": "string",
-                      "x-cipp-field-source": "storage"
                     }
                   }
                 }
@@ -37710,7 +39371,7 @@
         "tags": [
           "CIPP > Core"
         ],
-        "description": "Returns the CIPP dashboard banner notifications: any hosted maintenance notice, today's most recent entries from the alert log, and warnings for an out-of-date or misconfigured deployment.",
+        "description": "Returns the CIPP dashboard banner notifications: any hosted maintenance notice, a legacy infrastructure warning for instances still on Function Apps, today's most recent entries from the alert log, and warnings for an out-of-date or misconfigured deployment.",
         "parameters": [
           {
             "name": "localversion",
@@ -37956,7 +39617,7 @@
         "summary": "ListAgent365PackageDetail",
         "operationId": "ListAgent365PackageDetail",
         "tags": [
-          "Tenant > Standards"
+          "Tenant > AI"
         ],
         "description": "Gets the full detail for a single Microsoft Agent 365 / Copilot package by id, including the\nallowedUsersAndGroups, acquireUsersAndGroups and elementDetails that the list endpoint omits.\nUses delegated auth: this call returns 424 Failed Dependency under application context.",
         "parameters": [
@@ -38132,7 +39793,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.Read"
+        "x-cipp-role": "Tenant.AI.Read"
       }
     },
     "/api/ListAgent365Packages": {
@@ -38140,7 +39801,7 @@
         "summary": "ListAgent365Packages",
         "operationId": "ListAgent365Packages",
         "tags": [
-          "Tenant > Standards"
+          "Tenant > AI"
         ],
         "description": "Lists Microsoft Agent 365 / Copilot packages (agents and Microsoft 365 apps) in the tenant\ncatalog via the Package Management API. Requires a Microsoft Agent 365 license on the tenant.\nUses delegated auth: the Package Management API currently fails under application context\n(424 Failed Dependency on GET, partial on LIST). Agents are NOT returned by the default list,\nso this also queries supportedHosts=Copilot and merges the results (deduped by id). An explicit\nOData $filter (Filter query parameter) overrides the default merge.",
         "parameters": [
@@ -38316,7 +39977,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.Read"
+        "x-cipp-role": "Tenant.AI.Read"
       }
     },
     "/api/ListAlertResults": {
@@ -38326,8 +39987,24 @@
         "tags": [
           "CIPP > Core"
         ],
-        "description": "Lists the currently-active fired alert items for a tenant, read from the\nAlertLastRun table. AlertLastRun stores the items produced by the most recent\nrun of each scripted alert (Get-CIPPAlert*) after snoozed items have already\nbeen filtered out, so this returns the active (non-snoozed) instances. Each\nitem is returned with a content preview/hash (matching the snooze format) and\nthe raw alert item so the frontend can snooze it via ExecSnoozeAlert.",
+        "description": "Lists the tracked alert items for a tenant from the AlertLifecycle table, which\nWrite-AlertTrace maintains: one row per alert item with its Status (Open, Snoozed or\nResolved), when it was first and last seen, when it was last checked, how often it\nreopened and the snooze details when one applies. Pass tenantFilter (or AllTenants for\nevery tenant the caller may see). Open and Snoozed items are always returned; Resolved\nitems are included when IncludeResolved=true, limited to those resolved within the last\nDays days (default 2, at most 366). Each item carries the raw alert item and the keys\nneeded to snooze or unsnooze it.",
         "parameters": [
+          {
+            "name": "Days",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "IncludeResolved",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "tenantFilter",
             "in": "query",
@@ -38346,21 +40023,57 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                    "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "CmdletName": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "ContentPreview": {
+                        "x-cipp-field-source": "frontend"
+                      },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
                       },
-                      "LastRunTime": {
-                        "x-cipp-field-source": "storage"
+                      "FirstSeen": {
+                        "x-cipp-field-source": "frontend"
                       },
-                      "PartitionKey": {
+                      "LastChecked": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "LastSeen": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "ReopenCount": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "ResolvedAt": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "SnoozedBy": {
+                        "x-cipp-field-source": "storage,frontend"
+                      },
+                      "SnoozeReason": {
+                        "x-cipp-field-source": "storage,frontend"
+                      },
+                      "SnoozeRowKey": {
                         "x-cipp-field-source": "storage"
                       },
-                      "RowKey": {
+                      "SnoozeUntil": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SnoozeUntilResolved": {
+                        "x-cipp-field-source": "storage,frontend"
+                      },
+                      "SnoozeVisible": {
+                        "x-cipp-field-source": "storage,frontend"
+                      },
+                      "Status": {
+                        "x-cipp-field-source": "storage,frontend"
+                      },
+                      "Tenant": {
+                        "x-cipp-field-source": "frontend"
+                      },
                       "Timestamp": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
@@ -39005,6 +40718,9 @@
                       "AppType": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "Error": {
                         "x-cipp-field-source": "backend"
                       },
@@ -39035,11 +40751,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateId": {
                         "x-cipp-field-source": "backend"
                       },
@@ -39643,222 +41363,232 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
-                      "appCount": {
-                        "x-cipp-field-source": "backend,frontend"
-                      },
-                      "appNames": {
-                        "x-cipp-field-source": "backend,frontend"
-                      },
-                      "Apps": {
+                      "appCount": {
+                        "x-cipp-field-source": "backend,frontend"
+                      },
+                      "appNames": {
+                        "x-cipp-field-source": "backend,frontend"
+                      },
+                      "Apps": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "appTypes": {
+                        "x-cipp-field-source": "backend,frontend"
+                      },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "description": {
+                        "x-cipp-field-source": "backend,frontend"
+                      },
+                      "displayName": {
+                        "x-cipp-field-source": "backend,frontend"
+                      },
+                      "ETag": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "GUID": {
+                        "x-cipp-field-source": "storage,backend"
+                      },
+                      "JSON": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "Package": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "PartitionKey": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "Permissions": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "RowKey": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "SHA": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "Source": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "TemplateName": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "Timestamp": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "UpdatedBy": {
+                        "x-cipp-field-source": "storage"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Endpoint.Application.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
+    "/api/ListAssignmentFilters": {
+      "get": {
+        "summary": "ListAssignmentFilters",
+        "operationId": "ListAssignmentFilters",
+        "tags": [
+          "Endpoint > MEM"
+        ],
+        "description": "Lists Intune assignment filters for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.",
+        "parameters": [
+          {
+            "name": "filterId",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          },
+          {
+            "name": "UseReportDB",
+            "in": "query",
+            "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.",
+                    "properties": {
+                      "assignmentFilterManagementType": {
+                        "type": "object",
+                        "x-cipp-field-source": "graph-entity,frontend"
+                      },
+                      "createdDateTime": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "description": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity,frontend"
+                      },
+                      "displayName": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity,frontend"
+                      },
+                      "id": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "lastModifiedDateTime": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "payloads": {
+                        "type": "array",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "platform": {
+                        "type": "object",
+                        "x-cipp-field-source": "graph-entity,frontend"
+                      },
+                      "roleScopeTags": {
+                        "type": "array",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "rule": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity,frontend"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Endpoint.MEM.Read"
+      }
+    },
+    "/api/ListAssignmentFilterTemplates": {
+      "get": {
+        "summary": "ListAssignmentFilterTemplates",
+        "operationId": "ListAssignmentFilterTemplates",
+        "tags": [
+          "Endpoint > MEM"
+        ],
+        "description": "Lists the saved Intune assignment filter templates, each with its platform, filter rule and management type. Pass ID to return a single template. These are CIPP templates, not a tenant's deployed filters.",
+        "parameters": [
+          {
+            "name": "ID",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                    "properties": {
+                      "assignmentFilterManagementType": {
                         "x-cipp-field-source": "backend"
                       },
-                      "appTypes": {
-                        "x-cipp-field-source": "backend,frontend"
-                      },
-                      "description": {
-                        "x-cipp-field-source": "backend,frontend"
-                      },
-                      "displayName": {
-                        "x-cipp-field-source": "backend,frontend"
-                      },
-                      "ETag": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "GUID": {
-                        "x-cipp-field-source": "storage,backend"
-                      },
-                      "JSON": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Package": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "PartitionKey": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Permissions": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "RowKey": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "SHA": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Source": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "TemplateName": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Timestamp": {
-                        "type": "string",
+                      "ContentHash": {
                         "x-cipp-field-source": "storage"
                       },
-                      "UpdatedBy": {
-                        "x-cipp-field-source": "storage"
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Endpoint.Application.Read",
-        "x-cipp-any-tenant": true
-      }
-    },
-    "/api/ListAssignmentFilters": {
-      "get": {
-        "summary": "ListAssignmentFilters",
-        "operationId": "ListAssignmentFilters",
-        "tags": [
-          "Endpoint > MEM"
-        ],
-        "description": "Lists Intune assignment filters for a tenant. Supports UseReportDB=true query parameter to retrieve cached data from the reporting database for significantly better performance, especially when querying AllTenants.",
-        "parameters": [
-          {
-            "name": "filterId",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "$ref": "#/components/parameters/tenantFilter"
-          },
-          {
-            "name": "UseReportDB",
-            "in": "query",
-            "description": "Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.",
-            "required": false,
-            "schema": {
-              "type": "boolean"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.",
-                    "properties": {
-                      "assignmentFilterManagementType": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity,frontend"
-                      },
-                      "createdDateTime": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "description": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity,frontend"
-                      },
-                      "displayName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity,frontend"
-                      },
-                      "id": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "lastModifiedDateTime": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "payloads": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "platform": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity,frontend"
-                      },
-                      "roleScopeTags": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "rule": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity,frontend"
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Endpoint.MEM.Read"
-      }
-    },
-    "/api/ListAssignmentFilterTemplates": {
-      "get": {
-        "summary": "ListAssignmentFilterTemplates",
-        "operationId": "ListAssignmentFilterTemplates",
-        "tags": [
-          "Endpoint > MEM"
-        ],
-        "description": "Lists the saved Intune assignment filter templates, each with its platform, filter rule and management type. Pass ID to return a single template. These are CIPP templates, not a tenant's deployed filters.",
-        "parameters": [
-          {
-            "name": "ID",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
-                    "properties": {
-                      "assignmentFilterManagementType": {
-                        "x-cipp-field-source": "backend"
-                      },
                       "description": {
                         "x-cipp-field-source": "backend,frontend"
                       },
@@ -39895,11 +41625,15 @@
                         "x-cipp-field-source": "backend"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -40201,6 +41935,9 @@
                         "type": "string",
                         "x-cipp-field-source": "storage"
                       },
+                      "EventCreationTime": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "LogId": {
                         "x-cipp-field-source": "backend"
                       },
@@ -40460,7 +42197,57 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                    "description": "Derived from the Microsoft Graph entity it queries, and the columns the CIPP UI renders. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.",
+                    "properties": {
+                      "createdDateTime": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "description": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity,frontend"
+                      },
+                      "deviceEnrollmentConfigurationType": {
+                        "type": "object",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "deviceNameTemplate": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "displayName": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity,frontend"
+                      },
+                      "extractHardwareHash": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "id": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "language": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "lastModifiedDateTime": {
+                        "type": "string",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "PolicyAssignment": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "priority": {
+                        "type": "integer",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "roleScopeTagIds": {
+                        "type": "array",
+                        "x-cipp-field-source": "graph-entity"
+                      },
+                      "version": {
+                        "type": "integer",
+                        "x-cipp-field-source": "graph-entity"
+                      }
+                    }
                   }
                 }
               }
@@ -40620,9 +42407,14 @@
           {
             "name": "DataToReturn",
             "in": "query",
+            "description": "Optional. Which section to return: 'AzureADConnectSettings' for the sync status and configuration, or 'AzureADObjectsInError' for objects that failed to sync. Omit to return both.",
             "required": false,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "enum": [
+                "AzureADConnectSettings",
+                "AzureADObjectsInError"
+              ]
             }
           },
           {
@@ -40682,6 +42474,9 @@
               }
             }
           },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
           "401": {
             "description": "Unauthorized - invalid or missing bearer token"
           },
@@ -40790,6 +42585,9 @@
                       "remediationPosture": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "source": {
+                        "x-cipp-field-source": "frontend"
+                      },
                       "stageNames": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -40944,18 +42742,37 @@
         "x-cipp-role": "Identity.AuditLog.Read"
       }
     },
-    "/api/ListBPA": {
+    "/api/ListBECPhishingSpread": {
       "get": {
-        "summary": "ListBPA",
-        "operationId": "ListBPA",
+        "summary": "Lists who else received mail from a sender, from message-trace metadata.",
+        "operationId": "ListBECPhishingSpread",
         "tags": [
-          "Tenant > Standards"
+          "Identity > Administration > Users"
         ],
-        "description": "Lists Best Practice Analyser (BPA) report results for tenants, based on a selected BPA template.",
+        "description": "Given a sender address (and optionally a subject fragment), walks the message trace for the last N days and groups the recipients: address, internal or external, message count, first and last delivery and the subjects seen. Use it to find the spread of a phishing message from a compromised or look-alike sender. Metadata only - no message content is read.",
         "parameters": [
           {
-            "name": "Report",
+            "name": "days",
+            "in": "query",
+            "description": "look-back in days (1-90)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "sender",
+            "in": "query",
+            "description": "the sender to trace",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "subject",
             "in": "query",
+            "description": "optional subject fragment to narrow the trace (case-insensitive contains)",
             "required": false,
             "schema": {
               "type": "string"
@@ -40974,58 +42791,109 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
                     "properties": {
-                      "Columns": {
+                      "Complete": {
                         "x-cipp-field-source": "backend"
                       },
-                      "Data": {
+                      "Days": {
                         "x-cipp-field-source": "backend"
                       },
-                      "ETag": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "GUID": {
-                        "x-cipp-field-source": "storage"
+                      "ExternalCount": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "JSON": {
-                        "x-cipp-field-source": "storage"
+                      "InternalCount": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Keys": {
+                      "Recipients": {
                         "x-cipp-field-source": "backend"
                       },
-                      "Package": {
-                        "x-cipp-field-source": "storage"
+                      "Sender": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "PartitionKey": {
-                        "x-cipp-field-source": "storage"
+                      "TotalMessages": {
+                        "x-cipp-field-source": "backend"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Identity.User.Read"
+      }
+    },
+    "/api/ListBECRemediationActions": {
+      "post": {
+        "summary": "Lists the available Business Email Compromise containment actions.",
+        "operationId": "ListBECRemediationActions",
+        "tags": [
+          "Identity > Administration > Users"
+        ],
+        "description": "Returns the catalog of containment actions ExecBECRemediate accepts - id, label, description, impact (Low/Medium/High/Critical), whether it is reversible and whether it runs by default (the instance-wide defaults from CIPP settings).",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {}
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                    "properties": {
+                      "DefaultSelected": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Permissions": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
+                      "Description": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "RowKey": {
-                        "x-cipp-field-source": "storage"
+                      "Id": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "SHA": {
-                        "x-cipp-field-source": "storage"
+                      "Impact": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Source": {
-                        "x-cipp-field-source": "storage"
+                      "Label": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Style": {
+                      "Order": {
                         "x-cipp-field-source": "backend"
                       },
-                      "TemplateName": {
-                        "x-cipp-field-source": "storage"
+                      "ParameterName": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Timestamp": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
+                      "Reversible": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "UpdatedBy": {
-                        "x-cipp-field-source": "storage"
+                      "TargetSource": {
+                        "x-cipp-field-source": "backend"
                       }
                     }
                   }
@@ -41038,6 +42906,9 @@
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -41045,21 +42916,31 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.BestPracticeAnalyser.Read"
+        "x-cipp-role": "Identity.User.ReadWrite",
+        "x-cipp-any-tenant": true
       }
     },
-    "/api/ListBPATemplates": {
+    "/api/ListBECReports": {
       "get": {
-        "summary": "ListBPATemplates",
-        "operationId": "ListBPATemplates",
+        "summary": "Lists Business Email Compromise runs.",
+        "operationId": "ListBECReports",
         "tags": [
-          "Tenant > Standards"
+          "Identity > Administration > Users"
         ],
-        "description": "Lists available Best Practice Analyser (BPA) templates that define which checks to run.",
+        "description": "Lists every stored BEC run (case id, user, status, threat level and score, when it was extracted, who requested it) for a tenant, or for every tenant with tenantFilter=AllTenants. Optionally narrowed to one user with userId. Runs are kept until deleted; this list never reads the result payloads.",
         "parameters": [
           {
-            "name": "RawJson",
+            "name": "tenantFilter",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "userId",
             "in": "query",
+            "description": "Narrow the list to one user's run history",
             "required": false,
             "schema": {
               "type": "string"
@@ -41075,52 +42956,49 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
                     "properties": {
-                      "ETag": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
+                      "CaseId": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "GUID": {
-                        "x-cipp-field-source": "storage"
+                      "ContainmentRuns": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "JSON": {
-                        "x-cipp-field-source": "storage"
+                      "DisplayName": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Name": {
-                        "x-cipp-field-source": "frontend"
+                      "ErrorMessage": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Package": {
-                        "x-cipp-field-source": "storage"
+                      "ExtractedAt": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "PartitionKey": {
-                        "x-cipp-field-source": "storage"
+                      "IncompleteCount": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Permissions": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
+                      "Level": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "RowKey": {
-                        "x-cipp-field-source": "storage"
+                      "RequestedAt": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "SHA": {
-                        "x-cipp-field-source": "storage"
+                      "RequestedBy": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Source": {
-                        "x-cipp-field-source": "storage"
+                      "Score": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Style": {
-                        "x-cipp-field-source": "frontend"
+                      "Status": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "TemplateName": {
-                        "x-cipp-field-source": "storage"
+                      "Tenant": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "Timestamp": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
+                      "UserId": {
+                        "x-cipp-field-source": "backend"
                       },
-                      "UpdatedBy": {
-                        "x-cipp-field-source": "storage"
+                      "UserPrincipalName": {
+                        "x-cipp-field-source": "backend"
                       }
                     }
                   }
@@ -41133,6 +43011,9 @@
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -41140,7 +43021,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.BestPracticeAnalyser.Read",
+        "x-cipp-role": "Identity.User.Read",
         "x-cipp-any-tenant": true
       }
     },
@@ -41292,7 +43173,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-role": "CIPP.BreachLookup.Read",
         "x-cipp-any-tenant": true
       }
     },
@@ -41367,7 +43248,67 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read"
+        "x-cipp-role": "CIPP.BreachLookup.Read"
+      }
+    },
+    "/api/ListCAGapAnalysis": {
+      "get": {
+        "summary": "ListCAGapAnalysis",
+        "operationId": "ListCAGapAnalysis",
+        "tags": [
+          "Tenant > SecuritySimulations"
+        ],
+        "description": "Conditional Access gap analysis for one tenant from the cached policies: findings, the\npersona-by-control coverage matrix and the 1 to 10 posture score.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                    "properties": {
+                      "analysis": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "analysisError": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "licensed": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "tenantFilter": {
+                        "x-cipp-field-source": "backend"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Tenant.SecuritySimulations.Read"
       }
     },
     "/api/ListCalendarPermissions": {
@@ -41522,6 +43463,86 @@
         "x-cipp-role": "Tenant.ConditionalAccess.Read"
       }
     },
+    "/api/ListCASituations": {
+      "get": {
+        "summary": "ListCASituations",
+        "operationId": "ListCASituations",
+        "tags": [
+          "Tenant > SecuritySimulations"
+        ],
+        "description": "Evaluates every predefined sign-in situation (admin, user and guest personas under unmanaged\ndevices, foreign locations, legacy clients, device-code flow, risk levels and more) live against the\ntenant's Conditional Access through the What If API, and names the control missing wherever a\nsign-in gets through. Optional adminUserId, userUserId and guestUserId pick the accounts to sign\nin as; country picks where the foreign-country sign-ins come from.",
+        "parameters": [
+          {
+            "name": "country",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "$ref": "#/components/parameters/tenantFilter"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                    "properties": {
+                      "candidates": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "country": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "excluded": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "identities": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "licensed": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "situations": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "summary": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "tenantFilter": {
+                        "x-cipp-field-source": "backend"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Tenant.SecuritySimulations.Read"
+      }
+    },
     "/api/ListCAtemplates": {
       "get": {
         "summary": "ListCAtemplates",
@@ -41567,6 +43588,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "displayName": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -41597,11 +43621,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage,frontend"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "templateCount": {
                         "x-cipp-field-source": "backend"
                       },
@@ -42122,7 +44150,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-role": "CIPP.TemplateLibrary.Read",
         "x-cipp-any-tenant": true
       }
     },
@@ -42188,7 +44216,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-role": "CIPP.TemplateLibrary.Read",
         "x-cipp-any-tenant": true
       }
     },
@@ -42616,6 +44644,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "EnableSafeList": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -42655,11 +44686,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -42884,6 +44919,9 @@
                       "companyName": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "displayName": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -42920,11 +44958,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -43107,7 +45149,7 @@
         "summary": "ListCopilotSettings",
         "operationId": "ListCopilotSettings",
         "tags": [
-          "Tenant > Standards"
+          "Tenant > AI"
         ],
         "description": "Lists the Microsoft 365 Copilot admin policy settings for a tenant, one row per setting,\nwith the current raw value and a friendly state (Enabled / Disabled / Not configured).",
         "parameters": [
@@ -43156,7 +45198,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.Read"
+        "x-cipp-role": "Tenant.AI.Read"
       }
     },
     "/api/ListCopilotUsage": {
@@ -43164,7 +45206,7 @@
         "summary": "ListCopilotUsage",
         "operationId": "ListCopilotUsage",
         "tags": [
-          "Tenant > Standards"
+          "Tenant > AI"
         ],
         "description": "Returns Microsoft 365 Copilot usage reports for a tenant, flattened into table rows.\nType=Adoption  -> getMicrosoft365CopilotUserCountSummary (per-product enabled vs active users)\nType=Trend     -> getMicrosoft365CopilotUserCountTrend    (per-date active/enabled users)\nType=UserDetail-> getMicrosoft365CopilotUsageUserDetail   (per-user last activity per app)",
         "parameters": [
@@ -43292,7 +45334,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.Read"
+        "x-cipp-role": "Tenant.AI.Read"
       }
     },
     "/api/ListCSPLicenses": {
@@ -43864,7 +45906,7 @@
         "tags": [
           "CIPP > Core"
         ],
-        "description": "Retrieves cached tenant data from the CIPP reporting database (CippReportingDB). This is the fastest\nand most efficient way to query tenant data across single or multiple tenants. The database is populated\nnightly by background cache jobs, so data is typically at most 24 hours old.\n\nRequired query parameters:\n  - tenantFilter: The tenant domain or 'AllTenants' to query all managed tenants.\n  - type: The cache collection to retrieve (e.g. Users, Groups, Mailboxes, Devices, etc.).\n          Not required when countsOnly=true.\n\nOptional query parameters:\n  - countsOnly: When 'true', returns one row per tenant per collection containing only the record\n                count and the time that collection was last cached. This reads the pre-computed\n                '<Type>-Count' rows, so it is a single table query regardless of tenant count and\n                never materializes the underlying records. Combine with tenantFilter=AllTenants to\n                get an estate-wide inventory and per-tenant cache freshness in one call. Pass a\n                type alongside it to restrict the result to a single collection.\n\nUse type=_availableTypes to discover which cache collections exist for a given tenant. Omitting the\ntype parameter also returns the available types.\n\nPERFORMANCE GUIDANCE: For AllTenants queries or any bulk/cross-tenant data retrieval, prefer\nListDBCache over calling individual endpoints (e.g. ListUsers, ListGroups, ListMailboxes) directly.\nIndividual endpoints make live API calls per tenant which is significantly slower and may hit\nthrottling limits. ListDBCache reads pre-cached data from Azure Table Storage and returns results\nin seconds regardless of tenant count.\n\nNote that tenantFilter=AllTenants WITH a type performs a cross-partition scan and materializes every\nrecord of that collection across every tenant, so it grows with the size of the estate. Where only\ntotals are needed, countsOnly=true is dramatically cheaper and should always be preferred.\n\nRecommended workflow for MCP tool selection:\n  1. Call ListDBCache with type=_availableTypes to discover available cache collections.\n  2. If the data you need exists as a cache type, use ListDBCache with that type.\n  3. Only fall back to individual List* endpoints when you need real-time data for a single tenant\n     or when the data is not available in the cache.\n\nCommon cache types include: Users, Groups, Mailboxes, Devices, ConditionalAccess, Applications,\nIntunePolicy, CompliancePolicy, and many more. The exact set depends on what has been configured.",
+        "description": "Retrieves cached tenant data from the CIPP reporting database (CippReportingDB). This is the fastest\nand most efficient way to query tenant data across single or multiple tenants. The database is populated\nnightly by background cache jobs, so data is typically at most 24 hours old.\n\nRequired query parameters:\n  - tenantFilter: The tenant domain or 'AllTenants' to query all managed tenants.\n\nOptional query parameters:\n  - type: The cache collection to retrieve (e.g. Users, Groups, Mailboxes, Devices, etc.).\n          Omit it (or pass type=_availableTypes) to get the list of collections for the tenant\n          instead of records; it is also not needed when countsOnly=true.\n  - countsOnly: When 'true', returns one row per tenant per collection containing only the record\n                count and the time that collection was last cached. This reads the pre-computed\n                '<Type>-Count' rows, so it is a single table query regardless of tenant count and\n                never materializes the underlying records. Combine with tenantFilter=AllTenants to\n                get an estate-wide inventory and per-tenant cache freshness in one call. Pass a\n                type alongside it to restrict the result to a single collection.\n  - select: Comma-separated list of top-level fields to keep on each record (e.g.\n            select=id,displayName,userPrincipalName). Everything else is dropped during parse,\n            shrinking the response. A kept field keeps its ENTIRE subtree, so select=conditions\n            keeps conditions.users.includeRoles too; projection never reaches inside a kept\n            value. The owning Tenant is always stamped on each record regardless of select.\n  - top: Return at most this many records. For tenantFilter=AllTenants this is a GLOBAL cap\n         across all tenants when ungrouped, so use it to sample rather than to page. When\n         groupBy=Tenant is also set, top instead caps the records within each tenant bucket.\n  - latestOnly: When 'true', keep only the newest record per tenant, ranked by dateField (or\n                an auto-detected date field such as createdDateTime). Collapses per-day\n                snapshot types like SecureScore to one current row per tenant.\n  - groupBy: Set to 'Tenant' to return one bucket per tenant as\n             { Tenant, Count, Records } objects instead of a flat record list.\n  - dateField: The record field latestOnly ranks by. Omit to auto-detect.\n\nUse type=_shape for every collection's row count and fields (recorded when the cache was written).\nUse type=_availableTypes to discover which cache collections exist for a given tenant. Omitting the\ntype parameter also returns the available types.\n\nPERFORMANCE GUIDANCE: For AllTenants queries or any bulk/cross-tenant data retrieval, prefer\nListDBCache over calling individual endpoints (e.g. ListUsers, ListGroups, ListMailboxes) directly.\nIndividual endpoints make live API calls per tenant which is significantly slower and may hit\nthrottling limits. ListDBCache reads pre-cached data from Azure Table Storage and returns results\nin seconds regardless of tenant count.\n\nNote that tenantFilter=AllTenants WITH a type performs a cross-partition scan and materializes every\nrecord of that collection across every tenant, so it grows with the size of the estate. Where only\ntotals are needed, countsOnly=true is dramatically cheaper and should always be preferred.\n\nRecommended workflow for MCP tool selection:\n  1. Call ListDBCache with type=_availableTypes to discover available cache collections.\n  2. If the data you need exists as a cache type, use ListDBCache with that type.\n  3. Only fall back to individual List* endpoints when you need real-time data for a single tenant\n     or when the data is not available in the cache.\n\nCommon cache types include: Users, Groups, Mailboxes, Devices, ConditionalAccess, Applications,\nIntunePolicy, CompliancePolicy, and many more. The exact set depends on what has been configured.",
         "parameters": [
           {
             "name": "countsOnly",
@@ -43874,6 +45916,42 @@
               "type": "boolean"
             }
           },
+          {
+            "name": "dateField",
+            "in": "query",
+            "description": "The record date field latestOnly ranks by. Omit to auto-detect (createdDateTime, lastRefresh, etc).",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "groupBy",
+            "in": "query",
+            "description": "Group the result into one bucket per tenant. Only 'Tenant' is supported.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "latestOnly",
+            "in": "query",
+            "description": "When true, keep only the newest record per tenant (by dateField, or an auto-detected date field). Collapses e.g. SecureScore's per-day snapshots to one current row per tenant.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
+          {
+            "name": "select",
+            "in": "query",
+            "description": "Comma-separated list of top-level fields to keep on each record; everything else is dropped during parse. A kept field keeps its ENTIRE subtree (e.g. select=conditions keeps conditions.users.includeRoles). The Tenant stamp is always preserved. Omit to return all fields.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "tenantFilter",
             "in": "query",
@@ -43882,10 +45960,19 @@
               "type": "string"
             }
           },
+          {
+            "name": "top",
+            "in": "query",
+            "description": "Return at most this many records. For AllTenants this is a global cap across all tenants, unless groupBy=Tenant is set, in which case it caps records within each tenant bucket.",
+            "required": false,
+            "schema": {
+              "type": "integer"
+            }
+          },
           {
             "name": "type",
             "in": "query",
-            "required": true,
+            "required": false,
             "schema": {
               "type": "string"
             }
@@ -45351,6 +47438,9 @@
                       "comments": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "Enabled": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -45384,11 +47474,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -46035,6 +48129,9 @@
                       "cippconnectortype": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
@@ -46062,11 +48159,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -47386,7 +49487,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read"
+        "x-cipp-role": "CIPP.ReportBuilder.Read"
       }
     },
     "/api/ListGenericTestFunction": {
@@ -47683,14 +49784,22 @@
           {
             "name": "period",
             "in": "query",
+            "description": "Reporting window for Graph reports: 'D7', 'D30' (default), 'D90' or 'D180'.",
             "required": false,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "enum": [
+                "D180",
+                "D30",
+                "D7",
+                "D90"
+              ]
             }
           },
           {
             "name": "report",
             "in": "query",
+            "description": "The report name to fetch (e.g. 'getEmailActivityUserDetail'). Omit to enumerate the reports available for the selected Type instead of fetching one.",
             "required": false,
             "schema": {
               "type": "string"
@@ -47702,9 +49811,14 @@
           {
             "name": "type",
             "in": "query",
+            "description": "Report source: 'graph' (default) for Microsoft Graph usage reports, or 'office' for the reports.office.com service.",
             "required": false,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "enum": [
+                "graph",
+                "office"
+              ]
             }
           }
         ],
@@ -47762,7 +49876,7 @@
         "tags": [
           "CIPP > Core"
         ],
-        "description": "Proxies an arbitrary Microsoft Graph API GET request for a tenant. Supports custom endpoints, filters, pagination, and field selection via query parameters.",
+        "description": "Proxies an arbitrary Microsoft Graph API GET request for a tenant. Supports custom endpoints, filters, pagination, and field selection via query parameters. If a request returns a permission error, retry with AsApp set to true: admin and application-scoped endpoints (for example admin/sharepoint/settings) require the application's own permissions rather than the default delegated access.",
         "parameters": [
           {
             "name": "$count",
@@ -47980,9 +50094,14 @@
           {
             "name": "Version",
             "in": "query",
+            "description": "Graph API version to call: v1.0 or beta. Defaults to beta when omitted.",
             "required": false,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "enum": [
+                "beta",
+                "v1.0"
+              ]
             }
           }
         ],
@@ -48442,6 +50561,9 @@
                       "allowExternal": {
                         "x-cipp-field-source": "backend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "description": {
                         "x-cipp-field-source": "backend,frontend"
                       },
@@ -48487,11 +50609,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage,backend"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -49557,6 +51683,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "description": {
                         "x-cipp-field-source": "backend,frontend"
                       },
@@ -49593,11 +51722,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -49753,6 +51886,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "corrupt": {
                         "x-cipp-field-source": "backend"
                       },
@@ -49792,11 +51928,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage,backend,frontend"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "templateCount": {
                         "x-cipp-field-source": "backend"
                       },
@@ -49851,7 +51991,7 @@
         "tags": [
           "CIPP > Settings"
         ],
-        "description": "Lists trusted IP addresses configured in CIPP for IP-based access control.",
+        "description": "Lists CIPP's IP allow/block list: every tenant or AllTenants entry with its address or CIDR range (Range) and state (Trusted, Blocked or NotTrusted).",
         "responses": {
           "200": {
             "description": "Success",
@@ -49879,7 +52019,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-role": "CIPP.IPDatabase.Read",
         "x-cipp-any-tenant": true
       }
     },
@@ -49913,6 +52053,12 @@
                       "AzureRMSLicensingEnabled": {
                         "x-cipp-field-source": "backend"
                       },
+                      "DecryptAttachmentForEncryptOnly": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "EnablePdfEncryption": {
+                        "x-cipp-field-source": "backend"
+                      },
                       "ExternalLicensingEnabled": {
                         "x-cipp-field-source": "backend"
                       },
@@ -49928,9 +52074,15 @@
                       "MessageEncryptionEnabled": {
                         "x-cipp-field-source": "backend"
                       },
+                      "SimplifiedClientAccessDoNotForwardDisabled": {
+                        "x-cipp-field-source": "backend"
+                      },
                       "SimplifiedClientAccessEnabled": {
                         "x-cipp-field-source": "backend"
                       },
+                      "SimplifiedClientAccessEncryptOnlyDisabled": {
+                        "x-cipp-field-source": "backend"
+                      },
                       "TransportDecryptionSetting": {
                         "x-cipp-field-source": "backend"
                       }
@@ -50045,6 +52197,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "defaultDuration.label": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -50090,11 +52245,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "templateName": {
                         "x-cipp-field-source": "storage,frontend"
                       },
@@ -50165,23 +52324,237 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Identity.Role.Read",
+        "x-cipp-role": "Identity.Role.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
+    "/api/ListJITRoleTemplates": {
+      "get": {
+        "summary": "ListJITRoleTemplates",
+        "operationId": "ListJITRoleTemplates",
+        "tags": [
+          "Identity > Administration > Users"
+        ],
+        "description": "Lists JIT Role Templates - named allow-lists of directory roles used to restrict which roles a\nCIPP custom role may assign via JIT Admin.",
+        "parameters": [
+          {
+            "name": "GUID",
+            "in": "query",
+            "description": "If a specific GUID is requested, filter to that template",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                    "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "createdBy": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "createdDate": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "ETag": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "GUID": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "JSON": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "Package": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "PartitionKey": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "Permissions": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "roles": {
+                        "x-cipp-field-source": "frontend"
+                      },
+                      "RowKey": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "SHA": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "Source": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
+                      "templateName": {
+                        "x-cipp-field-source": "storage,frontend"
+                      },
+                      "Timestamp": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage"
+                      },
+                      "UpdatedBy": {
+                        "x-cipp-field-source": "storage"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Identity.Role.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
+    "/api/ListKnownIPDb": {
+      "get": {
+        "summary": "ListKnownIPDb",
+        "operationId": "ListKnownIPDb",
+        "tags": [
+          "CIPP > Core"
+        ],
+        "description": "Lists known IP address entries from the CIPP IP database, optionally filtered by tenant.",
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "CIPP.IPDatabase.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
+    "/api/ListLicenseOptimization": {
+      "get": {
+        "summary": "ListLicenseOptimization",
+        "operationId": "ListLicenseOptimization",
+        "tags": [
+          "Tenant > Reports"
+        ],
+        "description": "License cost-optimization report for a tenant: a monetary summary plus reclaim\nopportunities across five waste tiers (unassigned seats, disabled and inactive licensed\naccounts, mailbox-only downgrade candidates, and redundant overlapping SKUs). Computed from\nthe reporting-DB cache. For tenantFilter=AllTenants it returns a per-tenant summary money\nmap (ranked by reclaimable spend) instead of the full opportunity detail.",
+        "parameters": [
+          {
+            "name": "currency",
+            "in": "query",
+            "description": "Currency the money figures are resolved in (ISO code); defaults to USD",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "inactiveDays",
+            "in": "query",
+            "description": "Sign-in age in days past which an enabled licensed user counts as inactive (default 90)",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "tenantFilter",
+            "in": "query",
+            "description": "The tenant to report on, or AllTenants for the cross-tenant summary money map",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                  }
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Tenant.Directory.Read",
         "x-cipp-any-tenant": true
       }
     },
-    "/api/ListJITRoleTemplates": {
+    "/api/ListLicensePricing": {
       "get": {
-        "summary": "ListJITRoleTemplates",
-        "operationId": "ListJITRoleTemplates",
+        "summary": "ListLicensePricing",
+        "operationId": "ListLicensePricing",
         "tags": [
-          "Identity > Administration > Users"
+          "Tenant > Reports"
         ],
-        "description": "Lists JIT Role Templates - named allow-lists of directory roles used to restrict which roles a\nCIPP custom role may assign via JIT Admin.",
+        "description": "Lists the resolved monthly price for every known license SKU: MSP price overrides merged\nover the shipped MSRP estimates. Consumed by the license optimization report and its\nprice-management UI. Each row carries a Source of Override, Estimate, or Unknown.\n\nPrices are resolved in the requested currency (?currency=, default USD). The response also\ncarries the list of currencies present in the price data so the UI can offer a selector.",
         "parameters": [
           {
-            "name": "GUID",
+            "name": "currency",
             "in": "query",
-            "description": "If a specific GUID is requested, filter to that template",
+            "description": "Currency to resolve prices in (ISO code); defaults to USD",
             "required": false,
             "schema": {
               "type": "string"
@@ -50197,55 +52570,25 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                    "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.",
                     "properties": {
-                      "createdBy": {
+                      "Currency": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "createdDate": {
+                      "MonthlyPrice": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "ETag": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "GUID": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "JSON": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Package": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "PartitionKey": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Permissions": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "roles": {
+                      "Product_Display_Name": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "RowKey": {
-                        "x-cipp-field-source": "storage"
+                      "skuId": {
+                        "x-cipp-field-source": "frontend"
                       },
-                      "SHA": {
-                        "x-cipp-field-source": "storage"
+                      "skuPartNumber": {
+                        "x-cipp-field-source": "frontend"
                       },
                       "Source": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "templateName": {
-                        "x-cipp-field-source": "storage,frontend"
-                      },
-                      "Timestamp": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "UpdatedBy": {
-                        "x-cipp-field-source": "storage"
+                        "x-cipp-field-source": "frontend"
                       }
                     }
                   }
@@ -50258,45 +52601,9 @@
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Identity.Role.Read",
-        "x-cipp-any-tenant": true
-      }
-    },
-    "/api/ListKnownIPDb": {
-      "get": {
-        "summary": "ListKnownIPDb",
-        "operationId": "ListKnownIPDb",
-        "tags": [
-          "CIPP > Core"
-        ],
-        "description": "Lists known IP address entries from the CIPP IP database, optionally filtered by tenant.",
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
-                  }
-                }
-              }
-            }
           },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -50304,18 +52611,18 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-role": "Tenant.Directory.Read",
         "x-cipp-any-tenant": true
       }
     },
-    "/api/ListLicenseOptimization": {
+    "/api/ListLicenseRecommendations": {
       "get": {
-        "summary": "ListLicenseOptimization",
-        "operationId": "ListLicenseOptimization",
+        "summary": "ListLicenseRecommendations",
+        "operationId": "ListLicenseRecommendations",
         "tags": [
           "Tenant > Reports"
         ],
-        "description": "License cost-optimization report for a tenant: a monetary summary plus reclaim\nopportunities across five waste tiers (unassigned seats, disabled and inactive licensed\naccounts, mailbox-only downgrade candidates, and redundant overlapping SKUs). Computed from\nthe reporting-DB cache. For tenantFilter=AllTenants it returns a per-tenant summary money\nmap (ranked by reclaimable spend) instead of the full opportunity detail.",
+        "description": "License recommendation report for a tenant: the waste tiers from ListLicenseOptimization\nplus evidence-based downgrade targets (from 90-day usage reports against the license\ncatalog), consolidation and protection upgrades, and the recommended annual/monthly\ncommitment split per SKU. Feeds the License Optimization page and the client PDF.",
         "parameters": [
           {
             "name": "currency",
@@ -50329,66 +52636,51 @@
           {
             "name": "inactiveDays",
             "in": "query",
-            "description": "Sign-in age in days past which an enabled licensed user counts as inactive (default 90)",
+            "description": "Sign-in / activity age in days past which a user counts as inactive (default 90)",
             "required": false,
             "schema": {
               "type": "string"
             }
           },
           {
-            "name": "tenantFilter",
+            "name": "protectSecurityFeatures",
             "in": "query",
-            "description": "The tenant to report on, or AllTenants for the cross-tenant summary money map",
-            "required": true,
+            "required": false,
             "schema": {
               "type": "string"
             }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
-                  }
-                }
-              }
+          },
+          {
+            "name": "recommendDowngrades",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
             }
           },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
+          {
+            "name": "recommendTerms",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
           },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          }
-        },
-        "security": [
           {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Tenant.Directory.Read",
-        "x-cipp-any-tenant": true
-      }
-    },
-    "/api/ListLicensePricing": {
-      "get": {
-        "summary": "ListLicensePricing",
-        "operationId": "ListLicensePricing",
-        "tags": [
-          "Tenant > Reports"
-        ],
-        "description": "Lists the resolved monthly price for every known license SKU: MSP price overrides merged\nover the shipped MSRP estimates. Consumed by the license optimization report and its\nprice-management UI. Each row carries a Source of Override, Estimate, or Unknown.\n\nPrices are resolved in the requested currency (?currency=, default USD). The response also\ncarries the list of currencies present in the price data so the UI can offer a selector.",
-        "parameters": [
+            "name": "recommendUpgrades",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
           {
-            "name": "currency",
+            "$ref": "#/components/parameters/tenantFilter"
+          },
+          {
+            "name": "tenureMonths",
             "in": "query",
-            "description": "Currency to resolve prices in (ISO code); defaults to USD",
+            "description": "Months a seat must have been assigned to count as stable for an annual commitment (default 6)",
             "required": false,
             "schema": {
               "type": "string"
@@ -50406,22 +52698,19 @@
                     "type": "object",
                     "description": "Derived from the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.",
                     "properties": {
-                      "Currency": {
-                        "x-cipp-field-source": "frontend"
-                      },
-                      "MonthlyPrice": {
+                      "License": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "Product_Display_Name": {
+                      "Reason": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "skuId": {
+                      "Suggestion": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "skuPartNumber": {
+                      "Type": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "Source": {
+                      "User": {
                         "x-cipp-field-source": "frontend"
                       }
                     }
@@ -50435,9 +52724,6 @@
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
-          },
-          "500": {
-            "description": "Internal server error"
           }
         },
         "security": [
@@ -50445,8 +52731,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Directory.Read",
-        "x-cipp-any-tenant": true
+        "x-cipp-role": "Tenant.Directory.Read"
       }
     },
     "/api/ListLicenses": {
@@ -50628,7 +52913,7 @@
         "tags": [
           "CIPP > Core"
         ],
-        "description": "Lists CIPP platform audit logs with filtering by severity, date range, tenant, and user. Supports listing available log categories, fetching a single entry, and server-side pagination via manualPagination/nextLink.",
+        "description": "Lists CIPP platform audit logs with filtering by severity, date range, tenant, and user. Supports listing available log categories, fetching a single entry, and server-side pagination via manualPagination/nextLink. Pass Search to filter rows by a case-insensitive substring of the log Message. Pass summaryOnly=true (or countsOnly=true) to get per-API and per-severity counts across the requested range with the heavy LogData dropped, instead of the full rows.",
         "parameters": [
           {
             "name": "API",
@@ -50646,6 +52931,15 @@
               "type": "string"
             }
           },
+          {
+            "name": "countsOnly",
+            "in": "query",
+            "description": "summaryOnly/countsOnly: return per-API and per-severity counts for the matching rows across the requested date range, dropping the (often huge) LogData payloads entirely. Ignores pagination.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
           {
             "name": "DateFilter",
             "in": "query",
@@ -50718,7 +53012,7 @@
           {
             "name": "PageSize",
             "in": "query",
-            "description": "Rows to return per page, clamped between 50 and 1000. Defaults to 400.",
+            "description": "Rows to return per page, clamped between 50 and 5000. Defaults to 2000.",
             "required": false,
             "schema": {
               "type": "integer"
@@ -50732,6 +53026,15 @@
               "type": "string"
             }
           },
+          {
+            "name": "Search",
+            "in": "query",
+            "description": "Free-text search over the log Message (case-insensitive literal substring). Applied client-side per partition alongside the other row filters, and independent of the Filter flag.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "Severity",
             "in": "query",
@@ -50756,6 +53059,15 @@
               "type": "string"
             }
           },
+          {
+            "name": "summaryOnly",
+            "in": "query",
+            "description": "summaryOnly/countsOnly: return per-API and per-severity counts for the matching rows across the requested date range, dropping the (often huge) LogData payloads entirely. Ignores pagination.",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
           {
             "name": "Tenant",
             "in": "query",
@@ -50790,6 +53102,9 @@
                       "AppId": {
                         "x-cipp-field-source": "backend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "DateFilter": {
                         "x-cipp-field-source": "backend"
                       },
@@ -50832,11 +53147,15 @@
                         "x-cipp-field-source": "backend"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "Standard": {
                         "x-cipp-field-source": "backend"
                       },
@@ -50880,7 +53199,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read",
+        "x-cipp-role": "CIPP.Logs.Read",
         "x-cipp-any-tenant": true
       }
     },
@@ -52599,6 +54918,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
@@ -52623,11 +54945,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "templateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -52709,6 +55035,9 @@
                       "PartitionKey": {
                         "x-cipp-field-source": "storage"
                       },
+                      "PSAConsolidationKey": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "PsaTicketId": {
                         "x-cipp-field-source": "storage"
                       },
@@ -52987,17 +55316,17 @@
     },
     "/api/ListOffboardingProgress": {
       "get": {
-        "summary": "Get the live progress of an offboarding job",
+        "summary": "Get the live progress of an offboarding or BEC remediation job",
         "operationId": "ListOffboardingProgress",
         "tags": [
           "Identity > Administration > Users"
         ],
-        "description": "Returns the progress rows of an offboarding job started from the wizard: one row per user with\nits overall status and the status and message of every step. Same rows as ListAsyncDeployment.\nThis is a read-only GET, so it carries a read role; an offboarding operator (who holds the\nbroader user write role) can still follow and re-run their jobs.",
+        "description": "Returns the progress rows of an offboarding job started from the wizard, or of a background BEC\nremediation (ExecBECRemediate with Async): one row per user with its overall status and the\nstatus and message of every step. Same rows as ListAsyncDeployment.\nThis is a read-only GET, so it carries a read role; an offboarding operator (who holds the\nbroader user write role) can still follow and re-run their jobs.",
         "parameters": [
           {
             "name": "DeploymentId",
             "in": "query",
-            "description": "The DeploymentId handed back by ExecOffboardUser, also stored on each offboarding task",
+            "description": "The DeploymentId handed back by ExecOffboardUser (also stored on each offboarding task) or ExecBECRemediate",
             "required": true,
             "schema": {
               "type": "string"
@@ -53650,6 +55979,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
@@ -53698,11 +56030,15 @@
                         "x-cipp-field-source": "frontend"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "templateName": {
                         "x-cipp-field-source": "storage,frontend"
                       },
@@ -53911,6 +56247,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "CustomCount": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -53944,11 +56283,15 @@
                         "x-cipp-field-source": "frontend"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -53983,7 +56326,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "CIPP.Core.Read"
+        "x-cipp-role": "CIPP.ReportBuilder.Read"
       }
     },
     "/api/ListResellerRelationshipLink": {
@@ -54201,6 +56544,9 @@
                       "comments": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "Enabled": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -54234,11 +56580,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -55067,6 +57417,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
@@ -55091,11 +57444,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateDescription": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -55607,6 +57964,9 @@
                       "comments": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "Description": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -55637,11 +57997,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -55784,6 +58148,9 @@
                       "Comment": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "ContentType": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -55820,11 +58187,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -55942,7 +58313,7 @@
         "summary": "ListShadowAI",
         "operationId": "ListShadowAI",
         "tags": [
-          "Tenant > Standards"
+          "Tenant > AI"
         ],
         "description": "Compiles a Shadow AI overview for a tenant by matching CACHED data from the CIPP reporting\ndatabase (DetectedApps, ServicePrincipals, OAuth2PermissionGrants) against the curated AI\ncatalog (Config/ShadowAI.json). No live Graph enumeration is performed - refresh the data by\nsyncing those caches (ExecCIPPDBCache). The only live call is a bounded, best-effort 7-day\nsign-in lookup for the matched AI applications.",
         "parameters": [
@@ -55959,359 +58330,7 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the Microsoft Graph entity it queries, and the fields the endpoint selects onto each record. This endpoint returns the Graph response as-is without selecting fields, so these are the properties the entity CAN carry (x-cipp-field-source: graph-entity) rather than a proven projection - Graph returns a default subset unless asked otherwise.",
-                    "properties": {
-                      "agent": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "aiToolsDetected": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "appDisplayName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "appId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "appliedConditionalAccessPolicies": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "appliedEventListeners": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "appOwnerTenantId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "appTokenProtectionStatus": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationAppDeviceDetails": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationAppPolicyEvaluationDetails": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationContextClassReferences": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationDetails": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationMethodsUsed": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationProcessingDetails": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationProtocol": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationRequirement": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "authenticationRequirementPolicies": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "autonomousSystemNumber": {
-                        "type": "integer",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "azureResourceId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "byCategory": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "byRisk": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "clientAppUsed": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "clientCredentialType": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "clientSessionId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "conditionalAccessAudiences": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "conditionalAccessStatus": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "consentedAiApps": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "consentedApps": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "correlationId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "createdDateTime": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "crossTenantAccessType": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "detectedApps": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "deviceDetail": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "deviceInstalls": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "entraSynced": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "federatedCredentialId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "flaggedForReview": {
-                        "type": "boolean",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "globalSecureAccessIpAddress": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "highRiskTools": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "homeTenantId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "homeTenantName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "id": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "incomingTokenType": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "intuneSynced": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "ipAddress": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "ipAddressFromResourceProvider": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "isInteractive": {
-                        "type": "boolean",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "isTenantRestricted": {
-                        "type": "boolean",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "isThroughGlobalSecureAccess": {
-                        "type": "boolean",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "lastDataRefresh": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "location": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "managedServiceIdentity": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "mfaDetail": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "networkLocationDetails": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "originalRequestId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "originalTransferMethod": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "privateLinkDetails": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "processingTimeInMilliseconds": {
-                        "type": "integer",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "resourceDisplayName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "resourceId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "resourceOwnerTenantId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "resourceServicePrincipalId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "resourceTenantId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "riskDetail": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "riskEventTypes_v2": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "riskLevelAggregated": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "riskLevelDuringSignIn": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "riskState": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "sanctionedTools": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "servicePrincipalCredentialKeyId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "servicePrincipalCredentialThumbprint": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "servicePrincipalId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "servicePrincipalName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "sessionId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "sessionLifetimePolicies": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "signInEventTypes": {
-                        "type": "array",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "signInIdentifier": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "signInIdentifierType": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "signInTokenProtectionStatus": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "status": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "summary": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "tokenIssuerName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "tokenIssuerType": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "tokenProtectionStatusDetails": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "topTools": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "uniqueTokenIdentifier": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "userAgent": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "userDisplayName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "userId": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "userPrincipalName": {
-                        "type": "string",
-                        "x-cipp-field-source": "graph-entity"
-                      },
-                      "userType": {
-                        "type": "object",
-                        "x-cipp-field-source": "graph-entity"
-                      }
-                    }
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
                   }
                 }
               }
@@ -56329,7 +58348,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.Standards.Read"
+        "x-cipp-role": "Tenant.AI.Read"
       }
     },
     "/api/ListSharedMailboxAccountEnabled": {
@@ -56591,78 +58610,7 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
-                    "properties": {
-                      "assignments": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "broadClaimGrants": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "byBroadClaim": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "byPermissionLevel": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "byPrincipalType": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "claim": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "directFullControlGrants": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "externalGrants": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "grants": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "lastDataRefresh": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "level": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "libraries": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "librariesScanned": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "permissionsSynced": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "site": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "sitesScanned": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "sitesSkipped": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "skippedSites": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "summary": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "topSitesByUniqueLibraries": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "totalAssignments": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "type": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "uniquePermissionLibraries": {
-                        "x-cipp-field-source": "backend"
-                      }
-                    }
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
                   }
                 }
               }
@@ -56692,6 +58640,14 @@
         ],
         "description": "Retrieves SharePoint Online storage quota usage for a tenant, showing used and total storage.",
         "parameters": [
+          {
+            "name": "live",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "boolean"
+            }
+          },
           {
             "$ref": "#/components/parameters/tenantFilter"
           }
@@ -56705,7 +58661,24 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                    "properties": {
+                      "Dashboard": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "GeoLocations": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "GeoUsedStorageMB": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "Percentage": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "TenantStorageMB": {
+                        "x-cipp-field-source": "backend"
+                      }
+                    }
                   }
                 }
               }
@@ -56716,6 +58689,9 @@
           },
           "403": {
             "description": "Forbidden - caller lacks the required RBAC role"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "security": [
@@ -56913,111 +58889,7 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
-                    "properties": {
-                      "anonymousEditLinks": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "anonymousLinks": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "byLinkType": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "byScope": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "externalLinks": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "externalRecipients": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "folderShares": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "internalLinks": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "itemsShared": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "lastDataRefresh": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "library": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "links": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "linksSynced": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "neverExpiringAnonymous": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "oneDriveAccounts": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "oneDriveFiles": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "oneDriveStorageUsedGB": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "passwordProtectedLinks": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "recipient": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "scope": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "sharePointFiles": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "sharePointSites": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "sharePointStorageUsedGB": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "site": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "summary": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "teamsFiles": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "teamsSites": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "teamsStorageUsedGB": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "topLibraries": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "topRecipients": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "topSites": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "totalLinks": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "type": {
-                        "x-cipp-field-source": "backend"
-                      },
-                      "usageSynced": {
-                        "x-cipp-field-source": "backend"
-                      }
-                    }
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
                   }
                 }
               }
@@ -57057,6 +58929,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "Error": {
                         "x-cipp-field-source": "backend"
                       },
@@ -57087,6 +58962,7 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "SiteTemplateCount": {
@@ -57095,6 +58971,9 @@
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateId": {
                         "x-cipp-field-source": "backend"
                       },
@@ -57547,9 +59426,14 @@
           {
             "name": "Type",
             "in": "query",
+            "description": "Optional site-type filter: 'SharePoint' or 'TeamsSite'. Omit to return both.",
             "required": false,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "enum": [
+                "SharePoint",
+                "TeamsSite"
+              ]
             }
           }
         ],
@@ -58177,9 +60061,14 @@
           {
             "name": "Type",
             "in": "query",
+            "description": "Required. Which usage set to list: SharePointSiteUsage or OneDriveUsageAccount.",
             "required": false,
             "schema": {
-              "type": "string"
+              "type": "string",
+              "enum": [
+                "OneDriveUsageAccount",
+                "SharePointSiteUsage"
+              ]
             }
           },
           {
@@ -58409,7 +60298,7 @@
         "tags": [
           "CIPP > Core"
         ],
-        "description": "Lists alerts that have been snoozed (temporarily suppressed), filterable by cmdlet name. Returns snooze duration and scope details.",
+        "description": "Lists alerts that have been snoozed (temporarily suppressed), filterable by cmdlet name. Returns the snooze duration, whether it runs until the item resolves, whether the item stays visible on the dashboard, and who set it.",
         "parameters": [
           {
             "name": "CmdletName",
@@ -58449,8 +60338,11 @@
                       "IsExpired": {
                         "x-cipp-field-source": "backend"
                       },
-                      "PartitionKey": {
+                      "KeepVisible": {
                         "type": "string",
+                        "x-cipp-field-source": "storage,backend,frontend"
+                      },
+                      "PartitionKey": {
                         "x-cipp-field-source": "storage,backend"
                       },
                       "RemainingDays": {
@@ -58489,6 +60381,10 @@
                       "Timestamp": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
+                      },
+                      "UntilResolved": {
+                        "type": "string",
+                        "x-cipp-field-source": "storage,backend,frontend"
                       }
                     }
                   }
@@ -58619,6 +60515,9 @@
                       "BulkSpamAction": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
@@ -58652,11 +60551,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -58892,7 +60795,7 @@
             "bearerAuth": []
           }
         ],
-        "x-cipp-role": "Tenant.BestPracticeAnalyser.Read"
+        "x-cipp-role": "Tenant.Standards.Read"
       }
     },
     "/api/ListStandardsCurrentState": {
@@ -59018,54 +60921,31 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Derived from the fields written into the storage table it reads, and the fields the endpoint selects onto each record, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
+                    "description": "Derived from the fields the endpoint selects onto each record, and the columns the CIPP UI renders. The response may carry more; these are the ones known to exist.",
                     "properties": {
                       "displayName": {
                         "x-cipp-field-source": "backend"
                       },
-                      "ETag": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
                       "excludedTenants": {
                         "x-cipp-field-source": "frontend"
                       },
                       "GUID": {
-                        "x-cipp-field-source": "storage,backend"
-                      },
-                      "JSON": {
-                        "x-cipp-field-source": "storage"
+                        "x-cipp-field-source": "backend"
                       },
                       "name": {
                         "x-cipp-field-source": "backend"
                       },
-                      "Package": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "PartitionKey": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Permissions": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
-                      "RowKey": {
-                        "x-cipp-field-source": "storage"
-                      },
                       "runManually": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "SHA": {
-                        "x-cipp-field-source": "storage"
-                      },
-                      "Source": {
-                        "x-cipp-field-source": "storage"
+                      "source": {
+                        "x-cipp-field-source": "frontend"
                       },
                       "standards": {
                         "x-cipp-field-source": "frontend"
                       },
                       "templateName": {
-                        "x-cipp-field-source": "storage,frontend"
+                        "x-cipp-field-source": "frontend"
                       },
                       "templates": {
                         "x-cipp-field-source": "backend"
@@ -59073,18 +60953,14 @@
                       "tenantFilter": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "Timestamp": {
-                        "type": "string",
-                        "x-cipp-field-source": "storage"
-                      },
                       "type": {
                         "x-cipp-field-source": "frontend"
                       },
                       "updatedAt": {
                         "x-cipp-field-source": "frontend"
                       },
-                      "UpdatedBy": {
-                        "x-cipp-field-source": "storage,frontend"
+                      "updatedBy": {
+                        "x-cipp-field-source": "frontend"
                       }
                     }
                   }
@@ -59997,6 +61873,9 @@
                       "compliant": {
                         "x-cipp-field-source": "backend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "currentValue": {
                         "x-cipp-field-source": "backend"
                       },
@@ -60045,11 +61924,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "standardId": {
                         "x-cipp-field-source": "backend"
                       },
@@ -60215,6 +62098,9 @@
                     "type": "object",
                     "description": "Derived from the fields written into the storage table it reads, and the columns the CIPP UI renders. Fields taken from the storage writers may be omitted by this endpoint, and the response may carry computed fields not listed here.",
                     "properties": {
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "entries": {
                         "x-cipp-field-source": "frontend"
                       },
@@ -60257,11 +62143,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage,frontend"
                       },
@@ -60571,6 +62461,9 @@
                       "Status": {
                         "x-cipp-field-source": "storage,frontend"
                       },
+                      "TenantGroups": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "Timestamp": {
                         "type": "string",
                         "x-cipp-field-source": "storage,frontend"
@@ -60606,7 +62499,7 @@
         "tags": [
           "Tenant > Administration > Tenant"
         ],
-        "description": "Lists all managed tenants accessible to the current user, with support for cache clearing and tenant filtering. This is the primary endpoint for tenant enumeration.",
+        "description": "Lists all managed tenants accessible to the current user, with support for cache clearing and tenant filtering. This is the primary endpoint for tenant enumeration. Pass Search for a fuzzy, case-insensitive substring lookup across displayName, defaultDomainName, initialDomainName and customerId when the exact domain is unknown.",
         "requestBody": {
           "required": false,
           "content": {
@@ -60651,6 +62544,15 @@
               "type": "string"
             }
           },
+          {
+            "name": "Search",
+            "in": "query",
+            "description": "Fuzzy tenant lookup: case-insensitive substring match over displayName, defaultDomainName, initialDomainName and customerId. Arbitrary verified domains are not indexed by Get-Tenants and cannot be matched here. Supports '*' wildcards. Use this when you don't know the exact domain.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "TenantFilter",
             "in": "query",
@@ -60662,6 +62564,7 @@
           {
             "name": "TriggerRefresh",
             "in": "query",
+            "description": "Re-reads the tenant given in tenantFilter, or queues a refresh of all tenants when omitted. Returns a Results message instead of the tenant list.",
             "required": false,
             "schema": {
               "type": "string"
@@ -60783,64 +62686,151 @@
         "x-cipp-any-tenant": true
       }
     },
-    "/api/ListTestResultsTenants": {
+    "/api/ListTestResultsTenants": {
+      "get": {
+        "summary": "Lists CIPP test results for a given test across one, many, or all tenants.",
+        "operationId": "ListTestResultsTenants",
+        "tags": [
+          "Tenant > Tests"
+        ],
+        "description": "Cross-tenant overview of stored test results. Backed by Get-CIPPTestResultsTenants, which\nqueries the shared CippTestResults table server-side and enriches Custom rows with their\ndefinition. Results are filtered to the tenants the calling user is permitted to see via\nTest-CIPPAccess, so an all-tenants read still respects per-user tenant scoping.",
+        "parameters": [
+          {
+            "name": "category",
+            "in": "query",
+            "description": "Restrict to a single category (the framework/area name a test belongs to).",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "countsOnly",
+            "in": "query",
+            "description": "'true' to return only the aggregate counts with no rows. Implies includeCounts.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "includeCounts",
+            "in": "query",
+            "description": "'true' to also return aggregate counts (per status, high-risk failures, distinct tenants).",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "risk",
+            "in": "query",
+            "description": "Restrict to a single risk level: High, Medium or Low.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "rowStatus",
+            "in": "query",
+            "description": "Return rows only for these statuses, while still counting every status the filters match.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "description": "Narrow the scan to these statuses: Passed, Failed, Investigate, Skipped, Informational and Unlicensed.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "summaryOnly",
+            "in": "query",
+            "description": "'true' to project away the large ResultMarkdown/ResultDataJson blobs for a lighter read.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "tenantFilter",
+            "in": "query",
+            "description": "One or more tenant domains to report on. Omit, or pass 'AllTenants', to query every tenant the caller may see. Accepts a string, a comma-delimited string, or an array.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "testId",
+            "in": "query",
+            "description": "One or more test IDs (the result row's RowKey), e.g. 'CustomScript-<guid>'.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "testType",
+            "in": "query",
+            "description": "Restrict to a single test type: Identity, Devices or Custom.",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad request - missing required field or invalid input"
+          },
+          "401": {
+            "description": "Unauthorized - invalid or missing bearer token"
+          },
+          "403": {
+            "description": "Forbidden - caller lacks the required RBAC role"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "x-cipp-role": "Tenant.Reports.Read",
+        "x-cipp-any-tenant": true
+      }
+    },
+    "/api/ListTests": {
       "get": {
-        "summary": "Lists CIPP test results for a given test across one, many, or all tenants.",
-        "operationId": "ListTestResultsTenants",
+        "summary": "Lists tests for a tenant, optionally filtered by report ID",
+        "operationId": "ListTests",
         "tags": [
           "Tenant > Tests"
         ],
-        "description": "Cross-tenant overview of stored test results. Backed by Get-CIPPTestResultsTenants, which\nqueries the shared CippTestResults table server-side and enriches Custom rows with their\ndefinition. Results are filtered to the tenants the calling user is permitted to see via\nTest-CIPPAccess, so an all-tenants read still respects per-user tenant scoping.",
         "parameters": [
           {
-            "name": "category",
-            "in": "query",
-            "description": "Restrict to a single category (the framework/area name a test belongs to).",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "countsOnly",
-            "in": "query",
-            "description": "'true' to return only the aggregate counts with no rows. Implies includeCounts.",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "includeCounts",
-            "in": "query",
-            "description": "'true' to also return aggregate counts (per status, high-risk failures, distinct tenants).",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "risk",
-            "in": "query",
-            "description": "Restrict to a single risk level: High, Medium or Low.",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "rowStatus",
-            "in": "query",
-            "description": "Return rows only for these statuses, while still counting every status the filters match.",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "status",
+            "name": "reportId",
             "in": "query",
-            "description": "Narrow the scan to these statuses: Passed, Failed, Investigate, Skipped, Informational.",
             "required": false,
             "schema": {
               "type": "string"
@@ -60849,88 +62839,10 @@
           {
             "name": "summaryOnly",
             "in": "query",
-            "description": "'true' to project away the large ResultMarkdown/ResultDataJson blobs for a lighter read.",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "tenantFilter",
-            "in": "query",
-            "description": "One or more tenant domains to report on. Omit, or pass 'AllTenants', to query every tenant the caller may see. Accepts a string, a comma-delimited string, or an array.",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "testId",
-            "in": "query",
-            "description": "One or more test IDs (the result row's RowKey), e.g. 'CustomScript-<guid>'.",
+            "description": "When true, return only the aggregated TestCounts (per-type pass/fail/etc totals) and skip the per-result markdown/metadata enrichment and the SecureScore/MFAState/License DB reads.",
             "required": false,
             "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "testType",
-            "in": "query",
-            "description": "Restrict to a single test type: Identity, Devices or Custom.",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
-                  }
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Bad request - missing required field or invalid input"
-          },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Tenant.Reports.Read",
-        "x-cipp-any-tenant": true
-      }
-    },
-    "/api/ListTests": {
-      "get": {
-        "summary": "Lists tests for a tenant, optionally filtered by report ID",
-        "operationId": "ListTests",
-        "tags": [
-          "Tenant > Tests"
-        ],
-        "parameters": [
-          {
-            "name": "reportId",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
+              "type": "boolean"
             }
           },
           {
@@ -60946,7 +62858,15 @@
                   "type": "array",
                   "items": {
                     "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
+                    "description": "Derived from the fields the endpoint selects onto each record. The response may carry more; these are the ones known to exist.",
+                    "properties": {
+                      "TenantFilter": {
+                        "x-cipp-field-source": "backend"
+                      },
+                      "TestCounts": {
+                        "x-cipp-field-source": "backend"
+                      }
+                    }
                   }
                 }
               }
@@ -61110,6 +63030,9 @@
                       "comments": {
                         "x-cipp-field-source": "frontend"
                       },
+                      "ContentHash": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "ETag": {
                         "type": "string",
                         "x-cipp-field-source": "storage"
@@ -61137,11 +63060,15 @@
                         "x-cipp-field-source": "storage"
                       },
                       "SHA": {
+                        "type": "string",
                         "x-cipp-field-source": "storage"
                       },
                       "Source": {
                         "x-cipp-field-source": "storage"
                       },
+                      "SourcePath": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "TemplateName": {
                         "x-cipp-field-source": "storage"
                       },
@@ -61174,57 +63101,6 @@
         "x-cipp-any-tenant": true
       }
     },
-    "/api/ListUserConditionalAccessPolicies": {
-      "get": {
-        "summary": "ListUserConditionalAccessPolicies",
-        "operationId": "ListUserConditionalAccessPolicies",
-        "tags": [
-          "Identity > Administration > Users"
-        ],
-        "description": "Lists Conditional Access policies that apply to a specific user in a tenant.",
-        "parameters": [
-          {
-            "$ref": "#/components/parameters/tenantFilter"
-          },
-          {
-            "name": "UserID",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "description": "Not described statically: this endpoint returns the upstream response as-is, so its fields are determined by the upstream API rather than by CIPP. Call the endpoint to see the actual shape, or add a response schema in backend/Config/openapi-overrides."
-                  }
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Identity.User.Read"
-      }
-    },
     "/api/ListUserCounts": {
       "get": {
         "summary": "ListUserCounts",
@@ -63725,6 +65601,9 @@
                       "PartitionKey": {
                         "x-cipp-field-source": "storage"
                       },
+                      "PSAConsolidationKey": {
+                        "x-cipp-field-source": "storage"
+                      },
                       "PsaTicketId": {
                         "x-cipp-field-source": "storage"
                       },
@@ -64011,6 +65890,16 @@
             }
           }
         },
+        "parameters": [
+          {
+            "name": "client",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "description": "Success",
@@ -64869,67 +66758,6 @@
         "x-cipp-role": "Tenant.Baselines.ReadWrite"
       }
     },
-    "/api/RemoveBPATemplate": {
-      "post": {
-        "summary": "RemoveBPATemplate",
-        "operationId": "RemoveBPATemplate",
-        "tags": [
-          "Tenant > Standards"
-        ],
-        "requestBody": {
-          "required": false,
-          "content": {
-            "application/json": {
-              "schema": {
-                "type": "object",
-                "properties": {
-                  "TemplateName": {
-                    "type": "string"
-                  }
-                }
-              }
-            }
-          }
-        },
-        "parameters": [
-          {
-            "name": "TemplateName",
-            "in": "query",
-            "required": false,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Success",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/StandardResults"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized - invalid or missing bearer token"
-          },
-          "403": {
-            "description": "Forbidden - caller lacks the required RBAC role"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "x-cipp-role": "Tenant.Standards.ReadWrite"
-      }
-    },
     "/api/RemoveCAPolicy": {
       "post": {
         "summary": "RemoveCAPolicy",
@@ -67938,6 +69766,9 @@
                     "PartitionKey": {
                       "x-cipp-field-source": "storage"
                     },
+                    "PSAConsolidationKey": {
+                      "x-cipp-field-source": "storage"
+                    },
                     "PsaTicketId": {
                       "x-cipp-field-source": "storage"
                     },
diff --git a/Config/standards.json b/Config/standards.json
index 4653ad33f0aaa..196396f5fa630 100644
--- a/Config/standards.json
+++ b/Config/standards.json
@@ -1555,7 +1555,7 @@
         "name": "standards.NudgeMFA.targetedAuthenticationMethod",
         "options": [
           { "label": "Microsoft Authenticator", "value": "microsoftAuthenticator" },
-          { "label": "Passkey (FIDO2)", "value": "fido2" }
+          { "label": "Passkey (FIDO2)", "value": "FIDO2" }
         ],
         "condition": {
           "field": "standards.NudgeMFA.state",
@@ -2173,6 +2173,51 @@
     "powershellEquivalent": "Update-MgUser -UserId user@domain.com -BodyParameter @{preferredLanguage='en-US'}",
     "recommendedBy": []
   },
+  {
+    "name": "standards.UsageLocation",
+    "cat": "Entra (AAD) Standards",
+    "tag": [],
+    "helpText": "Sets the Entra usage location (the two-letter country code that licensing and security tools such as Huntress ITDR depend on) on every member account. Optionally limit the sweep to members of named groups, skip members of named groups (users legitimately based in another country), or only fill in accounts that have no usage location yet.",
+    "docsDescription": "Sets the usage location on every member account; guest accounts are ignored. Group names are resolved per tenant by display name and expanded to their transitive user members: include groups restrict the sweep to those members, exclude groups remove them from it. A configured group that does not exist in a tenant, or a failed membership lookup, skips the run rather than sweeping the wrong accounts. With 'only set when blank' enabled, accounts that already carry any usage location are left as they are. Directory-synced accounts are included: usage location is cloud-managed and stays writable for them unless a custom sync rule maps it from on-premises.",
+    "executiveText": "Ensures every employee account records the country it is used from, which Microsoft requires before licences can be assigned and which security monitoring uses to recognise sign-ins from unexpected locations. Staff based in other countries are exempted through a group.",
+    "addedComponent": [
+      {
+        "type": "CountryCodeSelect",
+        "required": true,
+        "name": "standards.UsageLocation.usageLocation",
+        "label": "Usage location"
+      },
+      {
+        "type": "autoComplete",
+        "multiple": true,
+        "creatable": true,
+        "required": false,
+        "name": "standards.UsageLocation.includeGroups",
+        "label": "Only apply to members of these groups (display names; blank = all member accounts)"
+      },
+      {
+        "type": "autoComplete",
+        "multiple": true,
+        "creatable": true,
+        "required": false,
+        "name": "standards.UsageLocation.excludeGroups",
+        "label": "Skip members of these groups (display names; users legitimately located elsewhere)"
+      },
+      {
+        "type": "switch",
+        "name": "standards.UsageLocation.onlyWhenBlank",
+        "label": "Only set accounts that have no usage location (never overwrite an existing value)",
+        "required": false
+      }
+    ],
+    "label": "Usage location for all users",
+    "impact": "Medium Impact",
+    "impactColour": "warning",
+    "addedDate": "2026-09-16",
+    "powershellEquivalent": "Update-MgUser -UserId user@domain.com -UsageLocation 'US'",
+    "recommendedBy": [],
+    "requiredCapabilities": []
+  },
   {
     "name": "standards.AppManagementPolicy",
     "cat": "Entra (AAD) Standards",
@@ -6180,6 +6225,39 @@
     "recommendedBy": ["CIS"],
     "requiredCapabilities": ["MCOSTANDARD", "MCOEV", "MCOIMP", "TEAMS1", "Teams_Room_Standard"]
   },
+  {
+    "name": "standards.PlannerBlockTaskDelete",
+    "cat": "Teams Standards",
+    "tag": [],
+    "helpText": "Sets the Planner user policy that blocks each in-scope member from deleting Planner tasks they did not create. Applies across all basic Planner plans for that user (not a single board). Only enabled members with an enabled Microsoft Planner (PROJECTWORKMANAGEMENT) service plan are touched. Optionally limit the sweep to members of named groups or skip members of named groups. The remediate wash is limited to once per 24 hours per tenant because there is no list API and every user needs its own write. Alert and report still run every time. May also prevent those users from deleting plans. Requires CIPP-SAM consent for ProjectWorkManagement OrgSettings-Planner permissions.",
+    "docsDescription": "Uses the Planner tenant admin UserPolicy API (tasks.office.com) to set blockDeleteTasksNotCreatedBySelf to true for each in-scope enabled member account that has an enabled PROJECTWORKMANAGEMENT (Microsoft Planner) service plan in the user cache. Guest accounts, disabled accounts, and members without that plan are ignored. Group names are resolved per tenant by display name and expanded to their transitive user members: include groups restrict the sweep to those members, exclude groups remove them from it. A configured group that does not exist in a tenant, or a failed membership lookup, skips the run rather than sweeping the wrong accounts. When no include group is named, every Planner-licensed enabled member account is in scope. Remediate is an idempotent PUT per candidate with no preflight GET; a 24-hour rerun guard (Test-CIPPRerun) skips repeating that write sweep for the same settings, while alert and report still GET live state each run. The policy is per user and applies to all basic plans that user can access; it is not board-scoped. Known side effect: the same policy can also block plan deletion. Requires application permissions OrgSettings-Planner.ReadWrite.All on ProjectWorkManagement (tasks.office.com), consented via CIPP-SAM repair and CPV refresh.",
+    "executiveText": "Stops employees from deleting Planner tasks they did not create, reducing accidental loss on boards used as shared work queues. Can be limited to a department security group so only those staff are locked down.",
+    "addedComponent": [
+      {
+        "type": "autoComplete",
+        "multiple": true,
+        "creatable": true,
+        "required": false,
+        "name": "standards.PlannerBlockTaskDelete.includeGroups",
+        "label": "Only apply to members of these groups (display names; blank = all Planner-licensed enabled members)"
+      },
+      {
+        "type": "autoComplete",
+        "multiple": true,
+        "creatable": true,
+        "required": false,
+        "name": "standards.PlannerBlockTaskDelete.excludeGroups",
+        "label": "Skip members of these groups (display names)"
+      }
+    ],
+    "label": "Block Planner users from deleting tasks they did not create",
+    "impact": "Medium Impact",
+    "impactColour": "warning",
+    "addedDate": "2026-09-16",
+    "powershellEquivalent": "Set-PlannerUserPolicy -UserAadIdOrPrincipalName user@domain.com -BlockDeleteTasksNotCreatedBySelf $true",
+    "recommendedBy": [],
+    "requiredCapabilities": ["PROJECTWORKMANAGEMENT"]
+  },
   {
     "name": "standards.TeamsChatProtection",
     "cat": "Teams Standards",
@@ -6804,8 +6882,8 @@
         "name": "standards.DevicePrepProfile.AccountType",
         "label": "Account Type",
         "options": [
-          { "label": "Standard user", "value": "0" },
-          { "label": "Administrator", "value": "1" }
+          { "label": "Standard user", "value": "1" },
+          { "label": "Administrator", "value": "0" }
         ]
       },
       {
@@ -8123,15 +8201,128 @@
     "name": "standards.MessageEncryption",
     "cat": "Exchange Standards",
     "tag": [],
-    "helpText": "Enables Microsoft Purview Message Encryption by turning on Azure RMS licensing for Exchange Online, and turns on simplified client access so the Encrypt button appears in Outlook on the web and the new Outlook. Skipped with a warning when the tenant still points at an on-premises AD RMS cluster, because AD RMS has to be migrated to Azure RMS first. This standard only turns the feature on: branding, one-time passcodes, and social ID sign-in for encrypted messages are configured in the [Configure Encrypted Message Branding (OME)](https://standards.cipp.app/standards/omebranding) standard. [Read more](https://learn.microsoft.com/en-us/purview/set-up-new-message-encryption-capabilities)",
-    "docsDescription": "Sets AzureRMSLicensingEnabled to true, the prerequisite for Microsoft Purview Message Encryption, and SimplifiedClientAccessEnabled to true so the Encrypt button appears when composing mail in Outlook on the web and the new Outlook. Reports the IRM licensing state per tenant, including the licensing location, so you can see at a glance which tenants have message encryption available. Remediation is deliberately skipped for tenants with an on-premises AD RMS licensing location, as Purview Message Encryption is not compatible with AD RMS and those tenants need to be migrated to Azure RMS first.",
+    "helpText": "Enables Microsoft Purview Message Encryption by turning on Azure RMS licensing for Exchange Online, and turns on simplified client access so the Encrypt button appears in Outlook on the web and the new Outlook. Skipped with a warning when the tenant still points at an on-premises AD RMS cluster, because AD RMS has to be migrated to Azure RMS first. The optional settings below default to \"Do not change\", which leaves the tenant's current value alone and out of the drift check. This standard only turns the feature on: branding, one-time passcodes, and social ID sign-in for encrypted messages are configured in the [Configure Encrypted Message Branding (OME)](https://standards.cipp.app/standards/omebranding) standard. [Read more](https://learn.microsoft.com/en-us/purview/set-up-new-message-encryption-capabilities)",
+    "docsDescription": "Sets AzureRMSLicensingEnabled to true, the prerequisite for Microsoft Purview Message Encryption, and SimplifiedClientAccessEnabled to true so the Encrypt button appears when composing mail in Outlook on the web and the new Outlook. Optionally also enforces EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled and TransportDecryptionSetting; each of these is left untouched unless the template picks a value. Reports the IRM licensing state per tenant, including the licensing location, so you can see at a glance which tenants have message encryption available. Remediation is deliberately skipped for tenants with an on-premises AD RMS licensing location, as Purview Message Encryption is not compatible with AD RMS and those tenants need to be migrated to Azure RMS first.",
     "executiveText": "Turns on the built-in encryption that lets staff send protected email to anyone, including recipients outside the organization. Uses licensing the organization already owns, removing the need for a separate secure-email product.",
-    "addedComponent": [],
+    "addedComponent": [
+      {
+        "type": "radio",
+        "name": "standards.MessageEncryption.EnablePdfEncryption",
+        "label": "Encrypt PDF attachments",
+        "required": false,
+        "defaultValue": "donotchange",
+        "helperText": "Applies Encrypt-only and Do Not Forward protection to PDF attachments as well as the message body.",
+        "options": [
+          {
+            "value": "donotchange",
+            "label": "Do not change"
+          },
+          {
+            "value": "true",
+            "label": "Enable"
+          },
+          {
+            "value": "false",
+            "label": "Disable"
+          }
+        ]
+      },
+      {
+        "type": "radio",
+        "name": "standards.MessageEncryption.DecryptAttachmentForEncryptOnly",
+        "label": "Let recipients save Encrypt-only attachments unprotected",
+        "required": false,
+        "defaultValue": "donotchange",
+        "helperText": "When enabled, attachments on Encrypt-only mail are decrypted when the recipient downloads them.",
+        "options": [
+          {
+            "value": "donotchange",
+            "label": "Do not change"
+          },
+          {
+            "value": "true",
+            "label": "Enable"
+          },
+          {
+            "value": "false",
+            "label": "Disable"
+          }
+        ]
+      },
+      {
+        "type": "radio",
+        "name": "standards.MessageEncryption.SimplifiedClientAccessDoNotForwardDisabled",
+        "label": "Do Not Forward option in the Outlook Encrypt menu",
+        "required": false,
+        "defaultValue": "donotchange",
+        "options": [
+          {
+            "value": "donotchange",
+            "label": "Do not change"
+          },
+          {
+            "value": "true",
+            "label": "Hide"
+          },
+          {
+            "value": "false",
+            "label": "Show"
+          }
+        ]
+      },
+      {
+        "type": "radio",
+        "name": "standards.MessageEncryption.SimplifiedClientAccessEncryptOnlyDisabled",
+        "label": "Encrypt-only option in the Outlook Encrypt menu",
+        "required": false,
+        "defaultValue": "donotchange",
+        "options": [
+          {
+            "value": "donotchange",
+            "label": "Do not change"
+          },
+          {
+            "value": "true",
+            "label": "Hide"
+          },
+          {
+            "value": "false",
+            "label": "Show"
+          }
+        ]
+      },
+      {
+        "type": "radio",
+        "name": "standards.MessageEncryption.TransportDecryptionSetting",
+        "label": "Transport decryption",
+        "required": false,
+        "defaultValue": "donotchange",
+        "helperText": "Disabled leaves protected mail encrypted in transit, Optional decrypts it where possible and delivers either way, Mandatory rejects mail it cannot decrypt.",
+        "options": [
+          {
+            "value": "donotchange",
+            "label": "Do not change"
+          },
+          {
+            "value": "Disabled",
+            "label": "Disabled"
+          },
+          {
+            "value": "Optional",
+            "label": "Optional"
+          },
+          {
+            "value": "Mandatory",
+            "label": "Mandatory"
+          }
+        ]
+      }
+    ],
     "label": "Enable Purview Message Encryption",
     "impact": "Low Impact",
     "impactColour": "info",
     "addedDate": "2026-08-04",
-    "powershellEquivalent": "Set-IRMConfiguration -AzureRMSLicensingEnabled $true -SimplifiedClientAccessEnabled $true",
+    "powershellEquivalent": "Set-IRMConfiguration -AzureRMSLicensingEnabled $true -SimplifiedClientAccessEnabled $true [-EnablePdfEncryption ...] [-DecryptAttachmentForEncryptOnly ...] [-SimplifiedClientAccessDoNotForwardDisabled ...] [-SimplifiedClientAccessEncryptOnlyDisabled ...] [-TransportDecryptionSetting ...]",
     "recommendedBy": [],
     "requiredCapabilities": [
       "EXCHANGE_S_STANDARD",
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1
index 2fda2e5351d42..19ddc76f088db 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BEC/Push-BECRun.ps1	
@@ -1,24 +1,114 @@
-function Push-BECRun {
+function Push-BECRun {
     <#
         .FUNCTIONALITY
         Entrypoint
+        .SYNOPSIS
+        Runs the Business Email Compromise check for one user and stores the run.
+        .DESCRIPTION
+        Queued by Invoke-ExecBECCheck / Invoke-ExecBECBulkCheck. Collects audit-log changes, sign-ins,
+        rules, safelists, sharing, sent mail, apps, MFA, devices, the delegation inventory, the user's
+        OAuth grants, transport rules, add-ins, received-mail heuristics, Defender detections, directory
+        audits, registered devices, non-interactive sign-ins, mailbox-activity counts and Identity
+        Protection state. Every collector records a completeness marker and the threat score is
+        computed server-side. Results go to the BecReports table (metadata) and the BecResults table
+        (payload), keyed by the case id. Metadata only - no message bodies, attachments or file contents.
     #>
     param($Item)
 
     $TenantFilter = $Item.TenantFilter
     $SuspectUser = $Item.UserID
     $UserName = $Item.userName
+    $CaseId = if ($Item.CaseId) { [string]$Item.CaseId } else { New-CIPPBecCaseId }
 
     if (!$TenantFilter -or !$SuspectUser) {
         Write-Information 'BEC: No user or tenant specified'
         return
     }
-    $Table = Get-CippTable -tablename 'cachebec'
 
-    Write-Information "Working on $UserName"
+    # The collectors bind the UPN as a mandatory parameter and attribute audit records to it; a blank one
+    # throws "empty string" across the run and makes the tenant-wide record filter (-UserIds / -like) match
+    # everything, so unrelated tenant and admin actions surface as this user's compromise events. Resolve
+    # it from the object id when the run was queued without one, and fail the run cleanly if it truly can't
+    # be found rather than producing a run full of errors and false positives.
+    if ([string]::IsNullOrWhiteSpace($UserName)) {
+        try {
+            $ResolvedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($SuspectUser)?`$select=userPrincipalName" -tenantid $TenantFilter -AsApp $true
+            $UserName = [string]$ResolvedUser.userPrincipalName
+            if (-not [string]::IsNullOrWhiteSpace($UserName)) {
+                $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Properties @{ UserPrincipalName = $UserName }
+            }
+        } catch {
+            Write-Information "BEC: could not resolve a UPN for $SuspectUser in $TenantFilter`: $($_.Exception.Message)"
+        }
+    }
+    if ([string]::IsNullOrWhiteSpace($UserName)) {
+        Write-Information "BEC: the investigated user ($SuspectUser) has no resolvable UPN; marking the run failed."
+        try {
+            $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Properties @{ Status = 'Error'; ErrorMessage = 'The investigated user could not be resolved to a user principal name (the account was deleted, or no UPN was provided to the run).'; ExtractedAt = (Get-Date).ToUniversalTime().ToString('o') }
+        } catch {
+            Write-Information "BEC: could not mark the unresolved run $CaseId failed: $($_.Exception.Message)"
+        }
+        return
+    }
+
+    Set-CippBecCaseContext -CaseId $CaseId
+    Write-Information "Working on $UserName (case $CaseId)"
+
+    # Live progress for the page: the async-deployment row keyed on the case id (created when the
+    # run was queued; created here for runs queued another way), one step per phase. Progress
+    # writes are best-effort - a failure to report never fails the run.
+    $StepIndex = @{}
+    $RunSteps = @(Get-CIPPBecRunSteps)
+    for ($i = 0; $i -lt $RunSteps.Count; $i++) { $StepIndex[$RunSteps[$i].Key] = $i }
+    $ProgressName = [string]$UserName
+    $Progress = @{ Current = $null }
+    try {
+        # (Re)create the job so every step starts pending: Craft retries a killed activity under the same
+        # case id, and the retry must not inherit the dead attempt's half-finished steps.
+        $null = New-CIPPAsyncDeployment -JobId $CaseId -Names @($ProgressName) -StepTitles @($RunSteps.Title) -Source 'BEC' -TenantFilter $TenantFilter
+        Set-CIPPAsyncDeploymentStatus -JobId $CaseId -Name $ProgressName -Status 'running'
+        $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Properties @{ Status = 'Running'; StartedAt = (Get-Date).ToUniversalTime().ToString('o') }
+    } catch {
+        Write-Information "BEC: progress reporting unavailable for $CaseId`: $($_.Exception.Message)"
+    }
+    $Step = {
+        param($Key, $Status, $Message)
+        if (-not $StepIndex.ContainsKey($Key)) { return }
+        Set-CIPPAsyncDeploymentStep -JobId $CaseId -Name $ProgressName -StepIndex $StepIndex[$Key] -StepStatus $Status -Message ([string]$Message)
+    }
+    # Marks the previous phase done and the next one running.
+    $Phase = {
+        param($Key, $Message)
+        if ($Progress.Current) { & $Step $Progress.Current 'succeeded' 'Done' }
+        $Progress.Current = $Key
+        & $Step $Key 'running' $Message
+    }
     try {
-        $startDate = (Get-Date).ToUniversalTime().AddDays(-7)
+        $Heuristics = Get-CIPPBecHeuristics
+        $Caps = $Heuristics.caps
+        $WindowDays = [int]($Heuristics.window.days ?? 7)
+        $startDate = (Get-Date).ToUniversalTime().AddDays(-$WindowDays)
         $endDate = (Get-Date).ToUniversalTime()
+        $AuditPages = [int]($Caps.auditLogPages ?? 10)
+
+        # Completeness marker per collector: { Complete, Cap, Error, Skipped, Requirement, Count }.
+        # Skipped/Requirement are null-safe: inline markers that omit them read as $false/$null.
+        $Completeness = [ordered]@{}
+        $Mark = {
+            param($Name, $Result)
+            # Clean and classify the error once, here, so every collector benefits: known-benign
+            # conditions (no mailbox, no Intune) become a skip with a plain reason, and raw Exchange
+            # exception text is trimmed for display.
+            $Info = if ($Result.Error) { Get-CIPPBecErrorInfo -Message ([string]$Result.Error) } else { $null }
+            $Completeness[$Name] = [pscustomobject]@{
+                Complete    = [bool]$Result.Complete
+                Cap         = $Result.Cap
+                Error       = if ($Info) { $Info.Message } else { $Result.Error }
+                Skipped     = [bool]($Result.Skipped -or ($Info -and $Info.Skipped))
+                Requirement = if ($Result.Requirement) { $Result.Requirement } elseif ($Info) { $Info.Requirement } else { $null }
+                Count       = [int]$Result.Count
+            }
+        }
 
         # conditionalAccessStatus is 'success'/'notApplied'/'failure'; errorCode 0 is a successful
         # sign-in. Shared by every sign-in projection below.
@@ -27,73 +117,82 @@
         # renders a locale string neither understands
         $SignInDate = { if ($_.createdDateTime) { ([datetime]$_.createdDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null } }
 
+        # Licence preflight, up front and all at once: a check the tenant cannot support is skipped with
+        # its reason instead of run only to fail. Get-CIPPTenantCapabilities is CIPP's shared (cached)
+        # service-plan read and the plan names are the ones Test-CIPPStandardLicense's presets use. If
+        # the read itself fails every check runs and the error classifier (Get-CIPPBecErrorInfo, via
+        # $Mark) is the safety net - never skip on a failed preflight.
+        $Capabilities = $null
+        try {
+            $Capabilities = Get-CIPPTenantCapabilities -TenantFilter $TenantFilter
+        } catch {
+            Write-LogMessage -API 'BECRun' -message "BEC preflight could not read tenant plans for $($TenantFilter): $((Get-NormalizedError -message $_.Exception.Message))" -tenant $TenantFilter -sev Info
+        }
+        $HasPlan = { param([string[]]$Plans) (-not $Capabilities) -or [bool]@($Plans | Where-Object { $Capabilities.$_ -eq $true }).Count }
+        $HasEntraP2 = & $HasPlan 'AAD_PREMIUM_P2'
+        $HasDefenderP2 = & $HasPlan 'THREAT_INTELLIGENCE', 'THREAT_INTELLIGENCE_GOV'
+        $HasIntune = & $HasPlan 'INTUNE_A', 'MDM_Services', 'EMS', 'SCCM', 'MICROSOFTINTUNEPLAN1'
+        $Skip = { param($Requirement) New-CIPPBecCollectorResult -Data @() -Skipped $true -Requirement $Requirement }
+
+        & $Phase 'AuditLog' "Searching the unified audit log for the last $WindowDays days"
         Write-Information 'Getting audit logs'
+        $auditLog = $null
         try {
             $auditLog = (New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AdminAuditLogConfig').UnifiedAuditLogIngestionEnabled
-            $7DaysLog = if ($auditLog -eq $false) {
+            if ($auditLog -eq $false) {
+                $PermissionRecords = @()
                 $ExtractResult = 'AuditLog is disabled. Cannot perform full analysis'
+                & $Mark 'AuditLog' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = 'Unified audit log ingestion is disabled for this tenant'; Count = 0 })
             } else {
-                $sessionid = Get-Random -Minimum 10000 -Maximum 99999
-                $operations = @(
-                    'Remove-MailboxPermission',
-                    'Add-MailboxPermission',
-                    'UpdateCalendarDelegation',
-                    'AddFolderPermissions'
-                )
-                $SearchParam = @{
-                    SessionCommand = 'ReturnLargeSet'
-                    Operations     = $operations
-                    sessionid      = $sessionid
-                    startDate      = $startDate
-                    endDate        = $endDate
-                }
-                do {
-                    $logsTenant = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Search-unifiedAuditLog' -cmdParams $SearchParam -Anchor $Username
-                    Write-Information "Retrieved $($logsTenant.count) logs"
-                    $logsTenant
-                } while ($LogsTenant.count % 5000 -eq 0 -and $LogsTenant.count -ne 0)
+                $PermissionSearch = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $startDate -EndDate $endDate -Operations @('Remove-MailboxPermission', 'Add-MailboxPermission', 'UpdateCalendarDelegation', 'AddFolderPermissions') -Anchor $UserName -MaxPages $AuditPages
+                $PermissionRecords = @($PermissionSearch.Records)
+                Write-Information "Retrieved $($PermissionRecords.Count) permission change records"
                 $ExtractResult = 'Successfully extracted logs from auditlog'
+                & $Mark 'AuditLog' ([pscustomobject]@{ Complete = $PermissionSearch.Complete; Cap = $PermissionSearch.Cap; Error = $null; Count = $PermissionRecords.Count })
             }
         } catch {
-            $7DaysLog = @()
+            $PermissionRecords = @()
             $CippAuditError = Get-CippException -Exception $_
             $ExtractResult = "Could not retrieve audit logs: $($CippAuditError.NormalizedError)"
+            & $Mark 'AuditLog' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $ExtractResult; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve audit logs for $($UserName): $($CippAuditError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippAuditError
         }
-        Write-Information 'Getting last sign-in'
-        try {
-            $URI = "https://graph.microsoft.com/beta/auditLogs/signIns?`$filter=(userId eq '$SuspectUser')&`$top=1&`$orderby=createdDateTime desc"
-            $LastSignIn = New-GraphGetRequest -uri $URI -tenantid $TenantFilter -noPagination $true -verbose | Select-Object @{ Name = 'CreatedDateTime'; Expression = $SignInDate },
-            id,
-            @{ Name = 'AppDisplayName'; Expression = { $_.resourceDisplayName } },
-            @{ Name = 'Status'; Expression = $SignInStatus },
-            @{ Name = 'IPAddress'; Expression = { $_.ipAddress } },
-            @{ Name = 'Country'; Expression = { $_.location.countryOrRegion } },
-            @{ Name = 'City'; Expression = { $_.location.city } }
-        } catch {
-            $LastSignIn = [PSCustomObject]@{
-                AppDisplayName  = 'Unknown - could not retrieve information. No access to sign-in logs'
-                CreatedDateTime = 'Unknown'
-                Id              = '0'
-                Status          = 'Could not retrieve additional details'
-            }
-        }
+        & $Phase 'SignIns' 'Reading sign-ins and mobile devices'
         Write-Information 'Getting suspect user sign-ins'
         $SuspectUserSignInsError = $null
         try {
-            $URI = "https://graph.microsoft.com/beta/auditLogs/signIns?`$filter=(userId eq '$SuspectUser')&`$top=50&`$orderby=createdDateTime desc"
-            $SuspectUserSignIns = @(New-GraphGetRequest -uri $URI -tenantid $TenantFilter -noPagination $true | Select-Object @{ Name = 'CreatedDateTime'; Expression = $SignInDate },
+            # Every interactive sign-in in the window, paged to the end: the score's foreign sign-in
+            # signals count these, so a newest-N cut would hide the first foreign access.
+            $URI = "https://graph.microsoft.com/beta/auditLogs/signIns?`$filter=(userId eq '$SuspectUser') and createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ'))&`$top=999&`$orderby=createdDateTime desc"
+            $SuspectUserSignIns = @(New-GraphGetRequest -uri $URI -tenantid $TenantFilter | Select-Object @{ Name = 'CreatedDateTime'; Expression = $SignInDate },
                 id,
                 @{ Name = 'AppDisplayName'; Expression = { $_.resourceDisplayName } },
                 @{ Name = 'ClientAppUsed'; Expression = { $_.clientAppUsed } },
                 @{ Name = 'Status'; Expression = $SignInStatus },
                 @{ Name = 'IPAddress'; Expression = { $_.ipAddress } },
                 @{ Name = 'Country'; Expression = { $_.location.countryOrRegion } },
-                @{ Name = 'City'; Expression = { $_.location.city } })
+                @{ Name = 'City'; Expression = { $_.location.city } },
+                # what the IP verdicts weigh: the network, Entra's own risk call, the client and device,
+                # and the session/token ids that tie audited actions back to this sign-in
+                @{ Name = 'ASN'; Expression = { $_.autonomousSystemNumber } },
+                @{ Name = 'RiskLevelDuringSignIn'; Expression = { $_.riskLevelDuringSignIn } },
+                @{ Name = 'RiskEventTypes'; Expression = { @($_.riskEventTypes_v2) } },
+                @{ Name = 'UserAgent'; Expression = { $_.userAgent } },
+                @{ Name = 'DeviceCompliant'; Expression = { $_.deviceDetail.isCompliant } },
+                @{ Name = 'DeviceManaged'; Expression = { $_.deviceDetail.isManaged } },
+                @{ Name = 'DeviceTrustType'; Expression = { $_.deviceDetail.trustType } },
+                @{ Name = 'OperatingSystem'; Expression = { $_.deviceDetail.operatingSystem } },
+                @{ Name = 'Browser'; Expression = { $_.deviceDetail.browser } },
+                @{ Name = 'SessionId'; Expression = { $_.sessionId } },
+                @{ Name = 'UniqueTokenId'; Expression = { $_.uniqueTokenIdentifier } },
+                # the CIPP application's own sign-ins (its service account) are not the user's or an attacker's
+                @{ Name = 'AppId'; Expression = { $_.appId } })
+            & $Mark 'SignIns' ([pscustomobject]@{ Complete = $true; Cap = $null; Error = $null; Count = $SuspectUserSignIns.Count })
         } catch {
             $SuspectUserSignIns = @()
             $CippSignInError = Get-CippException -Exception $_
             $SuspectUserSignInsError = "Could not retrieve sign-in logs: $($CippSignInError.NormalizedError)"
+            & $Mark 'SignIns' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $SuspectUserSignInsError; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve sign-ins for $($UserName): $($CippSignInError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippSignInError
         }
         Write-Information 'Getting user devices'
@@ -101,73 +200,91 @@
         $Bytes = [System.Text.Encoding]::UTF8.GetBytes($SuspectUser)
         $base64IdentityParam = [Convert]::ToBase64String($Bytes)
         try {
-            $Devices = New-GraphGetRequest -uri "https://outlook.office365.com:443/adminapi/beta/$($TenantFilter)/mailbox('$($base64IdentityParam)')/MobileDevice/Exchange.GetMobileDeviceStatistics()/?IsEncoded=True" -Tenantid $TenantFilter -scope ExchangeOnline
+            $Devices = @(New-GraphGetRequest -uri "https://outlook.office365.com:443/adminapi/beta/$($TenantFilter)/mailbox('$($base64IdentityParam)')/MobileDevice/Exchange.GetMobileDeviceStatistics()/?IsEncoded=True" -Tenantid $TenantFilter -scope ExchangeOnline)
+            & $Mark 'MobileDevices' ([pscustomobject]@{ Complete = $true; Cap = $null; Error = $null; Count = $Devices.Count })
         } catch {
-            $Devices = $null
+            $Devices = @()
+            & $Mark 'MobileDevices' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = "Could not retrieve mobile devices: $((Get-NormalizedError -message $_.Exception.Message))"; Count = 0 })
         }
 
         try {
             # for the target-mailbox heuristic below: canonical ObjectIds carry the alias, not the UPN
             $UserLocalPart = ($UserName -split '@')[0]
-            $PermissionsLog = ($7DaysLog | Where-Object -Property Operations -In 'Remove-MailboxPermission', 'Add-MailboxPermission', 'UpdateCalendarDelegation', 'AddFolderPermissions' ).AuditData | ConvertFrom-Json -ErrorAction Stop | ForEach-Object {
-                $perms = if ($_.Parameters) {
-                    $_.Parameters | ForEach-Object { if ($_.Name -eq 'AccessRights') { $_.Value } }
-                } else
-                { $_.item.ParentFolder.MemberRights }
-                $objectID = if ($_.ObjectID) { $_.ObjectID } else { $($_.MailboxOwnerUPN) + $_.item.ParentFolder.Path }
-                # this is a tenant-wide search; flag the rows that concern the investigated mailbox
-                # so the threat score can weight them above unrelated tenant churn
-                $IdentityParam = if ($_.Parameters) { ($_.Parameters | Where-Object { $_.Name -eq 'Identity' }).Value }
-                $TargetCandidates = @($objectID, $IdentityParam, $_.MailboxOwnerUPN) -join ' '
-                [pscustomobject]@{
-                    Operation      = $_.Operation
-                    UserKey        = $_.UserKey
-                    ObjectId       = $objectId
-                    Permissions    = $perms
-                    TargetsSuspect = ($TargetCandidates -like "*$UserName*" -or ($UserLocalPart -and $TargetCandidates -like "*$UserLocalPart*"))
-                }
-            }
+            $PermissionsLog = @($PermissionRecords | Where-Object { $_.AuditData -and $_.Operation -in 'Remove-MailboxPermission', 'Add-MailboxPermission', 'UpdateCalendarDelegation', 'AddFolderPermissions' } | ForEach-Object {
+                    $AD = $_.AuditData
+                    $perms = if ($AD.Parameters) {
+                        $AD.Parameters | ForEach-Object { if ($_.Name -eq 'AccessRights') { $_.Value } }
+                    } else
+                    { $AD.item.ParentFolder.MemberRights }
+                    $objectID = if ($AD.ObjectID) { $AD.ObjectID } else { $($AD.MailboxOwnerUPN) + $AD.item.ParentFolder.Path }
+                    # this is a tenant-wide search; flag the rows that concern the investigated mailbox
+                    # so the threat score can weight them above unrelated tenant churn
+                    $IdentityParam = if ($AD.Parameters) { ($AD.Parameters | Where-Object { $_.Name -eq 'Identity' }).Value }
+                    $TargetCandidates = @($objectID, $IdentityParam, $AD.MailboxOwnerUPN) -join ' '
+                    # who received the access: the User/Trustee parameter, or the folder member for AddFolderPermissions
+                    $Trustee = if ($AD.Parameters) { ($AD.Parameters | Where-Object { $_.Name -in @('User', 'Trustee', 'Delegate') } | Select-Object -First 1).Value } else { $AD.item.ParentFolder.MemberUpn ?? $AD.item.ParentFolder.MemberSid }
+                    $TargetsSuspect = ($TargetCandidates -like "*$UserName*" -or ($UserLocalPart -and $TargetCandidates -like "*$UserLocalPart*"))
+                    [pscustomobject]@{
+                        Operation      = $AD.Operation
+                        UserKey        = $AD.UserKey
+                        UserId         = $AD.UserId
+                        ObjectId       = $objectId
+                        Permissions    = $perms
+                        Trustee        = [string]$Trustee
+                        Date           = $AD.CreationTime
+                        ClientIP       = ConvertTo-CIPPBecHostAddress -Address ($AD.ClientIP ?? $AD.ClientIPAddress)
+                        TargetsSuspect = $TargetsSuspect
+                        # the full audit record, kept for the rows about this mailbox (the search is tenant-wide)
+                        AuditData      = if ($TargetsSuspect) { $AD } else { $null }
+                    }
+                })
         } catch {
             $PermissionsLog = @()
         }
 
+        & $Phase 'MailboxRules' 'Reading inbox rules, safelists and sharing links'
+
+        # Inbox-rule, safelist and sharing changes are all user-scoped to the same mailbox and window;
+        # only their operations differ, and the unified-audit-log session is the slow part. One combined
+        # search feeds all three (partitioned by operation locally) instead of three separate sessions.
+        $RuleOps = @('New-InboxRule', 'Set-InboxRule', 'Remove-InboxRule', 'UpdateInboxRules')
+        $SafelistOps = @('Set-MailboxJunkEmailConfiguration')
+        $SharingOps = @('SharingSet', 'SharingInvitationCreated', 'AnonymousLinkCreated', 'AnonymousLinkUpdated', 'SecureLinkCreated', 'SecureLinkUpdated', 'AddedToSecureLink', 'CompanyLinkCreated')
+        $ChangeSearch = $null
+        $ChangeSearchError = $null
+        if ($auditLog -ne $false) {
+            try {
+                $ChangeSearch = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $startDate -EndDate $endDate -Operations @($RuleOps + $SafelistOps + $SharingOps) -UserIds @($UserName) -Anchor $UserName -MaxPages $AuditPages
+            } catch {
+                $ChangeSearchError = Get-CippException -Exception $_
+            }
+        }
+        $ChangeRecords = @($ChangeSearch.Records)
+
         Write-Information 'Getting inbox rule changes'
         try {
             $RuleChangesLog = if ($auditLog -eq $false) { @() } else {
-                # ponytail: separate user-scoped search - UpdateInboxRules is too high-volume for the tenant-wide query above
-                $RuleSearchParam = @{
-                    SessionCommand = 'ReturnLargeSet'
-                    Operations     = @('New-InboxRule', 'Set-InboxRule', 'Remove-InboxRule', 'UpdateInboxRules')
-                    sessionid      = (Get-Random -Minimum 10000 -Maximum 99999)
-                    startDate      = $startDate
-                    endDate        = $endDate
-                    # Must be an array: New-ExoRequest JSON-serializes cmdParams, and a bare
-                    # string binds to Search-UnifiedAuditLog's String[] UserIds as a scalar,
-                    # which EXO rejects with an argument transformation error.
-                    UserIds        = @($UserName)
-                }
-                # A search with no hits returns no AuditData at all, and piping that null into
-                # ConvertFrom-Json throws - which would report every clean user as a failure.
-                $RuleAuditData = (New-ExoRequest -tenantid $TenantFilter -cmdlet 'Search-UnifiedAuditLog' -cmdParams $RuleSearchParam -Anchor $UserName).AuditData
-                if (-not $RuleAuditData) { @() } else {
-                    $RuleAuditData | ConvertFrom-Json -ErrorAction Stop |
-                        Where-Object { $_.UserId -eq $UserName -or $_.MailboxOwnerUPN -eq $UserName -or $_.ObjectId -like "*$UserName*" } | ForEach-Object {
-                            $RuleName = ($_.Parameters | Where-Object { $_.Name -eq 'Name' }).Value ?? $_.ObjectId
-                            [pscustomobject]@{
-                                Operation  = $_.Operation
-                                UserKey    = $_.UserId
-                                RuleName   = $RuleName
-                                Parameters = ($_.Parameters | Where-Object { $_ -and $_.Name -notin 'Identity', 'Name' } | ForEach-Object { "$($_.Name)=$($_.Value)" }) -join '; '
-                                Date       = $_.CreationTime
-                                # admin-cmdlet records carry ClientIP, mailbox-sync records (UpdateInboxRules) ClientIPAddress
-                                ClientIP   = $_.ClientIP ?? $_.ClientIPAddress
-                            }
+                if ($ChangeSearchError) { throw $ChangeSearchError.NormalizedError }
+                $RuleRecords = @($ChangeRecords | Where-Object { $RuleOps -contains [string]$_.Operation })
+                & $Mark 'InboxRuleChanges' ([pscustomobject]@{ Complete = [bool]$ChangeSearch.Complete; Cap = $ChangeSearch.Cap; Error = $null; Count = $RuleRecords.Count })
+                @($RuleRecords | ForEach-Object { $_.AuditData } | Where-Object { $_ -and ($_.UserId -eq $UserName -or $_.MailboxOwnerUPN -eq $UserName -or $_.ObjectId -like "*$UserName*") } | ForEach-Object {
+                        $RuleName = ($_.Parameters | Where-Object { $_.Name -eq 'Name' }).Value ?? $_.ObjectId
+                        [pscustomobject]@{
+                            Operation  = $_.Operation
+                            UserKey    = $_.UserId
+                            RuleName   = $RuleName
+                            Parameters = ($_.Parameters | Where-Object { $_ -and $_.Name -notin 'Identity', 'Name' } | ForEach-Object { "$($_.Name)=$($_.Value)" }) -join '; '
+                            Date       = $_.CreationTime
+                            # admin-cmdlet records carry ClientIP, mailbox-sync records (UpdateInboxRules) ClientIPAddress
+                            ClientIP   = ConvertTo-CIPPBecHostAddress -Address ($_.ClientIP ?? $_.ClientIPAddress)
+                            AuditData  = $_
                         }
-                }
+                    })
             }
         } catch {
             $RuleChangesLog = @()
             $CippRuleError = Get-CippException -Exception $_
+            & $Mark 'InboxRuleChanges' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $CippRuleError.NormalizedError; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve inbox rule changes for $($UserName): $($CippRuleError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippRuleError
         }
 
@@ -176,15 +293,60 @@
         try {
             $RulesLog = New-ExoRequest -cmdlet 'Get-InboxRule' -tenantid $TenantFilter -cmdParams @{ Mailbox = $Username; IncludeHidden = $true } -Anchor $Username |
                 Where-Object { $_.Name -ne 'Junk E-Mail Rule' -and $_.Name -notlike 'Microsoft.Exchange.OOF.*' }
+            & $Mark 'InboxRules' ([pscustomobject]@{ Complete = $true; Cap = $null; Error = $null; Count = @($RulesLog | Where-Object { $_ }).Count })
         } catch {
             $CippRulesError = Get-CippException -Exception $_
+            & $Mark 'InboxRules' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $CippRulesError.NormalizedError; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve inbox rules for $($UserName): $($CippRulesError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippRulesError
             $RulesLog = @()
         }
 
-        # inbox rules carry no timestamps, so 'recent' = name-matches a 7-day audit event; Outlook-client changes (UpdateInboxRules) carry no rule name and stay unflagged
+        # inbox rules carry no timestamps, so 'recent' = name-matches an audit event in the window; Outlook-client changes (UpdateInboxRules) carry no rule name and stay unflagged
         $RecentRuleNames = @($RuleChangesLog | Where-Object { $_.Operation -in 'New-InboxRule', 'Set-InboxRule' } | ForEach-Object { ($_.RuleName -split '\\')[-1] })
-        $RulesLog = @($RulesLog | Where-Object { $_ } | Select-Object *, @{ Name = 'RecentlyChanged'; Expression = { $_.Name -in $RecentRuleNames } })
+        $LowVisibilityRegex = [string]$Heuristics.inboxRules.lowVisibilityFolderRegex
+        $SensitiveNameRegex = [string]$Heuristics.inboxRules.sensitiveNameRegex
+        $SensitiveKeywordRegex = [string]$Heuristics.inboxRules.sensitiveKeywordRegex
+        $SuspiciousFolder = [string]$Heuristics.inboxRules.suspiciousFolderPattern
+        # AcceptedDomains is fetched later, so 'external' here is any forward domain that is not the
+        # user's own domain or the tenant's default domain - approximate, but the false positive
+        # (a legitimate internal forward across a second accepted domain) is still worth a look.
+        $InternalDomains = @(($UserName -split '@')[-1], $TenantFilter) | ForEach-Object { ([string]$_).ToLowerInvariant() } | Where-Object { $_ } | Select-Object -Unique
+        # Condition properties that scope a rule to specific mail; with none set the rule acts on everything.
+        $RuleConditionProps = @('From', 'FromAddressContainsWords', 'SubjectContainsWords', 'BodyContainsWords', 'SubjectOrBodyContainsWords', 'SentTo', 'RecipientAddressContainsWords', 'HeaderContainsWords', 'MyNameInToBox', 'MyNameInCcBox', 'MyNameInToOrCcBox', 'HasAttachment', 'MessageTypeMatches', 'WithImportance', 'WithSensitivity', 'FromSubscription', 'FlaggedForAction')
+        # Condition properties whose words are scanned for financial/sensitive terms.
+        $RuleKeywordProps = @('SubjectContainsWords', 'BodyContainsWords', 'SubjectOrBodyContainsWords', 'FromAddressContainsWords', 'HeaderContainsWords')
+        $RulesLog = @($RulesLog | Where-Object { $_ } | ForEach-Object {
+                $Rule = $_
+                $Reasons = [System.Collections.Generic.List[string]]::new()
+                # Forwarding/redirection - external is the exfiltration case, called out separately.
+                $ForwardTargets = @(@($Rule.ForwardTo) + @($Rule.RedirectTo) + @($Rule.ForwardAsAttachmentTo) | Where-Object { $_ })
+                $ForwardDomains = @($ForwardTargets | ForEach-Object { if ("$_" -match '@([A-Za-z0-9.\-]+)') { $Matches[1].ToLowerInvariant() } } | Where-Object { $_ })
+                $ExternalForward = @($ForwardDomains | Where-Object { $InternalDomains -notcontains $_ }).Count -gt 0
+                if ($ExternalForward) { $Reasons.Add('Forwards or redirects mail to an external address') }
+                elseif ($ForwardTargets.Count -gt 0) { $Reasons.Add('Forwards or redirects messages') }
+                if ($Rule.DeleteMessage -eq $true) { $Reasons.Add('Deletes messages') }
+                if ($Rule.MarkAsRead -eq $true) { $Reasons.Add('Marks messages as read') }
+                $MovesToLowVis = [bool]($LowVisibilityRegex -and [string]$Rule.MoveToFolder -match $LowVisibilityRegex)
+                if ($MovesToLowVis) { $Reasons.Add('Moves messages to a low-visibility folder') }
+                if ($Rule.StopProcessingRules -eq $true) { $Reasons.Add('Stops processing other rules') }
+                $KeywordHit = $false
+                if ($SensitiveKeywordRegex) { foreach ($KP in $RuleKeywordProps) { if ((@($Rule.$KP) -join ' ') -match $SensitiveKeywordRegex) { $KeywordHit = $true; break } } }
+                if ($KeywordHit) { $Reasons.Add('Targets financial or sensitive keywords') }
+                # Acts on all mail: a hiding/exfil action (forward, delete, move) with no scoping condition.
+                $HasCondition = $false
+                foreach ($CP in $RuleConditionProps) { $CV = $Rule.$CP; if (($CV -is [bool] -and $CV) -or (@($CV | Where-Object { $_ }).Count -gt 0)) { $HasCondition = $true; break } }
+                $HidingAction = [bool]($ForwardTargets.Count -gt 0 -or ($Rule.DeleteMessage -eq $true) -or $Rule.MoveToFolder)
+                $ActsOnAll = ($HidingAction -and -not $HasCondition)
+                if ($ActsOnAll) { $Reasons.Add('Acts on all incoming mail') }
+                if ($SensitiveNameRegex -and [string]$Rule.Name -match $SensitiveNameRegex) { $Reasons.Add('Security-sensitive rule name') }
+                # Strong indicators mark a rule 'suspicious' for the score's +5 signal (RSS stays, plus these).
+                $Suspicious = [bool]($ExternalForward -or ($Rule.DeleteMessage -eq $true) -or $MovesToLowVis -or $ActsOnAll -or ([string]$Rule.MoveToFolder -clike "*$SuspiciousFolder*"))
+                $Rule | Select-Object *,
+                @{ Name = 'RecentlyChanged'; Expression = { $_.Name -in $RecentRuleNames } },
+                @{ Name = 'RiskReasons'; Expression = { $Reasons.ToArray() } },
+                @{ Name = 'Suspicious'; Expression = { $Suspicious } },
+                @{ Name = 'Risk'; Expression = { if ($Suspicious -or $Reasons.Count -gt 1) { 'High' } elseif ($Reasons.Count -eq 1) { 'Medium' } else { 'Review' } } }
+            })
 
         Write-Information 'Getting trusted and blocked senders'
         $SafelistError = $null
@@ -192,98 +354,85 @@
             $JunkConfig = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MailboxJunkEmailConfiguration' -cmdParams @{ Identity = $UserName } -Anchor $UserName
             $TrustedSenders = @($JunkConfig.TrustedSendersAndDomains | Where-Object { $_ })
             $BlockedSenders = @($JunkConfig.BlockedSendersAndDomains | Where-Object { $_ })
+            & $Mark 'Safelists' ([pscustomobject]@{ Complete = $true; Cap = $null; Error = $null; Count = $TrustedSenders.Count + $BlockedSenders.Count })
         } catch {
             $TrustedSenders = @()
             $BlockedSenders = @()
             $CippSafelistError = Get-CippException -Exception $_
             $SafelistError = "Could not retrieve the trusted/blocked senders list: $($CippSafelistError.NormalizedError)"
+            & $Mark 'Safelists' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $SafelistError; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve junk email configuration for $($UserName): $($CippSafelistError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippSafelistError
         }
 
         Write-Information 'Getting safelist changes'
         try {
             $SafelistChanges = if ($auditLog -eq $false) { @() } else {
-                $SafelistSearchParam = @{
-                    SessionCommand = 'ReturnLargeSet'
-                    Operations     = @('Set-MailboxJunkEmailConfiguration')
-                    sessionid      = (Get-Random -Minimum 10000 -Maximum 99999)
-                    startDate      = $startDate
-                    endDate        = $endDate
-                    # array for the same String[] binding reason as the rule search above
-                    UserIds        = @($UserName)
-                }
-                $SafelistAuditData = (New-ExoRequest -tenantid $TenantFilter -cmdlet 'Search-UnifiedAuditLog' -cmdParams $SafelistSearchParam -Anchor $UserName).AuditData
-                if (-not $SafelistAuditData) { @() } else {
-                    @($SafelistAuditData | ConvertFrom-Json -ErrorAction Stop | ForEach-Object {
-                            $TrustedValue = ($_.Parameters | Where-Object { $_.Name -eq 'TrustedSendersAndDomains' }).Value
-                            $BlockedValue = ($_.Parameters | Where-Object { $_.Name -eq 'BlockedSendersAndDomains' }).Value
-                            [pscustomobject]@{
-                                Operation = $_.Operation
-                                UserKey   = $_.UserId
-                                Date      = $_.CreationTime
-                                ClientIP  = $_.ClientIP ?? $_.ClientIPAddress
-                                # the audit record carries the full new list, not a delta
-                                Trusted   = if ($TrustedValue) { @(($TrustedValue -split ';').Trim() | Where-Object { $_ }) } else { $null }
-                                Blocked   = if ($BlockedValue) { @(($BlockedValue -split ';').Trim() | Where-Object { $_ }) } else { $null }
-                            }
-                        })
-                }
+                if ($ChangeSearchError) { throw $ChangeSearchError.NormalizedError }
+                $SafelistRecords = @($ChangeRecords | Where-Object { $SafelistOps -contains [string]$_.Operation })
+                & $Mark 'SafelistChanges' ([pscustomobject]@{ Complete = [bool]$ChangeSearch.Complete; Cap = $ChangeSearch.Cap; Error = $null; Count = $SafelistRecords.Count })
+                @($SafelistRecords | ForEach-Object { $_.AuditData } | Where-Object { $_ } | ForEach-Object {
+                        $TrustedValue = ($_.Parameters | Where-Object { $_.Name -eq 'TrustedSendersAndDomains' }).Value
+                        $BlockedValue = ($_.Parameters | Where-Object { $_.Name -eq 'BlockedSendersAndDomains' }).Value
+                        [pscustomobject]@{
+                            Operation = $_.Operation
+                            UserKey   = $_.UserId
+                            Date      = $_.CreationTime
+                            ClientIP  = ConvertTo-CIPPBecHostAddress -Address ($_.ClientIP ?? $_.ClientIPAddress)
+                            AuditData = $_
+                            # the audit record carries the full new list, not a delta
+                            Trusted   = if ($TrustedValue) { @(($TrustedValue -split ';').Trim() | Where-Object { $_ }) } else { $null }
+                            Blocked   = if ($BlockedValue) { @(($BlockedValue -split ';').Trim() | Where-Object { $_ }) } else { $null }
+                        }
+                    })
             }
         } catch {
             $SafelistChanges = @()
             $CippSafelistChangeError = Get-CippException -Exception $_
+            & $Mark 'SafelistChanges' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $CippSafelistChangeError.NormalizedError; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve safelist changes for $($UserName): $($CippSafelistChangeError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippSafelistChangeError
         }
 
         Write-Information 'Getting sharing link activity'
         try {
             $SharingChanges = if ($auditLog -eq $false) { @() } else {
-                $SharingSearchParam = @{
-                    SessionCommand = 'ReturnLargeSet'
-                    # link creation/changes only - AnonymousLinkUsed and access events are usage, not exposure changes
-                    Operations     = @('SharingSet', 'SharingInvitationCreated', 'AnonymousLinkCreated', 'AnonymousLinkUpdated', 'SecureLinkCreated', 'SecureLinkUpdated', 'AddedToSecureLink', 'CompanyLinkCreated')
-                    sessionid      = (Get-Random -Minimum 10000 -Maximum 99999)
-                    startDate      = $startDate
-                    endDate        = $endDate
-                    # array for the same String[] binding reason as the rule search above
-                    UserIds        = @($UserName)
-                }
-                $SharingAuditData = (New-ExoRequest -tenantid $TenantFilter -cmdlet 'Search-UnifiedAuditLog' -cmdParams $SharingSearchParam -Anchor $UserName).AuditData
-                if (-not $SharingAuditData) { @() } else {
-                    @($SharingAuditData | ConvertFrom-Json -ErrorAction Stop | ForEach-Object {
-                            [pscustomobject]@{
-                                Operation  = $_.Operation
-                                UserKey    = $_.UserId
-                                Date       = $_.CreationTime
-                                Workload   = $_.Workload
-                                FileName   = $_.SourceFileName
-                                ItemUrl    = $_.ObjectId
-                                Target     = $_.TargetUserOrGroupName
-                                TargetType = $_.TargetUserOrGroupType
-                                ClientIP   = $_.ClientIP ?? $_.ClientIPAddress
-                            }
-                        })
-                }
+                # link creation/changes only - AnonymousLinkUsed and access events are usage, not exposure changes
+                if ($ChangeSearchError) { throw $ChangeSearchError.NormalizedError }
+                $SharingRecords = @($ChangeRecords | Where-Object { $SharingOps -contains [string]$_.Operation })
+                & $Mark 'SharingChanges' ([pscustomobject]@{ Complete = [bool]$ChangeSearch.Complete; Cap = $ChangeSearch.Cap; Error = $null; Count = $SharingRecords.Count })
+                @($SharingRecords | ForEach-Object { $_.AuditData } | Where-Object { $_ } | ForEach-Object {
+                        [pscustomobject]@{
+                            Operation  = $_.Operation
+                            UserKey    = $_.UserId
+                            Date       = $_.CreationTime
+                            Workload   = $_.Workload
+                            FileName   = $_.SourceFileName
+                            ItemUrl    = $_.ObjectId
+                            Target     = $_.TargetUserOrGroupName
+                            TargetType = $_.TargetUserOrGroupType
+                            ClientIP   = ConvertTo-CIPPBecHostAddress -Address ($_.ClientIP ?? $_.ClientIPAddress)
+                            AuditData  = $_
+                        }
+                    })
             }
         } catch {
             $SharingChanges = @()
             $CippSharingError = Get-CippException -Exception $_
+            & $Mark 'SharingChanges' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $CippSharingError.NormalizedError; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve sharing link activity for $($UserName): $($CippSharingError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippSharingError
         }
 
+        & $Phase 'SentMail' 'Walking the sent message trace'
         Write-Information 'Getting sent message trace'
         try {
-            $MessageTraceParams = @{
-                SenderAddress = $UserName
-                StartDate     = $startDate.ToString('s')
-                EndDate       = $endDate.ToString('s')
-            }
-            $SentMessagesRaw = @(New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MessageTraceV2' -cmdParams $MessageTraceParams -Anchor $UserName)
-            $SentMessages = @($SentMessagesRaw | Select-Object MessageTraceId, Status, Subject, RecipientAddress, @{ Name = 'Received'; Expression = { $_.Received.ToString('u') } }, FromIP)
+            $SentTrace = Get-CIPPBecMessageTrace -TenantFilter $TenantFilter -SenderAddress $UserName -StartDate $startDate -EndDate $endDate -Anchor $UserName
+            $SentMessagesRaw = @($SentTrace.Rows)
+            $SentMessages = @($SentMessagesRaw | Select-Object MessageTraceId, Status, Subject, RecipientAddress, @{ Name = 'Received'; Expression = { ([datetime]$_.Received).ToString('u') } }, FromIP)
+            & $Mark 'SentMessages' ([pscustomobject]@{ Complete = $SentTrace.Complete; Cap = $SentTrace.Cap; Error = $null; Count = $SentMessagesRaw.Count })
         } catch {
             $SentMessagesRaw = @()
             $SentMessages = @()
             $CippTraceError = Get-CippException -Exception $_
+            & $Mark 'SentMessages' ([pscustomobject]@{ Complete = $false; Cap = $null; Error = $CippTraceError.NormalizedError; Count = 0 })
             Write-LogMessage -API 'BECRun' -message "Failed to retrieve message trace for $($UserName): $($CippTraceError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CippTraceError
         }
 
@@ -291,11 +440,14 @@
         # are distinct MessageTraceIds and 'recipients' are rows - one mail BCC'd to 200 people
         # and 200 individual sends are both blasts, just along different axes.
         try {
-            $RepeatSubjectMessages = 5      # same subject sent as this many separate messages
-            $RepeatSubjectRecipients = 20   # or reaching this many recipients in total
-            $BurstMessages = 10             # distinct messages inside one window
-            $BurstRecipients = 30           # or recipients inside one window
-            $BurstWindowTicks = [timespan]::FromMinutes(10).Ticks
+            $SentMail = $Heuristics.sentMail
+            $RepeatSubjectMessages = [int]($SentMail.repeatSubjectMessages ?? 5)      # same subject sent as this many separate messages
+            $RepeatSubjectRecipients = [int]($SentMail.repeatSubjectRecipients ?? 20) # or reaching this many recipients in total
+            $MinRepeatedSubjectMessages = [int]($SentMail.minRepeatedSubjectMessages ?? 3)
+            $BurstMessages = [int]($SentMail.burstMessages ?? 10)                      # distinct messages inside one window
+            $BurstRecipients = [int]($SentMail.burstRecipients ?? 30)                  # or recipients inside one window
+            $BurstWindowMinutes = [int]($SentMail.burstWindowMinutes ?? 10)
+            $BurstWindowTicks = [timespan]::FromMinutes($BurstWindowMinutes).Ticks
 
             $RepeatedSubjects = @($SentMessagesRaw | Group-Object -Property { ([string]$_.Subject).Trim().ToLowerInvariant() } | ForEach-Object {
                     $MessageCount = @($_.Group.MessageTraceId | Select-Object -Unique).Count
@@ -308,7 +460,7 @@
                         LastSent       = if ($Times.Count -gt 0) { ([datetime]$Times[-1]).ToString('u') } else { $null }
                         Flagged        = ($MessageCount -ge $RepeatSubjectMessages -or $_.Count -ge $RepeatSubjectRecipients)
                     }
-                } | Where-Object { $_.MessageCount -ge 3 -or $_.Flagged } | Sort-Object -Property MessageCount -Descending | Select-Object -First 10)
+                } | Where-Object { $_.MessageCount -ge $MinRepeatedSubjectMessages -or $_.Flagged } | Sort-Object -Property MessageCount -Descending | Select-Object -First 10)
 
             $Bursts = @($SentMessagesRaw | Where-Object { $_.Received } | Group-Object -Property { [long](([datetime]$_.Received).ToUniversalTime().Ticks / $BurstWindowTicks) } | ForEach-Object {
                     $MessageCount = @($_.Group.MessageTraceId | Select-Object -Unique).Count
@@ -316,7 +468,7 @@
                         $TopSubject = ($_.Group | Group-Object -Property Subject | Sort-Object -Property Count -Descending | Select-Object -First 1).Name
                         [pscustomobject]@{
                             WindowStart    = [datetime]::new(([long]$_.Name) * $BurstWindowTicks, [System.DateTimeKind]::Utc).ToString('u')
-                            WindowMinutes  = 10
+                            WindowMinutes  = $BurstWindowMinutes
                             MessageCount   = $MessageCount
                             RecipientCount = $_.Count
                             TopSubject     = $TopSubject
@@ -344,39 +496,18 @@
             Write-LogMessage -API 'BECRun' -message "Failed to analyze sent message patterns for $($UserName): $($_.Exception.Message)" -tenant $TenantFilter -sev Warning
         }
 
-        Write-Information 'Getting last 50 tenant sign-ins'
-        try {
-            $TenantLastSignIns = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/auditLogs/signIns?`$filter=userDisplayName ne 'On-Premises Directory Synchronization Service Account'&`$top=50&`$orderby=createdDateTime desc" -tenantid $TenantFilter -noPagination $true | Select-Object @{ Name = 'CreatedDateTime'; Expression = $SignInDate },
-            id,
-            @{ Name = 'AppDisplayName'; Expression = { $_.resourceDisplayName } },
-            @{ Name = 'Status'; Expression = $SignInStatus },
-            @{ Name = 'IPAddress'; Expression = { $_.ipAddress } },
-            @{ Name = 'Country'; Expression = { $_.location.countryOrRegion } },
-            @{ Name = 'City'; Expression = { $_.location.city } }, UserPrincipalName, UserDisplayName
-        } catch {
-            $TenantLastSignIns = @(
-                [PSCustomObject]@{
-                    AppDisplayName  = 'Unknown - could not retrieve information. No access to sign-in logs'
-                    CreatedDateTime = 'Unknown'
-                    Id              = '0'
-                    Status          = 'Could not retrieve additional details'
-                    Exception       = $_.Exception.Message
-                }
-            )
-        }
-
-        # Known-malicious application catalog shipped with CIPP; matched on appId below.
-        $MaliciousAppsCatalog = try {
-            @((Get-Content -Path (Join-Path $env:CIPPRootPath 'Config\MaliciousApps.json') -ErrorAction Stop | ConvertFrom-Json).applications)
-        } catch {
-            Write-Information "Could not load MaliciousApps.json: $($_.Exception.Message)"
-            @()
-        }
+        & $Phase 'Tenant' 'Reading tenant users, MFA methods and applications'
+        # The rogue-application catalog (CIPP MaliciousApps.json + the Huntress feed) keyed by lowercase
+        # appId; shared with the consent collector so every section matches the same list.
+        $RogueAppFeed = Get-CIPPBecRogueAppFeed
+        $RogueApps = $RogueAppFeed.Apps
+        $CatalogAppIds = @($RogueApps.Keys)
+        $RogueMatch = { param($AppId) $Key = ([string]$AppId).ToLowerInvariant(); if ($Key -and $RogueApps.ContainsKey($Key)) { $RogueApps[$Key] } else { $null } }
 
         $Requests = @(
             @{
                 id     = 'Users'
-                url    = "users?`$select=id,displayName,userPrincipalName,createdDateTime,lastPasswordChangeDateTime"
+                url    = "users?`$select=id,displayName,userPrincipalName,userType,createdDateTime,lastPasswordChangeDateTime"
                 method = 'GET'
             }
             @{
@@ -389,10 +520,12 @@
                 url    = "servicePrincipals?`$select=displayName,createdDateTime,appId,appDisplayName,publisher&`$filter=createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ'))"
                 method = 'GET'
             }
-            @{
-                id     = 'IntuneDevices'
-                url    = "users/$($SuspectUser)/managedDevices"
-                method = 'GET'
+            if ($HasIntune) {
+                @{
+                    id     = 'IntuneDevices'
+                    url    = "users/$($SuspectUser)/managedDevices"
+                    method = 'GET'
+                }
             }
             @{
                 id     = 'SuspectUser'
@@ -402,18 +535,22 @@
         )
         # Look for catalog apps present in the tenant regardless of age, chunked to keep each
         # 'in' filter within Graph's operand limit.
-        $CatalogAppIds = @($MaliciousAppsCatalog.appId | Where-Object { $_ })
-        for ($i = 0; $i -lt $CatalogAppIds.Count; $i += 15) {
-            $Chunk = $CatalogAppIds[$i..([Math]::Min($i + 14, $CatalogAppIds.Count - 1))]
-            $Requests += @{
-                id     = "MaliciousSPs$i"
-                url    = "servicePrincipals?`$select=displayName,appId,accountEnabled,createdDateTime&`$filter=appId in ('$($Chunk -join "','")')"
-                method = 'GET'
-            }
-        }
+        $Requests = @($Requests) + @(for ($i = 0; $i -lt $CatalogAppIds.Count; $i += 15) {
+                $Chunk = $CatalogAppIds[$i..([Math]::Min($i + 14, $CatalogAppIds.Count - 1))]
+                @{
+                    id     = "MaliciousSPs$i"
+                    url    = "servicePrincipals?`$select=displayName,appId,accountEnabled,createdDateTime&`$filter=appId in ('$($Chunk -join "','")')"
+                    method = 'GET'
+                }
+            })
 
         Write-Information 'Getting bulk requests'
         $GraphResults = New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter -asapp $true
+        foreach ($Pair in @(@{ Id = 'Users'; Name = 'TenantUsers' }, @{ Id = 'MFADevices'; Name = 'MFAMethods' }, @{ Id = 'NewSPs'; Name = 'NewApps' })) {
+            $Response = $GraphResults | Where-Object { $_.id -eq $Pair.Id } | Select-Object -First 1
+            $Failed = (-not $Response) -or ([int]$Response.status -ge 400)
+            & $Mark $Pair.Name ([pscustomobject]@{ Complete = (-not $Failed); Cap = $null; Error = $(if ($Failed) { $Response.body.error.message ?? "Graph request $($Pair.Id) failed" } else { $null }); Count = @($Response.body.value).Count })
+        }
 
         $PasswordChanges = (($GraphResults | Where-Object { $_.id -eq 'Users' }).body.value | Where-Object { $_.lastPasswordChangeDateTime -ge $startDate }) ?? @()
         $NewUsers = (($GraphResults | Where-Object { $_.id -eq 'Users' }).body.value | Where-Object { $_.createdDateTime -ge $startDate }) ?? @()
@@ -426,9 +563,9 @@
 
         # Flag service principals added during the window that match the malicious catalog
         $NewSPs = @(foreach ($SP in @($NewSPs)) {
-                $CatalogEntry = $MaliciousAppsCatalog | Where-Object { $_.appId -eq $SP.appId } | Select-Object -First 1
+                $CatalogEntry = & $RogueMatch $SP.appId
                 $Match = if ($CatalogEntry) {
-                    [PSCustomObject]@{ Name = $CatalogEntry.name; Categories = @($CatalogEntry.categories); Description = $CatalogEntry.description }
+                    [PSCustomObject]@{ Name = $CatalogEntry.Name; Categories = @($CatalogEntry.Categories); Description = $CatalogEntry.Description; Source = $CatalogEntry.Source }
                 } else { $null }
                 $SP | Select-Object *, @{ Name = 'MaliciousMatch'; Expression = { $Match } }
             })
@@ -437,78 +574,303 @@
         # password reset, so an old grant matters as much as a new one.
         $MaliciousSPResults = @($GraphResults | Where-Object { $_.id -like 'MaliciousSPs*' -and [int]$_.status -lt 400 } | ForEach-Object { $_.body.value } | Where-Object { $_ })
         $MaliciousSPs = @(foreach ($SP in $MaliciousSPResults) {
-                $CatalogEntry = $MaliciousAppsCatalog | Where-Object { $_.appId -eq $SP.appId } | Select-Object -First 1
+                $CatalogEntry = & $RogueMatch $SP.appId
                 [PSCustomObject]@{
                     displayName     = $SP.displayName
                     appId           = $SP.appId
                     accountEnabled  = $SP.accountEnabled
                     createdDateTime = $SP.createdDateTime
-                    CatalogName     = $CatalogEntry.name
-                    Categories      = @($CatalogEntry.categories)
-                    Description     = $CatalogEntry.description
+                    CatalogName     = $CatalogEntry.Name
+                    Categories      = @($CatalogEntry.Categories)
+                    Description     = $CatalogEntry.Description
+                    Source          = $CatalogEntry.Source
                 }
             })
 
-        # Intune managed devices for the suspect user — surface Graph failures instead of a silent empty list
-        $IntuneResponse = $GraphResults | Where-Object { $_.id -eq 'IntuneDevices' } | Select-Object -First 1
+        # Intune managed devices for the suspect user - surface Graph failures instead of a silent empty list
         $IntuneDevicesError = $null
         $IntuneDevices = @()
-        if (-not $IntuneResponse) {
-            $IntuneDevicesError = 'Intune device query did not return a response'
-        } elseif ([int]$IntuneResponse.status -ge 400) {
-            # Graph proxies this call to Intune's DeviceFE service, which returns its own JSON
-            # error blob as the Graph error message. Unwrap it so the report shows a readable
-            # sentence instead of raw JSON, keeping the Activity ID for Microsoft support cases.
-            $RawIntuneError = $IntuneResponse.body.error.message
-            $IntuneDevicesError = $RawIntuneError
-            if ($RawIntuneError -match '^\s*\{') {
-                try {
-                    $ParsedIntuneError = $RawIntuneError | ConvertFrom-Json -ErrorAction Stop
-                    if (-not [string]::IsNullOrWhiteSpace($ParsedIntuneError.Message)) {
-                        $IntuneDevicesError = $ParsedIntuneError.Message
+        if (-not $HasIntune) {
+            & $Mark 'IntuneDevices' (& $Skip 'requires an Intune licence')
+        } else {
+            $IntuneResponse = $GraphResults | Where-Object { $_.id -eq 'IntuneDevices' } | Select-Object -First 1
+            if (-not $IntuneResponse) {
+                $IntuneDevicesError = 'Intune device query did not return a response'
+            } elseif ([int]$IntuneResponse.status -ge 400) {
+                # Graph proxies this call to Intune's DeviceFE service, which returns its own JSON
+                # error blob as the Graph error message. Unwrap it so the report shows a readable
+                # sentence instead of raw JSON, keeping the Activity ID for Microsoft support cases.
+                $RawIntuneError = $IntuneResponse.body.error.message
+                $IntuneDevicesError = $RawIntuneError
+                if ($RawIntuneError -match '^\s*\{') {
+                    try {
+                        $ParsedIntuneError = $RawIntuneError | ConvertFrom-Json -ErrorAction Stop
+                        if (-not [string]::IsNullOrWhiteSpace($ParsedIntuneError.Message)) {
+                            $IntuneDevicesError = $ParsedIntuneError.Message
+                        }
+                    } catch { Write-Verbose 'Intune error body is not JSON; keeping the raw message' }
+                }
+                if ($IntuneDevicesError -like 'An error has occurred*') {
+                    $ActivityId = [regex]::Match($IntuneDevicesError, 'Activity ID: ([0-9a-fA-F-]{36})').Groups[1].Value
+                    $IntuneDevicesError = "Intune returned an unexpected error (HTTP $($IntuneResponse.status)). This is a failure inside the Intune service itself and is usually transient. Rerun the check to retry.$(if ($ActivityId) { " Microsoft support reference (Activity ID): $ActivityId" })"
+                }
+                if ([string]::IsNullOrWhiteSpace($IntuneDevicesError)) {
+                    $IntuneDevicesError = "Intune device query failed with status $($IntuneResponse.status)"
+                }
+                Write-LogMessage -API 'BECRun' -message "Failed to retrieve Intune devices for $($UserName): $IntuneDevicesError" -tenant $TenantFilter -sev Warning
+            } else {
+                $IntuneDevicesRaw = $IntuneResponse.body.value ?? @()
+                $IntuneDevices = @(
+                    foreach ($Device in @($IntuneDevicesRaw)) {
+                        [PSCustomObject]@{
+                            id                     = $Device.id
+                            deviceName             = $Device.deviceName
+                            operatingSystem        = $Device.operatingSystem
+                            osVersion              = $Device.osVersion
+                            complianceState        = $Device.complianceState
+                            enrolledDateTime       = if ($Device.enrolledDateTime) { ([datetime]$Device.enrolledDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                            lastSyncDateTime       = if ($Device.lastSyncDateTime) { ([datetime]$Device.lastSyncDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                            deviceEnrollmentType   = $Device.deviceEnrollmentType
+                            manufacturer           = $Device.manufacturer
+                            model                  = $Device.model
+                            serialNumber           = $Device.serialNumber
+                            userPrincipalName      = $Device.userPrincipalName
+                            managedDeviceOwnerType = $Device.managedDeviceOwnerType
+                        }
                     }
-                } catch {
-                    # Not valid JSON after all - keep the raw message
+                )
+            }
+            & $Mark 'IntuneDevices' ([pscustomobject]@{ Complete = (-not $IntuneDevicesError); Cap = $null; Error = $IntuneDevicesError; Count = $IntuneDevices.Count })
+        }
+
+        # ---------------------------------------------------------------------------------
+        # The deeper collectors. Each one degrades to an Error marker - a failed collector
+        # never fails the run.
+        # ---------------------------------------------------------------------------------
+        $MailboxState = $null
+        $Delegations = @()
+        $MailboxAddIns = @()
+        $TransportRuleChanges = @()
+        $TransportRulesFlagged = @()
+        $ReceivedMailFindings = @()
+        $ReceivedMailSummary = $null
+        $DefenderDetections = @()
+        $AcceptedDomains = @()
+        & $Phase 'MailboxInventory' 'Reading mailbox state, delegations and add-ins'
+        Write-Information 'Full scope: accepted domains'
+        try {
+            $AcceptedDomains = @((New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AcceptedDomain' -Anchor $UserName).DomainName | Where-Object { $_ } | ForEach-Object { [string]$_ })
+        } catch {
+            Write-LogMessage -API 'BECRun' -message "Failed to retrieve accepted domains for $($TenantFilter): $((Get-NormalizedError -message $_.Exception.Message))" -tenant $TenantFilter -sev Warning
+        }
+        # Without accepted domains the external-trustee and typosquat checks fall back to the user's own domain.
+        if ($AcceptedDomains.Count -eq 0 -and $UserName -match '@') { $AcceptedDomains = @(($UserName -split '@')[-1]) }
+
+        $Collect = {
+            param($Name, [scriptblock]$Body)
+            try {
+                & $Body
+            } catch {
+                $CollectorError = Get-CippException -Exception $_
+                Write-LogMessage -API 'BECRun' -message "BEC collector $Name failed for $($UserName): $($CollectorError.NormalizedError)" -tenant $TenantFilter -sev Warning -LogData $CollectorError
+                New-CIPPBecCollectorResult -Data @() -Error $CollectorError.NormalizedError
+            }
+        }
+
+        Write-Information 'Full scope: mailbox inventory'
+        $Inventory = & $Collect 'MailboxInventory' { Get-CIPPBecMailboxInventory -TenantFilter $TenantFilter -UserPrincipalName $UserName -Heuristics $Heuristics -AcceptedDomains $AcceptedDomains }
+        if ($Inventory.PSObject.Properties['MailboxState']) {
+            & $Mark 'MailboxState' $Inventory.MailboxState
+            & $Mark 'Delegations' $Inventory.Delegations
+            & $Mark 'MailboxAddIns' $Inventory.AddIns
+            $MailboxState = $Inventory.MailboxState.Data
+            $Delegations = @($Inventory.Delegations.Data)
+            $MailboxAddIns = @($Inventory.AddIns.Data)
+            # Exchange returns GrantSendOnBehalfTo (and some folder members) as directory ids; show the UPN.
+            $UserById = @{}
+            foreach ($TenantUser in @(($GraphResults | Where-Object { $_.id -eq 'Users' }).body.value)) { if ($TenantUser.id) { $UserById[[string]$TenantUser.id] = [string]$TenantUser.userPrincipalName } }
+            # A delegation whose grant is in this window's audit log (Add-MailboxPermission / Add-RecipientPermission /
+            # folder grants on this mailbox) is the classic persistence move and is flagged even for an internal trustee.
+            $RecentTrustees = @($PermissionsLog | Where-Object { $_.TargetsSuspect -and $_.Operation -match '^(Add-|Update)' -and $_.Trustee } | ForEach-Object { $_.Trustee.ToLowerInvariant() })
+            foreach ($Delegation in $Delegations) {
+                if ($Delegation.Trustee -match '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' -and $UserById.ContainsKey($Delegation.Trustee)) {
+                    $Delegation | Add-Member -NotePropertyName 'TrusteeId' -NotePropertyValue $Delegation.Trustee -Force
+                    $Delegation.Trustee = $UserById[$Delegation.Trustee]
                 }
+                $GrantedInWindow = [bool]($Delegation.Trustee -and $RecentTrustees -contains $Delegation.Trustee.ToLowerInvariant())
+                $Delegation | Add-Member -NotePropertyName 'GrantedInWindow' -NotePropertyValue $GrantedInWindow -Force
+                if ($GrantedInWindow) { $Delegation.Flagged = $true }
             }
-            if ($IntuneDevicesError -like 'An error has occurred*') {
-                $ActivityId = [regex]::Match($IntuneDevicesError, 'Activity ID: ([0-9a-fA-F-]{36})').Groups[1].Value
-                $IntuneDevicesError = "Intune returned an unexpected error (HTTP $($IntuneResponse.status)). This is a failure inside the Intune service itself - usually transient, or the tenant does not have Intune provisioned. Rerun the check to retry.$(if ($ActivityId) { " Microsoft support reference (Activity ID): $ActivityId" })"
+            $Delegations = @($Delegations | Sort-Object -Property @{ Expression = { $_.Flagged }; Descending = $true }, PermissionType, Trustee)
+            # ForwardingAddress (internal forwarding) is a directory id too
+            if ($MailboxState -and $MailboxState.ForwardingAddress -match '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$' -and $UserById.ContainsKey([string]$MailboxState.ForwardingAddress)) {
+                $MailboxState | Add-Member -NotePropertyName 'ForwardingAddressId' -NotePropertyValue $MailboxState.ForwardingAddress -Force
+                $MailboxState.ForwardingAddress = $UserById[[string]$MailboxState.ForwardingAddress]
             }
-            if ([string]::IsNullOrWhiteSpace($IntuneDevicesError)) {
-                $IntuneDevicesError = "Intune device query failed with status $($IntuneResponse.status)"
+        } else {
+            & $Mark 'MailboxState' $Inventory; & $Mark 'Delegations' $Inventory; & $Mark 'MailboxAddIns' $Inventory
+        }
+
+        & $Phase 'Grants' 'Reading application consents'
+        Write-Information 'Full scope: user grants'
+        $Grants = & $Collect 'UserGrants' { Get-CIPPBecUserGrants -TenantFilter $TenantFilter -UserId $SuspectUser -Heuristics $Heuristics -RogueAppFeed $RogueAppFeed }
+        & $Mark 'UserGrants' $Grants
+        $UserGrants = @($Grants.Data)
+
+        & $Phase 'TransportRules' 'Reading transport rules and their changes'
+        Write-Information 'Full scope: transport rules'
+        $Transport = & $Collect 'TransportRules' { Get-CIPPBecTransportRules -TenantFilter $TenantFilter -StartDate $startDate -EndDate $endDate -Heuristics $Heuristics -Anchor $UserName }
+        if ($Transport.PSObject.Properties['Changes']) {
+            & $Mark 'TransportRuleChanges' $Transport.Changes
+            & $Mark 'TransportRulesFlagged' $Transport.Flagged
+            $TransportRuleChanges = @($Transport.Changes.Data)
+            $TransportRulesFlagged = @($Transport.Flagged.Data)
+        } else {
+            & $Mark 'TransportRuleChanges' $Transport; & $Mark 'TransportRulesFlagged' $Transport
+        }
+
+        & $Phase 'ReceivedMail' 'Reading the received-mail trace and Defender verdicts'
+        Write-Information 'Full scope: received mail'
+        $Received = & $Collect 'ReceivedMail' { Get-CIPPBecReceivedMailFindings -TenantFilter $TenantFilter -UserPrincipalName $UserName -StartDate $startDate -EndDate $endDate -Heuristics $Heuristics -AcceptedDomains $AcceptedDomains -Anchor $UserName -IncludeDefender:$HasDefenderP2 }
+        if ($Received.PSObject.Properties['Findings']) {
+            & $Mark 'ReceivedMailFindings' $Received.Findings
+            & $Mark 'DefenderDetections' $Received.Defender
+            $ReceivedMailFindings = @($Received.Findings.Data)
+            $ReceivedMailSummary = $Received.Findings.Summary
+            $DefenderDetections = @($Received.Defender.Data)
+        } else {
+            & $Mark 'ReceivedMailFindings' $Received; & $Mark 'DefenderDetections' $Received
+        }
+
+        & $Phase 'Directory' 'Reading directory audits, registered devices and non-interactive sign-ins'
+        Write-Information 'Full scope: directory audits'
+        $Audits = & $Collect 'DirectoryAudits' { Get-CIPPBecDirectoryAudits -TenantFilter $TenantFilter -UserId $SuspectUser -StartDate $startDate -Heuristics $Heuristics }
+        & $Mark 'DirectoryAudits' $Audits
+        $DirectoryAudits = @($Audits.Data)
+
+        Write-Information 'Full scope: registered devices'
+        $Registered = & $Collect 'RegisteredDevices' { Get-CIPPBecRegisteredDevices -TenantFilter $TenantFilter -UserId $SuspectUser -StartDate $startDate }
+        & $Mark 'RegisteredDevices' $Registered
+        $RegisteredDevices = @($Registered.Data)
+
+        Write-Information 'Full scope: non-interactive sign-ins'
+        $NonInteractive = & $Collect 'NonInteractiveSignIns' { Get-CIPPBecNonInteractiveSignIns -TenantFilter $TenantFilter -UserId $SuspectUser -UsageLocation $UsageLocation -StartDate $startDate }
+        & $Mark 'NonInteractiveSignIns' $NonInteractive
+        $NonInteractiveSignIns = @($NonInteractive.Data)
+
+        & $Phase 'Activity' 'Reading mailbox activity counts and Identity Protection state'
+        Write-Information 'Full scope: mailbox activity'
+        $Activity = if ($auditLog -eq $false) { New-CIPPBecCollectorResult -Data @() -Error 'Unified audit log ingestion is disabled for this tenant' } else { & $Collect 'MailActivity' { Get-CIPPBecMailActivity -TenantFilter $TenantFilter -UserPrincipalName $UserName -StartDate $startDate -EndDate $endDate -Heuristics $Heuristics -Anchor $UserName } }
+        & $Mark 'MailActivity' $Activity
+        $MailActivity = @($Activity.Data)
+        $MailActivitySummary = $Activity.Summary
+        # the raw records, for the attacker-activity pass (not stored)
+        $MailRecords = @($Activity.Records | Where-Object { $_ })
+
+        Write-Information 'Full scope: risk state'
+        $Risk = if ($HasEntraP2) { & $Collect 'RiskState' { Get-CIPPBecRiskState -TenantFilter $TenantFilter -UserId $SuspectUser -StartDate $startDate } } else { & $Skip 'requires Entra ID P2 (Identity Protection)' }
+        & $Mark 'RiskState' $Risk
+        $RiskState = $Risk.Data
+
+        # Who did it: a partner (GDAP) identity, CIPP's own service principal, an application or the
+        # tenant's own user. Stamped on every actor-bearing row so partner and CIPP actions read as such
+        # (the case page lists them together) instead of as unknown actors. The score is not changed.
+        $PartnerUsers = try { Get-CIPPPartnerUserLookup } catch { Write-Information "BEC: partner user lookup unavailable: $($_.Exception.Message)"; @{} }
+        $StampActor = {
+            param($Rows, $Property, $TypeProperty, $IdProperty)
+            foreach ($Row in @($Rows)) {
+                if (-not $Row) { continue }
+                $Type = if ($TypeProperty) { [string]$Row.$TypeProperty } else { 'User' }
+                $AppId = if ($IdProperty -and $Type -eq 'Application') { [string]$Row.$IdProperty } else { $null }
+                $Who = Resolve-CIPPAuditActor -Actor ([string]$Row.$Property) -ActorType $Type -AppId $AppId -PartnerUserLookup $PartnerUsers
+                $Row | Add-Member -NotePropertyName 'ActorKind' -NotePropertyValue $Who.Kind -Force
+                $Row | Add-Member -NotePropertyName 'ActorResolved' -NotePropertyValue $Who.Actor -Force
             }
-            Write-LogMessage -API 'BECRun' -message "Failed to retrieve Intune devices for $($UserName): $IntuneDevicesError" -tenant $TenantFilter -sev Warning
+        }
+        & $StampActor $RuleChangesLog 'UserKey'
+        & $StampActor $PermissionsLog 'UserId'
+        & $StampActor $SafelistChanges 'UserKey'
+        & $StampActor $SharingChanges 'UserKey'
+        & $StampActor $TransportRuleChanges 'Actor'
+        & $StampActor $DirectoryAudits 'InitiatedBy' 'InitiatedByType' 'InitiatedById'
+        & $StampActor $MailActivity 'Actor'
+
+        # Which addresses are the attacker's: sign-in baseline, CIPP's IP allow/block list and the
+        # tenant's own lists, geo, and the other accounts on each address. The IP review re-run calls
+        # the same analysis with the investigator's overrides.
+        & $Phase 'IPAnalysis' 'Establishing attacker IPs from the sign-in baseline, IP lists and other accounts'
+        Write-Information 'Full scope: IP analysis'
+        $IPDraft = [pscustomobject]@{
+            SuspectUserSignIns       = @($SuspectUserSignIns)
+            NonInteractiveSignIns    = @($NonInteractiveSignIns)
+            NewRules                 = @($RulesLog)
+            InboxRuleChanges         = @($RuleChangesLog)
+            MailboxPermissionChanges = @($PermissionsLog)
+            SafelistChanges          = @($SafelistChanges)
+            SharingChanges           = @($SharingChanges)
+            TransportRuleChanges     = @($TransportRuleChanges)
+            DirectoryAudits          = @($DirectoryAudits)
+            SentMessages             = @($SentMessages)
+            SentMessageAnalysis      = $SentMessageAnalysis
+            MailActivity             = @($MailActivity)
+        }
+        # the technician who started the run: their address is theirs, not the user's or the attacker's
+        $TechnicianIPs = @(if ($Item.RequestedFromIP) { [pscustomobject]@{ IP = [string]$Item.RequestedFromIP; By = [string]$Item.RequestedBy } })
+        $IPAnalysis = & $Collect 'IPAnalysis' { Invoke-CIPPBecIPAnalysis -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $UserName -Results $IPDraft -Heuristics $Heuristics -WindowStart $startDate -UsageLocation $UsageLocation -Anchor $UserName -SampleColleagues -TechnicianIPs $TechnicianIPs }
+        if ($IPAnalysis.PSObject.Properties['Verdicts']) {
+            & $Mark 'SignInBaseline' $IPAnalysis.Baseline
+            & $Mark 'IPGuidance' $IPAnalysis.Guidance
+            & $Mark 'IPPeers' $IPAnalysis.PeersResult
+            & $Mark 'IPVerdicts' ([pscustomobject]@{ Complete = $true; Count = @($IPAnalysis.Verdicts).Count })
+            $IPVerdicts = @($IPAnalysis.Verdicts)
+            $IPBaseline = $IPAnalysis.Baseline.Data
+            $IPGuidance = @($IPAnalysis.Guidance.Data)
+            $IPPeers = @($IPAnalysis.Peers.Values)
         } else {
-            $IntuneDevicesRaw = $IntuneResponse.body.value ?? @()
-            $IntuneDevices = @(
-                foreach ($Device in @($IntuneDevicesRaw)) {
-                    [PSCustomObject]@{
-                        id                     = $Device.id
-                        deviceName             = $Device.deviceName
-                        operatingSystem        = $Device.operatingSystem
-                        osVersion              = $Device.osVersion
-                        complianceState        = $Device.complianceState
-                        enrolledDateTime       = if ($Device.enrolledDateTime) { ([datetime]$Device.enrolledDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
-                        lastSyncDateTime       = if ($Device.lastSyncDateTime) { ([datetime]$Device.lastSyncDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
-                        deviceEnrollmentType   = $Device.deviceEnrollmentType
-                        manufacturer           = $Device.manufacturer
-                        model                  = $Device.model
-                        serialNumber           = $Device.serialNumber
-                        userPrincipalName      = $Device.userPrincipalName
-                        managedDeviceOwnerType = $Device.managedDeviceOwnerType
-                    }
-                }
-            )
+            & $Mark 'SignInBaseline' $IPAnalysis; & $Mark 'IPGuidance' $IPAnalysis; & $Mark 'IPPeers' $IPAnalysis; & $Mark 'IPVerdicts' $IPAnalysis
+            $IPVerdicts = @(); $IPBaseline = $null; $IPGuidance = @(); $IPPeers = @()
         }
+        Set-CIPPBecIPVerdictStamp -Results $IPDraft -Verdicts $IPVerdicts
 
-        # Geo-locate the client IPs behind rule changes, safelist changes and sent mail so
+        # What the attacker-side addresses did, item by item: mail opened/synced/deleted/moved/sent,
+        # files touched, sharing links used, Forms built - and the other mailboxes the account reaches.
+        & $Phase 'AttackerActivity' 'Reading what the attacker addresses opened, sent, downloaded and shared'
+        Write-Information 'Full scope: attacker activity'
+        $KnownSubjects = @{}
+        if ($Received.MessageIndex -is [hashtable]) { foreach ($Key in $Received.MessageIndex.Keys) { $KnownSubjects[$Key] = $Received.MessageIndex[$Key] } }
+        foreach ($Row in @($SentMessagesRaw | Where-Object { $_.MessageId })) { $KnownSubjects[[string]$Row.MessageId] = [string]$Row.Subject }
+        $Attacker = & $Collect 'AttackerActivity' { Get-CIPPBecAttackerActivity -TenantFilter $TenantFilter -UserPrincipalName $UserName -StartDate $startDate -EndDate $endDate -Heuristics $Heuristics -Verdicts $IPVerdicts -SignIns $SuspectUserSignIns -NonInteractiveSignIns $NonInteractiveSignIns -MailRecords $MailRecords -SharingChanges $SharingChanges -KnownSubjects $KnownSubjects -Anchor $UserName }
+        if ($Attacker.PSObject.Properties['Mail']) {
+            & $Mark 'AttackerMailActivity' $Attacker.Mail
+            & $Mark 'AttackerFileActivity' $Attacker.Files
+            & $Mark 'LinkUsage' $Attacker.LinkUsage
+            & $Mark 'FormsActivity' $Attacker.Forms
+            $AttackerMailActivity = @($Attacker.Mail.Data); $AttackerMailSummary = $Attacker.Mail.Summary
+            $AttackerFileActivity = @($Attacker.Files.Data); $AttackerFileSummary = $Attacker.Files.Summary
+            $LinkUsage = @($Attacker.LinkUsage.Data)
+            $FormsActivity = @($Attacker.Forms.Data); $FormsSummary = $Attacker.Forms.Summary
+        } else {
+            foreach ($Name in @('AttackerMailActivity', 'AttackerFileActivity', 'LinkUsage', 'FormsActivity')) { & $Mark $Name $Attacker }
+            $AttackerMailActivity = @(); $AttackerMailSummary = $null; $AttackerFileActivity = @(); $AttackerFileSummary = $null; $LinkUsage = @(); $FormsActivity = @(); $FormsSummary = $null
+        }
+        $Delegated = & $Collect 'DelegatedAccess' { Get-CIPPBecDelegatedAccess -TenantFilter $TenantFilter -UserPrincipalName $UserName -UserDisplayName ([string]$SuspectUserDetail.displayName) -PermissionChanges $PermissionsLog -MailActivity $MailActivity -AttackerMail $AttackerMailActivity }
+        & $Mark 'DelegatedAccess' $Delegated
+        $DelegatedAccess = @($Delegated.Data)
+        # The other accounts the attacker addresses reached: tenant-wide sign-ins and audit log per address
+        $AnalysisPeers = if ($IPAnalysis.PSObject.Properties['Peers'] -and $IPAnalysis.Peers -is [hashtable]) { $IPAnalysis.Peers } else { @{} }
+        $Blast = & $Collect 'BlastRadius' { Get-CIPPBecBlastRadius -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $UserName -Verdicts $IPVerdicts -Peers $AnalysisPeers -StartDate $startDate -EndDate $endDate -Heuristics $Heuristics -Anchor $UserName }
+        & $Mark 'BlastRadius' $Blast
+        $BlastRadius = @($Blast.Data)
+
+        # Geo-locate the client IPs behind rule changes, safelist changes, sharing changes, sent
+        # mail and (Full scope) transport-rule changes, directory audits and mailbox activity so
         # activity can be compared against the user's assigned usage location. Sign-ins carry
         # their own location from Graph. A geo failure degrades to no location, never a failed run.
+        & $Phase 'Score' 'Resolving locations and computing the threat score'
         Write-Information 'Resolving IP locations'
-        $ClientIpRegex = [regex]'^(?<IP>(?:\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-fA-F:]+\]|[0-9a-fA-F:]+))(?::\d+)?$'
         $GeoIPCandidates = [System.Collections.Generic.List[string]]::new()
-        foreach ($Row in (@($RuleChangesLog) + @($SafelistChanges) + @($SharingChanges))) { if ($Row.ClientIP) { $GeoIPCandidates.Add([string]$Row.ClientIP) } }
+        $GeoRows = @($RuleChangesLog) + @($SafelistChanges) + @($SharingChanges) + @($PermissionsLog | Where-Object { $_.TargetsSuspect }) + @($TransportRuleChanges) + @($DirectoryAudits) + @($MailActivity)
+        foreach ($Row in $GeoRows) { if ($Row.ClientIP) { $GeoIPCandidates.Add([string]$Row.ClientIP) } }
         foreach ($Row in @($SentMessages)) { if ($Row.FromIP) { $GeoIPCandidates.Add([string]$Row.FromIP) } }
         $GeoMap = @{}
         if ($GeoIPCandidates.Count -gt 0) {
@@ -523,7 +885,7 @@
             param($RawIP)
             if ([string]::IsNullOrWhiteSpace($RawIP)) { return $null }
             # same normalization the batch helper applies to its keys (strip :port and brackets)
-            $Clean = $ClientIpRegex.Replace(([string]$RawIP).Trim(), '${IP}') -replace '[\[\]]', ''
+            $Clean = ConvertTo-CIPPBecHostAddress -Address $RawIP
             if ([string]::IsNullOrWhiteSpace($Clean)) { return $null }
             return $GeoMap[$Clean]
         }
@@ -534,7 +896,7 @@
             return ($Country -ne $UsageLocation)
         }
 
-        foreach ($Row in (@($RuleChangesLog) + @($SafelistChanges) + @($SharingChanges))) {
+        foreach ($Row in $GeoRows) {
             $Geo = & $GetGeo $Row.ClientIP
             $Row | Add-Member -NotePropertyMembers ([ordered]@{
                     Country         = $Geo.CountryOrRegion
@@ -558,26 +920,30 @@
                 [PSCustomObject]@{ Country = $_.Name; Count = $_.Count }
             })
         $LocationAnalysis = [PSCustomObject]@{
-            UsageLocation              = $UsageLocation
-            UserRegisteredCountry      = $SuspectUserDetail.country
-            SignInCountries            = $SignInCountries
-            ForeignSignInCount         = @($SuspectUserSignIns | Where-Object { $_.ForeignLocation -eq $true }).Count
+            UsageLocation                     = $UsageLocation
+            UserRegisteredCountry             = $SuspectUserDetail.country
+            SignInCountries                   = $SignInCountries
+            ForeignSignInCount                = @($SuspectUserSignIns | Where-Object { $_.ForeignLocation -eq $true }).Count
             # failed foreign attempts are password-spray background noise; only a success proves access
-            ForeignSuccessfulSignInCount = @($SuspectUserSignIns | Where-Object { $_.ForeignLocation -eq $true -and $_.Status -eq 'Success' }).Count
-            ForeignRuleChangeCount     = @($RuleChangesLog | Where-Object { $_.ForeignLocation -eq $true }).Count
-            ForeignSafelistChangeCount = @($SafelistChanges | Where-Object { $_.ForeignLocation -eq $true }).Count
-            ForeignSharingChangeCount  = @($SharingChanges | Where-Object { $_.ForeignLocation -eq $true }).Count
-            ForeignSentMessageCount    = @($SentMessages | Where-Object { $_.ForeignLocation -eq $true }).Count
-            Note                       = if (-not $UsageLocation) { 'The user has no usage location assigned in Entra ID, so activity cannot be compared against an expected country. Countries are still listed for manual review.' } else { $null }
+            ForeignSuccessfulSignInCount      = @($SuspectUserSignIns | Where-Object { $_.ForeignLocation -eq $true -and $_.Status -eq 'Success' }).Count
+            ForeignRuleChangeCount            = @($RuleChangesLog | Where-Object { $_.ForeignLocation -eq $true }).Count
+            ForeignSafelistChangeCount        = @($SafelistChanges | Where-Object { $_.ForeignLocation -eq $true }).Count
+            ForeignSharingChangeCount         = @($SharingChanges | Where-Object { $_.ForeignLocation -eq $true }).Count
+            ForeignSentMessageCount           = @($SentMessages | Where-Object { $_.ForeignLocation -eq $true }).Count
+            ForeignNonInteractiveSignInCount  = @($NonInteractiveSignIns | Where-Object { $_.ForeignLocation -eq $true -and $_.Status -eq 'Success' }).Count
+            ForeignTransportRuleChangeCount   = @($TransportRuleChanges | Where-Object { $_.ForeignLocation -eq $true }).Count
+            ForeignDirectoryAuditCount        = @($DirectoryAudits | Where-Object { $_.ForeignLocation -eq $true }).Count
+            ForeignMailActivityCount          = @($MailActivity | Where-Object { $_.ForeignLocation -eq $true }).Count
+            Note                              = if (-not $UsageLocation) { 'The user has no usage location assigned in Entra ID, so activity cannot be compared against an expected country. Countries are still listed for manual review.' } else { $null }
         }
 
         $Results = [PSCustomObject]@{
+            CaseId                   = $CaseId
+            UserPrincipalName        = $UserName
             AddedApps                = @($NewSPs)
             MaliciousSPs             = @($MaliciousSPs)
             SuspectUserSignIns       = @($SuspectUserSignIns)
             SuspectUserSignInsError  = $SuspectUserSignInsError
-            TenantLastSignIns        = @($TenantLastSignIns)
-            LastSuspectUserLogon     = @($LastSignIn)
             SuspectUserDevices       = @($Devices)
             NewRules                 = @($RulesLog)
             InboxRuleChanges         = @($RuleChangesLog)
@@ -595,32 +961,78 @@
             IntuneDevices            = @($IntuneDevices)
             IntuneDevicesError       = $IntuneDevicesError
             LocationAnalysis         = $LocationAnalysis
-            AnalysisWindowDays       = 7
+            # The deeper collectors
+            MailboxState             = $MailboxState
+            Delegations              = @($Delegations)
+            MailboxAddIns            = @($MailboxAddIns)
+            UserGrants               = @($UserGrants)
+            TransportRuleChanges     = @($TransportRuleChanges)
+            TransportRulesFlagged    = @($TransportRulesFlagged)
+            ReceivedMailFindings     = @($ReceivedMailFindings)
+            ReceivedMailSummary      = $ReceivedMailSummary
+            DefenderDetections       = @($DefenderDetections)
+            DirectoryAudits          = @($DirectoryAudits)
+            RegisteredDevices        = @($RegisteredDevices)
+            NonInteractiveSignIns    = @($NonInteractiveSignIns)
+            MailActivity             = @($MailActivity)
+            MailActivitySummary      = $MailActivitySummary
+            # the attacker-IP picture: one verdict per address plus the evidence behind it
+            IPVerdicts               = @($IPVerdicts)
+            IPBaseline               = $IPBaseline
+            IPGuidance               = @($IPGuidance)
+            IPPeers                  = @($IPPeers)
+            IPOverrides              = @()
+            IPTechnicians            = @($TechnicianIPs)
+            # item-level detail of the attacker-side addresses, and the mailboxes the account reaches
+            AttackerMailActivity     = @($AttackerMailActivity)
+            AttackerMailSummary      = $AttackerMailSummary
+            AttackerFileActivity     = @($AttackerFileActivity)
+            AttackerFileSummary      = $AttackerFileSummary
+            LinkUsage                = @($LinkUsage)
+            FormsActivity            = @($FormsActivity)
+            FormsSummary             = $FormsSummary
+            DelegatedAccess          = @($DelegatedAccess)
+            BlastRadius              = @($BlastRadius)
+            RiskState                = $RiskState
+            Completeness             = [pscustomobject]$Completeness
+            AnalysisWindowDays       = $WindowDays
             ExtractedAt              = (Get-Date)
             ExtractResult            = $ExtractResult
         }
+        $Score = Get-CIPPBecScore -Results $Results -Heuristics $Heuristics
+        $Results | Add-Member -NotePropertyName 'Score' -NotePropertyValue $Score -Force
 
-        $Entity = @{
-            UserId       = $SuspectUser
-            Results      = [string]($Results | ConvertTo-Json -Depth 10 -Compress)
-            RowKey       = $SuspectUser
-            PartitionKey = 'bec'
-            Status       = 'Completed'
+        $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Results $Results -Properties @{
+            UserId            = [string]$SuspectUser
+            UserPrincipalName = [string]$UserName
+            DisplayName       = [string]$SuspectUserDetail.displayName
+            Status            = 'Completed'
+            Score             = [int]$Score.Value
+            Level             = [string]$Score.Level
+            ExtractedAt       = $Results.ExtractedAt.ToUniversalTime().ToString('o')
+            IncompleteCount   = @($Completeness.Values | Where-Object { -not $_.Complete }).Count
         }
-        Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
-        Write-LogMessage -API 'BECRun' -message "BEC Check run for $UserName" -tenant $TenantFilter -sev 'Info'
+        Write-LogMessage -API 'BECRun' -message "BEC check run for $UserName - threat level $($Score.Level) ($($Score.Value)) [case $CaseId]" -tenant $TenantFilter -sev 'Info'
+        & $Step 'Score' 'succeeded' "Threat level $($Score.Level) ($($Score.Value))"
+        Set-CIPPAsyncDeploymentStatus -JobId $CaseId -Name $ProgressName -Status 'succeeded' -Logs "Completed run $CaseId with threat level $($Score.Level) ($($Score.Value))"
     } catch {
         $errMessage = Get-NormalizedError -message $_.Exception.Message
         $CippError = Get-CippException -Exception $_
-        $results = [pscustomobject]@{'Results' = "$errMessage"; Exception = $CippError; ExtractedAt = (Get-Date) }
-        Write-LogMessage -API 'BECRun' -message "Error Running BEC for $($UserName): $errMessage" -tenant $TenantFilter -sev 'Error' -LogData $CIPPError
-        $Entity = @{
-            UserId       = $SuspectUser
-            Results      = [string]($Results | ConvertTo-Json -Depth 10 -Compress)
-            RowKey       = $SuspectUser
-            PartitionKey = 'bec'
-            Status       = 'Error'
-        }
-        Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
+        Write-LogMessage -API 'BECRun' -message "Error Running BEC for $($UserName): $errMessage [case $CaseId]" -tenant $TenantFilter -sev 'Error' -LogData $CIPPError
+        if ($Progress.Current) { & $Step $Progress.Current 'failed' $errMessage }
+        Set-CIPPAsyncDeploymentStatus -JobId $CaseId -Name $ProgressName -Status 'failed' -Logs $errMessage
+        try {
+            $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Properties @{
+                UserId            = [string]$SuspectUser
+                UserPrincipalName = [string]$UserName
+                Status            = 'Error'
+                ErrorMessage      = [string]$errMessage
+                ExtractedAt       = (Get-Date).ToUniversalTime().ToString('o')
+            }
+        } catch {
+            Write-Information "BEC: could not record the failed run $CaseId`: $($_.Exception.Message)"
+        }
+    } finally {
+        Set-CippBecCaseContext -CaseId $null
     }
 }
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1
deleted file mode 100644
index a3c9131c0208a..0000000000000
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1	
+++ /dev/null
@@ -1,128 +0,0 @@
-function Push-BPACollectData {
-    <#
-    .FUNCTIONALITY
-    Entrypoint
-    #>
-    param($Item)
-
-    $TenantName = Get-Tenants -TenantFilter $Item.Tenant
-    $BPATemplateTable = Get-CippTable -tablename 'templates'
-    $Filter = "PartitionKey eq 'BPATemplate'"
-    $TemplatesLoc = (Get-CIPPAzDataTableEntity @BPATemplateTable -Filter $Filter).JSON | ConvertFrom-Json
-
-    $Templates = $TemplatesLoc | ForEach-Object {
-        $Template = $_
-        [PSCustomObject]@{
-            Data  = $Template
-            Name  = $Template.Name
-            Style = $Template.Style
-        }
-    }
-    $Table = Get-CippTable -tablename 'cachebpav2'
-
-    $Rerun = Test-CIPPRerun -Type 'BPA' -Tenant $Item.Tenant -API $Item.Template
-    if ($Rerun) {
-        Write-Host 'Detected rerun for BPA. Exiting cleanly'
-        return
-    }
-    Write-Host "Working on BPA for $($TenantName.defaultDomainName) with GUID $($TenantName.customerId) - Report ID $($Item.Template)"
-    $Template = $Templates | Where-Object -Property Name -EQ -Value $Item.Template
-    # Build up the result object that will be stored in tables
-    $Result = @{
-        Tenant       = "$($TenantName.displayName)"
-        GUID         = "$($TenantName.customerId)"
-        RowKey       = "$($Template.Name)"
-        PartitionKey = "$($TenantName.customerId)"
-        LastRefresh  = [string]$(Get-Date (Get-Date).ToUniversalTime() -UFormat '+%Y-%m-%dT%H:%M:%S.000Z')
-    }
-    foreach ($field in $Template.Data.Fields) {
-        if ($field.UseExistingInfo) { continue }
-        if ($Field.Where) { $filterscript = [scriptblock]::Create($Field.Where) } else { $filterscript = { $true } }
-        try {
-            switch ($field.API) {
-                'Graph' {
-                    $paramsField = @{
-                        uri      = $field.URL
-                        tenantid = $TenantName.defaultDomainName
-                    }
-                    if ($Field.Parameters.PSObject.properties.name) {
-                        $field.Parameters | ForEach-Object {
-                            $paramsField[$_.PSObject.properties.name] = $_.PSObject.properties.value
-                        }
-                    }
-                    $FieldInfo = New-GraphGetRequest @paramsField | Where-Object $filterscript | Select-Object $field.ExtractFields
-                }
-                'Exchange' {
-                    Write-Host "Trying to execute $($field.Command) for $($TenantName.displayName) with GUID $($TenantName.customerId)"
-                    if ($field.Command -notlike 'get-*') {
-                        Write-LogMessage -API 'BPA' -tenant $TenantName.defaultDomainName -message 'The BPA only supports get- exchange commands. A set or update command was used.' -sev Error
-                        break
-                    } else {
-                        $paramsField = @{
-                            tenantid = $TenantName.defaultDomainName
-                            cmdlet   = $field.Command
-                        }
-                        if ($Field.Parameters) { $paramsField.'cmdParams' = $field.parameters }
-                        $FieldInfo = New-ExoRequest @paramsField | Where-Object $filterscript | Select-Object $field.ExtractFields
-                    }
-                }
-                'CIPPFunction' {
-                    if ($field.Command -notlike 'get-CIPP*') {
-                        Write-LogMessage -API 'BPA' -tenant $TenantName.defaultDomainName -message 'The BPA only supports get-CIPP commands. A set or update command was used, or a command that is not allowed.' -sev Error
-                        break
-                    }
-                    $paramsField = @{
-                        TenantFilter = $TenantName.defaultDomainName
-                    }
-                    if ($field.Parameters.PSObject.properties.name) {
-                        $field.Parameters | ForEach-Object {
-                            $paramsField[$_.PSObject.properties.name] = $_.PSObject.properties.value
-                        }
-                    }
-                    $FieldInfo = & $field.Command @paramsField | Where-Object $filterscript | Select-Object $field.ExtractFields
-                }
-            }
-        } catch {
-            Write-Information "Error getting $($field.Name) in $($field.api) for $($TenantName.displayName) with GUID $($TenantName.customerId). Error: $($_.Exception.Message)"
-            Write-LogMessage -API 'BPA' -tenant $TenantName.defaultDomainName -message "Error getting $($field.Name) for $($TenantName.displayName) with GUID $($TenantName.customerId). Error: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_)
-            $FieldInfo = 'FAILED'
-            $field.StoreAs = 'string'
-        }
-        try {
-            switch -Wildcard ($field.StoreAs) {
-                '*bool' {
-                    if ($field.ExtractFields.Count -gt 1) {
-                        Write-LogMessage -API 'BPA' -tenant $TenantName.defaultDomainName -message "The BPA only supports 1 field for a bool. $($field.ExtractFields.Count) fields were specified." -sev Error
-                        break
-                    }
-                    if ($null -eq $FieldInfo.$($field.ExtractFields)) { $FieldInfo = $false }
-
-                    $Result.Add($field.Name, [bool]$FieldInfo.$($field.ExtractFields))
-                }
-                'JSON' {
-                    if ($null -eq $FieldInfo) { $JsonString = '{}' } else { $JsonString = (ConvertTo-Json -Depth 15 -InputObject $FieldInfo -Compress) }
-                    Write-Host "Adding $($field.Name) to table with value $JsonString"
-                    $Result.Add($field.Name, $JSONString)
-                }
-                'string' {
-                    $Result.Add($field.Name, [string]$FieldInfo)
-                }
-                'percentage' {
-
-                }
-            }
-        } catch {
-            Write-LogMessage -API 'BPA' -tenant $TenantName.defaultDomainName -message "Error storing $($field.Name) for $($TenantName.displayName) with GUID $($TenantName.customerId). Error: $($_.Exception.Message)" -sev Error -LogData (Get-CippException -Exception $_)
-            $Result.Add($field.Name, 'FAILED')
-        }
-
-    }
-
-    if ($Result) {
-        try {
-            Add-CIPPAzDataTableEntity @Table -Entity $Result -Force
-        } catch {
-            Write-LogMessage -API 'BPA' -tenant $TenantName.defaultDomainName -message "Error getting saving data for $($template.Name) - $($TenantName.customerId). Error: $($_.Exception.Message)" -LogData (Get-CippException -Exception $_) -sev Error
-        }
-    }
-}
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineCacheRefresh.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineCacheRefresh.ps1
index 6b5713edd351f..a9c534c99f722 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineCacheRefresh.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineCacheRefresh.ps1	
@@ -25,6 +25,10 @@ function Push-CIPPBaselineCacheRefresh {
             Write-Information "Baseline trend point skipped: $($_.Exception.Message)"
         }
 
+        try { Send-CIPPBaselineAlertDigest } catch {
+            Write-LogMessage -API 'Baselines' -message "Baseline alert digest failed: $($_.Exception.Message)" -Sev 'Error'
+        }
+
         $Impacted = @{}
         foreach ($ActivityResult in @($Item.Results)) {
             foreach ($Record in @($ActivityResult)) {
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineStandard.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineStandard.ps1
index a88d744c8fa5d..3802a69c9f1bc 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineStandard.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Baselines/Push-CIPPBaselineStandard.ps1	
@@ -63,6 +63,19 @@ function Push-CIPPBaselineStandard {
                             Write-LogMessage -API 'Baselines' -tenant $Item.Item.TenantFilter -message "The refreshed cache still grades `"$($Item.Item.Standard)`" as drifted after remediation - either the write did not take effect or the API is lagging beyond the retry window; the next compare may re-report drift until the scheduled collection." -Sev 'Warning'
                         }
                     }
+                    if ($Verdict -and $Verdict.Compliant) {
+                        # GradeOnly persists nothing - the row still carries the optimistic
+                        # PendingVerification the initial remediation wrote. A clean verdict
+                        # here (first pass or after backoff) confirms the fix, so clear it.
+                        $ResolvedTable = Get-CippTable -tablename 'BaselineAlignment'
+                        $SafeTenant = ConvertTo-CIPPODataFilterValue -Value "$($Item.Item.TenantFilter)" -Type String
+                        $SafeRowKey = ConvertTo-CIPPODataFilterValue -Value ("$($Item.Item.Standard)" -replace '#', '~') -Type String
+                        $ResolvedRow = Get-CIPPAzDataTableEntity @ResolvedTable -Filter "PartitionKey eq '$SafeTenant' and RowKey eq '$SafeRowKey'" | Select-Object -First 1
+                        if ($ResolvedRow -and $ResolvedRow.PendingVerification) {
+                            $ResolvedRow.PendingVerification = $false
+                            $null = Add-CIPPAzDataTableEntity @ResolvedTable -Entity $ResolvedRow -Force
+                        }
+                    }
                 } catch {
                     Write-Information "Baselines: post-remediation cache verification for $($Item.Item.Standard) failed: $($_.Exception.Message)"
                 }
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserDomain.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserDomain.ps1
index cfb5d02467384..d9b2867153339 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserDomain.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserDomain.ps1	
@@ -226,7 +226,7 @@ function Push-DomainAnalyserDomain {
         if ($Domain -match 'onmicrosoft.com' -and $Domain -notmatch 'mail.onmicrosoft.com') {
             $DKIMSelector1Value = "selector1-$($Domain -replace '\.', '-' )"
             $DKIMSelector2Value = "selector2-$($Domain -replace '\.', '-' )"
-            $DkimParams.Add('Selectors', @("$DKIMSelector1Value", "$DKIMSelector2Value"))
+            $DkimParams.Selectors = @("$DKIMSelector1Value", "$DKIMSelector2Value")
         }
 
         $DkimRecord = Read-DkimRecord @DkimParams -ErrorAction Stop
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1
index 20bba052712a5..990dc3ef78c4a 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1	
@@ -16,8 +16,6 @@ function Push-DomainAnalyserTenant {
             Write-LogMessage -API 'DomainAnalyser' -tenant $Tenant.defaultDomainName -tenantid $Tenant.customerId -message "Cleaning up $CleanupCount domain(s) for excluded tenant" -sev Info
             Remove-CIPPAzDataTableEntity -Force @DomainTable -Entity $CleanupRows
         }
-    } elseif ($Tenant.GraphErrorCount -gt 50) {
-        return
     } else {
         try {
             # Get domains from cached database instead of making Graph API calls
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetCalendarPermissionsBatch.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetCalendarPermissionsBatch.ps1
index d95878b545a93..dcc2014a47462 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetCalendarPermissionsBatch.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetCalendarPermissionsBatch.ps1	
@@ -74,7 +74,7 @@ function Push-GetCalendarPermissionsBatch {
             }
 
             Write-Information "Phase 1: Bulk Get-MailboxFolderStatistics for $($CacheMissMailboxes.Count) mailboxes"
-            $FolderStatsResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($FolderStatsRequests) -Select 'Name,FolderType'
+            $FolderStatsResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($FolderStatsRequests) -Select 'Name,FolderType' -MaxConcurrency 5
 
             # One call returns EVERY calendar folder flattened under one OperationGuid, so
             # last-wins cached whatever the mailbox listed last - 'United States holidays' for
@@ -140,7 +140,7 @@ function Push-GetCalendarPermissionsBatch {
 
         if ($PermissionRequests) {
             Write-Information "Phase 2: Bulk Get-MailboxFolderPermission for $(@($PermissionRequests).Count) mailboxes"
-            $PermissionResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($PermissionRequests) -useSystemMailbox $true
+            $PermissionResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($PermissionRequests) -useSystemMailbox $true -MaxConcurrency 5
 
             foreach ($Perm in $PermissionResults) {
                 if ($Perm.error) {
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetMailboxPermissionsBatch.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetMailboxPermissionsBatch.ps1
index a47f664de2d3e..a905dff2d345e 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetMailboxPermissionsBatch.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Mailbox Permissions/Push-GetMailboxPermissionsBatch.ps1	
@@ -41,7 +41,7 @@ function Push-GetMailboxPermissionsBatch {
         Write-Information "Built $($ExoBulkRequests.Count) bulk requests for batch $BatchNumber"
 
         # Execute bulk request for this batch with ReturnWithCommand to separate permission types
-        $MailboxPermissions = New-ExoBulkRequest -cmdletArray @($ExoBulkRequests) -tenantid $TenantFilter -ReturnWithCommand $true
+        $MailboxPermissions = New-ExoBulkRequest -cmdletArray @($ExoBulkRequests) -tenantid $TenantFilter -ReturnWithCommand $true -MaxConcurrency 5
 
         Write-Information "Bulk request completed. Result type: $($MailboxPermissions.GetType().Name)"
         if ($MailboxPermissions -is [hashtable]) {
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1
index b1f17b64e77a5..6c88e3f6950cd 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecOnboardTenantQueue.ps1	
@@ -501,6 +501,23 @@ function Push-ExecOnboardTenantQueue {
         }
 
         if ($OnboardingSteps.Step4.Status -eq 'succeeded') {
+            $SelectedGroupIds = if ($TenantOnboarding.TenantGroups) { $TenantOnboarding.TenantGroups | ConvertFrom-Json }
+            if ($SelectedGroupIds) {
+                $GroupTable = Get-CIPPTable -tablename 'TenantGroups'
+                $MembersTable = Get-CIPPTable -tablename 'TenantGroupMembers'
+                # Only static groups, dynamic group membership is managed by the orchestrator
+                $SelectedGroups = Get-CIPPAzDataTableEntity @GroupTable -Filter "PartitionKey eq 'TenantGroup'" | Where-Object { $_.GroupType -ne 'dynamic' -and $SelectedGroupIds -contains $_.RowKey }
+                foreach ($Group in $SelectedGroups) {
+                    Add-CIPPAzDataTableEntity @MembersTable -Entity @{
+                        PartitionKey = 'Member'
+                        RowKey       = '{0}-{1}' -f $Group.RowKey, $Tenant.customerId
+                        GroupId      = $Group.RowKey
+                        customerId   = $Tenant.customerId
+                    } -Force
+                    $Logs.Add([PSCustomObject]@{ Date = (Get-Date).ToUniversalTime(); Log = "Added tenant to group '$($Group.Name)'" })
+                }
+                $null = Get-TenantGroups -SkipCache
+            }
             if ($StandardsExcludeAllTenants -eq $true) {
                 $GroupTable = Get-CIPPTable -tablename 'TenantGroups'
                 $MembersTable = Get-CIPPTable -tablename 'TenantGroupMembers'
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetMailboxRulesBatch.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetMailboxRulesBatch.ps1
index cac14c52d3e19..b31519d977756 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetMailboxRulesBatch.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-GetMailboxRulesBatch.ps1	
@@ -31,7 +31,7 @@ function Push-GetMailboxRulesBatch {
             }
         }
 
-        $Rules = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($Request) | Where-Object { $_.Identity }
+        $Rules = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($Request) -MaxConcurrency 5 | Where-Object { $_.Identity }
 
         Write-Information "Retrieved $($Rules.Count) rules from batch $BatchNumber/$TotalBatches"
 
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1
index cf36ed310c70e..e8f027391ce3e 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1	
@@ -145,7 +145,9 @@ function Push-SchedulerCIPPNotifications {
                 $Data = $g.Group | Select-Object Message, API, Tenant, Username, Severity
                 $HTMLContent = New-CIPPAlertTemplate -Data $Data -Format 'psa' -InputObject 'table' -CIPPURL $CIPPURL
                 $Title = "$tenant CIPP Alert: Alerts found starting at $((Get-Date).AddMinutes(-15))"
-                Send-CIPPAlert -Type 'psa' -Title $Title -HTMLContent $HTMLContent.htmlcontent -TenantFilter $tenant -APIName 'Alerts'
+                # The visible title contains a timestamp, so use a stable per-tenant key for PSA
+                # consolidation. PSA integrations that ignore the optional key remain unchanged.
+                Send-CIPPAlert -Type 'psa' -Title $Title -HTMLContent $HTMLContent.htmlcontent -TenantFilter $tenant -APIName 'Alerts' -PSAConsolidationKey "$tenant|Alerts"
                 & $MarkSent $g.Group $LogTable
                 $Data = $null; $HTMLContent = $null
             }
diff --git a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1 b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1
index fff94115fdb04..7036846ab86d6 100644
--- a/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1	
+++ b/Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1	
@@ -37,7 +37,7 @@ function Push-CIPPTestsList {
 
         # Emit one task per suite — suite names must match the ValidateSet in Invoke-CIPPTestCollection.
         # Function discovery happens inside Invoke-CIPPTestCollection via Get-Command (path-independent).
-        $Suites = @('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'SMB1001', 'CopilotReadiness', 'GenericTests', 'Custom', 'E8')
+        $Suites = @('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'SMB1001', 'CopilotReadiness', 'GenericTests', 'Custom', 'E8', 'SecuritySimulations')
 
         # Optional caller-supplied suite filter (e.g. a Custom-only run). When present, restrict
         # the emitted suites to the requested subset so we don't spin up every suite unnecessarily.
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1
index 35666a10d4ba9..4a04ff384db44 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1
@@ -38,9 +38,7 @@ function Get-CIPPAlertAdminPassword {
             $AlertData = @()
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not get admin password changes for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertApnCertExpiry.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertApnCertExpiry.ps1
index dfc1459d293c8..bb4fc57f70714 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertApnCertExpiry.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertApnCertExpiry.ps1
@@ -26,9 +26,7 @@ function Get-CIPPAlertApnCertExpiry {
         $AlertData = if ($Apn.expirationDateTime -lt (Get-Date).AddDays($expiryDays) -and $Apn.expirationDateTime -gt (Get-Date).AddDays(-7)) {
             $Apn | Select-Object -Property appleIdentifier, expirationDateTime
         }
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         #no error because if a tenant does not have an APN, it'll error anyway.
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1
index e31714f632dd2..8a742b1f02fd4 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1
@@ -13,11 +13,14 @@ function Get-CIPPAlertAppCertificateExpiry {
 
     $Now = Get-Date
     $AlertData = @()
+    # A cache read that fails is 'could not check', not 'nothing expiring': skip the reconcile so open items stay open.
+    $ReadFailed = $false
 
     try {
         $appList = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Apps'
     } catch {
         $appList = @()
+        $ReadFailed = $true
     }
 
     $AppAlertData = foreach ($App in $appList) {
@@ -40,6 +43,7 @@ function Get-CIPPAlertAppCertificateExpiry {
         $servicePrincipals = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'ServicePrincipals'
     } catch {
         $servicePrincipals = @()
+        $ReadFailed = $true
     }
 
     $SamlAlertData = foreach ($ServicePrincipal in $servicePrincipals) {
@@ -63,7 +67,9 @@ function Get-CIPPAlertAppCertificateExpiry {
         @($AppAlertData)
         @($SamlAlertData)
     ) | Where-Object { $null -ne $_ }
-    if ($AlertData) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
+    if ($ReadFailed) {
+        Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message 'App certificate expiry alert skipped: the application or service principal cache could not be read' -sev Info
+        return
     }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1
index 7e741af1e5d2b..7c565cde491bd 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1
@@ -43,7 +43,5 @@ function Get-CIPPAlertAppSecretExpiry {
             }
         }
     }
-    if ($AlertData) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-    }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppleTerms.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppleTerms.ps1
index f5678cd954210..773603abaaa8f 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppleTerms.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppleTerms.ps1
@@ -35,6 +35,6 @@ function Get-CIPPAlertAppleTerms {
             LastSyncTriggeredDateTime  = $AppleTerms.lastSyncTriggeredDateTime
             Tenant                     = $TenantFilter
         }
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertArchiveQuota.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertArchiveQuota.ps1
index 8c9499d49a53f..700f369520849 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertArchiveQuota.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertArchiveQuota.ps1
@@ -49,7 +49,10 @@ function Get-CIPPAlertArchiveQuota {
             Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Archive quota Alert: Unable to get archive mailboxes: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
             return
         }
-        if ($ArchiveMailboxes.Count -eq 0) { return }
+        if ($ArchiveMailboxes.Count -eq 0) {
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data @()
+            return
+        }
 
         # Archive size only comes from Get-MailboxStatistics. Batch it with an operation guid per
         # mailbox so each result maps back to its mailbox, the same pattern the reporting-DB cache uses.
@@ -105,7 +108,5 @@ function Get-CIPPAlertArchiveQuota {
         }
     }
 
-    if ($OverQuota) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $OverQuota
-    }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $OverQuota
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertCheckExtension.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertCheckExtension.ps1
index 0d0fb4281d13d..11ce91f892b7e 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertCheckExtension.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertCheckExtension.ps1
@@ -49,9 +49,7 @@ function Get-CIPPAlertCheckExtension {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData -Append
 
         # Advance the watermark so the next run only picks up alerts newer than
         # this run. Without this, $Since always fell back to the default window
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderAlerts.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderAlerts.ps1
index d76dbe172a656..72e7e2cc5a9e4 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderAlerts.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderAlerts.ps1
@@ -49,9 +49,7 @@ function Get-CIPPAlertDefenderAlerts {
                 Tenant                = $TenantFilter
             }
         }
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         # Commented out due to potential licensing spam
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderIncidents.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderIncidents.ps1
index 5d6b405e98005..ef601fdc33472 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderIncidents.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderIncidents.ps1
@@ -36,9 +36,7 @@ function Get-CIPPAlertDefenderIncidents {
                 Tenant         = $TenantFilter
             }
         }
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         # Pretty sure this one is gonna be spammy cause of licensing issues, so it's commented out -Bobby
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1
index d651440f0cd3e..27b5ac315ad83 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1
@@ -27,9 +27,7 @@ function Get-CIPPAlertDefenderMalware {
                 TenantId                 = $_.tenantId
             }
         }
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1
index ee8d556ba7714..bbee97e05cb3c 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1
@@ -26,9 +26,7 @@ function Get-CIPPAlertDefenderStatus {
                 TenantId                       = $_.tenantId
             }
         }
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDepTokenExpiry.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDepTokenExpiry.ps1
index 10320d3bf030c..01ce26f829446 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDepTokenExpiry.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDepTokenExpiry.ps1
@@ -30,9 +30,7 @@ function Get-CIPPAlertDepTokenExpiry {
                     $Dep | Select-Object -Property tokenName, @{Name = 'Message'; Expression = { $Message } }
                 }
             }
-            if ($AlertData) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
         } catch {}
 
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceCompliance.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceCompliance.ps1
index 313fdaad06790..d96a97a7d63d0 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceCompliance.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceCompliance.ps1
@@ -13,9 +13,7 @@ function Get-CIPPAlertDeviceCompliance {
     )
     try {
         $AlertData = New-GraphGETRequest -uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices?`$filter=complianceState eq 'noncompliant'&`$select=id,deviceName,managedDeviceOwnerType,complianceState,lastSyncDateTime&`$top=999" -tenantid $TenantFilter
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not get compliance state for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceComplianceGracePeriod.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceComplianceGracePeriod.ps1
index 02acf09a1fd12..f337a3ed23f89 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceComplianceGracePeriod.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDeviceComplianceGracePeriod.ps1
@@ -45,9 +45,7 @@ function Get-CIPPAlertDeviceComplianceGracePeriod {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not get compliance grace period state for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraConnectSyncStatus.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraConnectSyncStatus.ps1
index e72b97f9a703e..253ccf63a32ab 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraConnectSyncStatus.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraConnectSyncStatus.ps1
@@ -32,9 +32,9 @@ function Get-CIPPAlertEntraConnectSyncStatus {
                     LastDirectorySync = $SyncDateTime
                     Tenant            = $TenantFilter
                 }
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
             }
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not get Entra Connect Sync Status for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraLicenseUtilization.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraLicenseUtilization.ps1
index 92cf90a31a9d7..f516b8eacfceb 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraLicenseUtilization.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertEntraLicenseUtilization.ps1
@@ -60,9 +60,7 @@ function Get-CIPPAlertEntraLicenseUtilization {
             }
         )
 
-        if ($AlertData.Count -gt 0) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1
index 200adf97719ba..dab15a864c86c 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1
@@ -52,6 +52,7 @@ function Get-CIPPAlertExpiringLicenses {
                         }
 
                         [PSCustomObject]@{
+                            Id             = $Term.SubscriptionId
                             Message        = $Message
                             License        = $_.License
                             SkuId          = $_.skuId
@@ -69,12 +70,11 @@ function Get-CIPPAlertExpiringLicenses {
             }
         )
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -error $_
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Expiring licenses alert failed: $($ErrorMessage.NormalizedError)" -sev 'Error' -LogData $ErrorMessage
         throw
     }
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminAllowList.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminAllowList.ps1
index daabacf92197a..1e658ab133094 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminAllowList.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminAllowList.ps1
@@ -75,9 +75,9 @@ function Get-CIPPAlertGlobalAdminAllowList {
                         Tenant            = $TenantFilter
                     })
             }
-
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to check approved Global Admins: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminNoAltEmail.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminNoAltEmail.ps1
index 3d3a7db653d92..1bd295f71cceb 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminNoAltEmail.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGlobalAdminNoAltEmail.ps1
@@ -30,8 +30,8 @@ function Get-CIPPAlertGlobalAdminNoAltEmail {
                     Tenant            = $TenantFilter
                 }
             }
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         Write-LogMessage -message "Failed to check alternate email status for Global Admins: $($_.exception.message)" -API 'Global Admin Alt Email Alerts' -tenant $TenantFilter -sev Error
     }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGroupMembershipChange.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGroupMembershipChange.ps1
index 0feeff359001f..c880e995bfd16 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGroupMembershipChange.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertGroupMembershipChange.ps1
@@ -38,9 +38,7 @@ function Get-CIPPAlertGroupMembershipChange {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not check group membership changes for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1
index 0e5886f927a22..a1e1928b81bbc 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertHuntressRogueApps.ps1
@@ -84,8 +84,8 @@ function Get-CIPPAlertHuntressRogueApps {
                     'Listed On'   = $RogueApp.Added
                 }
             }
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         #$ErrorMessage = Get-CippException -Exception $_
         #Write-AlertMessage -tenant $($TenantFilter) -message "Failed to check for rogue apps for $($TenantFilter): $($ErrorMessage.NormalizedError)"
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveGuestUsers.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveGuestUsers.ps1
index 54f40db6c6ee3..c9404e3233ec7 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveGuestUsers.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveGuestUsers.ps1
@@ -81,9 +81,7 @@ function Get-CIPPAlertInactiveGuestUsers {
                 }
             }
 
-            if ($AlertData) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         } catch {}
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveLicensedUsers.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveLicensedUsers.ps1
index 221e9a4444532..3176ab4c6e546 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveLicensedUsers.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveLicensedUsers.ps1
@@ -100,9 +100,7 @@ function Get-CIPPAlertInactiveLicensedUsers {
                 }
             }
 
-            if ($AlertData) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         } catch {}
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveSharePointSites.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveSharePointSites.ps1
index ba301c522572e..8d72d68b9b9d9 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveSharePointSites.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveSharePointSites.ps1
@@ -88,9 +88,7 @@ function Get-CIPPAlertInactiveSharePointSites {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-AlertMessage -message "Inactive SharePoint sites alert failed: $($ErrorMessage.NormalizedError)" -tenant $TenantFilter -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveTeamsSites.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveTeamsSites.ps1
index 38efa0383f51a..adf108b21904e 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveTeamsSites.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveTeamsSites.ps1
@@ -91,9 +91,7 @@ function Get-CIPPAlertInactiveTeamsSites {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-AlertMessage -message "Inactive TeamsSite alert failed: $($ErrorMessage.NormalizedError)" -tenant $TenantFilter -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveUsers.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveUsers.ps1
index d61205f23b80c..46f31f567134c 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveUsers.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertInactiveUsers.ps1
@@ -77,9 +77,7 @@ function Get-CIPPAlertInactiveUsers {
                 }
             }
 
-            if ($AlertData) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         } catch {}
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntuneApprovalRequests.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntuneApprovalRequests.ps1
index 4c2fe0844787a..d4ebc6d7f658a 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntuneApprovalRequests.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntuneApprovalRequests.ps1
@@ -32,9 +32,7 @@ function Get-CIPPAlertIntuneApprovalRequests {
             @{Name = 'Message'; Expression = { $Message } }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to check Intune multi-admin approval requests for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1
index bc672c406a38f..00d5ddeb19db5 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1
@@ -63,6 +63,7 @@ function Get-CIPPAlertIntunePolicyConflicts {
     }
 
     $Issues = [System.Collections.Generic.List[object]]::new()
+    $ReadFailed = $false
 
     if ($Config.IncludePolicies -and $AlertableStatuses) {
         $PolicySources = @(
@@ -96,6 +97,7 @@ function Get-CIPPAlertIntunePolicyConflicts {
                     }
                 }
             } catch {
+                $ReadFailed = $true
                 $ErrorMessage = Get-CippException -Exception $_
                 Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to read cached $($Source.Kind) policy states: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
             }
@@ -122,16 +124,20 @@ function Get-CIPPAlertIntunePolicyConflicts {
                     })
             }
         } catch {
+            $ReadFailed = $true
             $ErrorMessage = Get-CippException -Exception $_
             Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Failed to read cached Intune app install status: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
         }
     }
 
-    if (-not $Issues) {
+    # A failed cache read means the picture is incomplete: "could not check" is not "clear".
+    if ($ReadFailed) {
         return
     }
 
-    if (-not $Config.AlertEachIssue) {
+    if (-not $Issues) {
+        $AlertData = $null
+    } elseif (-not $Config.AlertEachIssue) {
         $PolicyCount = ($Issues | Where-Object { $_.Type -eq 'Policy' }).Count
         $AppCount = ($Issues | Where-Object { $_.Type -eq 'Application' }).Count
 
@@ -146,7 +152,5 @@ function Get-CIPPAlertIntunePolicyConflicts {
         $AlertData = $Issues
     }
 
-    if ($AlertData) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-    }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicenseAssignmentErrors.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicenseAssignmentErrors.ps1
index 0c44125c4b034..676b6fa6e092f 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicenseAssignmentErrors.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicenseAssignmentErrors.ps1
@@ -90,10 +90,7 @@ function Get-CIPPAlertLicenseAssignmentErrors {
             }
         }
 
-        # If errors are found, write alert
-        if ($LicenseAssignmentErrors) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $LicenseAssignmentErrors
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $LicenseAssignmentErrors
 
     } catch {
         Write-LogMessage -message "Failed to check license assignment errors: $($_.exception.message)" -API 'License Assignment Alerts' -tenant $TenantFilter -sev Error
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicensedUsersWithRoles.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicensedUsersWithRoles.ps1
index d97625653c8e1..3f9b8167c8585 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicensedUsersWithRoles.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLicensedUsersWithRoles.ps1
@@ -15,22 +15,23 @@ function Get-CIPPAlertLicensedUsersWithRoles {
     $LicensedUsers = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=999&`$select=userPrincipalName,assignedLicenses,displayName" -tenantid $TenantFilter | Where-Object { $_.assignedLicenses -and $_.assignedLicenses.Count -gt 0 }
     if (-not $LicensedUsers -or $LicensedUsers.Count -eq 0) {
         Write-Information "No licensed users found for tenant $TenantFilter"
-        return $true
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $null
+        return
     }
     # Get all directory roles with their members
     $DirectoryRoles = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/directoryRoles?`$expand=members" -tenantid $TenantFilter
     if (-not $DirectoryRoles -or $DirectoryRoles.Count -eq 0) {
         Write-Information "No directory roles found for tenant $TenantFilter"
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $null
         return
     }
     $UsersToAlertOn = $LicensedUsers | Where-Object { $_.userPrincipalName -in $DirectoryRoles.members.userPrincipalName }
 
 
-    if ($UsersToAlertOn.Count -gt 0) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $UsersToAlertOn
-    } else {
+    if ($UsersToAlertOn.Count -eq 0) {
         Write-Information "No licensed users with roles found for tenant $TenantFilter"
     }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $UsersToAlertOn
 
 
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLongLivedAppCredentials.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLongLivedAppCredentials.ps1
index 9699e2ca1b6be..15ded72b23724 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLongLivedAppCredentials.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLongLivedAppCredentials.ps1
@@ -17,11 +17,11 @@ function Get-CIPPAlertLongLivedAppCredentials {
         $Apps = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/applications?`$select=id,appId,displayName,passwordCredentials,keyCredentials&`$top=999" -tenantid $TenantFilter -AsApp $true)
 
         $NowUtc = [datetime]::UtcNow
-        $DatePartition = (Get-Date -UFormat '%Y%m%d').ToString()
         $CredTypeMap = @(
             @{ Property = 'passwordCredentials'; TypeLabel = 'Secret' }
             @{ Property = 'keyCredentials'; TypeLabel = 'Certificate' }
         )
+        $AlertData = [System.Collections.Generic.List[object]]::new()
 
         foreach ($App in @($Apps)) {
             foreach ($ct in $CredTypeMap) {
@@ -33,8 +33,6 @@ function Get-CIPPAlertLongLivedAppCredentials {
                     if ($endUtc -le $startUtc -or $endUtc -le $NowUtc) { continue }
                     $months = (New-TimeSpan -Start $startUtc -End $endUtc).TotalDays / 30.4375
                     if ($months -gt $MaxMonths) {
-                        $keyId = if ($Cred.keyId) { "$($Cred.keyId)" } else { 'unknown' }
-                        $tracePartition = "$DatePartition-$($App.id)-$keyId" -replace '[/\\#?]', '_'
                         $oneFinding = [PSCustomObject]@{
                             AppDisplayName   = $App.displayName
                             AppId            = $App.appId
@@ -46,11 +44,13 @@ function Get-CIPPAlertLongLivedAppCredentials {
                             ValidityMonths   = [math]::Round([double]$months, 2)
                             MaxMonthsAllowed = $MaxMonths
                         }
-                        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $oneFinding -PartitionKey $tracePartition
+                        $AlertData.Add($oneFinding)
                     }
                 }
             }
         }
+
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Excessive secret validity alert failed: $($ErrorMessage.NormalizedError)" -sev 'Error' -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowDomainScore.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowDomainScore.ps1
index 6746485852218..decd2785a8a30 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowDomainScore.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowDomainScore.ps1
@@ -13,6 +13,11 @@ function Get-CIPPAlertLowDomainScore {
     )
 
     $DomainData = Get-CIPPDomainAnalyser -TenantFilter $TenantFilter
+    if (-not $DomainData) {
+        # No analyser results yet is 'could not check', not 'every domain is fine'.
+        Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message 'Low domain score alert skipped: no domain analyser data available yet' -sev Info
+        return
+    }
     $LowScoreDomains = $DomainData | Where-Object { $_.ScorePercentage -lt $InputValue -and $_.ScorePercentage -ne '' -and $_.Domain -notlike '*.onmicrosoft.com' -and $_.Domain -notlike '*.mail.onmicrosoft.com' } | ForEach-Object {
         [PSCustomObject]@{
             Message          = "$($_.Domain): Domain security score is $($_.ScorePercentage)%, which is below the threshold of $InputValue%. Issues: $($_.ScoreExplanation)"
@@ -23,7 +28,5 @@ function Get-CIPPAlertLowDomainScore {
         }
     }
 
-    if ($LowScoreDomains) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $LowScoreDomains
-    }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $LowScoreDomains
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowTenantAlignment.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowTenantAlignment.ps1
index db205211cca04..6f2a6cd38d10e 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowTenantAlignment.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertLowTenantAlignment.ps1
@@ -42,9 +42,7 @@ function Get-CIPPAlertLowTenantAlignment {
             }
         }
 
-        if ($LowAlignmentAlerts.Count -gt 0) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $LowAlignmentAlerts
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $LowAlignmentAlerts
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAdmins.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAdmins.ps1
index 429c04de6202c..3bda1a35cf261 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAdmins.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAdmins.ps1
@@ -75,9 +75,7 @@ function Get-CIPPAlertMFAAdmins {
                     })
             }
 
-            if ($AlertData.Count -gt 0) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         } else {
             Write-LogMessage -message 'Potentially using Duo for MFA, could not check MFA status for Admins with 100% accuracy' -API 'MFA Alerts - Informational' -tenant $TenantFilter -sev Info
         }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1
index 4eb54bdf05d30..ca87c004b9d96 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1
@@ -21,6 +21,52 @@ function Get-CIPPAlertMFAAlertUsers {
             Where-Object { $_.userDisplayName -ne 'On-Premises Directory Synchronization Service Account' -and $_.userPrincipalName -notmatch '^package_[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}@' } |
             Select-Object @{n = 'UPN'; e = { $_.userPrincipalName } }, @{n = 'DisplayName'; e = { $_.userDisplayName } }
         }
+
+        # Give new accounts a grace period to register MFA before they are alerted on.
+        # Only suppress when we positively know createdDateTime is within the window;
+        # unknown age (missing user) leaves them in the alert list.
+        $NewUserGraceDays = [int]($InputValue ?? 0)
+        if ($Users -and $NewUserGraceDays -gt 0) {
+            $CreatedByUpn = @{}
+            try {
+                foreach ($CachedUser in @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Users' -Fields 'userPrincipalName', 'createdDateTime')) {
+                    if ($CachedUser.userPrincipalName) {
+                        $CreatedByUpn[$CachedUser.userPrincipalName] = $CachedUser.createdDateTime
+                    }
+                }
+            } catch {
+                Write-Host "Could not load user createdDateTime from reporting DB for tenant '$TenantFilter': $_"
+            }
+
+            # No usable cache — same fields from live Graph, same filter rules below.
+            if ($CreatedByUpn.Count -eq 0) {
+                try {
+                    foreach ($LiveUser in @(New-GraphGETRequest -uri "https://graph.microsoft.com/beta/users?`$select=userPrincipalName,createdDateTime" -tenantid $TenantFilter)) {
+                        if ($LiveUser.userPrincipalName) {
+                            $CreatedByUpn[$LiveUser.userPrincipalName] = $LiveUser.createdDateTime
+                        }
+                    }
+                } catch {
+                    Write-Host "Could not load user createdDateTime from Graph for tenant '$TenantFilter': $_"
+                }
+            }
+
+            if ($CreatedByUpn.Count -gt 0) {
+                $Cutoff = (Get-Date).ToUniversalTime().AddDays(-$NewUserGraceDays)
+                $Users = @($Users | Where-Object {
+                        $Created = $CreatedByUpn[$_.UPN]
+                        if (-not $Created) {
+                            $true
+                        } else {
+                            try {
+                                ([datetime]$Created).ToUniversalTime() -lt $Cutoff
+                            } catch {
+                                $true
+                            }
+                        }
+                    })
+            }
+        }
         Write-Host "Completed MFA status check for tenant '$TenantFilter'. Found $($Users.Count) users without MFA registered."
 
         if ($Users) {
@@ -31,8 +77,8 @@ function Get-CIPPAlertMFAAlertUsers {
                 }
             }
             Write-Host 'Writing alert trace'
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         Write-LogMessage -message "Failed to check MFA status for all users: $($_.exception.message)" -API 'MFA Alerts - Informational' -tenant $TenantFilter -sev Error
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1
index 056928e9c2afa..f4d9daab7e3dc 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMXRecordChanged.ps1
@@ -72,9 +72,7 @@ function Get-CIPPAlertMXRecordChanged {
             Add-CIPPAzDataTableEntity @CacheTable -Entity $CacheEntity -Force
         }
 
-        if ($ChangedDomains) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $ChangedDomains
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $ChangedDomains
     } catch {
         Write-LogMessage -message "Failed to check MX record changes: $($_.Exception.Message)" -API 'MX Record Alert' -tenant $TenantFilter -sev Error
     }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1
index b8e0252a39396..4771de839919e 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewAppApproval.ps1
@@ -56,9 +56,9 @@ function Get-CIPPAlertNewAppApproval {
                     $AlertData.Add($Message)
                 }
             }
-
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
     }
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewMFADevice.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewMFADevice.ps1
index 0bdb729a1581a..9fde9812a4913 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewMFADevice.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewMFADevice.ps1
@@ -48,9 +48,7 @@ function Get-CIPPAlertNewMFADevice {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1
index 46a8033f3c88e..b2c4caeeb91f7 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1
@@ -5,10 +5,13 @@ function Get-CIPPAlertNewRiskyUsers {
     #>
     [CmdletBinding()]
     param (
+        # Opt-in: run the default BEC containment for users that newly appear at high risk.
         [Parameter(Mandatory = $false)]
         [Alias('input')]
+        $InputValue,
         $TenantFilter
     )
+    $ContainHighRiskUsers = ($InputValue -eq $true -or [string]$InputValue -eq 'true')
     $Deltatable = Get-CIPPTable -Table DeltaCompare
     try {
         # Check if tenant has P2 capabilities
@@ -49,8 +52,24 @@ function Get-CIPPAlertNewRiskyUsers {
                     default { 'Info' }
                 }
 
+                # Opt-in auto-containment: the default six-step BEC containment for a user that is
+                # newly at high risk and still at risk. Automation confirms the Critical actions by
+                # design; the password never enters the alert payload.
+                $Containment = $null
+                if ($ContainHighRiskUsers -and $_.riskLevel -eq 'high' -and $_.riskState -eq 'atRisk') {
+                    $RiskyUpn = $_.userPrincipalName
+                    try {
+                        $Rows = Invoke-CIPPBecContainment -TenantFilter $TenantFilter -UserPrincipalName $RiskyUpn -Confirmed -Redacted -Headers 'Alert Engine' -APIName 'Alert Engine'
+                        $Containment = @(foreach ($Row in @($Rows)) { "$($Row.Action) ($($Row.state)): $($Row.resultText)" }) -join '; '
+                        Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Auto-contained high-risk user $RiskyUpn (NewRiskyUsers alert)" -sev Info
+                    } catch {
+                        $Containment = "Auto-containment failed: $($_.Exception.Message)"
+                        Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Auto-containment of high-risk user $RiskyUpn failed: $($_.Exception.Message)" -sev Error
+                    }
+                }
+
                 [PSCustomObject]@{
-                    Message = "New risky user detected: $($_.userPrincipalName)"
+                    Message = "New risky user detected: $($_.userPrincipalName)$(if ($Containment) { ' - BEC containment executed' })"
                     Details = @{
                         RiskLevel    = $_.riskLevel
                         RiskState    = $_.riskState
@@ -59,15 +78,14 @@ function Get-CIPPAlertNewRiskyUsers {
                         IsProcessing = $_.isProcessing
                         RiskHistory  = $RiskHistory
                         Severity     = $Severity
+                        Containment  = $Containment
                     }
                     Tenant  = $TenantFilter
                 }
             }
-
-            if ($AlertData) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
         }
+
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not get risky users for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRole.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRole.ps1
index 257f9a26e45bb..0c496c0527251 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRole.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRole.ps1
@@ -40,8 +40,8 @@ function Get-CIPPAlertNewRole {
                     }
                 }
             }
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not get role changes for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewShadowAITool.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewShadowAITool.ps1
index 86eb83645faa7..025915863acf5 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewShadowAITool.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewShadowAITool.ps1
@@ -117,7 +117,7 @@ function Get-CIPPAlertNewShadowAITool {
         Add-CIPPAzDataTableEntity @DeltaTable -Entity $DeltaEntity -Force
 
         # First run establishes the baseline without alerting.
-        if (-not $PreviousRow) { return }
+        if (-not $PreviousRow) { $NewToolNames = @() }
 
         # Optionally skip tools that are marked as sanctioned for this tenant.
         if ($InputValue -eq $true) {
@@ -139,8 +139,8 @@ function Get-CIPPAlertNewShadowAITool {
                     'Tenant'       = $TenantFilter
                 }
             }
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not check for new Shadow AI tools for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNoCAConfig.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNoCAConfig.ps1
index 8ed68ab257822..b6c231b6fdb68 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNoCAConfig.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNoCAConfig.ps1
@@ -25,9 +25,9 @@ function Get-CIPPAlertNoCAConfig {
                     Message = 'Conditional Access is available, but no policies could be found.'
                     Tenant  = $TenantFilter
                 }
-
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
             }
+
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOneDriveLongPaths.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOneDriveLongPaths.ps1
index de865c1a9015f..84b22aa777986 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOneDriveLongPaths.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOneDriveLongPaths.ps1
@@ -66,9 +66,7 @@ function Get-CIPPAlertOneDriveLongPaths {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-AlertMessage -message "OneDrive long paths alert failed: $($ErrorMessage.NormalizedError)" -tenant $TenantFilter -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1
index 66793768e3362..4d92054ff0e43 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOnedriveQuota.ps1
@@ -46,7 +46,5 @@ function Get-CIPPAlertOneDriveQuota {
     }
 
     #If the quota is over the threshold, send an alert
-    if ($OverQuota) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $OverQuota
-    }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $OverQuota
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1
index 527f9d46e3bdb..99b3d1600ac12 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1
@@ -27,9 +27,7 @@ function Get-CIPPAlertOverusedLicenses {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Overused Licenses Alert Error occurred: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertPermanentActiveAdminAssigned.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertPermanentActiveAdminAssigned.ps1
index 6cad3c9cdaa81..979dc8b433e2d 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertPermanentActiveAdminAssigned.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertPermanentActiveAdminAssigned.ps1
@@ -84,9 +84,7 @@ function Get-CIPPAlertPermanentActiveAdminAssigned {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not check permanent admin assignments for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1
index b9607981ecdcd..e7a4df6411b8d 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1
@@ -18,14 +18,13 @@
     }
 
     try {
-        # The received-date window has to be wide enough to catch a release request raised some time after
-        # the message was quarantined. The old 6-hour window missed most of them; a one-day window suits an
-        # hourly-scheduled alert. (The Quarantine page applies no received-date filter, which is why the
-        # request is visible there while no webhook or email is ever sent.)
+        # EXO can only filter on when the message was received, not when release was requested, and users
+        # often ask days after the message was quarantined. Cover the full 30 days EXO allows so every
+        # pending request is seen; Write-AlertTrace keeps an already-alerted request from re-alerting.
         $cmdParams = @{
             PageSize          = 1000
             ReleaseStatus     = 'Requested'
-            StartReceivedDate = (Get-Date).AddDays(-1)
+            StartReceivedDate = (Get-Date).AddDays(-30)
             EndReceivedDate   = (Get-Date)
         }
         $RequestedReleases = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams $cmdParams -ErrorAction Stop | Select-Object -ExcludeProperty *data.type* | Sort-Object -Property ReceivedTime
@@ -51,9 +50,9 @@
                     Tenant            = $TenantFilter
                 }
             }
-
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "QuarantineReleaseRequests: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1
index 91691e65b6c6c..125a711366a01 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1
@@ -44,7 +44,5 @@ function Get-CIPPAlertQuotaUsed {
             }
         }
     }
-    if ($OverQuota) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $OverQuota
-    }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $OverQuota
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertReportOnlyCA.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertReportOnlyCA.ps1
index 5cda78a798c89..3cf1cd3731a8c 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertReportOnlyCA.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertReportOnlyCA.ps1
@@ -32,8 +32,8 @@ function Get-CIPPAlertReportOnlyCA {
                         Tenant      = $TenantFilter
                     }
                 }
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
             }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRestrictedUsers.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRestrictedUsers.ps1
index 3fe718f8dd9d6..ca70160b3c247 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRestrictedUsers.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRestrictedUsers.ps1
@@ -34,8 +34,8 @@
                     Tenant          = $TenantFilter
                 }
             }
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
        # $ErrorMessage = Get-CippException -Exception $_
        # Write-LogMessage -tenant $($TenantFilter) -message "Could not get restricted users for $($TenantFilter): $($ErrorMessage.NormalizedError)" -severity 'Error' -API 'Get-CIPPAlertRestrictedUsers' -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRoleEscalableGroups.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRoleEscalableGroups.ps1
index 009f1cc7e389f..b32e5ee170cb2 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRoleEscalableGroups.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertRoleEscalableGroups.ps1
@@ -117,11 +117,10 @@ function Get-CIPPAlertRoleEscalableGroups {
             }
         }
 
-        if ($findings.Count -gt 0) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data @($findings)
-        } else {
+        if ($findings.Count -eq 0) {
             Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Role-escalable groups alert: no role-escalation group paths found" -sev 'Information'
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data @($findings)
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Role-escalable groups alert failed: $($ErrorMessage.NormalizedError)" -sev 'Error' -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsDisabled.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsDisabled.ps1
index 4a38cd6c23c9c..9eda2c6c02e2e 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsDisabled.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsDisabled.ps1
@@ -25,10 +25,10 @@ function Get-CIPPAlertSecDefaultsDisabled {
                     Message = 'Security Defaults is disabled and no Conditional Access policies are configured. This tenant has no baseline security protection.'
                     Tenant  = $TenantFilter
                 }
-
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
             }
         }
+
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Security Defaults Disabled Alert: Error occurred: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsUpsell.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsUpsell.ps1
index 6832a61a216ff..a595767d99ade 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsUpsell.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecDefaultsUpsell.ps1
@@ -21,9 +21,9 @@ function Get-CIPPAlertSecDefaultsUpsell {
                     Action         = $SecDefaults.securityDefaultsUpsell.action
                     Tenant         = $TenantFilter
                 }
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
             }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         } catch {}
 
     } catch {
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecureScore.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecureScore.ps1
index 87ddec1e4ba2f..2a77108b19f85 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecureScore.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSecureScore.ps1
@@ -67,9 +67,7 @@ function Get-CippAlertSecureScore {
             }
         }
 
-        if ($SecureScoreResult) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $SecureScoreResult -PartitionKey SecureScore
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $SecureScoreResult
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Could not get Secure Score for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1
index 3e0f6cd93532e..8cafb018d7cae 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSharepointQuota.ps1
@@ -38,7 +38,7 @@ function Get-CIPPAlertSharepointQuota {
                 AlertQuotaThreshold   = $Value
                 Tenant                = $TenantFilter
             }
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     }
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSmtpAuthSuccess.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSmtpAuthSuccess.ps1
index a20c79d262a0c..2294ef8e9882d 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSmtpAuthSuccess.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSmtpAuthSuccess.ps1
@@ -30,9 +30,7 @@ function Get-CIPPAlertSmtpAuthSuccess {
         $AlertData = $SignIns | Select-Object userPrincipalName, createdDateTime, clientAppUsed, ipAddress, status, @{Name = 'Tenant'; Expression = { $TenantFilter } }
 
         # Write results into the alert pipeline
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         # Suppress errors if no data returned
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSoftDeletedMailboxes.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSoftDeletedMailboxes.ps1
index e9db0b4df8c96..cb6d7ce2ab825 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSoftDeletedMailboxes.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertSoftDeletedMailboxes.ps1
@@ -21,9 +21,7 @@ function Get-CIPPAlertSoftDeletedMailboxes {
         $AlertData = $SoftDeletedMailBoxes | Where-Object { $_.IsInactiveMailbox -ne $true }
 
         # Write the alert trace with the filtered data
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertStaleEntraDevices.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertStaleEntraDevices.ps1
index 47868b4643668..afe1503f4e194 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertStaleEntraDevices.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertStaleEntraDevices.ps1
@@ -75,9 +75,7 @@ function Get-CIPPAlertStaleEntraDevices {
                 }
             }
 
-            if ($AlertData) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         } catch {}
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTERRL.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTERRL.ps1
index dcb8d932fcd1e..b0ee3cc449d1c 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTERRL.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTERRL.ps1
@@ -31,8 +31,8 @@ function Get-CIPPAlertTERRL {
                     Message            = 'Tenant is at {0}% of their TERRL limit (using {1} of {2} messages). Tenant Enforcement Status: {3}' -f $UsagePercentage, $TerrlStatus.ObservedValue, $TerrlStatus.Threshold, $TerrlStatus.Verdict
                     Tenant             = $TenantFilter
                 }
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
             }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
         }
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTenantAccess.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTenantAccess.ps1
index 6b1e2f317e8d6..a393737c0101d 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTenantAccess.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertTenantAccess.ps1
@@ -129,9 +129,7 @@ function Get-CIPPAlertTenantAccess {
                 })
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Tenant access alert error for $($TenantFilter): $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnlicensedOneDriveData.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnlicensedOneDriveData.ps1
index 751440ba7682f..325b48441c043 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnlicensedOneDriveData.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnlicensedOneDriveData.ps1
@@ -58,6 +58,8 @@ function Get-CIPPAlertUnlicensedOneDriveData {
     }
 
     if ($Billing.UnlicensedOdbSyntexBillingEnabled -eq $true) {
+        # Billing is enabled, so unlicensed OneDrive data is retained: nothing can be pending deletion.
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $null
         return
     }
 
@@ -161,7 +163,5 @@ function Get-CIPPAlertUnlicensedOneDriveData {
         $Item
     }
 
-    if ($AlertData) {
-        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-    }
+    Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1
index 98f958da3a88d..1441a0dff70dc 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1
@@ -26,9 +26,7 @@ function Get-CIPPAlertUnusedLicenses {
             }
         }
 
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Alerts' -tenant $TenantFilter -message "Unused Licenses Alert Error occurred: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1
index 8a9a680f8401b..9978ede813744 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1
@@ -36,9 +36,7 @@ function Get-CIPPAlertUserReportedPhishing {
                 Tenant           = $TenantFilter
             }
         }
-        if ($AlertData) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         if ($ErrorMessage.NormalizedError -match 'dataservice\.protection\.outlook\.com' -or $ErrorMessage.NormalizedError -match 'No HTTP resource was found') {
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVppTokenExpiry.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVppTokenExpiry.ps1
index c2d228ad4b8bf..f09f11600e838 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVppTokenExpiry.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVppTokenExpiry.ps1
@@ -32,9 +32,7 @@ function Get-CIPPAlertVppTokenExpiry {
                     $Vpp | Select-Object -Property organizationName, appleId, vppTokenAccountType, @{Name = 'Message'; Expression = { $Message } }, @{Name = 'Tenant'; Expression = { $TenantFilter } }
                 }
             }
-            if ($AlertData) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
+            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
 
         } catch {}
 
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVulnerabilities.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVulnerabilities.ps1
index 83dd5cce9310b..6d7ac3966aa0d 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVulnerabilities.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVulnerabilities.ps1
@@ -43,16 +43,28 @@ function Get-CIPPAlertVulnerabilities {
     }
 
     try {
-        $VulnerabilityGroups = New-GraphGetRequest -tenantid $TenantFilter -uri 'https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilitiesByMachine' -scope 'https://api.securitycenter.microsoft.com/.default' |
-            Where-Object { $_.cveId } |
-            Select-Object cveId, vulnerabilitySeverityLevel, firstSeenTimestamp, lastSeenTimestamp, cvssScore, exploitabilityLevel, softwareName, softwareVendor, softwareVersion, recommendedSecurityUpdate, recommendedSecurityUpdateId, recommendedSecurityUpdateUrl, deviceName, deviceId, osPlatform, osVersion, osArchitecture |
-            Group-Object cveId
+        # Fold the streamed export into one small bucket per CVE (earliest record, record count,
+        # unique device names) instead of grouping every device x CVE record in memory.
+        $Buckets = @{}
+        Get-DefenderTvmRaw -TenantId $TenantFilter -Stream | ForEach-Object {
+            if (-not $_.cveId) { return }
+            $Bucket = $Buckets[$_.cveId]
+            if (-not $Bucket) {
+                $Bucket = @{ First = $_; Count = 0; Devices = [System.Collections.Generic.List[string]]::new(); Seen = [System.Collections.Generic.HashSet[string]]::new() }
+                $Buckets[$_.cveId] = $Bucket
+            } elseif ($_.firstSeenTimestamp -lt $Bucket.First.firstSeenTimestamp) {
+                $Bucket.First = $_
+            }
+            $Bucket.Count++
+            if ($Bucket.Seen.Add([string]$_.deviceName)) { $Bucket.Devices.Add($_.deviceName) }
+        }
 
-        if ($VulnerabilityGroups) {
+        if ($Buckets.Count -gt 0) {
             $AlertData = [System.Collections.Generic.List[PSCustomObject]]::new()
 
-            foreach ($Group in $VulnerabilityGroups) {
-                $FirstVuln = $Group.Group | Sort-Object firstSeenTimestamp | Select-Object -First 1
+            foreach ($CveId in ($Buckets.Keys | Sort-Object)) {
+                $Bucket = $Buckets[$CveId]
+                $FirstVuln = $Bucket.First
                 $HoursOld = [math]::Round(((Get-Date) - [datetime]$FirstVuln.firstSeenTimestamp).TotalHours)
 
                 # Skip based on age threshold mode
@@ -82,16 +94,16 @@ function Get-CIPPAlertVulnerabilities {
                 }
 
                 $DaysOld = [math]::Round(((Get-Date) - [datetime]$FirstVuln.firstSeenTimestamp).TotalDays)
-                $AffectedDevices = ($Group.Group | Select-Object -ExpandProperty deviceName -Unique) -join ', '
+                $AffectedDevices = $Bucket.Devices -join ', '
 
                 $VulnerabilityAlert = [PSCustomObject]@{
-                    CVE                  = $Group.Name
+                    CVE                  = $CveId
                     Severity             = $FirstVuln.vulnerabilitySeverityLevel
                     FirstSeenTimestamp   = $FirstVuln.firstSeenTimestamp
                     LastSeenTimestamp    = $FirstVuln.lastSeenTimestamp
                     DaysOld              = $DaysOld
                     HoursOld             = $HoursOld
-                    AffectedDeviceCount  = $Group.Count
+                    AffectedDeviceCount  = $Bucket.Count
                     SoftwareName         = $FirstVuln.softwareName
                     SoftwareVendor       = $FirstVuln.softwareVendor
                     SoftwareVersion      = $FirstVuln.softwareVersion
@@ -106,11 +118,9 @@ function Get-CIPPAlertVulnerabilities {
                 $AlertData.Add($VulnerabilityAlert)
             }
 
-            # Only send alert if we have vulnerabilities that meet the criteria
-            if ($AlertData.Count -gt 0) {
-                Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
-            }
         }
+
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $AlertData
     } catch {
         Write-LogMessage -message "Failed to check vulnerabilities: $($_.exception.message)" -API 'Vulnerability Alerts' -tenant $TenantFilter -sev Error
     }
diff --git a/Modules/CIPPAlerts/Public/Alerts/Get-CippAlertBreachAlert.ps1 b/Modules/CIPPAlerts/Public/Alerts/Get-CippAlertBreachAlert.ps1
index b10f905a8fcb0..25bed1524cd45 100644
--- a/Modules/CIPPAlerts/Public/Alerts/Get-CippAlertBreachAlert.ps1
+++ b/Modules/CIPPAlerts/Public/Alerts/Get-CippAlertBreachAlert.ps1
@@ -12,9 +12,7 @@ function Get-CippAlertBreachAlert {
     )
     try {
         $Search = New-BreachTenantSearch -TenantFilter $TenantFilter
-        if ($Search) {
-            Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $Search -PartitionKey BreachAlert
-        }
+        Write-AlertTrace -cmdletName $MyInvocation.MyCommand -tenantFilter $TenantFilter -data $Search
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-AlertMessage -tenant $($TenantFilter) -message "Could not get New Breaches for $($TenantFilter): $($ErrorMessage.NormalizedError)"
diff --git a/Modules/CIPPCore/Public/Add-CIPPBPAField.ps1 b/Modules/CIPPCore/Public/Add-CIPPBPAField.ps1
deleted file mode 100644
index 0f119b13f266b..0000000000000
--- a/Modules/CIPPCore/Public/Add-CIPPBPAField.ps1
+++ /dev/null
@@ -1,41 +0,0 @@
-function Add-CIPPBPAField {
-    param (
-        $BPAName = 'CIPP Standards v1.0 - Table view',
-        $FieldName,
-        $FieldValue,
-        $StoreAs,
-        $Tenant
-    )
-    $Table = Get-CippTable -tablename 'cachebpav2'
-    $TenantName = Get-Tenants -TenantFilter $Tenant
-    $CurrentContentsObject = (Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$BPAName' and PartitionKey eq '$($TenantName.customerId)'")
-    Write-Information "Adding $FieldName to $BPAName for $Tenant. content is $FieldValue"
-    if ($CurrentContentsObject.RowKey) {
-        $CurrentContents = @{}
-        $CurrentContentsObject.PSObject.Properties.Name | ForEach-Object {
-            $CurrentContents[$_] = $CurrentContentsObject.$_
-        }
-        $Result = $CurrentContents
-    } else {
-        $Result = @{
-            Tenant       = "$($TenantName.displayName)"
-            GUID         = "$($TenantName.customerId)"
-            RowKey       = $BPAName
-            PartitionKey = "$($TenantName.customerId)"
-            LastRefresh  = [string]$(Get-Date (Get-Date).ToUniversalTime() -UFormat '+%Y-%m-%dT%H:%M:%S.000Z')
-        }
-    }
-    switch -Wildcard ($StoreAs) {
-        '*bool' {
-            $Result["$fieldName"] = [bool]$FieldValue
-        }
-        'JSON' {
-            if ($null -eq $FieldValue) { $JsonString = '{}' } else { $JsonString = (ConvertTo-Json -Depth 15 -InputObject $FieldValue -Compress) }
-            $Result[$fieldName] = [string]$JsonString
-        }
-        'string' {
-            $Result[$fieldName] = [string]$FieldValue
-        }
-    }
-    Add-CIPPAzDataTableEntity @Table -Entity $Result -Force
-}
diff --git a/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 b/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1
index 597a479adb257..53cd4d1343b4a 100644
--- a/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1
+++ b/Modules/CIPPCore/Public/Add-CIPPDbItem.ps1
@@ -57,6 +57,52 @@ function Add-CIPPDbItem {
         $RunStartUtc = [DateTimeOffset]::UtcNow.AddMinutes(-$SkewMarginMinutes)
 
         $TotalProcessed = 0
+
+        # The collection's shape - its fields and their types, one nested level deep - sampled from the
+        # first rows written and stored on the '<Type>-Count' row (Shape), so the report builder can
+        # offer a collection's fields without reading the collection. Sampled, not exhaustive: a field
+        # only some rows carry may be missed, which the picker tolerates by accepting a typed name.
+        $ShapeFields = [ordered]@{}
+        $ShapeSampled = 0
+        $ShapeSampleSize = 50
+        $ShapeMaxFields = 300
+        $TypeOf = {
+            param($Value)
+            if ($null -eq $Value) { return 'null' }
+            if ($Value -is [bool]) { return 'boolean' }
+            if ($Value -is [datetime] -or $Value -is [DateTimeOffset]) { return 'date' }
+            if ($Value -is [string]) { return $(if ($Value -match '^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}') { 'date' } else { 'string' }) }
+            if ($Value.GetType().IsPrimitive -or $Value -is [decimal]) { return 'number' }
+            if ($Value -is [System.Collections.IDictionary] -or $Value -is [System.Management.Automation.PSCustomObject]) { return 'object' }
+            if ($Value -is [System.Collections.IEnumerable]) { return 'array' }
+            'string'
+        }
+        $PropertiesOf = {
+            param($Value)
+            if ($Value -is [System.Collections.IDictionary]) { foreach ($Key in $Value.Keys) { @{ Name = "$Key"; Value = $Value[$Key] } } }
+            elseif ($Value -is [System.Management.Automation.PSCustomObject]) { foreach ($Property in $Value.PSObject.Properties) { @{ Name = $Property.Name; Value = $Property.Value } } }
+        }
+        $NoteField = {
+            param([string]$Name, $Value)
+            if ($ShapeFields.Count -ge $ShapeMaxFields -and -not $ShapeFields.Contains($Name)) { return }
+            $Kind = & $TypeOf $Value
+            if (-not $ShapeFields.Contains($Name) -or $ShapeFields[$Name] -eq 'null') { $ShapeFields[$Name] = $Kind }
+            $Kind
+        }
+        $NoteShape = {
+            param($Item)
+            if ($ShapeSampled -ge $ShapeSampleSize) { return }
+            $ShapeSampled++
+            foreach ($Property in @(& $PropertiesOf $Item)) {
+                $Kind = & $NoteField $Property.Name $Property.Value
+                # one level in: an object's own fields, or the fields of an array's first object
+                $Inner = if ($Kind -eq 'object') { $Property.Value } elseif ($Kind -eq 'array') { @($Property.Value | Select-Object -First 1)[0] }
+                if ($null -ne $Inner -and (& $TypeOf $Inner) -eq 'object') {
+                    foreach ($Child in @(& $PropertiesOf $Inner)) { $null = & $NoteField "$($Property.Name).$($Child.Name)" $Child.Value }
+                }
+            }
+        }
+
         # Cache regex instances so each row pays only the match cost, not regex compilation.
         # Two passes preserve the original semantics: path/wildcard chars → '_', control chars → stripped.
         $RowKeyPathRegex = [regex]::new('[/\\#?]')
@@ -83,6 +129,7 @@ function Add-CIPPDbItem {
             $ItemId = $Item.ExternalDirectoryObjectId ?? $Item.id ?? $Item.Identity ?? $Item.skuId ?? $Item.userPrincipalName ?? [guid]::NewGuid().ToString()
             $RowKey = $RowKeyControlRegex.Replace($RowKeyPathRegex.Replace("$Type-$ItemId", '_'), '')
             if ($SeenInBatch.Add($RowKey)) {
+                & $NoteShape $Item
                 $Batch.Add(@{
                         PartitionKey = $TenantFilter
                         RowKey       = $RowKey
@@ -154,16 +201,32 @@ function Add-CIPPDbItem {
 
         if ($Count.IsPresent -or $AddCount.IsPresent) {
             $NewCount = $TotalProcessed
-            if ($Append.IsPresent) {
+            # The existing count row is read when appending (to add to its count) and when this call
+            # sampled no rows (a count-only call after the rows went in separately), so a shape
+            # already recorded is kept rather than wiped.
+            $ExistingCount = $null
+            if ($Append.IsPresent -or $ShapeFields.Count -eq 0) {
                 $Filter = "PartitionKey eq '{0}' and RowKey eq '{1}-Count'" -f $TenantFilter, $Type
                 $ExistingCount = Get-CIPPAzDataTableEntity @Table -Filter $Filter
-                if ($ExistingCount.DataCount) { $NewCount += [int]$ExistingCount.DataCount }
             }
+            if ($Append.IsPresent -and $ExistingCount.DataCount) { $NewCount += [int]$ExistingCount.DataCount }
+            if (($Append.IsPresent -or $ShapeFields.Count -eq 0) -and $ExistingCount.Shape) {
+                try {
+                    foreach ($Known in @((ConvertFrom-Json -InputObject "$($ExistingCount.Shape)").fields)) {
+                        if ($Known.name -and -not $ShapeFields.Contains([string]$Known.name)) { $ShapeFields[[string]$Known.name] = [string]$Known.type }
+                    }
+                } catch { Write-Verbose "Unreadable shape on $Type-Count; recording afresh." }
+            }
+            $ShapeJson = ConvertTo-Json -InputObject @{
+                fields    = @(foreach ($Name in $ShapeFields.Keys) { @{ name = $Name; type = $ShapeFields[$Name] } })
+                sampledAt = (Get-Date).ToUniversalTime().ToString('o')
+            } -Depth 5 -Compress
             $null = Add-CIPPAzDataTableEntity @Table -Entity @{
                 PartitionKey = $TenantFilter
                 RowKey       = "$Type-Count"
                 DataCount    = [int]$NewCount
                 Type         = $Type
+                Shape        = $ShapeJson
             } -Force
         }
 
diff --git a/Modules/CIPPCore/Public/Add-CIPPImage.ps1 b/Modules/CIPPCore/Public/Add-CIPPImage.ps1
index 2168999eb7642..804fb7581f1ab 100644
--- a/Modules/CIPPCore/Public/Add-CIPPImage.ps1
+++ b/Modules/CIPPCore/Public/Add-CIPPImage.ps1
@@ -28,8 +28,17 @@ function Add-CIPPImage {
     if ($Data -notmatch '^data:image\/([^;]+);base64,') {
         throw 'Invalid image format. Expected a data URL image (data:image/...;base64,...).'
     }
+    $Subtype = $Matches[1].ToLowerInvariant()
 
-    $ContentType = "image/$($Matches[1])"
+    # The formats the report engine draws (ReportComponents.NormaliseImage: rasters handed to OfficeIMO
+    # as-is, SVG rasterised once). Anything else would be stored, sent down on every page load, and then
+    # dropped at render time. The branding page enforces the same list before uploading.
+    $SupportedTypes = @('png', 'jpeg', 'jpg', 'gif', 'bmp', 'tiff', 'webp', 'svg+xml')
+    if ($Subtype -notin $SupportedTypes) {
+        throw "Unsupported image format 'image/$Subtype'. Use PNG, JPEG, GIF, BMP, TIFF, WebP or SVG."
+    }
+
+    $ContentType = "image/$Subtype"
     $Base64Data = $Data -replace '^data:image\/[^;]+;base64,', ''
     try {
         $ImageBytes = [Convert]::FromBase64String($Base64Data)
diff --git a/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1 b/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1
index f94ec6b7675e7..8adbf96f73e00 100644
--- a/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1
+++ b/Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1
@@ -27,6 +27,9 @@ function Add-CIPPScheduledTask {
     )
 
     try {
+        # The [pscustomobject] parameter type doesn't convert hashtables, and PSObject.Properties can't see hashtable keys
+        if ($Task -is [System.Collections.IDictionary]) { $Task = [pscustomobject]$Task }
+        if ($Task.Parameters -is [System.Collections.IDictionary]) { $Task.Parameters = [pscustomobject]$Task.Parameters }
 
         $Table = Get-CIPPTable -TableName 'ScheduledTasks'
 
diff --git a/Modules/CIPPCore/Public/AsyncDeployment/Get-CIPPAsyncDeployment.ps1 b/Modules/CIPPCore/Public/AsyncDeployment/Get-CIPPAsyncDeployment.ps1
index 4162a966d2d4e..a1c3c0a8243da 100644
--- a/Modules/CIPPCore/Public/AsyncDeployment/Get-CIPPAsyncDeployment.ps1
+++ b/Modules/CIPPCore/Public/AsyncDeployment/Get-CIPPAsyncDeployment.ps1
@@ -31,6 +31,8 @@ function Get-CIPPAsyncDeployment {
                 TenantFilter = $_.TenantFilter
                 Steps  = @($_.Steps | ConvertFrom-Json)
                 Logs   = $_.Logs
+                # when the row last changed (a step or status update); lets callers detect abandoned jobs
+                LastUpdate = $_.Timestamp
             }
         })
 }
diff --git a/Modules/CIPPCore/Public/AuditLogs/Resolve-CIPPAuditActor.ps1 b/Modules/CIPPCore/Public/AuditLogs/Resolve-CIPPAuditActor.ps1
new file mode 100644
index 0000000000000..4b3c640b4efa1
--- /dev/null
+++ b/Modules/CIPPCore/Public/AuditLogs/Resolve-CIPPAuditActor.ps1
@@ -0,0 +1,71 @@
+function Resolve-CIPPAuditActor {
+    <#
+    .SYNOPSIS
+        Classifies the actor named in an audit record: the tenant's own user, a partner (GDAP) identity, CIPP itself, or an application.
+    .DESCRIPTION
+        Customer-tenant audit records name a partner identity in two shapes - user_<objectid>@<tenant>.onmicrosoft.com
+        (Entra) and <customer>.onmicrosoft.com\tenant: <partner tenant id>, object: <objectid> (Exchange) - the same
+        shapes the audit-log pipeline maps back to partner users. This resolves them against the partner user
+        lookup, tells this partner tenant from another partner by tenant id, recognises CIPP's own SAM application
+        by app id, and returns the kind with the resolved name, so a case can show partner and CIPP actions as
+        such instead of as an unknown actor.
+    .PARAMETER Actor
+        The actor as written in the record: UserId, UserKey, or the initiating user principal name.
+    .PARAMETER ActorType
+        'User' or 'Application' when the record says which (Entra directory audits do). Defaults to User.
+    .PARAMETER AppId
+        The application (client) id when the record was app-initiated.
+    .PARAMETER PartnerUserLookup
+        Hashtable of partner-tenant users keyed by object id (Get-CIPPPartnerUserLookup). Without it a partner
+        identity is still recognised by its shape, just not named.
+    .OUTPUTS
+        [pscustomobject] { Kind = User | Partner | OtherPartner | CIPP | Application | System; Actor; PartnerTenantId }
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [string]$Actor,
+        [string]$ActorType = 'User',
+        [string]$AppId,
+        [hashtable]$PartnerUserLookup = @{}
+    )
+    $Raw = [string]$Actor
+    $Answer = { param($Kind, $Name, $TenantId) [pscustomobject]@{ Kind = $Kind; Actor = $Name; PartnerTenantId = $TenantId } }
+    $NameOf = { param($Id, $Fallback) if ($Id -and $PartnerUserLookup.ContainsKey($Id)) { [string]$PartnerUserLookup[$Id].userPrincipalName } else { $Fallback } }
+    $CippAppId = [string]$env:ApplicationID
+    $CippTenantId = [string]$env:TenantID
+
+    if ($CippAppId -and (($AppId -and $AppId -eq $CippAppId) -or $Raw -eq $CippAppId)) {
+        return & $Answer 'CIPP' 'CIPP (service principal)' $CippTenantId
+    }
+    if ($ActorType -eq 'Application') {
+        return & $Answer 'Application' ($(if ($Raw) { $Raw } else { $AppId })) $null
+    }
+    if ([string]::IsNullOrWhiteSpace($Raw)) {
+        return & $Answer 'User' $Raw $null
+    }
+    if ($Raw -match '(?i)^NT AUTHORITY\\SYSTEM|^S-1-5-18$|Microsoft\.Exchange\.ServiceHost') {
+        return & $Answer 'System' $Raw $null
+    }
+    # Entra shape: user_<32 hex>@<tenant>.onmicrosoft.com - the hex is the partner-tenant object id
+    if ($Raw -match '(?i)user_([0-9a-f]{32})@[^@]+\.onmicrosoft\.com') {
+        $Hex = $Matches[1].ToLowerInvariant()
+        $Id = "$($Hex.Substring(0, 8))-$($Hex.Substring(8, 4))-$($Hex.Substring(12, 4))-$($Hex.Substring(16, 4))-$($Hex.Substring(20, 12))"
+        # Known to this partner, or unknowable (no lookup): this partner. Known lookup, unknown id: another one.
+        $Kind = if ($PartnerUserLookup.Count -eq 0 -or $PartnerUserLookup.ContainsKey($Id)) { 'Partner' } else { 'OtherPartner' }
+        return & $Answer $Kind (& $NameOf $Id $Raw) $null
+    }
+    # Exchange shape: <customer>.onmicrosoft.com\tenant: <partner tenant id>, object: <object id>
+    if ($Raw -match '(?i)\\tenant:\s*([0-9a-f-]{36}),\s*object:\s*([0-9a-f-]{36})') {
+        $TenantId = $Matches[1]
+        $Id = $Matches[2]
+        $Kind = if ($CippTenantId -and $TenantId -eq $CippTenantId) { 'Partner' } else { 'OtherPartner' }
+        return & $Answer $Kind (& $NameOf $Id $Raw) $TenantId
+    }
+    # A bare object id as the actor is a service principal acting app-only
+    if ($Raw -match '^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$') {
+        return & $Answer 'Application' $Raw $null
+    }
+    return & $Answer 'User' $Raw $null
+}
diff --git a/Modules/CIPPCore/Public/Authentication/ConvertTo-CIPPIPRange.ps1 b/Modules/CIPPCore/Public/Authentication/ConvertTo-CIPPIPRange.ps1
new file mode 100644
index 0000000000000..beb7fd1928664
--- /dev/null
+++ b/Modules/CIPPCore/Public/Authentication/ConvertTo-CIPPIPRange.ps1
@@ -0,0 +1,36 @@
+function ConvertTo-CIPPIPRange {
+    <#
+    .SYNOPSIS
+        Validates and normalises an IP address or CIDR range.
+    .DESCRIPTION
+        Accepts "203.0.113.10", "203.0.113.0/24", "2001:db8::1" or "2001:db8::/48" (surrounding
+        whitespace and IPv6 brackets are ignored) and returns the canonical text form: the address
+        as .NET prints it, plus "/prefix" when a prefix narrower than a single host is given. Throws
+        on anything that is not an IP address or a valid prefix length for its family.
+    .PARAMETER Value
+        The address or range.
+    .EXAMPLE
+        ConvertTo-CIPPIPRange -Value ' 203.0.113.0/24 '   # 203.0.113.0/24
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory = $true)][AllowEmptyString()][string]$Value)
+
+    $Text = $Value.Trim() -replace '[\[\]]', ''
+    if (-not $Text) { throw 'An IP address or range is required' }
+    $Parts = $Text -split '/'
+    if ($Parts.Count -gt 2) { throw "'$Value' is not a valid IP address or CIDR range" }
+    $Address = $null
+    if (-not [System.Net.IPAddress]::TryParse($Parts[0], [ref]$Address) -or $Parts[0] -notmatch '[.:]') {
+        throw "'$Value' is not a valid IP address or CIDR range"
+    }
+    $MaxBits = if ($Address.AddressFamily -eq [System.Net.Sockets.AddressFamily]::InterNetworkV6) { 128 } else { 32 }
+    if ($Parts.Count -eq 1) { return $Address.ToString() }
+    $Prefix = 0
+    if (-not [int]::TryParse($Parts[1], [ref]$Prefix) -or $Prefix -lt 0 -or $Prefix -gt $MaxBits) {
+        throw "'$Value' has an invalid prefix length (0-$MaxBits)"
+    }
+    if ($Prefix -eq $MaxBits) { return $Address.ToString() }
+    return "$($Address.ToString())/$Prefix"
+}
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CIPPIPAllowBlockList.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CIPPIPAllowBlockList.ps1
new file mode 100644
index 0000000000000..666516a732c67
--- /dev/null
+++ b/Modules/CIPPCore/Public/Authentication/Get-CIPPIPAllowBlockList.ps1
@@ -0,0 +1,37 @@
+function Get-CIPPIPAllowBlockList {
+    <#
+    .SYNOPSIS
+        Reads CIPP's IP allow/block list for a tenant.
+    .DESCRIPTION
+        The trustedIps table (managed from the Geo IP page) holds single addresses or CIDR ranges per
+        tenant (PartitionKey = default domain) or for every tenant (PartitionKey = AllTenants), each
+        Trusted or Blocked (NotTrusted rows are neutral and skipped). A CIDR range cannot be a table key,
+        so its RowKey carries '_' for '/' and the range itself is in the Range property; rows from before
+        ranges existed are a bare address in RowKey. Returns one entry per active row:
+        { Range, State (Trusted|Blocked), Scope (Tenant|AllTenants), Prefix, Note }.
+        Match an address against the result with Resolve-CIPPIPAllowBlockList.
+    .PARAMETER TenantFilter
+        The tenant's default domain name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory = $true)][string]$TenantFilter)
+
+    $Table = Get-CIPPTable -TableName 'trustedIps'
+    $SafeTenant = $TenantFilter -replace "'", "''"
+    $Rows = Get-CIPPAzDataTableEntity @Table -Filter "(PartitionKey eq '$SafeTenant' or PartitionKey eq 'AllTenants') and (state eq 'Trusted' or state eq 'Blocked')"
+    @(foreach ($Row in @($Rows | Where-Object { $_ })) {
+            $Raw = if ($Row.Range) { [string]$Row.Range } else { ([string]$Row.RowKey) -replace '_', '/' }
+            $Range = try { ConvertTo-CIPPIPRange -Value $Raw } catch { $null }
+            if (-not $Range) { continue }
+            $Prefix = if ($Range -match '/(\d+)$') { [int]$Matches[1] } elseif ($Range -match ':') { 128 } else { 32 }
+            [pscustomobject]@{
+                Range  = $Range
+                State  = [string]$Row.state
+                Scope  = if ($Row.PartitionKey -eq 'AllTenants') { 'AllTenants' } else { 'Tenant' }
+                Prefix = $Prefix
+                Note   = [string]$Row.Note
+            }
+        })
+}
diff --git a/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1 b/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1
index bf7ee05cb861e..245155747ff63 100644
--- a/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1
+++ b/Modules/CIPPCore/Public/Authentication/Get-CippMcpKnownClients.ps1
@@ -45,6 +45,9 @@ function Get-CippMcpKnownClients {
             'https://insiders.vscode.dev/redirect'
             # Loopback for desktop/CLI clients (port-agnostic in Entra)
             'http://127.0.0.1'
+            # Common local-dev default. NOTE: unlike 127.0.0.1, 'localhost' is only port-agnostic
+            # without a path, so this exact string only matches clients that use it verbatim.
+            'http://localhost/callback'
         )
         ConfidentialRedirectUris = @(
             # Copilot Studio / M365 Copilot agents (Power Platform connector redirect)
diff --git a/Modules/CIPPCore/Public/Authentication/Grant-CippAppGraphConsent.ps1 b/Modules/CIPPCore/Public/Authentication/Grant-CippAppGraphConsent.ps1
index fb9198a70d561..191ef95ab4440 100644
--- a/Modules/CIPPCore/Public/Authentication/Grant-CippAppGraphConsent.ps1
+++ b/Modules/CIPPCore/Public/Authentication/Grant-CippAppGraphConsent.ps1
@@ -2,7 +2,7 @@ function Grant-CippAppGraphConsent {
     <#
     .SYNOPSIS
         Ensures a tenant-wide (AllPrincipals) oauth2PermissionGrant exists from an app's service
-        principal to Microsoft Graph, covering the given delegated scopes.
+        principal to a resource API (Microsoft Graph by default), covering the given delegated scopes.
     .DESCRIPTION
         Admin-consents delegated Microsoft Graph scopes for an app registration in the partner
         tenant, so users signing in through it are not prompted to consent. Used to pre-consent
@@ -20,8 +20,12 @@ function Grant-CippAppGraphConsent {
     .PARAMETER AppId
         Application (client) ID of the app whose service principal should receive the grant.
     .PARAMETER Scopes
-        Delegated Microsoft Graph scope names to ensure are consented (e.g. openid, profile,
-        offline_access).
+        Delegated scope names to ensure are consented (e.g. openid, profile, offline_access for
+        Graph, or user_impersonation for a custom resource).
+    .PARAMETER ResourceAppId
+        Application (client) ID of the resource whose delegated scopes are being consented. Defaults
+        to Microsoft Graph. Pass a custom API's app id to admin-consent, for example, an MCP public
+        client (SSO app) on the MCP resource app's user_impersonation scope.
     .FUNCTIONALITY
         Internal
     #>
@@ -31,10 +35,11 @@ function Grant-CippAppGraphConsent {
         [string]$AppId,
 
         [Parameter(Mandatory)]
-        [string[]]$Scopes
-    )
+        [string[]]$Scopes,
 
-    $GraphAppId = '00000003-0000-0000-c000-000000000000'
+        [Parameter()]
+        [string]$ResourceAppId = '00000003-0000-0000-c000-000000000000'
+    )
 
     # The app's own service principal may still be replicating right after creation.
     $ClientSp = $null
@@ -50,13 +55,23 @@ function Grant-CippAppGraphConsent {
         throw "Service principal for app '$AppId' was not found; cannot write consent grant yet."
     }
 
-    $GraphSp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals(appId='$GraphAppId')?`$select=id" -NoAuthCheck $true -asapp $true
-    if (-not $GraphSp.id) {
-        throw 'Microsoft Graph service principal was not found in this tenant.'
+    # The resource's service principal may also still be replicating - e.g. right after the dedicated
+    # CIPP-MCP resource app is created, this consent runs in the same flow. Retry before giving up.
+    $ResourceSp = $null
+    for ($Attempt = 1; $Attempt -le 3 -and -not $ResourceSp.id; $Attempt++) {
+        try {
+            $ResourceSp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals(appId='$ResourceAppId')?`$select=id" -NoAuthCheck $true -asapp $true
+        } catch {
+            Write-Information "[App-Consent] Resource service principal for $ResourceAppId not queryable yet (attempt $Attempt): $($_.Exception.Message)"
+        }
+        if (-not $ResourceSp.id -and $Attempt -lt 3) { Start-Sleep -Seconds 2 }
+    }
+    if (-not $ResourceSp.id) {
+        throw "Resource service principal for app '$ResourceAppId' was not found in this tenant."
     }
 
     $Grants = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals/$($ClientSp.id)/oauth2PermissionGrants" -NoAuthCheck $true -asapp $true)
-    $TenantGrant = $Grants | Where-Object { $_.resourceId -eq $GraphSp.id -and $_.consentType -eq 'AllPrincipals' } | Select-Object -First 1
+    $TenantGrant = $Grants | Where-Object { $_.resourceId -eq $ResourceSp.id -and $_.consentType -eq 'AllPrincipals' } | Select-Object -First 1
 
     if ($TenantGrant) {
         $CurrentScopes = @($TenantGrant.scope -split ' ' | Where-Object { $_ })
@@ -73,7 +88,7 @@ function Grant-CippAppGraphConsent {
     $CreateBody = @{
         clientId    = $ClientSp.id
         consentType = 'AllPrincipals'
-        resourceId  = $GraphSp.id
+        resourceId  = $ResourceSp.id
         scope       = ($Scopes -join ' ')
     } | ConvertTo-Json -Compress
     $null = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/oauth2PermissionGrants' -body $CreateBody -type POST -NoAuthCheck $true -asapp $true
diff --git a/Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1 b/Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1
index 56aef6d4aab95..e4fb4e6ff7579 100644
--- a/Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1
+++ b/Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1
@@ -251,6 +251,18 @@ function Initialize-CIPPAuth {
                     # created before this existed, or whose service principal had not replicated at
                     # creation, self-heals on the next warmup. Idempotent and cheap: the grant helper
                     # no-ops once the scopes are present. Best-effort per client.
+                    # Resolve the dedicated CIPP-MCP resource app so we can also reconcile the
+                    # client -> resource user_impersonation consent (it can fail on the first Save if
+                    # the freshly created resource SP hasn't replicated yet).
+                    $McpResourceObjectId = $null
+                    $McpResourceScopeId = $null
+                    try {
+                        $McpResRow = Get-CIPPAzDataTableEntity @(Get-CippTable -tablename 'CippMcpResource') -Filter "PartitionKey eq 'McpResource' and RowKey eq 'McpResource'"
+                        if (-not [string]::IsNullOrWhiteSpace($McpResRow.ObjectId)) { $McpResourceObjectId = "$($McpResRow.ObjectId)" }
+                        if (-not [string]::IsNullOrWhiteSpace($McpResRow.ScopeId)) { $McpResourceScopeId = "$($McpResRow.ScopeId)" }
+                    } catch {
+                        Write-Information "[Auth-Init] Could not resolve CIPP-MCP resource app for consent reconcile: $_"
+                    }
                     foreach ($McpId in $McpClientIds) {
                         if ([string]::IsNullOrEmpty($McpId)) { continue }
                         try {
@@ -258,9 +270,47 @@ function Initialize-CIPPAuth {
                             if ($McpConsent.Action -ne 'nochange') {
                                 Write-Information "[Auth-Init] MCP client $McpId offline_access consent: $($McpConsent.Action)"
                             }
+                            if ($McpResourceObjectId -and $McpResourceScopeId) {
+                                $PreAuthChanged = Set-CippMcpResourcePreAuth -ResourceObjectId $McpResourceObjectId -ClientAppId $McpId -ScopeId $McpResourceScopeId
+                                if ($PreAuthChanged) {
+                                    Write-Information "[Auth-Init] MCP client $McpId pre-authorized on CIPP-MCP resource user_impersonation scope"
+                                }
+                            }
                         } catch {
-                            Write-Information "[Auth-Init] MCP client $McpId offline_access consent reconcile failed (non-fatal): $_"
+                            Write-Information "[Auth-Init] MCP client $McpId consent reconcile failed (non-fatal): $_"
+                        }
+                    }
+
+                    # Self-heal the split-app MCP wiring. If the dedicated CIPP-MCP resource app has
+                    # never been provisioned, or its stored app registration no longer resolves in
+                    # Entra, re-run Set-CIPPMCPClientApp for each MCPAllowed client — that ensures the
+                    # resource app (New-CIPPMcpResourceApp) and configures the client (callbacks,
+                    # permissions, consent). Gated so a healthy instance does no writes; covers
+                    # instances enabled before the split. Best-effort.
+                    $McpNeedsReconcile = $true
+                    try {
+                        $McpResTable = Get-CippTable -tablename 'CippMcpResource'
+                        $McpResRow = Get-CIPPAzDataTableEntity @McpResTable -Filter "PartitionKey eq 'McpResource' and RowKey eq 'McpResource'"
+                        if (-not [string]::IsNullOrWhiteSpace($McpResRow.AppId)) {
+                            $McpResExists = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$($McpResRow.AppId)')?`$select=appId" -NoAuthCheck $true -AsApp $true
+                            $McpNeedsReconcile = -not [bool]$McpResExists.appId
                         }
+                    } catch {
+                        Write-Information "[Auth-Init] Could not check CIPP-MCP resource state for reconcile (non-fatal): $_"
+                        $McpNeedsReconcile = $false
+                    }
+                    if ($McpNeedsReconcile) {
+                        foreach ($McpId in $McpClientIds) {
+                            if ([string]::IsNullOrEmpty($McpId)) { continue }
+                            try {
+                                $null = Set-CIPPMCPClientApp -AppId $McpId -Headers @{}
+                                Write-Information "[Auth-Init] MCP client $McpId + CIPP-MCP resource reconciled during warmup"
+                            } catch {
+                                Write-Information "[Auth-Init] MCP reconcile failed for client $McpId (non-fatal): $_"
+                            }
+                        }
+                    } else {
+                        Write-Information '[Auth-Init] CIPP-MCP resource app present — no MCP app reconcile needed'
                     }
 
                     # Ensure the MCP OAuth scope advertisement (challenge header + discovery docs)
diff --git a/Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1 b/Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1
new file mode 100644
index 0000000000000..631d3500b07fa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1
@@ -0,0 +1,220 @@
+function New-CIPPMcpResourceApp {
+    <#
+    .SYNOPSIS
+        Ensures the dedicated, CIPP-managed CIPP-MCP resource app registration exists.
+    .DESCRIPTION
+        In the MCP OAuth flow the *resource* app is the token audience and the identity the MCP
+        endpoint is exposed as - it holds the host identifier URIs (https://<host> and
+        https://<host>/api/ExecMcp), exposes the user_impersonation scope, and is what EasyAuth
+        validates incoming tokens against. It is deliberately NOT an OAuth client: it has no redirect
+        URIs, no secret and no public-client flow. The apps that AI connectors sign in AS are the
+        MCPAllowed API clients (separate app registrations, each with its own role, IP range,
+        redirect URIs and Conditional Access) - keeping client and resource separate is what stops
+        the non-interactive refresh being "a token for itself" (AADSTS90009) and lets an MSP apply
+        device-compliance CA to the client apps without affecting the resource.
+
+        Idempotent and self-healing. It resolves the resource app in this order: the appId stored in
+        the CippMcpResource table; an existing CIPP-MCP app that already owns this instance's host
+        URI (bind); an existing empty CIPP-MCP app left by a previous failed create (reuse, so we
+        don't spawn duplicates); otherwise create one. Before adding the host URIs it makes sure no
+        other app holds them: if the holder is one of CIPP's own MCP API clients (a single-app
+        leftover) it frees the URIs from it automatically; if it's a foreign app it records the
+        conflict (table + logbook) and throws so the pages can flag it. Persists
+        appId/objectId/scopeId to the table and returns @{ AppId; ObjectId; ScopeId }.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess)]
+    param($Headers)
+
+    $Hostname = $env:WEBSITE_HOSTNAME
+    if ([string]::IsNullOrWhiteSpace($Hostname)) {
+        throw 'WEBSITE_HOSTNAME is not set; cannot determine the MCP resource URL.'
+    }
+    $DisplayName = 'CIPP-MCP'
+    $McpEndpointUri = "https://$Hostname/api/ExecMcp"
+    $HostUris = @("https://$Hostname", $McpEndpointUri)
+    $Table = Get-CippTable -tablename 'CippMcpResource'
+
+    # 1) Stored appId is authoritative.
+    $Stored = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'McpResource' and RowKey eq 'McpResource'"
+    $App = $null
+    if ($Stored.AppId) {
+        try {
+            $App = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$($Stored.AppId)')" -NoAuthCheck $true -AsApp $true
+        } catch {
+            Write-Information "[MCP-Resource] Stored CIPP-MCP appId $($Stored.AppId) no longer resolves; will rediscover/recreate. $($_.Exception.Message)"
+        }
+    }
+
+    # 2) Bind to an existing CIPP-MCP app that owns the host URI; else reuse an empty CIPP-MCP app
+    #    left behind by a previous failed create (avoids spawning duplicates). Simple displayName
+    #    filter (no advanced-query quirks), matched in PowerShell.
+    if (-not $App.id) {
+        $Candidates = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=displayName eq '$DisplayName'&`$select=id,appId,api,identifierUris" -NoAuthCheck $true -AsApp $true)
+        $App = $Candidates | Where-Object { @($_.identifierUris) -contains $McpEndpointUri } | Select-Object -First 1
+        if (-not $App.id) {
+            $App = $Candidates | Where-Object { @($_.identifierUris).Count -eq 0 } | Select-Object -First 1
+            if ($App.id) { Write-Information "[MCP-Resource] Reusing existing empty CIPP-MCP app ($($App.appId)) instead of creating a new one." }
+        }
+    }
+
+    # 3) Before creating/claiming, make sure no OTHER app holds a host URI (checked here so a foreign
+    #    conflict never leaves an orphan created behind it). Self-heal our own MCP API clients
+    #    (single-app leftovers); record + warn on a foreign app. Skip URIs this app already owns.
+    foreach ($HostUri in $HostUris) {
+        if ($App -and (@($App.identifierUris) -contains $HostUri)) { continue }
+        $Holder = $null
+        try {
+            $Holders = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=identifierUris/any(u:u eq '$HostUri')&`$count=true&`$select=id,appId,displayName" -NoAuthCheck $true -AsApp $true -ComplexFilter)
+            $Holder = $Holders | Where-Object { $_.appId -and $_.appId -ne $App.appId } | Select-Object -First 1
+        } catch {
+            Write-Information "[MCP-Resource] Could not check for a host-URI holder ($HostUri): $($_.Exception.Message)"
+        }
+        if (-not $Holder) { continue }
+
+        $OwnedClient = $null
+        try {
+            $ApiClientsTable = Get-CippTable -tablename 'ApiClients'
+            $OwnedClient = Get-CIPPAzDataTableEntity @ApiClientsTable -Filter "RowKey eq '$($Holder.appId)'"
+        } catch {
+            Write-Information "[MCP-Resource] Could not check whether $($Holder.appId) is a managed API client: $($_.Exception.Message)"
+        }
+        if ($OwnedClient.RowKey) {
+            $HolderApp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$($Holder.appId)')?`$select=id,identifierUris" -NoAuthCheck $true -AsApp $true
+            $Kept = @(@($HolderApp.identifierUris) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) -and $HostUris -notcontains $_ })
+            $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($HolderApp.id)" -type PATCH -body (@{ identifierUris = @($Kept) } | ConvertTo-Json -Compress) -NoAuthCheck $true -asapp $true
+            Write-LogMessage -headers $Headers -API 'McpResource' -message "Migrated MCP: freed the resource URI ($HostUri) from API client '$($Holder.displayName)' ($($Holder.appId)) so the dedicated CIPP-MCP resource app can own it." -Sev 'Info'
+        } else {
+            $ConflictMsg = "MCP setup blocked: the app registration '$($Holder.displayName)' ($($Holder.appId)) already uses the MCP resource URL ($HostUri) and is not a CIPP-managed API client. Delete that app registration in Entra, then run Save to Azure again."
+            Write-LogMessage -headers $Headers -API 'McpResource' -message $ConflictMsg -Sev 'Warning'
+            $null = Add-CIPPAzDataTableEntity @Table -Entity @{
+                PartitionKey    = 'McpResource'
+                RowKey          = 'Error'
+                Message         = $ConflictMsg
+                ConflictAppId   = "$($Holder.appId)"
+                ConflictAppName = "$($Holder.displayName)"
+                DetectedAt      = (Get-Date).ToUniversalTime().ToString('o')
+            } -Force
+            throw $ConflictMsg
+        }
+    }
+
+    # 4) Create only if nothing could be resolved or reused.
+    if (-not $App.id) {
+        $CreateBody = @{
+            displayName    = $DisplayName
+            signInAudience = 'AzureADMyOrg'
+            api            = @{
+                requestedAccessTokenVersion = 2
+                oauth2PermissionScopes      = @(
+                    @{
+                        adminConsentDescription = 'Allow the application to access CIPP-API on behalf of the signed-in user.'
+                        adminConsentDisplayName = 'Access CIPP-API'
+                        id                      = [guid]::NewGuid().ToString()
+                        isEnabled               = $true
+                        type                    = 'User'
+                        userConsentDescription  = 'Allow the application to access CIPP-API on your behalf.'
+                        userConsentDisplayName  = 'Access CIPP-API'
+                        value                   = 'user_impersonation'
+                    }
+                )
+            }
+        } | ConvertTo-Json -Depth 10 -Compress
+        if ($PSCmdlet.ShouldProcess($DisplayName, 'Create MCP resource app')) {
+            $App = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/applications' -type POST -body $CreateBody -NoAuthCheck $true -asapp $true
+            Write-LogMessage -headers $Headers -API 'McpResource' -message "Created MCP resource app '$DisplayName' ($($App.appId))." -Sev 'Info'
+        }
+    }
+    if (-not $App.appId) {
+        throw 'MCP resource app could not be created or resolved.'
+    }
+
+    # Desired scope + identifier URIs.
+    $ApiObj = if ($App.api) { $App.api | ConvertTo-Json -Depth 10 | ConvertFrom-Json -AsHashtable } else { @{} }
+    $ScopeChanged = $false
+    $Scopes = [System.Collections.Generic.List[object]]::new()
+    if ($ApiObj.oauth2PermissionScopes) { foreach ($S in $ApiObj.oauth2PermissionScopes) { $Scopes.Add($S) } }
+    $UserImpersonation = $Scopes | Where-Object { $_.value -eq 'user_impersonation' } | Select-Object -First 1
+    if (-not $UserImpersonation) {
+        $UserImpersonation = @{
+            adminConsentDescription = 'Allow the application to access CIPP-API on behalf of the signed-in user.'
+            adminConsentDisplayName = 'Access CIPP-API'
+            id                      = [guid]::NewGuid().ToString()
+            isEnabled               = $true
+            type                    = 'User'
+            userConsentDescription  = 'Allow the application to access CIPP-API on your behalf.'
+            userConsentDisplayName  = 'Access CIPP-API'
+            value                   = 'user_impersonation'
+        }
+        $Scopes.Add($UserImpersonation)
+        $ScopeChanged = $true
+    }
+    $ScopeId = $UserImpersonation.id
+    $VersionChanged = ($ApiObj.requestedAccessTokenVersion -ne 2)
+
+    $IdentifierUris = [System.Collections.Generic.List[string]]::new()
+    foreach ($Uri in @($App.identifierUris)) { if (-not [string]::IsNullOrWhiteSpace($Uri) -and $IdentifierUris -notcontains $Uri) { $IdentifierUris.Add($Uri) } }
+    $UriChanged = $false
+    foreach ($Uri in (@("api://$($App.appId)") + $HostUris)) { if ($IdentifierUris -notcontains $Uri) { $IdentifierUris.Add($Uri); $UriChanged = $true } }
+
+    # 5) Reconcile the resource app (identifier URIs + v2 tokens + user_impersonation). Retry the
+    #    "in use" case briefly - right after freeing a URI, Entra can take a few seconds to release it.
+    if ($ScopeChanged -or $VersionChanged -or $UriChanged) {
+        if ($PSCmdlet.ShouldProcess($DisplayName, 'Reconcile MCP resource app')) {
+            $ApiObj.requestedAccessTokenVersion = 2
+            $ApiObj.oauth2PermissionScopes = @($Scopes)
+            $PatchBody = @{ identifierUris = @($IdentifierUris); api = $ApiObj } | ConvertTo-Json -Depth 10 -Compress
+            for ($Attempt = 1; $Attempt -le 5; $Attempt++) {
+                try {
+                    $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($App.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true
+                    Write-LogMessage -headers $Headers -API 'McpResource' -message "Reconciled MCP resource app '$DisplayName' ($($App.appId)): identifier URIs, v2 tokens, user_impersonation." -Sev 'Info'
+                    break
+                } catch {
+                    $ErrMsg = $_.Exception.Message
+                    $InUse = $ErrMsg -match 'identifierUri' -or $ErrMsg -match 'already exists' -or $ErrMsg -match 'in use'
+                    if ($InUse -and $Attempt -lt 5) { Start-Sleep -Seconds 3; continue }
+                    if ($InUse) {
+                        throw "The MCP resource host URIs (https://$Hostname ...) are still assigned to another app registration. If a non-CIPP app holds them, remove it in Entra, then run Save to Azure again. ($ErrMsg)"
+                    }
+                    throw
+                }
+            }
+        }
+    }
+
+    # Ensure a service principal so tokens are issued for this resource.
+    $Sp = $null
+    for ($Attempt = 1; $Attempt -le 6 -and -not $Sp.id; $Attempt++) {
+        try {
+            $Sp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals(appId='$($App.appId)')?`$select=id" -NoAuthCheck $true -AsApp $true
+        } catch { $Sp = $null }
+        if (-not $Sp.id) {
+            if ($Attempt -eq 1) {
+                try {
+                    $SpBody = @{ accountEnabled = $true; appId = $App.appId; displayName = $DisplayName; tags = @('WindowsAzureActiveDirectoryIntegratedApp') } | ConvertTo-Json -Compress
+                    $Sp = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/servicePrincipals' -type POST -body $SpBody -NoAuthCheck $true -asapp $true
+                } catch { Write-Information "[MCP-Resource] Service principal create attempt failed: $($_.Exception.Message)" }
+            }
+            if (-not $Sp.id -and $Attempt -lt 6) { Start-Sleep -Seconds 3 }
+        }
+    }
+
+    $null = Add-CIPPAzDataTableEntity @Table -Entity @{
+        PartitionKey = 'McpResource'
+        RowKey       = 'McpResource'
+        AppId        = "$($App.appId)"
+        ObjectId     = "$($App.id)"
+        ScopeId      = "$ScopeId"
+    } -Force
+
+    # The resource app is wired up, so clear any stored conflict error.
+    try {
+        $ErrRow = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'McpResource' and RowKey eq 'Error'"
+        if ($ErrRow.RowKey) { $null = Remove-CIPPAzDataTableEntity @Table -Entity $ErrRow -Force }
+    } catch {
+        Write-Information "[MCP-Resource] Could not clear stored MCP conflict error: $($_.Exception.Message)"
+    }
+
+    return @{ AppId = "$($App.appId)"; ObjectId = "$($App.id)"; ScopeId = "$ScopeId" }
+}
diff --git a/Modules/CIPPCore/Public/Authentication/Resolve-CIPPIPAllowBlockList.ps1 b/Modules/CIPPCore/Public/Authentication/Resolve-CIPPIPAllowBlockList.ps1
new file mode 100644
index 0000000000000..bfea8e7e389ad
--- /dev/null
+++ b/Modules/CIPPCore/Public/Authentication/Resolve-CIPPIPAllowBlockList.ps1
@@ -0,0 +1,29 @@
+function Resolve-CIPPIPAllowBlockList {
+    <#
+    .SYNOPSIS
+        Finds the CIPP IP allow/block list entry that decides an address.
+    .DESCRIPTION
+        Of the entries (from Get-CIPPIPAllowBlockList) whose range contains the address, the most
+        specific range wins; at equal specificity a tenant entry beats an AllTenants one. So an
+        AllTenants block can be relaxed for one tenant by a tenant allow of the same or a narrower
+        range, and a single blocked address inside a trusted office range stays blocked.
+        Returns the winning entry, or $null when nothing matches.
+    .PARAMETER IPAddress
+        The address to look up (a port or IPv6 brackets are ignored).
+    .PARAMETER Entries
+        The list entries.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][AllowEmptyString()][string]$IPAddress,
+        [AllowNull()][object[]]$Entries
+    )
+
+    $Address = ConvertTo-CIPPBecHostAddress -Address $IPAddress
+    if (-not $Address -or -not $Entries) { return $null }
+    @($Entries | Where-Object { $_ -and (Test-IpInRange -IPAddress $Address -Range $_.Range) } |
+            Sort-Object -Property @{ Expression = { [int]$_.Prefix }; Descending = $true }, @{ Expression = { $_.Scope -eq 'Tenant' }; Descending = $true }) |
+        Select-Object -First 1
+}
diff --git a/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1 b/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1
index 098ccf81bcdd6..47f8d79adeb52 100644
--- a/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1
+++ b/Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1
@@ -1,15 +1,23 @@
 function Set-CIPPMCPClientApp {
     <#
     .SYNOPSIS
-        Configures an API client's app registration to act as the MCP OAuth resource.
+        Configures an API client app registration as an MCP OAuth client.
     .DESCRIPTION
-        Adds the host-based MCP identifier URIs, forces v2 tokens, ensures the
-        user_impersonation scope, and pre-registers the well-known MCP clients from
-        Get-CippMcpKnownClients: their callback URLs as redirect URIs, loopback redirects
-        for desktop/CLI clients, and pre-authorization for first-party clients (VS Code)
-        so no manual app registration changes are needed to connect a client.
+        In the split-app model an MCPAllowed API client is one of the apps an AI connector signs in
+        AS (the OAuth client), while the dedicated CIPP-MCP app (New-CIPPMcpResourceApp) is the
+        protected resource the token is for. Several MCPAllowed clients can coexist, each with its own
+        role, IP range, redirect URIs and Conditional Access; every one is in EasyAuth
+        allowedApplications and CIPP resolves the caller's role from its appId (azp), so keeping them
+        as distinct app registrations is what makes per-client permissions and CA work.
+
+        This ensures the resource app exists, then configures THIS client: the known MCP client
+        callbacks (public for the PKCE clients, web for Copilot Studio), "allow public client flows",
+        the delegated permissions it needs (Microsoft Graph openid/profile/offline_access and the
+        resource's user_impersonation), and tenant-wide admin consent for them. It also strips the
+        host identifier URIs from the client if a previous (single-app) setup left them there, so the
+        dedicated resource app can own them.
     .PARAMETER AppId
-        Application (client) ID of the API client to configure.
+        Application (client) ID of the MCPAllowed API client to configure as an MCP OAuth client.
     .FUNCTIONALITY
         Internal
     #>
@@ -24,167 +32,101 @@ function Set-CIPPMCPClientApp {
     if ([string]::IsNullOrWhiteSpace($Hostname)) {
         throw 'WEBSITE_HOSTNAME is not set; cannot determine the MCP resource URL.'
     }
+    $GraphResourceId = '00000003-0000-0000-c000-000000000000'
+    $OidcScopeIds = @('37f7f235-527c-4136-accd-4a02d197296e', '14dad69e-099b-42c9-810b-d002981feec1', '7427e0e9-2fba-42fe-b0c0-848c9e6a8182')
+    $HostUris = @("https://$Hostname", "https://$Hostname/api/ExecMcp")
+    $KnownClients = Get-CippMcpKnownClients
 
-    $McpUris = @("https://$Hostname", "https://$Hostname/api/ExecMcp")
+    # Ensure the dedicated CIPP-MCP resource app exists; we consent this client on its scope.
+    $Resource = New-CIPPMcpResourceApp -Headers $Headers
+    $ResourceAppId = $Resource.AppId
+    $ResourceObjectId = $Resource.ObjectId
+    $ScopeId = $Resource.ScopeId
 
     $App = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$AppId')" -NoAuthCheck $true -AsApp $true
     if (-not $App) {
         throw "App registration with AppId '$AppId' was not found."
     }
 
-    # Merge identifier URIs, preserving existing (e.g. api://<appId>)
+    # Strip the host identifier URIs from the client (a previous single-app setup may have added
+    # them); they belong on the dedicated resource app now. Keep everything else (e.g. api://<appId>).
     $IdentifierUris = [System.Collections.Generic.List[string]]::new()
     foreach ($Uri in @($App.identifierUris)) {
-        if (-not [string]::IsNullOrWhiteSpace($Uri) -and $IdentifierUris -notcontains $Uri) { $IdentifierUris.Add($Uri) }
-    }
-    foreach ($Uri in $McpUris) {
-        if ($IdentifierUris -notcontains $Uri) { $IdentifierUris.Add($Uri) }
-    }
-
-    # Preserve the existing api object; force v2 tokens; ensure a user_impersonation delegated scope
-    $Api = if ($App.api) { $App.api | ConvertTo-Json -Depth 10 | ConvertFrom-Json -AsHashtable } else { @{} }
-    $Api.requestedAccessTokenVersion = 2
-    $Scopes = [System.Collections.Generic.List[object]]::new()
-    if ($Api.oauth2PermissionScopes) {
-        foreach ($Scope in $Api.oauth2PermissionScopes) { $Scopes.Add($Scope) }
-    }
-    if (-not ($Scopes | Where-Object { $_.value -eq 'user_impersonation' })) {
-        $Scopes.Add(@{
-                adminConsentDescription = 'Allow the application to access CIPP-API on behalf of the signed-in user.'
-                adminConsentDisplayName = 'Access CIPP-API'
-                id                      = [guid]::NewGuid().ToString()
-                isEnabled               = $true
-                type                    = 'User'
-                userConsentDescription  = 'Allow the application to access CIPP-API on your behalf.'
-                userConsentDisplayName  = 'Access CIPP-API'
-                value                   = 'user_impersonation'
-            })
-    }
-    $Api.oauth2PermissionScopes = @($Scopes)
-
-    $KnownClients = Get-CippMcpKnownClients
-    $UserImpersonationScope = $Scopes | Where-Object { $_.value -eq 'user_impersonation' } | Select-Object -First 1
-
-    # Pre-authorize first-party MCP clients (e.g. VS Code) on the user_impersonation scope so
-    # they can sign users in without a consent prompt. The other known clients (Claude, ChatGPT,
-    # Copilot Studio) use this app's own client ID and need their callback URLs registered instead.
-    $PreAuthorized = [System.Collections.Generic.List[object]]::new()
-    if ($Api.preAuthorizedApplications) {
-        foreach ($Entry in $Api.preAuthorizedApplications) { $PreAuthorized.Add($Entry) }
-    }
-    foreach ($KnownAppId in $KnownClients.PreAuthorizedClientIds) {
-        $Existing = $PreAuthorized | Where-Object { $_.appId -eq $KnownAppId } | Select-Object -First 1
-        if ($Existing) {
-            if (@($Existing.delegatedPermissionIds) -notcontains $UserImpersonationScope.id) {
-                $PermissionIds = [System.Collections.Generic.List[string]]::new()
-                foreach ($Id in @($Existing.delegatedPermissionIds)) {
-                    if (-not [string]::IsNullOrWhiteSpace($Id)) { $PermissionIds.Add($Id) }
-                }
-                $PermissionIds.Add($UserImpersonationScope.id)
-                $Existing.delegatedPermissionIds = @($PermissionIds)
-            }
-        } else {
-            $PreAuthorized.Add(@{
-                    appId                  = $KnownAppId
-                    delegatedPermissionIds = @($UserImpersonationScope.id)
-                })
-        }
+        if (-not [string]::IsNullOrWhiteSpace($Uri) -and $HostUris -notcontains $Uri -and $IdentifierUris -notcontains $Uri) { $IdentifierUris.Add($Uri) }
     }
-    $Api.preAuthorizedApplications = @($PreAuthorized)
 
-    # Register the callback URLs of known MCP clients under the platform each client's token
-    # exchange requires — see Get-CippMcpKnownClients for why the bucket decides success. Every
-    # list below is rebuilt from the live app so a URI that an earlier version filed under the
-    # wrong platform is moved rather than duplicated (Entra rejects the same URI twice).
+    # Redirect URIs: public (PKCE clients) and web (Copilot Studio confidential + the EasyAuth login
+    # callback), rebuilt from the live app so a URI filed under the wrong platform is moved, not
+    # duplicated. Nothing of ours belongs under 'spa'.
     $PublicRedirectUris = [System.Collections.Generic.List[string]]::new()
-    foreach ($Uri in @($App.publicClient.redirectUris)) {
-        if (-not [string]::IsNullOrWhiteSpace($Uri) -and $PublicRedirectUris -notcontains $Uri) { $PublicRedirectUris.Add($Uri) }
-    }
-    foreach ($Uri in $KnownClients.PublicClientRedirectUris) {
-        if ($PublicRedirectUris -notcontains $Uri) { $PublicRedirectUris.Add($Uri) }
-    }
+    foreach ($Uri in @($App.publicClient.redirectUris)) { if (-not [string]::IsNullOrWhiteSpace($Uri) -and $PublicRedirectUris -notcontains $Uri) { $PublicRedirectUris.Add($Uri) } }
+    foreach ($Uri in $KnownClients.PublicClientRedirectUris) { if ($PublicRedirectUris -notcontains $Uri) { $PublicRedirectUris.Add($Uri) } }
 
-    # Web keeps the app's own confidential callbacks — the EasyAuth login callback above all —
-    # plus the secret-authenticating clients, minus anything now claimed by another platform.
     $WebRedirectUris = [System.Collections.Generic.List[string]]::new()
     foreach ($Uri in @($App.web.redirectUris)) {
-        if ([string]::IsNullOrWhiteSpace($Uri) -or $WebRedirectUris -contains $Uri) { continue }
-        if ($PublicRedirectUris -contains $Uri) { continue }
+        if ([string]::IsNullOrWhiteSpace($Uri) -or $WebRedirectUris -contains $Uri -or $PublicRedirectUris -contains $Uri) { continue }
         $WebRedirectUris.Add($Uri)
     }
-    foreach ($Uri in $KnownClients.ConfidentialRedirectUris) {
-        if ($WebRedirectUris -notcontains $Uri -and $PublicRedirectUris -notcontains $Uri) { $WebRedirectUris.Add($Uri) }
-    }
+    foreach ($Uri in $KnownClients.ConfidentialRedirectUris) { if ($WebRedirectUris -notcontains $Uri -and $PublicRedirectUris -notcontains $Uri) { $WebRedirectUris.Add($Uri) } }
 
-    # Nothing of ours belongs under 'spa' (those tokens can only be redeemed cross-origin, which
-    # no MCP client does), so preserve any URI the tenant added there but drop ours.
     $SpaRedirectUris = [System.Collections.Generic.List[string]]::new()
     foreach ($Uri in @($App.spa.redirectUris)) {
-        if ([string]::IsNullOrWhiteSpace($Uri) -or $SpaRedirectUris -contains $Uri) { continue }
-        if ($PublicRedirectUris -contains $Uri -or $WebRedirectUris -contains $Uri) { continue }
+        if ([string]::IsNullOrWhiteSpace($Uri) -or $SpaRedirectUris -contains $Uri -or $PublicRedirectUris -contains $Uri -or $WebRedirectUris -contains $Uri) { continue }
         $SpaRedirectUris.Add($Uri)
     }
 
-    # Declare offline_access (Microsoft Graph, delegated) so Entra will issue a refresh token to
-    # MCP clients. Without it, Copilot Studio (Manual OAuth) and stricter discovery clients
-    # re-prompt for sign-in roughly every hour when the access token expires. Additive — every
-    # permission already on the app is preserved; only offline_access is added if missing.
-    $GraphResourceId = '00000003-0000-0000-c000-000000000000'
-    $OfflineAccessId = '7427e0e9-2fba-42fe-b0c0-848c9e6a8182'
+    # requiredResourceAccess: preserve existing, ensure Graph OIDC + offline_access, and add the
+    # resource app's user_impersonation (delegated) so this client can request a token for it.
     $RequiredResourceAccess = [System.Collections.Generic.List[object]]::new()
-    $GraphEntrySeen = $false
-    foreach ($Resource in @($App.requiredResourceAccess)) {
-        $ResourceAccess = [System.Collections.Generic.List[object]]::new()
-        foreach ($Access in @($Resource.resourceAccess)) { $ResourceAccess.Add(@{ id = $Access.id; type = $Access.type }) }
-        if ($Resource.resourceAppId -eq $GraphResourceId) {
-            $GraphEntrySeen = $true
-            if (-not ($ResourceAccess | Where-Object { $_.id -eq $OfflineAccessId })) {
-                $ResourceAccess.Add(@{ id = $OfflineAccessId; type = 'Scope' })
-            }
+    $GraphSeen = $false
+    $ResourceSeen = $false
+    foreach ($Resource2 in @($App.requiredResourceAccess)) {
+        $Access = [System.Collections.Generic.List[object]]::new()
+        foreach ($A in @($Resource2.resourceAccess)) { $Access.Add(@{ id = $A.id; type = $A.type }) }
+        if ($Resource2.resourceAppId -eq $GraphResourceId) {
+            $GraphSeen = $true
+            foreach ($Id in $OidcScopeIds) { if (-not ($Access | Where-Object { $_.id -eq $Id })) { $Access.Add(@{ id = $Id; type = 'Scope' }) } }
+        } elseif ($Resource2.resourceAppId -eq $ResourceAppId) {
+            $ResourceSeen = $true
+            if ($ScopeId -and -not ($Access | Where-Object { $_.id -eq $ScopeId })) { $Access.Add(@{ id = $ScopeId; type = 'Scope' }) }
         }
-        $RequiredResourceAccess.Add(@{ resourceAppId = $Resource.resourceAppId; resourceAccess = @($ResourceAccess) })
+        $RequiredResourceAccess.Add(@{ resourceAppId = $Resource2.resourceAppId; resourceAccess = @($Access) })
+    }
+    if (-not $GraphSeen) {
+        $RequiredResourceAccess.Add(@{ resourceAppId = $GraphResourceId; resourceAccess = @($OidcScopeIds | ForEach-Object { @{ id = $_; type = 'Scope' } }) })
     }
-    if (-not $GraphEntrySeen) {
-        $RequiredResourceAccess.Add(@{ resourceAppId = $GraphResourceId; resourceAccess = @(@{ id = $OfflineAccessId; type = 'Scope' }) })
+    if (-not $ResourceSeen -and $ScopeId) {
+        $RequiredResourceAccess.Add(@{ resourceAppId = $ResourceAppId; resourceAccess = @(@{ id = $ScopeId; type = 'Scope' }) })
     }
 
     $PatchBody = @{
         identifierUris         = @($IdentifierUris)
-        api                    = $Api
         web                    = @{ redirectUris = @($WebRedirectUris) }
         spa                    = @{ redirectUris = @($SpaRedirectUris) }
         publicClient           = @{ redirectUris = @($PublicRedirectUris) }
         requiredResourceAccess = @($RequiredResourceAccess)
-        # "Allow public client flows" — required for the secret-less PKCE redemption every MCP
-        # client above performs.
         isFallbackPublicClient = $true
     } | ConvertTo-Json -Depth 10 -Compress
 
-    if ($PSCmdlet.ShouldProcess($AppId, 'Configure app registration for MCP')) {
-        try {
-            $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($App.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true
-            Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Configured app registration $AppId as MCP resource (identifier URIs, v2 tokens, known MCP client callbacks + pre-authorization)." -Sev 'Info'
-
-            # Admin-consent the OIDC + offline_access delegated scopes for this app so Entra
-            # issues the refresh token without a per-user consent prompt. Copilot Studio uses
-            # Manual OAuth and never reads the challenge/discovery scope, so this app-registration
-            # consent — not WEBSITE_AUTH_PRM_DEFAULT_WITH_SCOPES — is what makes its refresh work.
-            # Best-effort: the app still works without it (users may see a one-time prompt, or the
-            # grant is retried the next time the client is saved), so a failure here is non-fatal.
-            try {
-                $ConsentResult = Grant-CippAppGraphConsent -AppId $AppId -Scopes @('openid', 'profile', 'offline_access')
-                Write-Information "[MCP-Client] offline_access admin-consent for $AppId : $($ConsentResult.Action)"
-            } catch {
-                Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "MCP client $AppId configured, but admin-consent for offline_access could not be written (refresh tokens may prompt on first use): $($_.Exception.Message)" -Sev 'Warning'
-            }
+    if ($PSCmdlet.ShouldProcess($AppId, 'Configure API client as MCP OAuth client')) {
+        $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($App.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true
+        Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Configured API client $AppId as an MCP OAuth client (callbacks, public client flows, resource permissions) against resource $ResourceAppId." -Sev 'Info'
 
-            return @{ Success = $true; IdentifierUris = @($IdentifierUris); RedirectUris = @($PublicRedirectUris) }
+        # OIDC + offline_access on Graph are admin-consented tenant-wide (they can't be
+        # pre-authorized). The resource's user_impersonation is handled by pre-authorizing this
+        # client on the CIPP-MCP resource app instead of a consent grant - that needs no consent at
+        # all, so it works even where user consent to apps is disabled. Both best-effort / non-fatal.
+        try {
+            $null = Grant-CippAppGraphConsent -AppId $AppId -Scopes @('openid', 'profile', 'offline_access')
+        } catch {
+            Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Failed to admin-consent Graph openid/profile/offline_access for MCP client ${AppId}: $($_.Exception.Message)" -Sev 'Warning'
+        }
+        try {
+            if ($ScopeId -and $ResourceObjectId) { $null = Set-CippMcpResourcePreAuth -ResourceObjectId $ResourceObjectId -ClientAppId $AppId -ScopeId $ScopeId }
         } catch {
-            $ErrMsg = $_.Exception.Message
-            if ($ErrMsg -match 'identifierUri' -or $ErrMsg -match 'already exists' -or $ErrMsg -match 'in use') {
-                throw "The MCP resource URIs are already assigned to another application. Only one API client can be the MCP resource client. ($ErrMsg)"
-            }
-            throw
+            Write-LogMessage -headers $Headers -API 'ExecApiClient' -message "Failed to pre-authorize MCP client $AppId on the CIPP-MCP resource user_impersonation scope: $($_.Exception.Message)" -Sev 'Warning'
         }
+
+        return @{ Success = $true; ClientAppId = $AppId; ResourceAppId = $ResourceAppId; RedirectUris = @($PublicRedirectUris) }
     }
 }
diff --git a/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 b/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1
index 148026e25ec05..0a4e85c2a1b3d 100644
--- a/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1
+++ b/Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1
@@ -65,18 +65,27 @@ function Set-CippApiAuth {
             [void]$AllAudiences.Add("api://$id")
         }
 
-        # MCP resource clients also accept tokens whose audience is the host-based identifier URI or
-        # the bare appId (v2 tokens), so the Claude connector's token validates against EasyAuth.
+        # The dedicated CIPP-MCP resource app is the token audience for MCP calls, so add its
+        # identifier URIs + bare appId (v2 tokens). The MCPAllowed client apps are the token's azp
+        # and are already in allowedApplications via $ClientIds.
         if ($McpClientIds -and $env:WEBSITE_HOSTNAME) {
             [void]$AllAudiences.Add("https://$($env:WEBSITE_HOSTNAME)")
             [void]$AllAudiences.Add("https://$($env:WEBSITE_HOSTNAME)/api/ExecMcp")
-            foreach ($McpId in $McpClientIds) {
-                if (-not [string]::IsNullOrEmpty($McpId)) { [void]$AllAudiences.Add($McpId) }
+            try {
+                $McpResTable = Get-CippTable -tablename 'CippMcpResource'
+                $McpResRow = Get-CIPPAzDataTableEntity @McpResTable -Filter "PartitionKey eq 'McpResource' and RowKey eq 'McpResource'"
+                if (-not [string]::IsNullOrWhiteSpace($McpResRow.AppId)) {
+                    [void]$AllAudiences.Add("api://$($McpResRow.AppId)")
+                    [void]$AllAudiences.Add("$($McpResRow.AppId)")
+                }
+            } catch {
+                Write-Information "[ApiAuth] Could not resolve CIPP-MCP resource app id for allowedAudiences: $($_.Exception.Message)"
             }
         }
 
         # First-party MCP clients (e.g. VS Code) bring their own client ID, so the token's azp
-        # is theirs — EasyAuth's allowedApplications must include them when MCP is enabled.
+        # is theirs — EasyAuth's allowedApplications must include them when MCP is enabled. The
+        # MCPAllowed API clients are already in $AllAppIds via $ClientIds.
         if ($McpClientIds) {
             foreach ($KnownId in (Get-CippMcpKnownClients).PreAuthorizedClientIds) {
                 [void]$AllAppIds.Add($KnownId)
@@ -132,8 +141,15 @@ function Set-CippApiAuth {
         if ($McpClientIds -and $env:WEBSITE_HOSTNAME) {
             $AudienceList.Add("https://$($env:WEBSITE_HOSTNAME)")
             $AudienceList.Add("https://$($env:WEBSITE_HOSTNAME)/api/ExecMcp")
-            foreach ($McpId in $McpClientIds) {
-                if (-not [string]::IsNullOrEmpty($McpId)) { $AudienceList.Add($McpId) }
+            try {
+                $McpResTable = Get-CippTable -tablename 'CippMcpResource'
+                $McpResRow = Get-CIPPAzDataTableEntity @McpResTable -Filter "PartitionKey eq 'McpResource' and RowKey eq 'McpResource'"
+                if (-not [string]::IsNullOrWhiteSpace($McpResRow.AppId)) {
+                    $AudienceList.Add("api://$($McpResRow.AppId)")
+                    $AudienceList.Add("$($McpResRow.AppId)")
+                }
+            } catch {
+                Write-Information "[ApiAuth] Could not resolve CIPP-MCP resource app id for allowedAudiences: $($_.Exception.Message)"
             }
         }
         $AllowedAudiences = @($AudienceList)
diff --git a/Modules/CIPPCore/Public/Authentication/Set-CippMcpResourcePreAuth.ps1 b/Modules/CIPPCore/Public/Authentication/Set-CippMcpResourcePreAuth.ps1
new file mode 100644
index 0000000000000..a2c0d8d35d9cf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Authentication/Set-CippMcpResourcePreAuth.ps1
@@ -0,0 +1,57 @@
+function Set-CippMcpResourcePreAuth {
+    <#
+    .SYNOPSIS
+        Pre-authorizes an MCP client app on the CIPP-MCP resource's user_impersonation scope.
+    .DESCRIPTION
+        Adds the client's appId to the CIPP-MCP resource app's api.preAuthorizedApplications
+        (additive, idempotent). Pre-authorization is what makes the client -> resource
+        user_impersonation grant require NO consent at all: the resource app trusts the listed
+        client, so Entra issues the token without a user or admin consent prompt - which is the
+        only reliable path in tenants that disable user consent to applications (CIPP's own
+        OauthConsentLowSec standard recommends exactly that).
+
+        This is preferred over an AllPrincipals oauth2PermissionGrant for the resource scope because
+        it is written with Application.ReadWrite.All (patching CIPP's own app registration), so it
+        does not depend on Directory.ReadWrite.All being consented, nor on the resource service
+        principal having replicated - both of which make a create-time consent grant racy.
+
+        Graph delegated scopes (openid/profile/offline_access) cannot be pre-authorized this way and
+        still need Grant-CippAppGraphConsent.
+    .PARAMETER ResourceObjectId
+        Object ID of the CIPP-MCP resource app registration to patch.
+    .PARAMETER ClientAppId
+        Application (client) ID of the MCP client to pre-authorize.
+    .PARAMETER ScopeId
+        The id of the resource's user_impersonation oauth2PermissionScope.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess)]
+    param(
+        [Parameter(Mandatory)][string]$ResourceObjectId,
+        [Parameter(Mandatory)][string]$ClientAppId,
+        [Parameter(Mandatory)][string]$ScopeId
+    )
+
+    $ResApp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications/$ResourceObjectId`?`$select=api" -NoAuthCheck $true -asapp $true
+    $ApiObj = if ($ResApp.api) { $ResApp.api | ConvertTo-Json -Depth 10 | ConvertFrom-Json -AsHashtable } else { @{} }
+
+    $PreAuth = [System.Collections.Generic.List[object]]::new()
+    foreach ($P in @($ApiObj.preAuthorizedApplications)) { $PreAuth.Add($P) }
+
+    $Existing = $PreAuth | Where-Object { $_.appId -eq $ClientAppId } | Select-Object -First 1
+    if ($Existing) {
+        $Ids = @($Existing.delegatedPermissionIds)
+        if ($Ids -contains $ScopeId) { return $false }
+        $Existing.delegatedPermissionIds = @($Ids + $ScopeId | Select-Object -Unique)
+    } else {
+        $PreAuth.Add(@{ appId = $ClientAppId; delegatedPermissionIds = @($ScopeId) })
+    }
+
+    $ApiObj.preAuthorizedApplications = @($PreAuth)
+    if ($PSCmdlet.ShouldProcess($ClientAppId, 'Pre-authorize MCP client on resource user_impersonation scope')) {
+        $Body = @{ api = $ApiObj } | ConvertTo-Json -Depth 10 -Compress
+        $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$ResourceObjectId" -type PATCH -body $Body -NoAuthCheck $true -asapp $true
+    }
+    return $true
+}
diff --git a/Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1 b/Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1
new file mode 100644
index 0000000000000..6d154f455bfe4
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1
@@ -0,0 +1,20 @@
+function ConvertTo-CIPPBecHostAddress {
+    <#
+    .SYNOPSIS
+        Strips the client port (and IPv6 brackets) from an audit-log address so one host correlates as one.
+    .DESCRIPTION
+        Unified-audit-log records carry the client as "203.0.113.10:51234" or "[2001:db8::1]:443", and
+        the port differs on every connection. The investigation correlates activity by host, so every
+        collector projects the address through this before storing it. Same normalisation the geo-IP
+        batch helper applies to its keys.
+    .PARAMETER Address
+        The raw client address.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param([string]$Address)
+
+    if ([string]::IsNullOrWhiteSpace($Address)) { return $null }
+    return ([regex]::Replace($Address.Trim(), '^(?<IP>(?:\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-fA-F:]+\]|[0-9a-fA-F:]+))(?::\d+)?$', '${IP}') -replace '[\[\]]', '')
+}
diff --git a/Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecIPEvents.ps1 b/Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecIPEvents.ps1
new file mode 100644
index 0000000000000..28ee7598cc090
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecIPEvents.ps1
@@ -0,0 +1,59 @@
+function ConvertTo-CIPPBecIPEvents {
+    <#
+    .SYNOPSIS
+        Flattens a BEC results payload into the per-address activity the IP verdicts are built from.
+    .DESCRIPTION
+        One { IP, Kind, Flagged, ActorKind, When, SessionIds } per audited action the investigated
+        account took. Tenant-wide sections (mailbox permission changes, transport rule changes,
+        directory audits) only contribute the rows this account made - another admin's address says
+        nothing about who holds this account. Flagged marks the actions an attacker takes: a suspicious
+        inbox rule, a permission change on this mailbox, a safelist change, an anonymous link, a risky
+        transport rule change, a flagged directory event (security info, consent, device), or mail
+        sent as part of a mass-mail pattern.
+    .PARAMETER Results
+        The BEC results payload (as assembled by Push-BECRun or read back from storage).
+    .PARAMETER UserPrincipalName
+        The investigated user.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]$Results,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName
+    )
+
+    $IsUser = { param($Value) [string]$Value -and ([string]$Value).Trim() -ieq $UserPrincipalName }
+    $Leaf = { param($Value) (([string]$Value) -split '\\')[-1] }
+    $SuspiciousRules = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($Rule in @($Results.NewRules | Where-Object { $_ -and $_.Suspicious -eq $true })) { $null = $SuspiciousRules.Add([string]$Rule.Name) }
+    $MassMail = $Results.SentMessageAnalysis.Flagged -eq $true
+    $New = { param($IP, $Kind, $Flagged, $ActorKind, $When, $SessionIds) [pscustomobject]@{ IP = $IP; Kind = $Kind; Flagged = [bool]$Flagged; ActorKind = $(if ($ActorKind) { [string]$ActorKind } else { 'User' }); When = $When; SessionIds = @($SessionIds | Where-Object { $_ }) } }
+
+    @(
+        foreach ($Row in @($Results.InboxRuleChanges | Where-Object { $_.ClientIP })) {
+            & $New $Row.ClientIP 'Inbox rule change' ($SuspiciousRules.Contains((& $Leaf $Row.RuleName))) $Row.ActorKind $Row.Date
+        }
+        foreach ($Row in @($Results.MailboxPermissionChanges | Where-Object { $_.ClientIP -and ((& $IsUser $_.UserId) -or (& $IsUser $_.UserKey)) })) {
+            & $New $Row.ClientIP 'Mailbox permission change' $Row.TargetsSuspect $Row.ActorKind $Row.Date
+        }
+        foreach ($Row in @($Results.SafelistChanges | Where-Object { $_.ClientIP })) {
+            & $New $Row.ClientIP 'Safelist change' $true $Row.ActorKind $Row.Date
+        }
+        foreach ($Row in @($Results.SharingChanges | Where-Object { $_.ClientIP })) {
+            & $New $Row.ClientIP 'Sharing change' ([string]$Row.Operation -like 'AnonymousLink*') $Row.ActorKind $Row.Date
+        }
+        foreach ($Row in @($Results.TransportRuleChanges | Where-Object { $_.ClientIP -and (& $IsUser $_.Actor) })) {
+            & $New $Row.ClientIP 'Transport rule change' ($Row.Flagged -eq $true) $Row.ActorKind $Row.Date
+        }
+        foreach ($Row in @($Results.DirectoryAudits | Where-Object { $_.ClientIP -and (& $IsUser $_.InitiatedBy) })) {
+            & $New $Row.ClientIP 'Directory change' ($Row.Flagged -eq $true) $Row.ActorKind $Row.ActivityDateTime
+        }
+        foreach ($Row in @($Results.SentMessages | Where-Object { $_.FromIP })) {
+            & $New $Row.FromIP 'Sent mail' $MassMail 'User' $Row.Received
+        }
+        foreach ($Row in @($Results.MailActivity | Where-Object { $_.ClientIP })) {
+            & $New $Row.ClientIP "Mailbox $($Row.Operation)" $false $Row.ActorKind $Row.FirstSeen $Row.SessionIds
+        }
+    )
+}
diff --git a/Modules/CIPPCore/Public/BEC/Disable-CIPPInboxRules.ps1 b/Modules/CIPPCore/Public/BEC/Disable-CIPPInboxRules.ps1
new file mode 100644
index 0000000000000..ea181f6f07748
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Disable-CIPPInboxRules.ps1
@@ -0,0 +1,70 @@
+function Disable-CIPPInboxRules {
+    <#
+    .SYNOPSIS
+        Disables a mailbox's inbox rules for BEC containment.
+    .DESCRIPTION
+        Disables every inbox rule on the mailbox except the Junk E-Mail and out-of-office system rules,
+        or only the rules whose Identity is in RuleIds. Each rule is handled on its own: one failure
+        never stops the rest, and the Exchange-managed 'Delegate Rule -N' rules, which cannot be
+        disabled, are skipped rather than reported as failures. Returns one result row per outcome.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The mailbox.
+    .PARAMETER RuleIds
+        Optional rule identities to restrict the operation to.
+    .PARAMETER Headers
+        CIPP request headers for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [string[]]$RuleIds,
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    $Results = [System.Collections.Generic.List[object]]::new()
+    $Add = { param($Text, $State) $Results.Add([pscustomobject]@{ resultText = $Text; state = $State }) }
+
+    $Rules = @(New-ExoRequest -anchor $UserPrincipalName -tenantid $TenantFilter -cmdlet 'Get-InboxRule' -cmdParams @{ Mailbox = $UserPrincipalName; IncludeHidden = $true } | Where-Object { $_ })
+    if ($Rules.Count -eq 0) {
+        & $Add "No inbox rules found for $UserPrincipalName." 'info'
+        return $Results.ToArray()
+    }
+
+    $Processable = @($Rules | Where-Object { $_.Name -ne 'Junk E-Mail Rule' -and $_.Name -notlike 'Microsoft.Exchange.OOF.*' })
+    if ($RuleIds) {
+        $Processable = @($Processable | Where-Object { $_.Identity -in $RuleIds -or $_.Name -in $RuleIds -or $_.RuleIdentity -in $RuleIds })
+    }
+    if ($Processable.Count -eq 0) {
+        & $Add "Found $($Rules.Count) inbox rule(s) for $UserPrincipalName, but none require disabling (only system rules found)." 'info'
+        return $Results.ToArray()
+    }
+
+    $Disabled = 0
+    $Skipped = 0
+    foreach ($Rule in $Processable) {
+        if (-not $PSCmdlet.ShouldProcess("$UserPrincipalName rule '$($Rule.Name)'", 'Disable inbox rule')) { continue }
+        try {
+            $null = Set-CIPPMailboxRule -Username $UserPrincipalName -UserId $UserPrincipalName -TenantFilter $TenantFilter -RuleId $Rule.Identity -RuleName $Rule.Name -Disable -APIName $APIName -Headers $Headers
+            $Disabled++
+        } catch {
+            if ($Rule.Name -match '^Delegate Rule -\d+$') {
+                # Exchange-managed delegate rules cannot be disabled; expected, not a failure.
+                $Skipped++
+            } else {
+                & $Add "Could not disable rule '$($Rule.Name)': $($_.Exception.Message)" 'error'
+            }
+        }
+    }
+    if ($Disabled -gt 0) { & $Add "Disabled $Disabled inbox rule(s) for $UserPrincipalName." 'success' }
+    if ($Skipped -gt 0) { & $Add "Skipped $Skipped Exchange-managed delegate rule(s) that cannot be disabled." 'info' }
+    if ($Disabled -eq 0 -and $Skipped -eq 0 -and $Results.Count -eq 0) { & $Add "No processable inbox rules found for $UserPrincipalName." 'info' }
+    return $Results.ToArray()
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecAttackerActivity.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecAttackerActivity.ps1
new file mode 100644
index 0000000000000..8cca4f2f12758
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecAttackerActivity.ps1
@@ -0,0 +1,351 @@
+function Get-CIPPBecAttackerActivity {
+    <#
+    .SYNOPSIS
+        Collects item-level detail of what the attacker's addresses did: mail opened, synced, deleted,
+        moved and sent, files touched, sharing links used, and Microsoft Forms built from the account.
+    .DESCRIPTION
+        Only the attacker side is kept in detail - addresses whose verdict is Compromised,
+        LikelyAttacker, Suspicious or Unknown - so the user's own day-to-day activity stays as the
+        counts it already is (MailActivity).
+        Every record is tied to an address, even when the audit log left it out or recorded a
+        Microsoft front-end address: its own client address, else the sign-in behind its token
+        (AppAccessContext.UniqueTokenId), else its Entra session (AppAccessContext.AADSessionId),
+        else another record of the same mailbox session. Of the candidates, the one with the worst
+        verdict wins - a record tied to an attacker token is the attacker's.
+        - Mail: from the mailbox records the MailActivity search already read (no second search):
+          one row per message opened (internet message id + folder, named from the message trace),
+          per folder synced by a desktop client (the whole folder counts as taken), per item deleted,
+          moved or sent, per attachment read, plus folder-permission, calendar-delegation, mailbox
+          setting and mailbox search events.
+        - Files: one SharePoint/OneDrive search filtered to the attacker-side addresses.
+        - Link usage: the anonymous, company and specific-people links created in the window, and who
+          opened them (these are logged against the opener, so they are searched by item).
+        - Forms: every Microsoft Forms action by the account with its verdict; for forms created,
+          edited, shared or sent from an attacker-side address, how many people opened or answered
+          them and whether Microsoft flagged them as phishing.
+        Returns { Mail, Files, LinkUsage, Forms, Subjects } where each is a collector result (Mail and
+        Forms carry a Summary).
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The investigated user.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .PARAMETER EndDate
+        Window end (UTC).
+    .PARAMETER Heuristics
+        The BEC heuristics object (attackerActivity section, caps).
+    .PARAMETER Verdicts
+        The IP verdict rows.
+    .PARAMETER SignIns
+        The window's interactive sign-ins (IPAddress, UniqueTokenId, SessionId).
+    .PARAMETER NonInteractiveSignIns
+        The window's non-interactive sign-ins.
+    .PARAMETER MailRecords
+        The raw mailbox audit records from Get-CIPPBecMailActivity.
+    .PARAMETER SharingChanges
+        The sharing-link changes of the window (ItemUrl / ObjectId).
+    .PARAMETER KnownSubjects
+        Subjects already known by internet message id (the run's sent and received traces).
+    .PARAMETER Anchor
+        Anchor mailbox for the Exchange requests.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate,
+        [Parameter(Mandatory = $true)]$Heuristics,
+        [object[]]$Verdicts = @(),
+        [object[]]$SignIns = @(),
+        [object[]]$NonInteractiveSignIns = @(),
+        [object[]]$MailRecords = @(),
+        [object[]]$SharingChanges = @(),
+        [hashtable]$KnownSubjects = @{},
+        [string]$Anchor
+    )
+
+    $Cfg = $Heuristics.attackerActivity
+    $MaxPages = [int]($Heuristics.caps.auditLogPages ?? 10)
+    $AttackerSide = @('Compromised', 'LikelyAttacker', 'Suspicious', 'Unknown')
+    $Rank = @{ Compromised = 0; LikelyAttacker = 1; Suspicious = 2; Unknown = 3; LikelyUser = 4; Safe = 5; Service = 6 }
+    $HostOf = { param($Value) ConvertTo-CIPPBecHostAddress -Address ([string]$Value) }
+    $VerdictOf = @{}
+    foreach ($Row in @($Verdicts | Where-Object { $_ -and $_.IP })) { $VerdictOf[[string]$Row.IP] = [string]$Row.Verdict }
+    # audit CreationTime is UTC without a zone: read it as UTC, not as the host's local time
+    $When = { param($Value) try { if ($Value) { $(if ($Value -is [datetime]) { if ($Value.Kind -eq 'Local') { $Value.ToUniversalTime() } else { [datetime]::SpecifyKind($Value, 'Utc') } } else { [datetime]::Parse([string]$Value, [cultureinfo]::InvariantCulture, [System.Globalization.DateTimeStyles]'AssumeUniversal,AdjustToUniversal') }).ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null } } catch { [string]$Value } }
+
+    # --- tie records to addresses: tokens and Entra sessions from the sign-ins, mailbox sessions from the records ---
+    $Tokens = @{}
+    $EntraSessions = @{}
+    foreach ($SignIn in @(@($SignIns) + @($NonInteractiveSignIns) | Where-Object { $_ })) {
+        $IP = & $HostOf $SignIn.IPAddress
+        if (-not $IP) { continue }
+        if ($SignIn.UniqueTokenId) { $Tokens[[string]$SignIn.UniqueTokenId] = $IP }
+        if ($SignIn.SessionId) {
+            if (-not $EntraSessions.ContainsKey([string]$SignIn.SessionId)) { $EntraSessions[[string]$SignIn.SessionId] = [System.Collections.Generic.HashSet[string]]::new() }
+            $null = $EntraSessions[[string]$SignIn.SessionId].Add($IP)
+        }
+    }
+    $MailboxSessions = @{}
+    foreach ($Record in @($MailRecords | Where-Object { $_ })) {
+        $AD = $Record.AuditData
+        $IP = & $HostOf ($AD.ClientIP ?? $AD.ClientIPAddress)
+        if (-not $IP -or -not $AD.SessionId) { continue }
+        if (-not $MailboxSessions.ContainsKey([string]$AD.SessionId)) { $MailboxSessions[[string]$AD.SessionId] = [System.Collections.Generic.HashSet[string]]::new() }
+        $null = $MailboxSessions[[string]$AD.SessionId].Add($IP)
+    }
+    $Worst = {
+        param($Candidates)
+        @($Candidates | Where-Object { $_.IP } | Sort-Object -Property @{ Expression = { $Rank[[string]$VerdictOf[$_.IP]] ?? 9 } }, @{ Expression = { $_.Order } }) | Select-Object -First 1
+    }
+    $Resolve = {
+        param($AD)
+        $Context = $AD.AppAccessContext
+        $Candidates = [System.Collections.Generic.List[object]]::new()
+        $RecordIP = & $HostOf ($AD.ClientIP ?? $AD.ClientIPAddress)
+        if ($RecordIP) { $Candidates.Add([pscustomobject]@{ IP = $RecordIP; Source = 'record'; Order = 0 }) }
+        if ($Context.UniqueTokenId -and $Tokens.ContainsKey([string]$Context.UniqueTokenId)) { $Candidates.Add([pscustomobject]@{ IP = $Tokens[[string]$Context.UniqueTokenId]; Source = 'token'; Order = 1 }) }
+        if ($Context.AADSessionId -and $EntraSessions.ContainsKey([string]$Context.AADSessionId)) {
+            foreach ($IP in $EntraSessions[[string]$Context.AADSessionId]) { $Candidates.Add([pscustomobject]@{ IP = $IP; Source = 'Entra session'; Order = 2 }) }
+        }
+        if ($AD.SessionId -and $MailboxSessions.ContainsKey([string]$AD.SessionId)) {
+            foreach ($IP in $MailboxSessions[[string]$AD.SessionId]) { $Candidates.Add([pscustomobject]@{ IP = $IP; Source = 'mailbox session'; Order = 3 }) }
+        }
+        # a record whose own address is a Microsoft front end says nothing about the actor: prefer what it is tied to
+        $Useful = @($Candidates | Where-Object { $VerdictOf[$_.IP] -and $VerdictOf[$_.IP] -ne 'Service' })
+        $Pick = if ($Useful.Count -gt 0) { & $Worst $Useful } else { $Candidates | Select-Object -First 1 }
+        if (-not $Pick) { return [pscustomobject]@{ IP = $null; Source = 'none'; Verdict = $null } }
+        [pscustomobject]@{ IP = $Pick.IP; Source = $Pick.Source; Verdict = $(if ($VerdictOf[$Pick.IP]) { $VerdictOf[$Pick.IP] } else { 'Unknown' }) }
+    }
+    $Props = { param($AD) @(@($AD.OperationProperties) + @($AD.Parameters) | Where-Object { $_ -and $_.Name } | ForEach-Object { "$($_.Name)=$($_.Value)" }) -join '; ' }
+
+    # --- mail: item-level rows from the records already read ---
+    $MailRows = [System.Collections.Generic.List[object]]::new()
+    $Unattributed = 0
+    foreach ($Record in @($MailRecords | Where-Object { $_ -and $_.AuditData })) {
+        $AD = $Record.AuditData
+        $Address = & $Resolve $AD
+        if (-not $Address.IP) { $Unattributed++; continue }
+        if ($Address.Verdict -notin $AttackerSide) { continue }
+        $Operation = [string]($AD.Operation ?? $Record.Operation)
+        $AccessType = [string]($AD.MailAccessType ?? (@($AD.OperationProperties) | Where-Object { $_.Name -eq 'MailAccessType' } | Select-Object -First 1).Value)
+        $Client = [string]($AD.ClientInfoString ?? $AD.AppAccessContext.ClientAppName)
+        if ($Client.Length -gt 120) { $Client = $Client.Substring(0, 120) + '...' }
+        $New = {
+            param($Folder, $Subject, $MessageId, $Detail, $ItemCount)
+            $MailRows.Add([pscustomobject]@{
+                    When              = & $When $AD.CreationTime
+                    Operation         = $Operation
+                    AccessType        = $AccessType
+                    Folder            = [string]$Folder
+                    Subject           = [string]$Subject
+                    InternetMessageId = [string]$MessageId
+                    ItemCount         = $ItemCount
+                    Detail            = [string]$Detail
+                    IP                = $Address.IP
+                    IPSource          = $Address.Source
+                    IPVerdict         = $Address.Verdict
+                    MailboxOwner      = [string]($AD.MailboxOwnerUPN ?? $UserPrincipalName)
+                    LogonType         = $AD.LogonType
+                    Client            = $Client
+                    SessionId         = [string]$AD.SessionId
+                })
+        }
+        switch ($Operation) {
+            'MailItemsAccessed' {
+                $Folders = @($AD.Folders | Where-Object { $_ })
+                if ($Folders.Count -eq 0) { & $New $null $null $null (& $Props $AD) ([int]($AD.OperationCount ?? 1)); break }
+                foreach ($Folder in $Folders) {
+                    $Items = @($Folder.FolderItems | Where-Object { $_ })
+                    if ($AccessType -eq 'Sync') {
+                        & $New $Folder.Path '(whole folder synced to a desktop client)' $null $null $Items.Count
+                    } else {
+                        foreach ($Item in $Items) { & $New $Folder.Path $Item.Subject $Item.InternetMessageId $null 1 }
+                        if ($Items.Count -eq 0) { & $New $Folder.Path $null $null $null 0 }
+                    }
+                }
+            }
+            { $_ -in @('SoftDelete', 'HardDelete', 'MoveToDeletedItems', 'Move', 'Copy') } {
+                $Destination = if ($AD.DestFolder.Path) { "to $($AD.DestFolder.Path)" } else { $null }
+                $Items = @($AD.AffectedItems | Where-Object { $_ })
+                foreach ($Item in $Items) { & $New $Item.ParentFolder.Path $Item.Subject $Item.InternetMessageId $Destination 1 }
+                if ($Items.Count -eq 0) { & $New $AD.Folder.Path $null $null $Destination 0 }
+            }
+            { $_ -in @('Send', 'SendAs', 'SendOnBehalf', 'AttachmentAccess') } {
+                $Item = $AD.Item
+                $Detail = if ($Item.Attachments) { "Attachments: $($Item.Attachments)" } else { & $Props $AD }
+                & $New $Item.ParentFolder.Path $Item.Subject $Item.InternetMessageId $Detail 1
+            }
+            'UpdateFolderPermissions' {
+                $Folder = $AD.Item.ParentFolder
+                & $New $Folder.Path $null $null "$($Folder.MemberUpn): $($Folder.MemberRights)" 1
+            }
+            default { & $New $AD.Item.ParentFolder.Path $AD.Item.Subject $AD.Item.InternetMessageId (& $Props $AD) 1 }
+        }
+    }
+
+    # name the opened messages that the records did not name
+    $SubjectResult = [pscustomobject]@{ Resolved = 0; Unresolved = 0; Error = $null }
+    $Unnamed = @($MailRows | Where-Object { $_.InternetMessageId -and -not $_.Subject } | ForEach-Object { $_.InternetMessageId } | Select-Object -Unique)
+    if ($Unnamed.Count -gt 0) {
+        $SubjectResult = Resolve-CIPPBecMessageSubjects -TenantFilter $TenantFilter -MessageIds $Unnamed -Known $KnownSubjects -LookbackDays ([int]($Cfg.subjectLookbackDays ?? 90)) -Anchor $Anchor
+        foreach ($Row in $MailRows) {
+            if ($Row.InternetMessageId -and -not $Row.Subject -and $SubjectResult.Subjects.ContainsKey($Row.InternetMessageId)) { $Row.Subject = $SubjectResult.Subjects[$Row.InternetMessageId] }
+        }
+    }
+    $Count = { param($Ops) @($MailRows | Where-Object { $_.Operation -in $Ops }).Count }
+    $MailSummary = [pscustomobject]@{
+        Rows               = $MailRows.Count
+        MessagesOpened     = @($MailRows | Where-Object { $_.Operation -eq 'MailItemsAccessed' -and $_.InternetMessageId } | ForEach-Object { $_.InternetMessageId } | Select-Object -Unique).Count
+        FoldersSynced      = @($MailRows | Where-Object { $_.Operation -eq 'MailItemsAccessed' -and $_.AccessType -eq 'Sync' } | ForEach-Object { "$($_.MailboxOwner)|$($_.Folder)" } | Select-Object -Unique).Count
+        Deleted            = & $Count @('SoftDelete', 'HardDelete', 'MoveToDeletedItems')
+        Moved              = & $Count @('Move')
+        Sent               = & $Count @('Send', 'SendAs', 'SendOnBehalf')
+        AttachmentsRead    = & $Count @('AttachmentAccess')
+        Searches           = & $Count @('SearchQueryInitiatedExchange')
+        OtherMailboxes     = @($MailRows | Where-Object { $_.MailboxOwner -and $_.MailboxOwner -ne $UserPrincipalName } | ForEach-Object { $_.MailboxOwner } | Select-Object -Unique).Count
+        Unattributed       = $Unattributed
+        SubjectsResolved   = [int]$SubjectResult.Resolved
+        SubjectsUnresolved = [int]$SubjectResult.Unresolved
+    }
+    $Mail = New-CIPPBecCollectorResult -Data @($MailRows | Sort-Object -Property When) -Error $SubjectResult.Error
+    $Mail | Add-Member -NotePropertyName 'Summary' -NotePropertyValue $MailSummary -Force
+
+    # --- files: one search for the attacker-side addresses ---
+    $SideIPs = @($Verdicts | Where-Object { $_.Verdict -in $AttackerSide } | ForEach-Object { [string]$_.IP } | Select-Object -Unique)
+    $Files = if ($SideIPs.Count -eq 0) {
+        New-CIPPBecCollectorResult -Data @()
+    } else {
+        try {
+            $FileRows = [System.Collections.Generic.List[object]]::new()
+            $Complete = $true
+            $Cap = $null
+            for ($i = 0; $i -lt $SideIPs.Count; $i += 50) {
+                $Chunk = @($SideIPs[$i..([Math]::Min($i + 49, $SideIPs.Count - 1))])
+                $Search = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -Operations @($Cfg.fileOperations) -UserIds @($UserPrincipalName) -IPAddresses $Chunk -Anchor $Anchor -MaxPages $MaxPages
+                if (-not $Search.Complete) { $Complete = $false; $Cap = $Search.Cap }
+                foreach ($Record in @($Search.Records)) {
+                    $AD = $Record.AuditData
+                    if (-not $AD) { continue }
+                    $Address = & $Resolve $AD
+                    $FileRows.Add([pscustomobject]@{
+                            When        = & $When $AD.CreationTime
+                            Operation   = [string]$AD.Operation
+                            File        = [string]$AD.SourceFileName
+                            Url         = [string]$AD.ObjectId
+                            Site        = [string]$AD.SiteUrl
+                            Destination = if ($AD.DestinationFileName) { "$($AD.DestinationRelativeUrl)/$($AD.DestinationFileName)" } else { $null }
+                            SearchQuery = [string]($AD.SearchQueryText ?? $AD.QueryText)
+                            IP          = $Address.IP
+                            IPSource    = $Address.Source
+                            IPVerdict   = $Address.Verdict
+                            UserAgent   = [string]$AD.UserAgent
+                            App         = [string]($AD.ApplicationDisplayName ?? $AD.AppAccessContext.ClientAppName)
+                        })
+                }
+            }
+            $Result = New-CIPPBecCollectorResult -Data @($FileRows | Sort-Object -Property When) -Complete $Complete -Cap $Cap
+            $Result | Add-Member -NotePropertyName 'Summary' -NotePropertyValue ([pscustomobject]@{
+                    Files      = @($FileRows | ForEach-Object { $_.Url } | Where-Object { $_ } | Select-Object -Unique).Count
+                    Downloaded = @($FileRows | Where-Object { $_.Operation -in @('FileDownloaded', 'FileSyncDownloadedFull') }).Count
+                    Accessed   = @($FileRows | Where-Object { $_.Operation -in @('FileAccessed', 'FilePreviewed') }).Count
+                    Uploaded   = @($FileRows | Where-Object { $_.Operation -eq 'FileUploaded' }).Count
+                    Deleted    = @($FileRows | Where-Object { $_.Operation -in @('FileDeleted', 'FileRecycled') }).Count
+                    Searches   = @($FileRows | Where-Object { $_.Operation -eq 'SearchQueryPerformed' }).Count
+                }) -Force
+            $Result
+        } catch {
+            New-CIPPBecCollectorResult -Data @() -Error "File activity search failed: $((Get-NormalizedError -message $_.Exception.Message))"
+        }
+    }
+
+    # --- link usage: who opened the links created in the window ---
+    $LinkItems = @($SharingChanges | ForEach-Object { [string]($_.ItemUrl ?? $_.ObjectId) } | Where-Object { $_ -match '^https?://' } | Select-Object -Unique)
+    $LinkUsage = if ($LinkItems.Count -eq 0) {
+        New-CIPPBecCollectorResult -Data @()
+    } else {
+        try {
+            $UseRows = [System.Collections.Generic.List[object]]::new()
+            $Complete = $true
+            $Cap = $null
+            for ($i = 0; $i -lt $LinkItems.Count; $i += 50) {
+                $Chunk = @($LinkItems[$i..([Math]::Min($i + 49, $LinkItems.Count - 1))])
+                $Search = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -Operations @($Cfg.linkUsageOperations) -ObjectIds $Chunk -Anchor $Anchor -MaxPages $MaxPages
+                if (-not $Search.Complete) { $Complete = $false; $Cap = $Search.Cap }
+                foreach ($Record in @($Search.Records)) {
+                    $AD = $Record.AuditData
+                    if (-not $AD) { continue }
+                    $UseRows.Add([pscustomobject]@{
+                            When      = & $When $AD.CreationTime
+                            Operation = [string]$AD.Operation
+                            File      = [string]$AD.SourceFileName
+                            Url       = [string]$AD.ObjectId
+                            OpenedBy  = [string]$AD.UserId
+                            IP        = & $HostOf ($AD.ClientIP ?? $AD.ClientIPAddress)
+                            UserAgent = [string]$AD.UserAgent
+                        })
+                }
+            }
+            New-CIPPBecCollectorResult -Data @($UseRows | Sort-Object -Property When) -Complete $Complete -Cap $Cap
+        } catch {
+            New-CIPPBecCollectorResult -Data @() -Error "Sharing-link usage search failed: $((Get-NormalizedError -message $_.Exception.Message))"
+        }
+    }
+
+    # --- Microsoft Forms: everything the account did, and the reach of forms built from attacker addresses ---
+    $Forms = try {
+        $Search = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -RecordType 'MicrosoftForms' -UserIds @($UserPrincipalName) -Anchor $Anchor -MaxPages $MaxPages
+        $FormRows = @(foreach ($Record in @($Search.Records)) {
+                $AD = $Record.AuditData
+                if (-not $AD) { continue }
+                $Address = & $Resolve $AD
+                $Operation = [string]$AD.Operation
+                [pscustomobject]@{
+                    When      = & $When $AD.CreationTime
+                    Operation = $Operation
+                    FormName  = [string]$AD.FormName
+                    FormId    = [string]($AD.FormId ?? $AD.ObjectId)
+                    UserType  = [string]$AD.FormsUserType
+                    IP        = $Address.IP
+                    IPSource  = $Address.Source
+                    IPVerdict = $Address.Verdict
+                    Flagged   = [bool]($Address.Verdict -in $AttackerSide -and $Operation -in @($Cfg.formsAttackerOperations))
+                    Detail    = & $Props $AD
+                }
+            })
+        $FormSummaries = @(foreach ($FormId in @($FormRows | Where-Object { $_.Flagged -and $_.FormId } | ForEach-Object { $_.FormId } | Select-Object -Unique)) {
+                $Reach = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -Operations @($Cfg.formsResponseOperations) -FreeText $FormId -Anchor $Anchor -MaxPages $MaxPages
+                $Records = @($Reach.Records | Where-Object { $_.AuditData -and [string]($_.AuditData.FormId ?? $_.AuditData.ObjectId) -eq $FormId })
+                $Responses = @($Records | Where-Object { $_.AuditData.Operation -in @('CreateResponse', 'SubmitResponse') })
+                [pscustomobject]@{
+                    FormId             = $FormId
+                    FormName           = ($FormRows | Where-Object { $_.FormId -eq $FormId -and $_.FormName } | Select-Object -First 1).FormName
+                    Responses          = $Responses.Count
+                    AnonymousResponses = @($Responses | Where-Object { -not $_.AuditData.ResponderId }).Count
+                    Views              = @($Records | Where-Object { $_.AuditData.Operation -eq 'ViewRuntimeForm' }).Count
+                    PhishingFlagged    = [bool](@($Records | Where-Object { $_.AuditData.Operation -eq 'UpdatePhishingStatus' }).Count)
+                    Complete           = [bool]$Reach.Complete
+                }
+            })
+        $Result = New-CIPPBecCollectorResult -Data @($FormRows | Sort-Object -Property When) -Complete ([bool]$Search.Complete) -Cap $Search.Cap
+        $Result | Add-Member -NotePropertyName 'Summary' -NotePropertyValue ([pscustomobject]@{
+                FlaggedActions = @($FormRows | Where-Object { $_.Flagged }).Count
+                Forms          = @($FormSummaries)
+            }) -Force
+        $Result
+    } catch {
+        New-CIPPBecCollectorResult -Data @() -Error "Microsoft Forms search failed: $((Get-NormalizedError -message $_.Exception.Message))"
+    }
+
+    [pscustomobject]@{
+        Mail      = $Mail
+        Files     = $Files
+        LinkUsage = $LinkUsage
+        Forms     = $Forms
+        Subjects  = $SubjectResult
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecBlastRadius.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecBlastRadius.ps1
new file mode 100644
index 0000000000000..58575169b0a2d
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecBlastRadius.ps1
@@ -0,0 +1,168 @@
+function Get-CIPPBecBlastRadius {
+    <#
+    .SYNOPSIS
+        Lists the other accounts in the tenant that the attacker addresses reached.
+    .DESCRIPTION
+        An attacker rarely stops at one account. For every address judged Compromised or
+        LikelyAttacker (never Suspicious or Unknown - a guess would send the investigator after
+        colleagues on the user's own office exit), it gathers:
+        - the tenant's sign-ins from the address (Get-CIPPBecIPPeers, reused from the IP analysis
+          when it already looked the address up), per account successful and failed;
+        - the tenant's audit log for the address across every workload, with no user filter, per
+          account the operations it recorded.
+        One row per other account: sign-ins, actions by operation, first and last seen. An account
+        with a successful sign-in or any recorded action from an attacker address is flagged as
+        reached; failed sign-ins alone are an attempt. Rows carry the account's object id so each
+        one can be investigated in turn.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The investigated user's object id (excluded).
+    .PARAMETER UserPrincipalName
+        The investigated user (excluded).
+    .PARAMETER Verdicts
+        The IP verdicts (Get-CIPPBecIPVerdicts).
+    .PARAMETER Peers
+        Hashtable keyed by IP from the IP analysis (Get-CIPPBecIPPeers shape).
+    .PARAMETER StartDate
+        Window start (UTC).
+    .PARAMETER EndDate
+        Window end (UTC).
+    .PARAMETER Heuristics
+        The BEC heuristics object (caps.auditLogPages).
+    .PARAMETER Anchor
+        Anchor mailbox for the EXO request.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$UserId,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [object[]]$Verdicts = @(),
+        [hashtable]$Peers = @{},
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate,
+        $Heuristics,
+        [string]$Anchor
+    )
+
+    $AttackerIPs = @($Verdicts | Where-Object { $_ -and $_.Verdict -in @('Compromised', 'LikelyAttacker') } | ForEach-Object { [string]$_.IP } | Select-Object -Unique)
+    if ($AttackerIPs.Count -eq 0) { return New-CIPPBecCollectorResult -Data @() }
+
+    $MaxPages = [int]($Heuristics.caps.auditLogPages ?? 10)
+    $Errors = [System.Collections.Generic.List[string]]::new()
+    $Complete = $true
+    $Cap = $null
+    $IsUser = { param($Who, $Id) ($UserId -and $Id -and [string]$Id -eq $UserId) -or ([string]$Who -ieq $UserPrincipalName) }
+    $Accounts = @{}
+    $Touch = {
+        param($Who)
+        $Key = ([string]$Who).ToLowerInvariant()
+        if (-not $Accounts.ContainsKey($Key)) {
+            $Accounts[$Key] = [pscustomobject]@{
+                UserPrincipalName = [string]$Who; UserId = $null; IPs = [System.Collections.Generic.HashSet[string]]::new()
+                Successful = 0; Failed = 0; Actions = 0; Operations = @{}; FirstSeen = $null; LastSeen = $null
+            }
+        }
+        $Accounts[$Key]
+    }
+    $Seen = {
+        param($Account, $Stamp)
+        if (-not $Stamp) { return }
+        if (-not $Account.FirstSeen -or $Stamp -lt $Account.FirstSeen) { $Account.FirstSeen = $Stamp }
+        if (-not $Account.LastSeen -or $Stamp -gt $Account.LastSeen) { $Account.LastSeen = $Stamp }
+    }
+
+    # --- sign-ins: reuse the analysis' tenant-wide lookup, look up only what it did not ---
+    $Known = @{}
+    foreach ($IP in $AttackerIPs) {
+        $Peer = $Peers[$IP]
+        # an entry only from the colleague sample, or stored before accounts were kept, is looked up again
+        if ($Peer -and $Peer.PSObject.Properties['Accounts'] -and (@($Peer.Accounts).Count -gt 0 -or [int]$Peer.OtherUsers -eq 0)) { $Known[$IP] = $Peer }
+    }
+    $Missing = @($AttackerIPs | Where-Object { -not $Known.ContainsKey($_) })
+    if ($Missing.Count -gt 0) {
+        try {
+            $Found = Get-CIPPBecIPPeers -TenantFilter $TenantFilter -UserId $(if ($UserId) { $UserId } else { 'none' }) -IPs $Missing -StartDate $StartDate -WindowStart $StartDate
+            foreach ($Key in $Found.Keys) { $Known[$Key] = $Found[$Key] }
+        } catch {
+            $Errors.Add("sign-ins: $($_.Exception.Message)")
+        }
+    }
+    foreach ($IP in $Known.Keys) {
+        if ($Known[$IP].Error) { $Errors.Add("sign-ins from $($IP): $($Known[$IP].Error)") }
+        foreach ($Entry in @($Known[$IP].Accounts | Where-Object { $_ -and $_.UserPrincipalName })) {
+            if (& $IsUser $Entry.UserPrincipalName $Entry.UserId) { continue }
+            $Account = & $Touch $Entry.UserPrincipalName
+            if ($Entry.UserId) { $Account.UserId = [string]$Entry.UserId }
+            $null = $Account.IPs.Add($IP)
+            $Account.Successful = $Account.Successful + [int]$Entry.Successful
+            $Account.Failed = $Account.Failed + [int]$Entry.Failed
+            & $Seen $Account $Entry.FirstSeen
+            & $Seen $Account $Entry.LastSeen
+        }
+    }
+
+    # --- audit log: every workload, no user filter ---
+    try {
+        for ($i = 0; $i -lt $AttackerIPs.Count; $i += 50) {
+            $Chunk = @($AttackerIPs[$i..([Math]::Min($i + 49, $AttackerIPs.Count - 1))])
+            $Search = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -IPAddresses $Chunk -Anchor $Anchor -MaxPages $MaxPages
+            if (-not $Search.Complete) { $Complete = $false; $Cap = $Search.Cap }
+            foreach ($Record in @($Search.Records)) {
+                $AD = $Record.AuditData
+                $Who = [string]($AD.UserId ?? $Record.UserId)
+                # service principals and system accounts (app@sharepoint, NT AUTHORITY, S-1-5-...) are not accounts to investigate
+                if ($Who -notmatch '@' -or $Who -match '^app@sharepoint$' -or (& $IsUser $Who $null)) { continue }
+                $Account = & $Touch $Who
+                $Address = ConvertTo-CIPPBecHostAddress -Address ([string]($AD.ClientIP ?? $AD.ClientIPAddress ?? $AD.ActorIpAddress))
+                if ($Address) { $null = $Account.IPs.Add($Address) }
+                $Account.Actions++
+                $Operation = [string]($AD.Operation ?? $Record.Operation)
+                $Account.Operations[$Operation] = [int]($Account.Operations[$Operation] ?? 0) + 1
+                # audit CreationTime is UTC without a zone: read it as UTC, not as the host's local time
+                $Value = $AD.CreationTime ?? $Record.CreationDate
+                $When = try { $(if ($Value -is [datetime]) { if ($Value.Kind -eq 'Local') { $Value.ToUniversalTime() } else { [datetime]::SpecifyKind($Value, 'Utc') } } else { [datetime]::Parse([string]$Value, [cultureinfo]::InvariantCulture, [System.Globalization.DateTimeStyles]'AssumeUniversal,AdjustToUniversal') }).ToString('yyyy-MM-ddTHH:mm:ssZ') } catch { $null }
+                & $Seen $Account $When
+            }
+        }
+    } catch {
+        $Errors.Add("audit log: $($_.Exception.Message)")
+    }
+
+    # accounts seen only in the audit log carry a UPN, not an object id: resolve them so they can be investigated
+    $Unresolved = @($Accounts.Values | Where-Object { -not $_.UserId } | Select-Object -First 50)
+    if ($Unresolved.Count -gt 0) {
+        try {
+            $Requests = for ($i = 0; $i -lt $Unresolved.Count; $i++) {
+                @{ id = "u$i"; method = 'GET'; url = "users/$([uri]::EscapeDataString($Unresolved[$i].UserPrincipalName))?`$select=id" }
+            }
+            foreach ($Response in @(New-GraphBulkRequest -Requests @($Requests) -tenantid $TenantFilter -asapp $true)) {
+                if ([int]$Response.status -ge 400 -or -not $Response.body.id) { continue }
+                $Unresolved[[int]([string]$Response.id).Substring(1)].UserId = [string]$Response.body.id
+            }
+        } catch {
+            Write-Information "Blast radius: could not resolve account ids: $($_.Exception.Message)"
+        }
+    }
+
+    $Rows = @($Accounts.Values | ForEach-Object {
+            $Reached = $_.Successful -gt 0 -or $_.Actions -gt 0
+            [pscustomobject]@{
+                UserPrincipalName = $_.UserPrincipalName
+                UserId            = $_.UserId
+                Reached           = $Reached
+                AttackerIPs       = @($_.IPs | Sort-Object) -join ', '
+                SuccessfulSignIns = $_.Successful
+                FailedSignIns     = $_.Failed
+                Actions           = $_.Actions
+                Operations        = @($_.Operations.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object { "$($_.Key) x$($_.Value)" }) -join ', '
+                FirstSeen         = $_.FirstSeen
+                LastSeen          = $_.LastSeen
+                Flagged           = $Reached
+            }
+        } | Sort-Object -Property @{ Expression = { $_.Reached }; Descending = $true }, @{ Expression = { $_.SuccessfulSignIns + $_.Actions }; Descending = $true }, UserPrincipalName)
+    New-CIPPBecCollectorResult -Data $Rows -Complete $Complete -Cap $Cap -Error $(if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null })
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecColleagueSample.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecColleagueSample.ps1
new file mode 100644
index 0000000000000..8c364b536a6eb
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecColleagueSample.ps1
@@ -0,0 +1,40 @@
+function Get-CIPPBecColleagueSample {
+    <#
+    .SYNOPSIS
+        Picks a handful of recently active colleagues whose sign-ins to correlate with a BEC case.
+    .DESCRIPTION
+        The investigation cannot know on its own which addresses are shared offices, VPNs or a home
+        network used by several people, so it looks at who else is signing in: one page of the tenant's
+        recent successful interactive sign-ins, reduced to member accounts other than the investigated
+        user (guests and the CIPP service account excluded), from which Count are picked at random.
+        Their sign-ins are then read with Get-CIPPBecCorrelatedUserPeers. Returns the object ids.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER ExcludeUserId
+        The investigated user's object id.
+    .PARAMETER StartDate
+        Only sign-ins from this time (UTC).
+    .PARAMETER Count
+        How many colleagues to pick.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$ExcludeUserId,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [ValidateRange(1, 50)][int]$Count = 8
+    )
+
+    $From = $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $Uri = "https://graph.microsoft.com/beta/auditLogs/signIns?`$filter=createdDateTime ge $From and status/errorCode eq 0&`$top=999&`$select=userId,userPrincipalName,userType,appId"
+    $SignIns = @(New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -noPagination $true)
+    $CippAppId = [string]$env:ApplicationID
+    $Candidates = @($SignIns | Where-Object {
+            $_.userId -and $_.userId -ne $ExcludeUserId -and $_.userType -ne 'guest' -and
+            (-not $CippAppId -or $_.appId -ne $CippAppId) -and [string]$_.userPrincipalName -notlike 'cipp*'
+        } | ForEach-Object { [string]$_.userId } | Select-Object -Unique)
+    if ($Candidates.Count -le $Count) { return $Candidates }
+    return @($Candidates | Get-Random -Count $Count)
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecContainmentActions.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecContainmentActions.ps1
new file mode 100644
index 0000000000000..9b75a1ecd9925
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecContainmentActions.ps1
@@ -0,0 +1,54 @@
+function Get-CIPPBecContainmentActions {
+    <#
+    .SYNOPSIS
+        Returns the catalog of BEC containment actions.
+    .DESCRIPTION
+        The single source of truth for what Invoke-CIPPBecContainment can do: id, label, what it does,
+        impact (Low/Medium/High/Critical), whether it is reversible, whether it runs by default (the
+        built-in set below, overridden by the instance-wide defaults saved from CIPP settings via
+        ExecBECRemediationDefaults), the order the dispatcher runs it in, and the
+        parameter it reads its explicit targets from. Critical actions need a typed confirmation from
+        an operator; automation (the webhook action) passes -Confirmed instead. The frontend renders
+        this list, so labels and descriptions are operator-facing.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    $Catalog = @(
+        [pscustomobject]@{ Id = 'ResetPassword'; Label = 'Reset password'; Description = 'Sets a new random password (shown once, or as a PwPush link) and requires a change at next sign-in.'; Impact = 'Critical'; Reversible = $false; DefaultSelected = $true; Order = 1; TargetSource = $null; ParameterName = $null }
+        [pscustomobject]@{ Id = 'DisableAccount'; Label = 'Block sign-in'; Description = 'Disables the account in Entra ID. Directory-synced accounts must also be disabled on-premises or the sync will re-enable them.'; Impact = 'Critical'; Reversible = $true; DefaultSelected = $true; Order = 2; TargetSource = $null; ParameterName = $null }
+        [pscustomobject]@{ Id = 'RevokeSessions'; Label = 'Revoke sessions'; Description = 'Invalidates every refresh token so existing sessions and stolen tokens stop working.'; Impact = 'High'; Reversible = $false; DefaultSelected = $true; Order = 3; TargetSource = $null; ParameterName = $null }
+        [pscustomobject]@{ Id = 'RemoveMFA'; Label = 'Remove MFA methods'; Description = 'Removes the selected authentication methods, or every method when none is selected, so an attacker-registered method cannot be used to get back in.'; Impact = 'High'; Reversible = $false; DefaultSelected = $true; Order = 4; TargetSource = 'MFADevices'; ParameterName = 'MfaMethodIds' }
+        [pscustomobject]@{ Id = 'RemoveOAuthGrants'; Label = 'Revoke application consents'; Description = 'Deletes the selected OAuth consent grants and app-role assignments (flagged ones by default). Consent survives a password reset.'; Impact = 'Critical'; Reversible = $false; DefaultSelected = $false; Order = 5; TargetSource = 'UserGrants'; ParameterName = 'GrantIds' }
+        [pscustomobject]@{ Id = 'DisableServicePrincipals'; Label = 'Disable rogue applications tenant-wide'; Description = 'Disables the service principal of every application that matched the rogue-app catalogs, for all users. Re-enable it from the enterprise applications page if it turns out to be legitimate.'; Impact = 'Critical'; Reversible = $true; DefaultSelected = $false; Order = 6; TargetSource = 'UserGrants'; ParameterName = 'ServicePrincipalIds' }
+        [pscustomobject]@{ Id = 'DisableInboxRules'; Label = 'Disable inbox rules'; Description = 'Disables every inbox rule on the mailbox except the junk and out-of-office system rules, or only the selected ones.'; Impact = 'High'; Reversible = $true; DefaultSelected = $true; Order = 7; TargetSource = 'NewRules'; ParameterName = 'RuleIds' }
+        [pscustomobject]@{ Id = 'ClearForwarding'; Label = 'Clear mailbox forwarding'; Description = 'Removes the mailbox forwarding address and SMTP forwarding address.'; Impact = 'High'; Reversible = $true; DefaultSelected = $false; Order = 8; TargetSource = 'MailboxState'; ParameterName = $null }
+        [pscustomobject]@{ Id = 'ClearAutoReply'; Label = 'Turn off automatic replies'; Description = 'Disables the out-of-office auto-reply, a common diversion once a mailbox is taken over.'; Impact = 'Medium'; Reversible = $true; DefaultSelected = $false; Order = 9; TargetSource = 'MailboxState'; ParameterName = $null }
+        [pscustomobject]@{ Id = 'RemoveDelegations'; Label = 'Remove mailbox delegations'; Description = 'Removes the selected FullAccess, SendAs, SendOnBehalf, folder and resource-delegate permissions (flagged ones by default).'; Impact = 'Critical'; Reversible = $true; DefaultSelected = $false; Order = 10; TargetSource = 'Delegations'; ParameterName = 'Delegations' }
+        [pscustomobject]@{ Id = 'DisableTransportRules'; Label = 'Disable transport rules'; Description = 'Disables the selected tenant-wide transport rules (by default the flagged ones changed in the window). Affects every mailbox in the tenant.'; Impact = 'Critical'; Reversible = $true; DefaultSelected = $false; Order = 11; TargetSource = 'TransportRulesFlagged'; ParameterName = 'TransportRuleIds' }
+        [pscustomobject]@{ Id = 'DisableMailboxAddIns'; Label = 'Disable mailbox add-ins'; Description = 'Disables the selected add-ins for this mailbox (flagged user-installed ones by default).'; Impact = 'Medium'; Reversible = $true; DefaultSelected = $false; Order = 12; TargetSource = 'MailboxAddIns'; ParameterName = 'AddInIds' }
+        [pscustomobject]@{ Id = 'BlockProtocols'; Label = 'Block legacy mailbox protocols'; Description = 'Turns off the selected client protocols on the mailbox (EWS, IMAP, POP, ActiveSync and SMTP AUTH by default; OWA, MAPI and ECP optional).'; Impact = 'High'; Reversible = $true; DefaultSelected = $true; Order = 13; TargetSource = 'MailboxState'; ParameterName = 'Protocols' }
+        [pscustomobject]@{ Id = 'BlockMobileDevices'; Label = 'Block mobile device partnerships'; Description = 'Adds the selected ActiveSync devices (all by default) to the mailbox block list.'; Impact = 'High'; Reversible = $true; DefaultSelected = $false; Order = 14; TargetSource = 'SuspectUserDevices'; ParameterName = 'MobileDeviceIds' }
+        [pscustomobject]@{ Id = 'RemoveMobileDevices'; Label = 'Remove mobile device partnerships'; Description = 'Deletes the selected ActiveSync device partnerships (all by default); the device must re-pair to sync again.'; Impact = 'High'; Reversible = $false; DefaultSelected = $false; Order = 15; TargetSource = 'SuspectUserDevices'; ParameterName = 'MobileDeviceIds' }
+        [pscustomobject]@{ Id = 'DisableRegisteredDevices'; Label = 'Disable registered devices'; Description = 'Disables the selected Entra devices (those registered in the window by default) so they can no longer satisfy device-based Conditional Access.'; Impact = 'High'; Reversible = $true; DefaultSelected = $false; Order = 16; TargetSource = 'RegisteredDevices'; ParameterName = 'RegisteredDeviceIds' }
+        [pscustomobject]@{ Id = 'RemoveRegisteredDevices'; Label = 'Delete registered devices'; Description = 'Deletes the selected Entra device objects (those registered in the window by default).'; Impact = 'Critical'; Reversible = $false; DefaultSelected = $false; Order = 17; TargetSource = 'RegisteredDevices'; ParameterName = 'RegisteredDeviceIds' }
+        [pscustomobject]@{ Id = 'TargetedCAPolicy'; Label = 'Targeted Conditional Access policy'; Description = 'Creates a Conditional Access policy for this user only that requires MFA (optionally plus a compliant device) for every application, and schedules its removal after the chosen number of hours.'; Impact = 'High'; Reversible = $true; DefaultSelected = $false; Order = 18; TargetSource = $null; ParameterName = 'CAPolicy' }
+        [pscustomobject]@{ Id = 'DisableOneDriveSharing'; Label = 'Disable OneDrive sharing'; Description = "Sets the user's OneDrive sharing capability to disabled. Existing links are not removed."; Impact = 'Medium'; Reversible = $true; DefaultSelected = $false; Order = 19; TargetSource = 'SharingChanges'; ParameterName = $null }
+        [pscustomobject]@{ Id = 'BlockSenders'; Label = 'Block phishing senders tenant-wide'; Description = 'Adds the phishing-shaped senders that reached this mailbox (from the received-mail findings) to the Tenant Allow/Block List as blocked senders, for every mailbox in the tenant. Reversible from the Tenant Allow/Block List page.'; Impact = 'Medium'; Reversible = $true; DefaultSelected = $false; Order = 20; TargetSource = 'ReceivedMailFindings'; ParameterName = 'BlockSenders' }
+        [pscustomobject]@{ Id = 'RemoveSharingLinks'; Label = 'Remove OneDrive/SharePoint sharing links'; Description = 'Deletes the anonymous ("anyone") and company-wide sharing links the user created on OneDrive/SharePoint items in the window (from the sharing-change findings). Unlike disabling sharing, this revokes links that already exist and are the actual exposure. Not reversible - a removed link is gone, though it can be re-created.'; Impact = 'High'; Reversible = $false; DefaultSelected = $false; Order = 21; TargetSource = 'SharingChanges'; ParameterName = 'SharingLinkUrls' }
+    )
+
+    # Instance-wide defaults saved from CIPP settings replace the built-in DefaultSelected flags.
+    # A missing row or a failed read keeps the built-in set.
+    $Saved = try {
+        $Table = Get-CIPPTable -TableName Settings
+        (Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'BecRemediation' and RowKey eq 'Defaults'").DefaultActions
+    } catch { $null }
+    if ($Saved) {
+        $SavedIds = @($Saved | ConvertFrom-Json)
+        foreach ($Action in $Catalog) { $Action.DefaultSelected = $Action.Id -in $SavedIds }
+    }
+    $Catalog
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecCorrelatedUserPeers.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecCorrelatedUserPeers.ps1
new file mode 100644
index 0000000000000..b80bc98607e3f
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecCorrelatedUserPeers.ps1
@@ -0,0 +1,83 @@
+function Get-CIPPBecCorrelatedUserPeers {
+    <#
+    .SYNOPSIS
+        Reads the sign-ins of accounts the investigator chose, to correlate the case's addresses with them.
+    .DESCRIPTION
+        For each chosen account, one Graph batch reads its interactive sign-ins (paged to the end) and
+        the first page of its non-interactive ones since the baseline start. Only the case's own
+        addresses matter: an address a colleague used before the window is evidence it is an office
+        or shared exit; one a colleague signed in from only during the window points at the attacker
+        reaching further. Returns a hashtable keyed by IP in the same shape as Get-CIPPBecIPPeers
+        ({ IP, OtherUsers, OtherUsersBefore, OtherUsersInWindowOnly, Users, Sampled, Error }), which
+        Invoke-CIPPBecIPAnalysis merges into the tenant-wide peers.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserIds
+        Object ids of the accounts to correlate.
+    .PARAMETER IPs
+        The case's addresses (host form).
+    .PARAMETER StartDate
+        How far back to read (UTC) - the baseline start.
+    .PARAMETER WindowStart
+        The start of the investigation window (UTC).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string[]]$UserIds = @(),
+        [string[]]$IPs = @(),
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$WindowStart
+    )
+
+    $Result = @{}
+    $Users = @($UserIds | Where-Object { $_ } | Select-Object -Unique)
+    $Wanted = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($IP in @($IPs | Where-Object { $_ })) { $null = $Wanted.Add([string]$IP) }
+    if ($Users.Count -eq 0 -or $Wanted.Count -eq 0) { return $Result }
+
+    $From = $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $Select = 'ipAddress,userPrincipalName,userId,createdDateTime'
+    $Requests = [System.Collections.Generic.List[object]]::new()
+    $NoPaginate = [System.Collections.Generic.List[string]]::new()
+    for ($i = 0; $i -lt $Users.Count; $i++) {
+        $SafeId = ConvertTo-CIPPODataFilterValue -Value ([string]$Users[$i]) -Type Guid
+        $Filter = "userId eq '$SafeId' and createdDateTime ge $From"
+        $Requests.Add(@{ id = "i$i"; method = 'GET'; url = "auditLogs/signIns?`$filter=$Filter&`$top=999&`$select=$Select" })
+        $Requests.Add(@{ id = "n$i"; method = 'GET'; url = "auditLogs/signIns?`$filter=$Filter and signInEventTypes/any(t: t eq 'nonInteractiveUser')&`$top=999&`$select=$Select" })
+        $NoPaginate.Add("n$i")
+    }
+    $Responses = @(New-GraphBulkRequest -Requests @($Requests) -tenantid $TenantFilter -asapp $true -Version 'beta' -NoPaginateIds @($NoPaginate))
+
+    $Window = $WindowStart.ToUniversalTime()
+    $Before = @{}
+    $During = @{}
+    $Failed = @($Responses | Where-Object { [int]$_.status -ge 400 })
+    foreach ($SignIn in @($Responses | Where-Object { [int]$_.status -lt 400 } | ForEach-Object { $_.body.value })) {
+        if (-not $SignIn) { continue }
+        $IP = ConvertTo-CIPPBecHostAddress -Address ([string]$SignIn.ipAddress)
+        if (-not $IP -or -not $Wanted.Contains($IP)) { continue }
+        $Who = if ($SignIn.userPrincipalName) { [string]$SignIn.userPrincipalName } else { [string]$SignIn.userId }
+        $When = try { ([datetime]$SignIn.createdDateTime).ToUniversalTime() } catch { $null }
+        $Bucket = if ($When -and $When -lt $Window) { $Before } else { $During }
+        if (-not $Bucket.ContainsKey($IP)) { $Bucket[$IP] = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase) }
+        $null = $Bucket[$IP].Add($Who)
+    }
+    foreach ($IP in @(@($Before.Keys) + @($During.Keys) | Select-Object -Unique)) {
+        $Earlier = if ($Before.ContainsKey($IP)) { @($Before[$IP]) } else { @() }
+        $Later = if ($During.ContainsKey($IP)) { @($During[$IP] | Where-Object { $_ -notin $Earlier }) } else { @() }
+        $All = @(@($Earlier) + @($Later) | Select-Object -Unique)
+        $Result[$IP] = [pscustomobject]@{
+            IP                     = $IP
+            OtherUsers             = $All.Count
+            OtherUsersBefore       = $Earlier.Count
+            OtherUsersInWindowOnly = $Later.Count
+            Users                  = @($All | Sort-Object)
+            Sampled                = $true
+            Error                  = if ($Failed.Count -gt 0) { [string]$Failed[0].body.error.message } else { $null }
+        }
+    }
+    return $Result
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecDelegatedAccess.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecDelegatedAccess.ps1
new file mode 100644
index 0000000000000..8a0c7d1220e52
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecDelegatedAccess.ps1
@@ -0,0 +1,121 @@
+function Get-CIPPBecDelegatedAccess {
+    <#
+    .SYNOPSIS
+        Lists the other mailboxes the investigated account can reach, and what the attacker did in them.
+    .DESCRIPTION
+        A compromised account reaches every mailbox it has delegate access to. The mailboxes come from:
+        - CIPP's permission cache (the reverse lookup of the mailbox and calendar permission reports,
+          Get-CIPPMailboxPermissionReport / Get-CIPPCalendarPermissionReport -ByUser), which may be
+          a few hours old;
+        - grants to this account recorded in the window's audit log (Add-MailboxPermission,
+          Add-RecipientPermission, folder grants), which catch a fresh or already-removed grant;
+        - mailbox activity by this account in a mailbox it does not own (MailItemsAccessed and sends
+          logged as a delegate), which catches access neither of the above knows about.
+        Each mailbox row carries its access rights and where they are known from, the delegate
+        activity counted in it, and the item-level attacker activity (opened, synced, sent) in it.
+        A permission cache that has not been built is reported as an error while the audit and
+        activity sources still count.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The investigated user.
+    .PARAMETER UserDisplayName
+        The user's display name (calendar permissions often name the delegate that way).
+    .PARAMETER PermissionChanges
+        The window's mailbox permission changes (MailboxPermissionChanges).
+    .PARAMETER MailActivity
+        The mailbox activity counts (MailActivity rows).
+    .PARAMETER AttackerMail
+        The attacker-side mail rows (Get-CIPPBecAttackerActivity Mail data).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [string]$UserDisplayName,
+        [object[]]$PermissionChanges = @(),
+        [object[]]$MailActivity = @(),
+        [object[]]$AttackerMail = @()
+    )
+
+    $IsUser = { param($Value) $Text = ([string]$Value).Trim(); $Text -and ($Text -ieq $UserPrincipalName -or ($UserDisplayName -and $Text -ieq $UserDisplayName)) }
+    $Mailboxes = @{}
+    $Touch = {
+        param($Mailbox)
+        $Key = ([string]$Mailbox).Trim().ToLowerInvariant()
+        if (-not $Mailboxes.ContainsKey($Key)) {
+            $Mailboxes[$Key] = [pscustomobject]@{
+                Mailbox = [string]$Mailbox; AccessRights = [System.Collections.Generic.HashSet[string]]::new(); Sources = [System.Collections.Generic.HashSet[string]]::new()
+                GrantedInWindow = $false; DelegateActivity = 0; AttackerOpened = 0; AttackerSynced = 0; AttackerSent = 0; LastAttackerActivity = $null
+            }
+        }
+        $Mailboxes[$Key]
+    }
+    $Errors = [System.Collections.Generic.List[string]]::new()
+
+    try {
+        foreach ($Entry in @(Get-CIPPMailboxPermissionReport -TenantFilter $TenantFilter -ByUser | Where-Object { & $IsUser $_.User })) {
+            foreach ($Permission in @($Entry.Permissions)) {
+                $Target = if ($Permission.MailboxUPN) { $Permission.MailboxUPN } else { $Permission.Mailbox }
+                if (& $IsUser $Target) { continue }
+                $Row = & $Touch $Target
+                foreach ($Right in @(([string]$Permission.AccessRights) -split ',\s*' | Where-Object { $_ })) { $null = $Row.AccessRights.Add($Right) }
+                $null = $Row.Sources.Add('Permission cache')
+            }
+        }
+    } catch {
+        $Errors.Add("mailbox permission cache: $($_.Exception.Message)")
+    }
+    try {
+        foreach ($Entry in @(Get-CIPPCalendarPermissionReport -TenantFilter $TenantFilter -ByUser | Where-Object { & $IsUser $_.User })) {
+            foreach ($Permission in @($Entry.Permissions)) {
+                if (& $IsUser $Permission.CalendarUPN) { continue }
+                $Row = & $Touch $Permission.CalendarUPN
+                $null = $Row.AccessRights.Add("Calendar: $($Permission.AccessRights)")
+                $null = $Row.Sources.Add('Permission cache')
+            }
+        }
+    } catch {
+        $Errors.Add("calendar permission cache: $($_.Exception.Message)")
+    }
+
+    foreach ($Change in @($PermissionChanges | Where-Object { $_ -and (& $IsUser $_.Trustee) -and [string]$_.Operation -match '^(Add-|Update|AddFolder)' })) {
+        $Target = if ($Change.AuditData.MailboxOwnerUPN) { $Change.AuditData.MailboxOwnerUPN } else { $Change.ObjectId }
+        if (-not $Target -or (& $IsUser $Target)) { continue }
+        $Row = & $Touch $Target
+        foreach ($Right in @(@($Change.Permissions) -split ',\s*' | Where-Object { $_ })) { $null = $Row.AccessRights.Add([string]$Right) }
+        $null = $Row.Sources.Add('Granted in the window')
+        $Row.GrantedInWindow = $true
+    }
+
+    foreach ($Activity in @($MailActivity | Where-Object { $_ -and $_.MailboxOwner -and -not (& $IsUser $_.MailboxOwner) })) {
+        $Row = & $Touch $Activity.MailboxOwner
+        $Row.DelegateActivity = $Row.DelegateActivity + [int]$Activity.Count
+        $null = $Row.Sources.Add('Delegate activity')
+    }
+    foreach ($Item in @($AttackerMail | Where-Object { $_ -and $_.MailboxOwner -and -not (& $IsUser $_.MailboxOwner) })) {
+        $Row = & $Touch $Item.MailboxOwner
+        if ($Item.Operation -eq 'MailItemsAccessed' -and $Item.AccessType -eq 'Sync') { $Row.AttackerSynced++ }
+        elseif ($Item.Operation -eq 'MailItemsAccessed') { $Row.AttackerOpened++ }
+        elseif ($Item.Operation -in @('Send', 'SendAs', 'SendOnBehalf')) { $Row.AttackerSent++ }
+        if ($Item.When -and (-not $Row.LastAttackerActivity -or [string]$Item.When -gt $Row.LastAttackerActivity)) { $Row.LastAttackerActivity = [string]$Item.When }
+    }
+
+    $Rows = @($Mailboxes.Values | ForEach-Object {
+            [pscustomobject]@{
+                Mailbox              = $_.Mailbox
+                AccessRights         = @($_.AccessRights | Sort-Object) -join ', '
+                KnownFrom            = @($_.Sources | Sort-Object) -join ', '
+                GrantedInWindow      = $_.GrantedInWindow
+                DelegateActivity     = $_.DelegateActivity
+                AttackerOpened       = $_.AttackerOpened
+                AttackerSynced       = $_.AttackerSynced
+                AttackerSent         = $_.AttackerSent
+                LastAttackerActivity = $_.LastAttackerActivity
+                Flagged              = [bool]($_.AttackerOpened + $_.AttackerSynced + $_.AttackerSent -gt 0 -or $_.GrantedInWindow)
+            }
+        } | Sort-Object -Property @{ Expression = { $_.Flagged }; Descending = $true }, @{ Expression = { $_.AttackerOpened + $_.AttackerSynced + $_.AttackerSent }; Descending = $true }, Mailbox)
+    New-CIPPBecCollectorResult -Data $Rows -Error $(if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null })
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecDirectoryAudits.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecDirectoryAudits.ps1
new file mode 100644
index 0000000000000..7627a1bb60c84
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecDirectoryAudits.ps1
@@ -0,0 +1,90 @@
+function Get-CIPPBecDirectoryAudits {
+    <#
+    .SYNOPSIS
+        Collects the Entra directory-audit events that targeted, or were initiated by, the investigated user.
+    .DESCRIPTION
+        Queries auditLogs/directoryAudits twice in one batch - once with targetResources/any(id eq user)
+        and once with initiatedBy/user/id eq user (the two cannot be or-combined on this endpoint) -
+        de-duplicates on id and flags the activities that matter during a compromise investigation
+        (security-info registration, consent, service principals, device registration, password and
+        token events, role changes) from the heuristics file. Metadata only: the audit record's
+        activity name, actor, IP, targets and modified property names.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .PARAMETER Heuristics
+        The BEC heuristics object (directoryAudit.flaggedActivities).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)]$Heuristics
+    )
+
+    $SafeId = ConvertTo-CIPPODataFilterValue -Value $UserId -Type Guid
+    $Start = $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $Select = 'id,activityDateTime,activityDisplayName,category,result,resultReason,initiatedBy,targetResources,loggedByService'
+    $Requests = @(
+        @{ id = 'Target'; method = 'GET'; url = "auditLogs/directoryAudits?`$filter=activityDateTime ge $Start and targetResources/any(t:t/id eq '$SafeId')&`$top=999&`$select=$Select"; headers = @{ ConsistencyLevel = 'eventual' } }
+        @{ id = 'Actor'; method = 'GET'; url = "auditLogs/directoryAudits?`$filter=activityDateTime ge $Start and initiatedBy/user/id eq '$SafeId'&`$top=999&`$select=$Select"; headers = @{ ConsistencyLevel = 'eventual' } }
+    )
+    $Responses = New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter -asapp $true
+
+    $Flagged = @($Heuristics.directoryAudit.flaggedActivities)
+    $Errors = [System.Collections.Generic.List[string]]::new()
+    $Seen = [System.Collections.Generic.HashSet[string]]::new()
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    $Partial = [System.Collections.Generic.List[string]]::new()
+    foreach ($Direction in @('Target', 'Actor')) {
+        $Response = $Responses | Where-Object { $_.id -eq $Direction } | Select-Object -First 1
+        if (-not $Response) { $Errors.Add("$Direction query returned no response"); continue }
+        if ([int]$Response.status -ge 400) { $Errors.Add("$Direction query: $($Response.body.error.message ?? "status $($Response.status)")"); continue }
+        $Items = @($Response.body.value)
+        # The batch helper follows every nextLink; it flags the item when a continuation page failed.
+        if ($Response.PagingIncomplete) { $Partial.Add("$Direction query: $($Response.PagingError ?? 'a continuation page failed')") }
+        foreach ($Item in $Items) {
+            if (-not $Item.id -or -not $Seen.Add([string]$Item.id)) { continue }
+            $Actor = if ($Item.initiatedBy.user) { $Item.initiatedBy.user.userPrincipalName ?? $Item.initiatedBy.user.displayName ?? $Item.initiatedBy.user.id } elseif ($Item.initiatedBy.app) { $Item.initiatedBy.app.displayName ?? $Item.initiatedBy.app.appId } else { $null }
+            $ActorType = if ($Item.initiatedBy.user) { 'User' } elseif ($Item.initiatedBy.app) { 'Application' } else { 'Unknown' }
+            $Targets = @(foreach ($T in @($Item.targetResources)) { $T.userPrincipalName ?? $T.displayName ?? $T.id })
+            $Modified = @(foreach ($T in @($Item.targetResources)) {
+                    foreach ($P in @($T.modifiedProperties)) {
+                        if (-not $P.displayName) { continue }
+                        $NewValue = [string]$P.newValue
+                        if ($NewValue.Length -gt 200) { $NewValue = $NewValue.Substring(0, 200) + '...' }
+                        "$($P.displayName)=$NewValue"
+                    }
+                })
+            $Activity = [string]$Item.activityDisplayName
+            $IsFlagged = ($Activity -in $Flagged) -or ($Activity -like 'User registered*security info*') -or ($Activity -like '*Strong Authentication*')
+            $Rows.Add([pscustomobject]@{
+                    Id                  = $Item.id
+                    ActivityDateTime    = if ($Item.activityDateTime) { ([datetime]$Item.activityDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                    Activity            = $Activity
+                    Category            = $Item.category
+                    Service             = $Item.loggedByService
+                    Result              = $Item.result
+                    ResultReason        = $Item.resultReason
+                    InitiatedBy         = $Actor
+                    InitiatedByType     = $ActorType
+                    InitiatedById       = [string]($Item.initiatedBy.user.id ?? $Item.initiatedBy.app.appId ?? $Item.initiatedBy.app.servicePrincipalId)
+                    ClientIP            = ConvertTo-CIPPBecHostAddress -Address $Item.initiatedBy.user.ipAddress
+                    Targets             = ($Targets -join ', ')
+                    ModifiedProperties  = ($Modified -join '; ')
+                    Direction           = $Direction
+                    Flagged             = [bool]$IsFlagged
+                })
+        }
+    }
+
+    $Data = @($Rows | Sort-Object -Property @{ Expression = { $_.Flagged }; Descending = $true }, @{ Expression = { $_.ActivityDateTime }; Descending = $true })
+    $ErrorText = if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null }
+    return New-CIPPBecCollectorResult -Data $Data -Complete ($Partial.Count -eq 0 -and $Errors.Count -eq 0) -Cap ($(if ($Partial.Count -gt 0) { $Partial -join '; ' } else { $null })) -Error $ErrorText
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecErrorInfo.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecErrorInfo.ps1
new file mode 100644
index 0000000000000..e5a810710dc84
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecErrorInfo.ps1
@@ -0,0 +1,56 @@
+function Get-CIPPBecErrorInfo {
+    <#
+    .SYNOPSIS
+        Turns a raw collector error into a concise message and classifies known-benign conditions.
+    .DESCRIPTION
+        Collectors surface raw Exchange/Graph exception text (e.g. "Ex41BAF5|Microsoft.Exchange...
+        ManagementObjectNotFoundException|The specified mailbox ... doesn't exist."). This strips the
+        diagnostic prefix and support-reference noise for display, and recognises the conditions that
+        are not failures at all - the user has no mailbox, or the tenant has no Intune - returning
+        Skipped=$true with a plain-language Requirement so the UI shows "not checked", never a failure
+        and never a pass. Anything it does not recognise comes back as a cleaned failure message.
+    .PARAMETER Message
+        The raw error text from a collector.
+    .OUTPUTS
+        [pscustomobject] { Message, Skipped, Requirement }
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param([string]$Message)
+
+    if ([string]::IsNullOrWhiteSpace($Message)) {
+        return [pscustomobject]@{ Message = $null; Skipped = $false; Requirement = $null }
+    }
+    $Raw = [string]$Message
+
+    # No mailbox / not a recipient: the mailbox checks do not apply to this user - it is not a failure.
+    if ($Raw -match "(?i)ManagementObjectNotFoundException|couldn't (find .+? as a recipient|be found as a recipient)|specified mailbox.+does(n't| not) exist|object '.+' couldn't be found on|Identity:.+couldn't be found") {
+        return [pscustomobject]@{
+            Message     = 'This user has no Exchange Online mailbox.'
+            Skipped     = $true
+            Requirement = 'this user has no Exchange Online mailbox'
+        }
+    }
+    # Intune not licensed: the device service rejects the tenant outright. A licence gap, not a failure.
+    if ($Raw -match '(?i)not applicable to (the )?target tenant') {
+        return [pscustomobject]@{
+            Message     = 'Intune is not licensed for this tenant.'
+            Skipped     = $true
+            Requirement = 'requires an Intune licence'
+        }
+    }
+    # Intune not provisioned (or a transient service 404): treat as not applicable, with a retry hint.
+    if ($Raw -match '(?i)Intune.+(HTTP 404|not.+provision|no.+Intune)') {
+        return [pscustomobject]@{
+            Message     = "Intune isn't provisioned for this tenant (or a transient service error - rerun to retry)."
+            Skipped     = $true
+            Requirement = 'Intune, which is not provisioned for this tenant'
+        }
+    }
+
+    # Otherwise a real failure: strip the Exchange "ExNNNN|Type|" prefix and any support-reference tail.
+    $Clean = if ($Raw -match '(?i)Ex[0-9A-F]{4,}\|[^|]*\|(.+)$') { $Matches[1] } else { $Raw }
+    $Clean = ($Clean -replace '(?i)\s*Microsoft support reference.*$', '').Trim()
+    return [pscustomobject]@{ Message = $Clean; Skipped = $false; Requirement = $null }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1
new file mode 100644
index 0000000000000..b7728b4b6c953
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1
@@ -0,0 +1,27 @@
+function Get-CIPPBecHeuristics {
+    <#
+    .SYNOPSIS
+        Loads the BEC detection heuristics from Config\BecHeuristics.json.
+    .DESCRIPTION
+        Returns the parsed heuristics object (regexes, thresholds, caps and score weights) used by the
+        BEC collectors and the server-side threat score. The delegated permission names from
+        Config\RiskyPermissions.json are merged into riskyScopes.catalogNames so a grant is flagged by
+        the curated catalog as well as by the regex. Read once per run.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    $Heuristics = [System.IO.File]::ReadAllText((Join-Path $env:CIPPRootPath 'Config\BecHeuristics.json')) | ConvertFrom-Json -ErrorAction Stop
+
+    $CatalogNames = try {
+        $RiskyPermissions = [System.IO.File]::ReadAllText((Join-Path $env:CIPPRootPath 'Config\RiskyPermissions.json')) | ConvertFrom-Json -ErrorAction Stop
+        @($RiskyPermissions | Where-Object { $_.type -eq 'Delegated' -and $_.name } | ForEach-Object { $_.name } | Select-Object -Unique)
+    } catch {
+        Write-Information "BEC heuristics: could not merge RiskyPermissions.json: $($_.Exception.Message)"
+        @()
+    }
+    $Heuristics.riskyScopes | Add-Member -NotePropertyName 'catalogNames' -NotePropertyValue $CatalogNames -Force
+    return $Heuristics
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPGuidance.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPGuidance.ps1
new file mode 100644
index 0000000000000..032efa75f0fdf
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPGuidance.ps1
@@ -0,0 +1,78 @@
+function Get-CIPPBecIPGuidance {
+    <#
+    .SYNOPSIS
+        Collects the address lists that tell the BEC investigation which IPs are known good or bad.
+    .DESCRIPTION
+        One entry per address or CIDR range: { Range, Prefix, Verdict (Trusted|Blocked), Strength
+        (List|Hint), Source, Scope, Note }.
+        - List (decides the verdict): CIPP's IP allow/block list for this tenant and AllTenants, where the
+          most specific range wins and a tenant entry beats an AllTenants one (Resolve-CIPPIPAllowBlockList).
+        - Hint (moves the score only): Conditional Access named locations marked trusted, and the
+          Exchange tenant allow/block list and connection-filter IP lists. The Exchange lists describe
+          sending mail servers rather than sign-ins, so they nudge rather than decide; hyphenated
+          ranges in the connection filter are skipped.
+        Each source degrades on its own: a failure is reported in the result's Error and the other
+        sources still count.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER Anchor
+        Anchor mailbox for the Exchange requests.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$Anchor
+    )
+
+    $Entries = [System.Collections.Generic.List[object]]::new()
+    $Errors = [System.Collections.Generic.List[string]]::new()
+    $AddEntry = {
+        param($Value, $Verdict, $Strength, $Source, $Scope, $Note)
+        $Range = try { ConvertTo-CIPPIPRange -Value ([string]$Value) } catch { $null }
+        if (-not $Range) { return }
+        $Prefix = if ($Range -match '/(\d+)$') { [int]$Matches[1] } elseif ($Range -match ':') { 128 } else { 32 }
+        $Entries.Add([pscustomobject]@{ Range = $Range; Prefix = $Prefix; Verdict = $Verdict; Strength = $Strength; Source = $Source; Scope = $Scope; Note = [string]$Note })
+    }
+
+    try {
+        foreach ($Entry in @(Get-CIPPIPAllowBlockList -TenantFilter $TenantFilter)) {
+            & $AddEntry $Entry.Range $Entry.State 'List' $(if ($Entry.Scope -eq 'AllTenants') { 'CIPP IP list (all tenants)' } else { 'CIPP IP list (this tenant)' }) $Entry.Scope $Entry.Note
+        }
+    } catch {
+        $Errors.Add("CIPP IP list: $($_.Exception.Message)")
+    }
+
+    try {
+        $Locations = @(New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/namedLocations?$top=999' -tenantid $TenantFilter -AsApp $true)
+        foreach ($Location in @($Locations | Where-Object { $_.'@odata.type' -eq '#microsoft.graph.ipNamedLocation' -and $_.isTrusted -eq $true })) {
+            foreach ($IpRange in @($Location.ipRanges)) { & $AddEntry $IpRange.cidrAddress 'Trusted' 'Hint' "Trusted named location '$($Location.displayName)'" 'Tenant' $null }
+        }
+    } catch {
+        $Errors.Add("named locations: $((Get-NormalizedError -message $_.Exception.Message))")
+    }
+
+    try {
+        foreach ($Item in @(Get-CIPPTenantAllowBlockListItems -TenantFilter $TenantFilter -ListType 'IP')) {
+            $Verdict = if ([string]$Item.Action -eq 'Block') { 'Blocked' } else { 'Trusted' }
+            & $AddEntry $Item.Value $Verdict 'Hint' "Tenant allow/block list ($($Item.Action))" 'Tenant' $Item.Notes
+        }
+    } catch {
+        $Errors.Add("tenant allow/block list: $((Get-NormalizedError -message $_.Exception.Message))")
+    }
+
+    try {
+        $ExoParams = @{ tenantid = $TenantFilter; cmdlet = 'Get-HostedConnectionFilterPolicy' }
+        if ($Anchor) { $ExoParams.Anchor = $Anchor }
+        foreach ($Policy in @(New-ExoRequest @ExoParams)) {
+            foreach ($Value in @($Policy.IPAllowList)) { & $AddEntry $Value 'Trusted' 'Hint' "Connection filter allow list ($($Policy.Name))" 'Tenant' $null }
+            foreach ($Value in @($Policy.IPBlockList)) { & $AddEntry $Value 'Blocked' 'Hint' "Connection filter block list ($($Policy.Name))" 'Tenant' $null }
+        }
+    } catch {
+        $Errors.Add("connection filter: $((Get-NormalizedError -message $_.Exception.Message))")
+    }
+
+    $ErrorText = if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null }
+    return New-CIPPBecCollectorResult -Data @($Entries) -Error $ErrorText
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPPeers.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPPeers.ps1
new file mode 100644
index 0000000000000..1403c741afa15
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPPeers.ps1
@@ -0,0 +1,92 @@
+function Get-CIPPBecIPPeers {
+    <#
+    .SYNOPSIS
+        Finds the other accounts in the tenant that signed in from each address.
+    .DESCRIPTION
+        For each IP, one Graph batch reads the tenant's interactive sign-ins from it (paged to the end)
+        and the first page of non-interactive ones (an office egress address can carry tens of
+        thousands of token refreshes; the first 999 already show whether colleagues use it). It
+        answers two opposite questions:
+        - Many colleagues on the address before the window: an office or VPN exit - evidence the user's.
+        - Other accounts on it only during the window, with no history: the attacker reaching further.
+        Returns a hashtable keyed by IP: { IP, OtherUsers, OtherUsersBefore, OtherUsersInWindowOnly,
+        Users[], Accounts[], Sampled, Error }. Accounts carries, per other account, its successful and
+        failed sign-ins and first/last seen (the blast radius of an attacker address). The investigated
+        user is excluded from every count.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The investigated user's object id (excluded from the counts).
+    .PARAMETER IPs
+        The addresses to look up (host form, no port).
+    .PARAMETER StartDate
+        How far back to look (UTC) - the baseline start.
+    .PARAMETER WindowStart
+        The start of the investigation window (UTC), which splits "before" from "in window".
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [string[]]$IPs = @(),
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$WindowStart
+    )
+
+    $Result = @{}
+    $Targets = @($IPs | Where-Object { $_ } | Select-Object -Unique)
+    if ($Targets.Count -eq 0) { return $Result }
+
+    $From = $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $Select = 'userId,userPrincipalName,createdDateTime,status'
+    $Requests = [System.Collections.Generic.List[object]]::new()
+    $NoPaginate = [System.Collections.Generic.List[string]]::new()
+    for ($i = 0; $i -lt $Targets.Count; $i++) {
+        $SafeIp = ConvertTo-CIPPODataFilterValue -Value ([string]$Targets[$i]) -Type String
+        $Filter = "ipAddress eq '$SafeIp' and createdDateTime ge $From"
+        $Requests.Add(@{ id = "i$i"; method = 'GET'; url = "auditLogs/signIns?`$filter=$Filter&`$top=999&`$select=$Select" })
+        $Requests.Add(@{ id = "n$i"; method = 'GET'; url = "auditLogs/signIns?`$filter=$Filter and signInEventTypes/any(t: t eq 'nonInteractiveUser')&`$top=999&`$select=$Select" })
+        $NoPaginate.Add("n$i")
+    }
+    $Responses = @(New-GraphBulkRequest -Requests @($Requests) -tenantid $TenantFilter -asapp $true -Version 'beta' -NoPaginateIds @($NoPaginate))
+
+    $Window = $WindowStart.ToUniversalTime()
+    for ($i = 0; $i -lt $Targets.Count; $i++) {
+        $IP = [string]$Targets[$i]
+        $Parts = @($Responses | Where-Object { $_.id -in @("i$i", "n$i") })
+        $Failed = @($Parts | Where-Object { [int]$_.status -ge 400 })
+        $Before = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        $During = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        $Accounts = @{}
+        foreach ($SignIn in @($Parts | Where-Object { [int]$_.status -lt 400 } | ForEach-Object { $_.body.value })) {
+            if (-not $SignIn -or -not $SignIn.userId -or $SignIn.userId -eq $UserId) { continue }
+            $Who = if ($SignIn.userPrincipalName) { [string]$SignIn.userPrincipalName } else { [string]$SignIn.userId }
+            $When = try { ([datetime]$SignIn.createdDateTime).ToUniversalTime() } catch { $null }
+            if ($When -and $When -lt $Window) { $null = $Before.Add($Who) } else { $null = $During.Add($Who) }
+            $Key = $Who.ToLowerInvariant()
+            if (-not $Accounts.ContainsKey($Key)) { $Accounts[$Key] = [pscustomobject]@{ UserPrincipalName = $Who; UserId = [string]$SignIn.userId; Successful = 0; Failed = 0; FirstSeen = $null; LastSeen = $null } }
+            $Account = $Accounts[$Key]
+            if ([int]$SignIn.status.errorCode -eq 0) { $Account.Successful++ } else { $Account.Failed++ }
+            if ($When) {
+                $Stamp = $When.ToString('yyyy-MM-ddTHH:mm:ssZ')
+                if (-not $Account.FirstSeen -or $Stamp -lt $Account.FirstSeen) { $Account.FirstSeen = $Stamp }
+                if (-not $Account.LastSeen -or $Stamp -gt $Account.LastSeen) { $Account.LastSeen = $Stamp }
+            }
+        }
+        $All = @(@($Before) + @($During) | Select-Object -Unique)
+        $Result[$IP] = [pscustomobject]@{
+            IP                     = $IP
+            OtherUsers             = $All.Count
+            OtherUsersBefore       = $Before.Count
+            OtherUsersInWindowOnly = @($During | Where-Object { -not $Before.Contains($_) }).Count
+            Users                  = @($All | Sort-Object)
+            # ponytail: capped at 100 per address (an office exit can carry hundreds); the counts above stay exact
+            Accounts               = @($Accounts.Values | Sort-Object -Property LastSeen -Descending | Select-Object -First 100)
+            Sampled                = [bool](@($Parts | Where-Object { $_.id -eq "n$i" -and $_.body.'@odata.nextLink' }).Count)
+            Error                  = if ($Failed.Count -gt 0) { [string]$Failed[0].body.error.message } else { $null }
+        }
+    }
+    return $Result
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPVerdicts.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPVerdicts.ps1
new file mode 100644
index 0000000000000..9a953423fa579
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecIPVerdicts.ps1
@@ -0,0 +1,325 @@
+function Get-CIPPBecIPVerdicts {
+    <#
+    .SYNOPSIS
+        Decides, per IP address, whether the investigated account's activity came from the attacker or the user.
+    .DESCRIPTION
+        Pure function over what the run already collected. Every address seen in the window's sign-ins
+        or on an audited action gets a verdict, a score and the reasons behind it:
+        - Compromised / Safe: an investigator override for this case, else CIPP's IP allow/block list
+          (Blocked / Trusted). These decide outright.
+        - Service: a Microsoft network address the user never signed in from (Exchange and other
+          services act from their own addresses), one whose sign-ins are all by a service
+          application (CIPP's own, or Microsoft's Partner Customer Delegated Administration - see
+          ipVerdict.serviceAppIds), or one seen only on CIPP or partner actions. An
+          address the user signed in from is scored normally even on Microsoft's network - attackers
+          rent Azure machines.
+        - LikelyAttacker / Suspicious / Unknown / LikelyUser: the heuristic score against the
+          ipVerdict thresholds.
+        Heuristics (weights in BecHeuristics.json ipVerdict.weights) raise the score for an address
+        behind a flagged action, a hosting or proxy network, a foreign location, one new to the user's
+        sign-in baseline, a risky sign-in, a scripted client, or other accounts appearing on it only
+        during the window; they lower it for an address, network or location the user regularly used
+        before the window, a compliant device, colleagues on it before the window, a trusted named
+        location, the address of a technician who ran or reviewed the investigation (most likely the
+        partner's own, so a strong start towards trusted - but still judged, since a technician's
+        address can be shared or wrong), or an address with only failed sign-ins (spray noise, which is also capped at
+        Suspicious). A final pass lifts addresses that share an Entra or mailbox session with a
+        likely-attacker address, because one session moving between addresses is one actor.
+    .PARAMETER SignIns
+        The window's interactive sign-ins (IPAddress, Status, Country, City, ASN, RiskLevelDuringSignIn,
+        UserAgent, DeviceCompliant, SessionId, CreatedDateTime).
+    .PARAMETER NonInteractiveSignIns
+        The window's non-interactive sign-ins, same shape.
+    .PARAMETER Events
+        Audited actions: { IP, Kind, Flagged, ActorKind, When, SessionIds } (ConvertTo-CIPPBecIPEvents).
+    .PARAMETER Baseline
+        The sign-in baseline profile (Get-CIPPBecSignInBaseline Data), or $null.
+    .PARAMETER Guidance
+        Address list entries (Get-CIPPBecIPGuidance Data).
+    .PARAMETER Overrides
+        This case's investigator overrides: { Range, Verdict (Safe|Compromised), Note }.
+    .PARAMETER Peers
+        Hashtable keyed by IP (Get-CIPPBecIPPeers).
+    .PARAMETER Geo
+        Hashtable keyed by IP: { CountryOrRegion, City, Proxy, Hosting, ASName }.
+    .PARAMETER UsageLocation
+        The user's usage location (two-letter country).
+    .PARAMETER Heuristics
+        The BEC heuristics object (ipVerdict section).
+    .PARAMETER TechnicianIPs
+        Addresses of the technicians who ran or reviewed the case ({ IP, By }).
+    .PARAMETER CippAppId
+        The CIPP application id; sign-ins by it (and by ipVerdict.serviceAppIds) are service sign-ins.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [object[]]$SignIns = @(),
+        [object[]]$NonInteractiveSignIns = @(),
+        [object[]]$Events = @(),
+        $Baseline,
+        [object[]]$Guidance = @(),
+        [object[]]$Overrides = @(),
+        [hashtable]$Peers = @{},
+        [hashtable]$Geo = @{},
+        [string]$UsageLocation,
+        $Heuristics,
+        [object[]]$TechnicianIPs = @(),
+        [string]$CippAppId = $env:ApplicationID
+    )
+
+    $Cfg = $Heuristics.ipVerdict
+    $W = $Cfg.weights
+    $Weight = { param($Name, $Default) [int]($W.$Name ?? $Default) }
+    $LikelyAttackerAt = [int]($Cfg.thresholds.likelyAttacker ?? 6)
+    $SuspiciousAt = [int]($Cfg.thresholds.suspicious ?? 3)
+    $LikelyUserAt = [int]($Cfg.thresholds.likelyUser ?? -3)
+    $MinBaseline = [int]($Cfg.minBaselineSignIns ?? 10)
+    $RegularShare = [double]($Cfg.regularShare ?? 0.05)
+    $RegularDays = [int]($Cfg.regularDays ?? 3)
+    $KnownAsnShare = [double]($Cfg.knownAsnShare ?? 0.2)
+    $KnownLocationShare = [double]($Cfg.knownLocationShare ?? 0.1)
+    $ServiceAsn = [string]($Cfg.serviceAsnRegex ?? '(?i)microsoft')
+    $ScriptedAgent = [string]($Cfg.scriptedUserAgentRegex ?? '(?i)(python|axios|curl|okhttp|go-http-client|node-fetch|powershell|libwww|java/|httpclient|postman)')
+    $ServiceActors = @('CIPP', 'Partner', 'OtherPartner')
+    $ServiceApps = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($AppId in @(@($CippAppId) + @($Cfg.serviceAppIds.PSObject.Properties.Name) | Where-Object { $_ })) { $null = $ServiceApps.Add([string]$AppId) }
+
+    $HostOf = { param($Value) ConvertTo-CIPPBecHostAddress -Address ([string]$Value) }
+    $Truthy = { param($Value) $Value -eq $true -or [string]$Value -eq 'True' }
+
+    # --- gather everything known about each address ---
+    $IPs = [ordered]@{}
+    $Touch = {
+        param($IP)
+        if (-not $IPs.Contains($IP)) {
+            $IPs[$IP] = [pscustomobject]@{
+                IP = $IP; SignIns = 0; NonInteractive = 0; Successful = 0; Failed = 0; FirstSeen = $null; LastSeen = $null
+                Country = $null; City = $null; ASN = $null; Risk = 'none'; Scripted = $false; Compliant = $false
+                Kinds = [System.Collections.Generic.HashSet[string]]::new(); FlaggedKinds = [System.Collections.Generic.HashSet[string]]::new()
+                Events = 0; ActorKinds = [System.Collections.Generic.HashSet[string]]::new(); Sessions = [System.Collections.Generic.HashSet[string]]::new(); CippSignIns = 0
+            }
+        }
+        $IPs[$IP]
+    }
+    $Seen = {
+        param($Entry, $When)
+        $At = try { if ($When) { ([datetime]$When).ToUniversalTime() } else { $null } } catch { $null }
+        if (-not $At) { return }
+        if (-not $Entry.FirstSeen -or $At -lt $Entry.FirstSeen) { $Entry.FirstSeen = $At }
+        if (-not $Entry.LastSeen -or $At -gt $Entry.LastSeen) { $Entry.LastSeen = $At }
+    }
+    $RiskRank = @{ none = 0; hidden = 0; low = 1; medium = 2; high = 3 }
+    foreach ($Set in @(@{ Rows = $SignIns; Interactive = $true }, @{ Rows = $NonInteractiveSignIns; Interactive = $false })) {
+        foreach ($SignIn in @($Set.Rows | Where-Object { $_ })) {
+            $IP = & $HostOf $SignIn.IPAddress
+            if (-not $IP) { continue }
+            $Entry = & $Touch $IP
+            if ($Set.Interactive) { $Entry.SignIns++ } else { $Entry.NonInteractive++ }
+            if ($SignIn.AppId -and $ServiceApps.Contains([string]$SignIn.AppId)) { $Entry.CippSignIns++ }
+            if ($SignIn.Status -eq 'Success') { $Entry.Successful++ } else { $Entry.Failed++ }
+            & $Seen $Entry $SignIn.CreatedDateTime
+            if (-not $Entry.Country -and $SignIn.Country) { $Entry.Country = [string]$SignIn.Country; $Entry.City = [string]$SignIn.City }
+            if (-not $Entry.ASN -and $SignIn.ASN) { $Entry.ASN = [string]$SignIn.ASN }
+            $Level = ([string]$SignIn.RiskLevelDuringSignIn).ToLowerInvariant()
+            if ([int]($RiskRank[$Level] ?? 0) -gt [int]($RiskRank[$Entry.Risk] ?? 0)) { $Entry.Risk = $Level }
+            if ($SignIn.UserAgent -and [string]$SignIn.UserAgent -match $ScriptedAgent) { $Entry.Scripted = $true }
+            if (& $Truthy $SignIn.DeviceCompliant) { $Entry.Compliant = $true }
+            if ($SignIn.SessionId) { $null = $Entry.Sessions.Add("entra:$($SignIn.SessionId)") }
+        }
+    }
+    foreach ($Activity in @($Events | Where-Object { $_ })) {
+        $IP = & $HostOf $Activity.IP
+        if (-not $IP) { continue }
+        $Entry = & $Touch $IP
+        $Entry.Events++
+        if ($Activity.Kind) { $null = $Entry.Kinds.Add([string]$Activity.Kind) }
+        if ($Activity.Flagged -eq $true -and $Activity.Kind) { $null = $Entry.FlaggedKinds.Add([string]$Activity.Kind) }
+        $null = $Entry.ActorKinds.Add([string]($Activity.ActorKind ?? 'User'))
+        foreach ($Session in @($Activity.SessionIds | Where-Object { $_ })) { $null = $Entry.Sessions.Add("mailbox:$Session") }
+        & $Seen $Entry $Activity.When
+    }
+
+    # --- lookups ---
+    $BaselineOk = $Baseline -and [int]$Baseline.Successful -ge $MinBaseline
+    $BaselineIPs = @{}
+    foreach ($Row in @($Baseline.IPs | Where-Object { $_ })) { $BaselineIPs[[string]$Row.IP] = $Row }
+    $BaselineAsns = @{}
+    foreach ($Row in @($Baseline.ASNs | Where-Object { $_ })) { $BaselineAsns[[string]$Row.ASN] = $Row }
+    $BaselineCountries = @{}
+    $BaselinePlaces = @{}
+    foreach ($Row in @($Baseline.Locations | Where-Object { $_ })) {
+        $BaselineCountries[[string]$Row.Country] = [double]($BaselineCountries[[string]$Row.Country] ?? 0) + [double]$Row.Share
+        $BaselinePlaces["$($Row.Country)|$($Row.City)"] = $Row
+    }
+    $ListEntries = @($Guidance | Where-Object { $_ -and $_.Strength -eq 'List' } | ForEach-Object {
+            [pscustomobject]@{ Range = $_.Range; Prefix = $_.Prefix; State = $_.Verdict; Scope = $_.Scope; Source = $_.Source; Note = $_.Note }
+        })
+    $Hints = @($Guidance | Where-Object { $_ -and $_.Strength -eq 'Hint' })
+    $Technicians = @{}
+    foreach ($Tech in @($TechnicianIPs | Where-Object { $_ -and $_.IP })) {
+        $TechIP = & $HostOf $Tech.IP
+        if ($TechIP -and -not $Technicians.ContainsKey($TechIP)) { $Technicians[$TechIP] = $Tech }
+    }
+    $CaseEntries = @($Overrides | Where-Object { $_ -and $_.Range } | ForEach-Object {
+            $Range = try { ConvertTo-CIPPIPRange -Value ([string]$_.Range) } catch { $null }
+            if ($Range) {
+                $Prefix = if ($Range -match '/(\d+)$') { [int]$Matches[1] } elseif ($Range -match ':') { 128 } else { 32 }
+                [pscustomobject]@{ Range = $Range; Prefix = $Prefix; State = $(if ($_.Verdict -eq 'Compromised') { 'Blocked' } else { 'Trusted' }); Scope = 'Tenant'; Note = $_.Note }
+            }
+        })
+
+    # --- score ---
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    foreach ($Entry in $IPs.Values) {
+        $IP = $Entry.IP
+        $GeoInfo = $Geo[$IP]
+        $Country = if ($Entry.Country) { $Entry.Country } else { [string]$GeoInfo.CountryOrRegion }
+        if ($Country -eq 'Unknown') { $Country = $null }
+        $City = if ($Entry.City) { $Entry.City } else { [string]$GeoInfo.City }
+        $AsName = [string]$GeoInfo.ASName
+        $Hosting = & $Truthy $GeoInfo.Hosting
+        $Proxy = & $Truthy $GeoInfo.Proxy
+        $Peer = $Peers[$IP]
+        $Reasons = [System.Collections.Generic.List[object]]::new()
+        $Add = { param($Code, $Points, $Text) $Reasons.Add([pscustomobject]@{ Code = $Code; Weight = [int]$Points; Text = $Text }) }
+
+        $Flagged = @($Entry.FlaggedKinds)
+        if ($Flagged.Count -gt 0) {
+            & $Add 'FlaggedAction' ((& $Weight 'flaggedAction' 4) + (& $Weight 'flaggedActionExtraKind' 1) * ($Flagged.Count - 1)) "Behind flagged activity: $($Flagged -join ', ')"
+        }
+        # an address the user signed in from is scored even on Microsoft's network (attackers rent Azure
+        # machines); a Microsoft address with no sign-ins is classed as a service before the score counts
+        if ($Hosting -or $Proxy) {
+            & $Add 'HostingOrProxy' (& $Weight 'hostingOrProxy' 3) "$(if ($Proxy) { 'Proxy/VPN' } else { 'Hosting' }) network$(if ($AsName) { " ($AsName)" })"
+        }
+        if ($UsageLocation -and $Country -and $Country -ne $UsageLocation) {
+            & $Add 'Foreign' (& $Weight 'foreign' 2) "Outside the usage location ($Country, expected $UsageLocation)"
+        }
+        if ($Entry.Risk -in @('medium', 'high')) { & $Add 'RiskySignIn' (& $Weight 'riskySignIn' 3) "Entra rated a sign-in $($Entry.Risk) risk" }
+        elseif ($Entry.Risk -eq 'low') { & $Add 'RiskySignInLow' (& $Weight 'riskySignInLow' 1) 'Entra rated a sign-in low risk' }
+        if ($Entry.Scripted) { & $Add 'ScriptedClient' (& $Weight 'scriptedClient' 3) 'A sign-in used a scripting or automation user agent' }
+
+        $Known = $BaselineIPs[$IP]
+        if ($Known) {
+            if ([double]$Known.Share -ge $RegularShare -or [int]$Known.Days -ge $RegularDays) {
+                & $Add 'BaselineRegular' (& $Weight 'baselineRegular' -4) "The user's regular address before the window ($([math]::Round([double]$Known.Share * 100, 1))% of sign-ins, $($Known.Days) day(s))"
+            } else {
+                & $Add 'BaselineSeen' (& $Weight 'baselineSeen' -2) "Used by the user before the window ($($Known.SignIns) sign-in(s))"
+            }
+        } elseif ($BaselineOk) {
+            & $Add 'NewToUser' (& $Weight 'newToUser' 2) 'Never used by the user before the window'
+        }
+        if ($BaselineOk -and $Entry.ASN) {
+            $KnownAsn = $BaselineAsns[[string]$Entry.ASN]
+            if ($KnownAsn -and [double]$KnownAsn.Share -ge $KnownAsnShare) { & $Add 'KnownNetwork' (& $Weight 'knownNetwork' -1) "The user's usual network (AS$($Entry.ASN))" }
+            elseif (-not $KnownAsn -and -not $Known) { & $Add 'NewNetwork' (& $Weight 'newNetwork' 1) "A network (AS$($Entry.ASN)) the user never signed in from" }
+        }
+        if ($BaselineOk -and $Country) {
+            $Place = $BaselinePlaces["$Country|$City"]
+            if ($Place -and [double]$Place.Share -ge $KnownLocationShare) { & $Add 'KnownLocation' (& $Weight 'knownLocation' -1) "The user's usual location ($City, $Country)" }
+            elseif (-not $BaselineCountries.ContainsKey($Country) -and -not $Known) { & $Add 'NewLocation' (& $Weight 'newLocation' 1) "A country ($Country) the user never signed in from" }
+        }
+        if ($Entry.Compliant) { & $Add 'CompliantDevice' (& $Weight 'compliantDevice' -2) 'Signed in from a compliant device' }
+        if ($Peer) {
+            if ([int]$Peer.OtherUsersBefore -ge 2 -and -not ($Hosting -or $Proxy)) {
+                & $Add 'Colleagues' (& $Weight 'colleagues' -2) "$($Peer.OtherUsersBefore) other account(s) used it before the window (office or VPN exit)"
+            } elseif ([int]$Peer.OtherUsersInWindowOnly -ge 2 -and [int]$Peer.OtherUsersBefore -eq 0) {
+                & $Add 'WiderAttack' (& $Weight 'widerAttack' 2) "$($Peer.OtherUsersInWindowOnly) other account(s) signed in from it only during the window"
+            }
+        }
+        foreach ($Hint in @($Hints | Where-Object { Test-IpInRange -IPAddress $IP -Range $_.Range })) {
+            if ($Hint.Verdict -eq 'Trusted') {
+                $Points = if ($Hint.Source -like 'Trusted named location*') { & $Weight 'trustedNamedLocation' -4 } else { & $Weight 'allowListHint' -1 }
+                & $Add 'AllowHint' $Points $Hint.Source
+            } else {
+                & $Add 'BlockHint' (& $Weight 'blockListHint' 2) $Hint.Source
+            }
+        }
+        $Technician = $Technicians[$IP]
+        if ($Technician) { & $Add 'TechnicianAddress' (& $Weight 'technicianAddress' -4) "The address of the technician who ran or reviewed this case$(if ($Technician.By) { " ($($Technician.By))" }) - most likely the partner's" }
+        $OnlyFailed = ($Entry.SignIns + $Entry.NonInteractive) -gt 0 -and $Entry.Successful -eq 0 -and $Entry.Events -eq 0
+        if ($OnlyFailed) { & $Add 'OnlyFailed' (& $Weight 'onlyFailedSignIns' -3) 'Only failed sign-ins (password spray or lockout noise)' }
+
+        $Score = [int](($Reasons | Measure-Object -Property Weight -Sum).Sum)
+        $Rows.Add([pscustomobject]@{
+                IP = $IP; Entry = $Entry; Reasons = $Reasons; Score = $Score; OnlyFailed = $OnlyFailed
+                Country = $Country; City = $City; ASName = $AsName; Hosting = $Hosting; Proxy = $Proxy; Peer = $Peer
+            })
+    }
+
+    $Classify = {
+        param($Row)
+        $Case = Resolve-CIPPIPAllowBlockList -IPAddress $Row.IP -Entries $CaseEntries
+        if ($Case) {
+            return [pscustomobject]@{ Verdict = $(if ($Case.State -eq 'Blocked') { 'Compromised' } else { 'Safe' }); Source = "Investigator ($($Case.Range))$(if ($Case.Note) { ": $($Case.Note)" })" }
+        }
+        $Listed = Resolve-CIPPIPAllowBlockList -IPAddress $Row.IP -Entries $ListEntries
+        if ($Listed) {
+            return [pscustomobject]@{ Verdict = $(if ($Listed.State -eq 'Blocked') { 'Compromised' } else { 'Safe' }); Source = "$($Listed.Source) ($($Listed.Range))" }
+        }
+        $SignInCount = $Row.Entry.SignIns + $Row.Entry.NonInteractive
+        if ($SignInCount -eq 0 -and $Row.ASName -match $ServiceAsn) { return [pscustomobject]@{ Verdict = 'Service'; Source = "Microsoft service address ($($Row.ASName))" } }
+        $OnlyServiceActors = @($Row.Entry.ActorKinds | Where-Object { $_ -notin $ServiceActors }).Count -eq 0
+        if ($SignInCount -gt 0 -and $Row.Entry.CippSignIns -eq $SignInCount -and $OnlyServiceActors) {
+            return [pscustomobject]@{ Verdict = 'Service'; Source = 'Sign-ins only by CIPP or partner delegated administration, not by the user' }
+        }
+        if ($SignInCount -eq 0 -and $Row.Entry.ActorKinds.Count -gt 0 -and @($Row.Entry.ActorKinds | Where-Object { $_ -notin $ServiceActors }).Count -eq 0) {
+            return [pscustomobject]@{ Verdict = 'Service'; Source = 'Only CIPP or partner actions' }
+        }
+        $Verdict = if ($Row.Score -ge $LikelyAttackerAt) { 'LikelyAttacker' } elseif ($Row.Score -ge $SuspiciousAt) { 'Suspicious' } elseif ($Row.Score -le $LikelyUserAt) { 'LikelyUser' } else { 'Unknown' }
+        if ($Row.OnlyFailed -and $Verdict -eq 'LikelyAttacker') { $Verdict = 'Suspicious' }
+        return [pscustomobject]@{ Verdict = $Verdict; Source = 'Heuristics' }
+    }
+    foreach ($Row in $Rows) { $Row | Add-Member -NotePropertyName 'Decision' -NotePropertyValue (& $Classify $Row) -Force }
+
+    # One Entra or mailbox session moving between addresses is one actor: lift the rest of a session
+    # that includes a likely-attacker address.
+    $AttackerSessions = [System.Collections.Generic.HashSet[string]]::new()
+    foreach ($Row in @($Rows | Where-Object { $_.Decision.Verdict -in @('Compromised', 'LikelyAttacker') })) {
+        foreach ($Session in $Row.Entry.Sessions) { $null = $AttackerSessions.Add($Session) }
+    }
+    if ($AttackerSessions.Count -gt 0) {
+        foreach ($Row in @($Rows | Where-Object { $_.Decision.Verdict -in @('Suspicious', 'Unknown', 'LikelyUser') })) {
+            $Shared = @($Row.Entry.Sessions | Where-Object { $AttackerSessions.Contains($_) })
+            if ($Shared.Count -eq 0) { continue }
+            $Points = & $Weight 'sharedSession' 3
+            $Row.Reasons.Add([pscustomobject]@{ Code = 'SharedSession'; Weight = $Points; Text = "Shares a $(($Shared[0] -split ':')[0]) session with a likely-attacker address" })
+            $Row.Score = $Row.Score + $Points
+            $Row.Decision = & $Classify $Row
+        }
+    }
+
+    $Order = @{ Compromised = 0; LikelyAttacker = 1; Suspicious = 2; Unknown = 3; LikelyUser = 4; Safe = 5; Service = 6 }
+    @($Rows | ForEach-Object {
+            $Known = $BaselineIPs[$_.IP]
+            [pscustomobject]@{
+                IP                     = $_.IP
+                Verdict                = $_.Decision.Verdict
+                Score                  = $_.Score
+                Source                 = $_.Decision.Source
+                Reasons                = @($_.Reasons)
+                ReasonText             = @($_.Reasons | ForEach-Object { "$($_.Text) ($(if ($_.Weight -ge 0) { '+' })$($_.Weight))" }) -join '; '
+                Country                = $_.Country
+                City                   = $_.City
+                ASN                    = $_.Entry.ASN
+                ASName                 = $_.ASName
+                Hosting                = $_.Hosting
+                Proxy                  = $_.Proxy
+                SignIns                = $_.Entry.SignIns
+                NonInteractiveSignIns  = $_.Entry.NonInteractive
+                SuccessfulSignIns      = $_.Entry.Successful
+                FailedSignIns          = $_.Entry.Failed
+                Activities             = $_.Entry.Events
+                Kinds                  = @($_.Entry.Kinds | Sort-Object)
+                FirstSeen              = if ($_.Entry.FirstSeen) { $_.Entry.FirstSeen.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                LastSeen               = if ($_.Entry.LastSeen) { $_.Entry.LastSeen.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                BaselineShare          = if ($Known) { [double]$Known.Share } else { 0 }
+                BaselineSignIns        = if ($Known) { [int]$Known.SignIns } else { 0 }
+                OtherUsersBefore       = if ($_.Peer) { [int]$_.Peer.OtherUsersBefore } else { $null }
+                OtherUsersInWindowOnly = if ($_.Peer) { [int]$_.Peer.OtherUsersInWindowOnly } else { $null }
+                OtherUsers             = if ($_.Peer) { @($_.Peer.Users) } else { @() }
+            }
+        } | Sort-Object -Property @{ Expression = { $Order[$_.Verdict] } }, @{ Expression = { $_.Score }; Descending = $true })
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecMailActivity.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecMailActivity.ps1
new file mode 100644
index 0000000000000..0196d2a5fcc19
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecMailActivity.ps1
@@ -0,0 +1,146 @@
+function Get-CIPPBecMailActivity {
+    <#
+    .SYNOPSIS
+        Counts the investigated user's mailbox activity from the unified audit log, bucketed by client IP and application.
+    .DESCRIPTION
+        Answers "what did they read, delete and send, and from where" without storing a single item:
+        MailItemsAccessed, HardDelete, SoftDelete, MoveToDeletedItems and Send records attributed to the
+        user, plus tenant-wide SendAs/SendOnBehalf records whose mailbox owner is the user, are reduced
+        to counts per Operation x ClientIP x client application x access type with first/last seen
+        times. Aggregated MailItemsAccessed records contribute their OperationCount. No subjects,
+        folders or item ids are kept in the counts. MailItemsAccessed is part of Audit (Standard) for
+        E3/E5 licences; when the log does not carry it the other operations still count. Each row also
+        lists the mailbox SessionIds it saw (one session moving between addresses is one actor), and
+        the raw records ride along on the result (Records, not stored) so the attacker-activity pass
+        can take item-level detail for the attacker's addresses without searching again.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The investigated user.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .PARAMETER EndDate
+        Window end (UTC).
+    .PARAMETER Heuristics
+        The BEC heuristics object (mailActivity section, caps).
+    .PARAMETER Anchor
+        Anchor mailbox for the EXO requests.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate,
+        [Parameter(Mandatory = $true)]$Heuristics,
+        [string]$Anchor
+    )
+
+    $UserOps = @($Heuristics.mailActivity.userOperations)
+    $OwnerOps = @($Heuristics.mailActivity.mailboxOwnerOperations)
+    $MaxPages = [int]($Heuristics.caps.mailActivityPages ?? 10)
+    $HardDeleteThreshold = [int]($Heuristics.mailActivity.hardDeleteThreshold ?? 20)
+
+    $Groups = @{}
+    $AllRecords = [System.Collections.Generic.List[object]]::new()
+    $Errors = [System.Collections.Generic.List[string]]::new()
+    $Complete = $true
+    $Cap = $null
+    $RecordCount = 0
+
+    $Accumulate = {
+        param($Record)
+        $AD = $Record.AuditData
+        if (-not $AD) { return }
+        $Operation = [string]($AD.Operation ?? $Record.Operation)
+        $ClientIP = [string](ConvertTo-CIPPBecHostAddress -Address ($AD.ClientIP ?? $AD.ClientIPAddress))
+        $ClientInfo = [string]($AD.ClientInfoString ?? $AD.ClientAppId ?? $AD.ClientApplication)
+        if ($ClientInfo.Length -gt 120) { $ClientInfo = $ClientInfo.Substring(0, 120) + '...' }
+        # real records carry the access type in OperationProperties; older payloads had it at the top
+        $AccessType = [string]($AD.MailAccessType ?? (@($AD.OperationProperties) | Where-Object { $_.Name -eq 'MailAccessType' } | Select-Object -First 1).Value)
+        $Actor = [string]$AD.UserId
+        $Owner = [string]($AD.MailboxOwnerUPN ?? $Actor)
+        $Key = "$Operation|$ClientIP|$ClientInfo|$AccessType|$Actor|$Owner"
+        $Count = if ($AD.OperationCount) { [int]$AD.OperationCount } else { 1 }
+        $When = try { ([datetime]$AD.CreationTime).ToUniversalTime() } catch { $null }
+        if (-not $Groups.ContainsKey($Key)) {
+            $Groups[$Key] = [pscustomobject]@{
+                Operation        = $Operation
+                ClientIP         = $ClientIP
+                ClientInfoString = $ClientInfo
+                MailAccessType   = $AccessType
+                LogonType        = $AD.LogonType
+                Actor            = $Actor
+                MailboxOwner     = $Owner
+                Count            = 0
+                Records          = 0
+                FirstSeen        = $When
+                LastSeen         = $When
+                SessionIds       = [System.Collections.Generic.HashSet[string]]::new()
+            }
+        }
+        $Group = $Groups[$Key]
+        if ($AD.SessionId) { $null = $Group.SessionIds.Add([string]$AD.SessionId) }
+        $AllRecords.Add($Record)
+        $Group.Count = $Group.Count + $Count
+        $Group.Records = $Group.Records + 1
+        if ($When) {
+            if (-not $Group.FirstSeen -or $When -lt $Group.FirstSeen) { $Group.FirstSeen = $When }
+            if (-not $Group.LastSeen -or $When -gt $Group.LastSeen) { $Group.LastSeen = $When }
+        }
+    }
+
+    if ($UserOps.Count -gt 0) {
+        try {
+            $Search = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -Operations $UserOps -UserIds @($UserPrincipalName) -Anchor $Anchor -MaxPages $MaxPages
+            foreach ($Record in $Search.Records) { & $Accumulate $Record; $RecordCount++ }
+            if (-not $Search.Complete) { $Complete = $false; $Cap = $Search.Cap }
+        } catch {
+            $Errors.Add("user activity search: $((Get-NormalizedError -message $_.Exception.Message))")
+        }
+    }
+    if ($OwnerOps.Count -gt 0) {
+        try {
+            $Search = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -Operations $OwnerOps -Anchor $Anchor -MaxPages $MaxPages
+            foreach ($Record in $Search.Records) {
+                $AD = $Record.AuditData
+                if (-not $AD) { continue }
+                if ($AD.MailboxOwnerUPN -ne $UserPrincipalName -and $AD.UserId -ne $UserPrincipalName) { continue }
+                & $Accumulate $Record
+                $RecordCount++
+            }
+            if (-not $Search.Complete) { $Complete = $false; $Cap = $Search.Cap }
+        } catch {
+            $Errors.Add("send-as search: $((Get-NormalizedError -message $_.Exception.Message))")
+        }
+    }
+
+    $Rows = @($Groups.Values | ForEach-Object {
+            $_.FirstSeen = if ($_.FirstSeen) { $_.FirstSeen.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+            $_.LastSeen = if ($_.LastSeen) { $_.LastSeen.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+            $_.SessionIds = @($_.SessionIds)
+            $_
+        } | Sort-Object -Property Count -Descending)
+
+    $ByOperation = @{}
+    foreach ($Row in $Rows) { $ByOperation[$Row.Operation] = [int]($ByOperation[$Row.Operation] ?? 0) + $Row.Count }
+    $Summary = [pscustomobject]@{
+        Records                = $RecordCount
+        ByOperation            = [pscustomobject]$ByOperation
+        MailItemsAccessedCount = [int]($ByOperation['MailItemsAccessed'] ?? 0)
+        HardDeleteCount        = [int]($ByOperation['HardDelete'] ?? 0)
+        SoftDeleteCount        = [int]($ByOperation['SoftDelete'] ?? 0)
+        SendCount              = [int]($ByOperation['Send'] ?? 0)
+        HardDeleteThreshold    = $HardDeleteThreshold
+        HardDeleteExceeded     = ([int]($ByOperation['HardDelete'] ?? 0) -ge $HardDeleteThreshold)
+        DistinctClientIPs      = @($Rows.ClientIP | Where-Object { $_ } | Select-Object -Unique).Count
+        SendAsByOthersCount    = [int](@($Rows | Where-Object { $_.Operation -in $OwnerOps -and $_.MailboxOwner -eq $UserPrincipalName -and $_.Actor -ne $UserPrincipalName } | Measure-Object -Property Count -Sum).Sum)
+    }
+
+    $Result = New-CIPPBecCollectorResult -Data $Rows -Complete ($Complete -and $Errors.Count -eq 0) -Cap $Cap -Error ($(if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null })) -Count $Rows.Count
+    $Result | Add-Member -NotePropertyName 'Summary' -NotePropertyValue $Summary -Force
+    $Result | Add-Member -NotePropertyName 'Records' -NotePropertyValue $AllRecords.ToArray() -Force
+    return $Result
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecMailboxInventory.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecMailboxInventory.ps1
new file mode 100644
index 0000000000000..978c1946fafbd
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecMailboxInventory.ps1
@@ -0,0 +1,254 @@
+function Get-CIPPBecMailboxInventory {
+    <#
+    .SYNOPSIS
+        Collects the mailbox's current state, its delegation inventory and its add-ins for the BEC check.
+    .DESCRIPTION
+        Two Exchange bulk rounds. Round one reads the mailbox (forwarding, send-on-behalf, audit state),
+        the CAS mailbox (protocol flags), the auto-reply configuration (state, schedule and audience only
+        - the reply text itself is never stored), FullAccess and SendAs permissions, the Calendar and
+        Inbox folder ids (display names are locale-dependent) and the mailbox add-ins. Round two reads
+        the folder permissions for those folder ids and, for room/equipment mailboxes, the resource
+        delegates.
+
+        Every sub-request is stamped with an OperationGuid and validated individually: New-ExoBulkRequest
+        swallows transport failures, so a missing or errored part is reported as incomplete rather than
+        read as "no delegations".
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The investigated mailbox.
+    .PARAMETER Heuristics
+        The BEC heuristics object.
+    .PARAMETER AcceptedDomains
+        The tenant's accepted domains, used to mark external trustees.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [Parameter(Mandatory = $true)]$Heuristics,
+        [string[]]$AcceptedDomains = @()
+    )
+
+    $Upn = $UserPrincipalName
+    $LocalPart = ($Upn -split '@')[0]
+    $AcceptedSet = [System.Collections.Generic.HashSet[string]]::new([string[]]@($AcceptedDomains | Where-Object { $_ } | ForEach-Object { $_.ToLowerInvariant() }), [System.StringComparer]::OrdinalIgnoreCase)
+
+    $Round1 = @(
+        @{ CmdletInput = @{ CmdletName = 'Get-Mailbox'; Parameters = @{ Identity = $Upn } }; OperationGuid = 'Mailbox' }
+        @{ CmdletInput = @{ CmdletName = 'Get-CASMailbox'; Parameters = @{ Identity = $Upn } }; OperationGuid = 'CAS' }
+        @{ CmdletInput = @{ CmdletName = 'Get-MailboxAutoReplyConfiguration'; Parameters = @{ Identity = $Upn } }; OperationGuid = 'AutoReply' }
+        @{ CmdletInput = @{ CmdletName = 'Get-MailboxPermission'; Parameters = @{ Identity = $Upn } }; OperationGuid = 'MailboxPermission' }
+        @{ CmdletInput = @{ CmdletName = 'Get-RecipientPermission'; Parameters = @{ Identity = $Upn } }; OperationGuid = 'RecipientPermission' }
+        @{ CmdletInput = @{ CmdletName = 'Get-App'; Parameters = @{ Mailbox = $Upn } }; OperationGuid = 'Apps' }
+        foreach ($Scope in @($Heuristics.delegations.folderScopes)) {
+            @{ CmdletInput = @{ CmdletName = 'Get-MailboxFolderStatistics'; Parameters = @{ Identity = $Upn; FolderScope = $Scope } }; OperationGuid = "FolderStats-$Scope" }
+        }
+    )
+
+    $Bulk = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($Round1) -ReturnWithCommand $true -Anchor $Upn
+    if (-not $Bulk) { $Bulk = @{} }
+
+    # Pull one operation's rows out of the cmdlet-keyed bulk result; $null when the request never came back.
+    $GetOp = {
+        param($Cmdlet, $Guid)
+        $Rows = @($Bulk[$Cmdlet] | Where-Object { $_.OperationGuid -eq $Guid })
+        if ($Rows.Count -eq 0) { return $null }
+        if ($Rows[0].PSObject.Properties['error']) { throw [string]$Rows[0].error }
+        return @($Rows | Where-Object { -not $_.PSObject.Properties['Success'] -or $_.PSObject.Properties.Count -gt 2 })
+    }
+    $Errors = @{}
+    $Fetch = {
+        param($Name, $Cmdlet, $Guid)
+        try {
+            $Rows = & $GetOp $Cmdlet $Guid
+            if ($null -eq $Rows) { $Errors[$Name] = "$Cmdlet returned no response"; return @() }
+            return $Rows
+        } catch {
+            $Errors[$Name] = "$Cmdlet`: $($_.Exception.Message)"
+            return @()
+        }
+    }
+
+    $Mailbox = @(& $Fetch 'Mailbox' 'Get-Mailbox' 'Mailbox') | Select-Object -First 1
+    $Cas = @(& $Fetch 'CAS' 'Get-CASMailbox' 'CAS') | Select-Object -First 1
+    $AutoReply = @(& $Fetch 'AutoReply' 'Get-MailboxAutoReplyConfiguration' 'AutoReply') | Select-Object -First 1
+    $MailboxPermissions = @(& $Fetch 'MailboxPermission' 'Get-MailboxPermission' 'MailboxPermission')
+    $RecipientPermissions = @(& $Fetch 'RecipientPermission' 'Get-RecipientPermission' 'RecipientPermission')
+    $Apps = @(& $Fetch 'Apps' 'Get-App' 'Apps')
+    $Folders = @(foreach ($Scope in @($Heuristics.delegations.folderScopes)) {
+            @(& $Fetch "FolderStats-$Scope" 'Get-MailboxFolderStatistics' "FolderStats-$Scope") | Where-Object { $_.FolderType -eq $Scope -and $_.FolderId } | Select-Object -First 1
+        })
+
+    $IsResource = $Mailbox.RecipientTypeDetails -in @('RoomMailbox', 'EquipmentMailbox')
+    $Round2 = @(
+        foreach ($Folder in $Folders) {
+            @{ CmdletInput = @{ CmdletName = 'Get-MailboxFolderPermission'; Parameters = @{ Identity = "$($Upn):$($Folder.FolderId)" } }; OperationGuid = "FolderPermission-$($Folder.FolderType)" }
+        }
+        if ($IsResource) {
+            @{ CmdletInput = @{ CmdletName = 'Get-CalendarProcessing'; Parameters = @{ Identity = $Upn } }; OperationGuid = 'CalendarProcessing' }
+        }
+    )
+    $FolderPermissions = @{}
+    $ResourceDelegates = @()
+    if ($Round2.Count -gt 0) {
+        $Bulk = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($Round2) -ReturnWithCommand $true -Anchor $Upn
+        if (-not $Bulk) { $Bulk = @{} }
+        foreach ($Folder in $Folders) {
+            $FolderPermissions[$Folder.FolderType] = @(& $Fetch "FolderPermission-$($Folder.FolderType)" 'Get-MailboxFolderPermission' "FolderPermission-$($Folder.FolderType)")
+        }
+        if ($IsResource) {
+            $Processing = @(& $Fetch 'CalendarProcessing' 'Get-CalendarProcessing' 'CalendarProcessing') | Select-Object -First 1
+            $ResourceDelegates = @($Processing.ResourceDelegates | Where-Object { $_ })
+        }
+    }
+
+    # A trustee is flagged when it is a guest, an address outside the accepted domains, or a
+    # catch-all folder principal with more than availability rights.
+    $TrusteeFlag = {
+        param($Trustee)
+        $T = [string]$Trustee
+        if ([string]::IsNullOrWhiteSpace($T)) { return $false }
+        if ($T -match '#EXT#') { return $true }
+        if ($T -match '@') {
+            $Domain = ($T -split '@')[-1].Trim().ToLowerInvariant()
+            if ($AcceptedSet.Count -gt 0 -and -not $AcceptedSet.Contains($Domain)) { return $true }
+        }
+        return $false
+    }
+    $IsSelf = { param($Trustee) $T = [string]$Trustee; ($T -match 'NT AUTHORITY\\SELF') -or ($T -eq 'S-1-5-10') -or ($T -ieq $Upn) -or ($T -ieq $LocalPart) }
+
+    # Identity is what a removal needs to send back to Exchange: the mailbox for mailbox-level
+    # rights, and mailbox:<FolderId> for folder rights (folder display names are locale-dependent).
+    $Delegations = [System.Collections.Generic.List[object]]::new()
+    foreach ($Permission in $MailboxPermissions) {
+        if ($Permission.IsInherited -eq $true -or (& $IsSelf $Permission.User)) { continue }
+        $Delegations.Add([pscustomobject]@{
+                PermissionType = 'FullAccess'
+                Resource       = $Upn
+                Identity       = $Upn
+                Trustee        = [string]$Permission.User
+                AccessRights   = @($Permission.AccessRights) -join ', '
+                Deny           = ([string]$Permission.Deny -eq 'True')
+                Flagged        = (& $TrusteeFlag $Permission.User)
+            })
+    }
+    foreach ($Permission in $RecipientPermissions) {
+        if ($Permission.IsInherited -eq $true -or (& $IsSelf $Permission.Trustee)) { continue }
+        $Delegations.Add([pscustomobject]@{
+                PermissionType = 'SendAs'
+                Resource       = $Upn
+                Identity       = $Upn
+                Trustee        = [string]$Permission.Trustee
+                AccessRights   = @($Permission.AccessRights) -join ', '
+                Deny           = ($Permission.AccessControlType -eq 'Deny')
+                Flagged        = (& $TrusteeFlag $Permission.Trustee)
+            })
+    }
+    foreach ($Trustee in @($Mailbox.GrantSendOnBehalfTo | Where-Object { $_ })) {
+        $Delegations.Add([pscustomobject]@{
+                PermissionType = 'SendOnBehalf'
+                Resource       = $Upn
+                Identity       = $Upn
+                Trustee        = [string]$Trustee
+                AccessRights   = 'SendOnBehalf'
+                Deny           = $false
+                Flagged        = (& $TrusteeFlag $Trustee)
+            })
+    }
+    foreach ($FolderType in $FolderPermissions.Keys) {
+        $Folder = $Folders | Where-Object { $_.FolderType -eq $FolderType } | Select-Object -First 1
+        foreach ($Permission in $FolderPermissions[$FolderType]) {
+            $User = [string]($Permission.User.DisplayName ?? $Permission.User)
+            $Rights = @($Permission.AccessRights) -join ', '
+            $IsCatchAll = $User -in @('Default', 'Anonymous')
+            if ($IsCatchAll -and ($Rights -in @('None', 'AvailabilityOnly', 'LimitedDetails') -or [string]::IsNullOrWhiteSpace($Rights))) { continue }
+            if ((& $IsSelf $User)) { continue }
+            $Delegations.Add([pscustomobject]@{
+                    PermissionType = 'Folder'
+                    Resource       = "$Upn`:\$FolderType"
+                    Identity       = "$($Upn):$($Folder.FolderId)"
+                    Trustee        = $User
+                    AccessRights   = $Rights
+                    Deny           = $false
+                    Flagged        = ($IsCatchAll -or (& $TrusteeFlag $User) -or (& $TrusteeFlag $Permission.User.ADRecipient.PrimarySmtpAddress))
+                })
+        }
+    }
+    foreach ($Delegate in $ResourceDelegates) {
+        $Delegations.Add([pscustomobject]@{
+                PermissionType = 'ResourceDelegate'
+                Resource       = $Upn
+                Identity       = $Upn
+                Trustee        = [string]$Delegate
+                AccessRights   = 'ResourceDelegate'
+                Deny           = $false
+                Flagged        = (& $TrusteeFlag $Delegate)
+            })
+    }
+
+    $TrustedProvider = [string]$Heuristics.mailboxAddIns.trustedProviderRegex
+    $AddIns = @(foreach ($App in $Apps) {
+            if (-not $App.DisplayName -and -not $App.AppId) { continue }
+            $Provider = [string]$App.ProviderName
+            $UserScoped = -not ($App.Scope -eq 'Organization')
+            [pscustomobject]@{
+                Identity           = $App.Identity
+                DisplayName        = $App.DisplayName
+                AppId              = $App.AppId
+                Enabled            = ([string]$App.Enabled -eq 'True')
+                ProviderName       = $Provider
+                AppVersion         = $App.AppVersion
+                Type               = $App.Type
+                Scope              = $App.Scope
+                DefaultStateForUser = $App.DefaultStateForUser
+                MarketplaceAssetId = $App.MarketplaceAssetId
+                Flagged            = (([string]$App.Enabled -eq 'True') -and $UserScoped -and -not ($TrustedProvider -and $Provider -match $TrustedProvider))
+            }
+        })
+
+    $MailboxState = if ($Mailbox) {
+        [pscustomobject]@{
+            PrimarySmtpAddress            = $Mailbox.PrimarySmtpAddress
+            RecipientTypeDetails          = $Mailbox.RecipientTypeDetails
+            ExternalDirectoryObjectId     = $Mailbox.ExternalDirectoryObjectId
+            ForwardingAddress             = [string]$Mailbox.ForwardingAddress
+            ForwardingSmtpAddress         = [string]$Mailbox.ForwardingSmtpAddress
+            DeliverToMailboxAndForward    = ([string]$Mailbox.DeliverToMailboxAndForward -eq 'True')
+            HasForwarding                 = [bool]($Mailbox.ForwardingAddress -or $Mailbox.ForwardingSmtpAddress)
+            GrantSendOnBehalfTo           = @($Mailbox.GrantSendOnBehalfTo | Where-Object { $_ } | ForEach-Object { [string]$_ })
+            AuditEnabled                  = $Mailbox.AuditEnabled
+            LitigationHoldEnabled         = $Mailbox.LitigationHoldEnabled
+            HiddenFromAddressListsEnabled = $Mailbox.HiddenFromAddressListsEnabled
+            WhenMailboxCreated            = $Mailbox.WhenMailboxCreated
+            AutoReplyState                = $AutoReply.AutoReplyState
+            AutoReplyStartTime            = $AutoReply.StartTime
+            AutoReplyEndTime              = $AutoReply.EndTime
+            AutoReplyExternalAudience     = $AutoReply.ExternalAudience
+            AutoReplyHasInternalMessage   = -not [string]::IsNullOrWhiteSpace([string]$AutoReply.InternalMessage)
+            AutoReplyHasExternalMessage   = -not [string]::IsNullOrWhiteSpace([string]$AutoReply.ExternalMessage)
+            OWAEnabled                    = $Cas.OWAEnabled
+            ECPEnabled                    = $Cas.ECPEnabled
+            EWSEnabled                    = $Cas.EWSEnabled
+            IMAPEnabled                   = $Cas.IMAPEnabled
+            POPEnabled                    = $Cas.POPEnabled
+            MAPIEnabled                   = $Cas.MAPIEnabled
+            ActiveSyncEnabled             = $Cas.ActiveSyncEnabled
+            SmtpClientAuthenticationDisabled = $Cas.SmtpClientAuthenticationDisabled
+            ActiveSyncBlockedDeviceIDs    = @($Cas.ActiveSyncBlockedDeviceIDs | Where-Object { $_ })
+        }
+    } else { $null }
+
+    $StateErrors = @('Mailbox', 'CAS', 'AutoReply') | Where-Object { $Errors.ContainsKey($_) } | ForEach-Object { $Errors[$_] }
+    $DelegationErrorKeys = @('MailboxPermission', 'RecipientPermission', 'CalendarProcessing') + @($Errors.Keys | Where-Object { $_ -like 'FolderStats-*' -or $_ -like 'FolderPermission-*' })
+    $DelegationErrors = @($DelegationErrorKeys | Select-Object -Unique | Where-Object { $Errors.ContainsKey($_) } | ForEach-Object { $Errors[$_] })
+    $AddInErrors = @(if ($Errors.ContainsKey('Apps')) { $Errors['Apps'] })
+
+    return [pscustomobject]@{
+        MailboxState = New-CIPPBecCollectorResult -Data $MailboxState -Complete ($StateErrors.Count -eq 0 -and $null -ne $Mailbox) -Error ($(if ($StateErrors.Count -gt 0) { $StateErrors -join '; ' } elseif (-not $Mailbox) { 'Get-Mailbox returned no mailbox' } else { $null })) -Count ($(if ($Mailbox) { 1 } else { 0 }))
+        Delegations  = New-CIPPBecCollectorResult -Data @($Delegations | Sort-Object -Property @{ Expression = { $_.Flagged }; Descending = $true }, PermissionType, Trustee) -Complete ($DelegationErrors.Count -eq 0) -Error ($(if ($DelegationErrors.Count -gt 0) { $DelegationErrors -join '; ' } else { $null }))
+        AddIns       = New-CIPPBecCollectorResult -Data @($AddIns | Sort-Object -Property @{ Expression = { $_.Flagged }; Descending = $true }, DisplayName) -Complete ($AddInErrors.Count -eq 0) -Error ($(if ($AddInErrors.Count -gt 0) { $AddInErrors -join '; ' } else { $null }))
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1
new file mode 100644
index 0000000000000..3b06df8dd301b
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1
@@ -0,0 +1,98 @@
+function Get-CIPPBecMessageTrace {
+    <#
+    .SYNOPSIS
+        Walks Get-MessageTraceV2 pages for a sender or recipient with an explicit completeness marker.
+    .DESCRIPTION
+        Get-MessageTraceV2 returns at most ResultSize rows per call, newest first, and continues from a
+        cursor made of the last row's Received time (as the next EndDate) plus its RecipientAddress
+        (StartingRecipientAddress). This walker follows that cursor until a short page ends the window,
+        de-duplicates rows on trace id + recipient + received, stops when the cursor stalls, and reports
+        { Rows, Complete, Pages, Cap }. Only trace metadata is returned (sender, recipient, subject,
+        status, size, IPs, timestamps) - never message content.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER SenderAddress
+        Trace messages sent by this address.
+    .PARAMETER RecipientAddress
+        Trace messages delivered to this address.
+    .PARAMETER StartDate
+        Window start (UTC). Get-MessageTraceV2 accepts at most 10 days per query.
+    .PARAMETER EndDate
+        Window end (UTC).
+    .PARAMETER Anchor
+        Anchor mailbox for the EXO request.
+    .PARAMETER PageSize
+        Rows per page (max 5000).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$SenderAddress,
+        [string]$RecipientAddress,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate,
+        [string]$Anchor,
+        [ValidateRange(1, 5000)][int]$PageSize = 5000
+    )
+
+    if (-not $SenderAddress -and -not $RecipientAddress) {
+        throw 'Get-CIPPBecMessageTrace needs a SenderAddress or a RecipientAddress'
+    }
+
+    $TraceParams = @{
+        StartDate  = $StartDate.ToString('s')
+        EndDate    = $EndDate.ToString('s')
+        ResultSize = $PageSize
+    }
+    if ($SenderAddress) { $TraceParams.SenderAddress = $SenderAddress }
+    if ($RecipientAddress) { $TraceParams.RecipientAddress = $RecipientAddress }
+
+    $ExoParams = @{ tenantid = $TenantFilter; cmdlet = 'Get-MessageTraceV2' }
+    if ($Anchor) { $ExoParams.Anchor = $Anchor }
+
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    $Seen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    $Pages = 0
+    $Done = $false
+    $Stalled = $false
+    $PreviousCursor = $null
+    do {
+        $Pages++
+        $Batch = @(New-ExoRequest @ExoParams -cmdParams $TraceParams | Where-Object { $_ })
+        $NewCount = 0
+        foreach ($Row in $Batch) {
+            $Key = "$($Row.MessageTraceId)|$($Row.RecipientAddress)|$($Row.Received)"
+            if ($Seen.Add($Key)) {
+                $Rows.Add($Row)
+                $NewCount++
+            }
+        }
+        if ($Batch.Count -lt $PageSize) {
+            $Done = $true
+            break
+        }
+        # A full page with nothing new means the cursor is not advancing: stop, report partial.
+        if ($NewCount -eq 0) { $Stalled = $true; break }
+        $Last = $Batch[-1]
+        $LastReceived = try { ([datetime]$Last.Received).ToUniversalTime() } catch { $null }
+        if (-not $LastReceived -or -not $Last.RecipientAddress) {
+            # Without a usable cursor the walk cannot continue; report what we have as partial.
+            $Stalled = $true
+            break
+        }
+        $Cursor = "$($LastReceived.ToString('o'))|$($Last.RecipientAddress)"
+        if ($Cursor -eq $PreviousCursor) { $Stalled = $true; break }
+        $PreviousCursor = $Cursor
+        $TraceParams.EndDate = $LastReceived.ToString('s')
+        $TraceParams.StartingRecipientAddress = $Last.RecipientAddress
+    } while (-not $Done -and -not $Stalled)
+
+    return [pscustomobject]@{
+        Rows     = $Rows.ToArray()
+        Complete = [bool]$Done
+        Pages    = $Pages
+        Cap      = if ($Stalled) { 'paging stalled (cursor did not advance)' } else { $null }
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecNonInteractiveSignIns.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecNonInteractiveSignIns.ps1
new file mode 100644
index 0000000000000..cee091d5b24a1
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecNonInteractiveSignIns.ps1
@@ -0,0 +1,68 @@
+function Get-CIPPBecNonInteractiveSignIns {
+    <#
+    .SYNOPSIS
+        Collects the investigated user's non-interactive sign-ins inside the analysis window.
+    .DESCRIPTION
+        Token replay and adversary-in-the-middle sessions show up as non-interactive sign-ins (refresh
+        token use, background token acquisition) rather than in the interactive log. This reads the beta
+        signIns endpoint filtered on signInEventTypes nonInteractiveUser and the window start, pages to
+        the end, projects the same fields as the interactive list and marks each row as inside or
+        outside the user's assigned usage location.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id.
+    .PARAMETER UsageLocation
+        The user's Entra usage location (ISO country code) for the foreign-location comparison.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [string]$UsageLocation,
+        [Parameter(Mandatory = $true)][datetime]$StartDate
+    )
+
+    $SafeId = ConvertTo-CIPPODataFilterValue -Value $UserId -Type Guid
+    $Start = $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $Uri = "https://graph.microsoft.com/beta/auditLogs/signIns?`$filter=userId eq '$SafeId' and signInEventTypes/any(t: t eq 'nonInteractiveUser') and createdDateTime ge $Start&`$top=999&`$orderby=createdDateTime desc"
+    $SignIns = @(New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true)
+
+    $Rows = foreach ($SignIn in $SignIns) {
+        if (-not $SignIn.id) { continue }
+        $Country = $SignIn.location.countryOrRegion
+        $Foreign = if (-not $UsageLocation -or [string]::IsNullOrWhiteSpace($Country) -or $Country -eq 'Unknown') { $null } else { ($Country -ne $UsageLocation) }
+        [pscustomobject]@{
+            CreatedDateTime     = if ($SignIn.createdDateTime) { ([datetime]$SignIn.createdDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+            id                  = $SignIn.id
+            AppDisplayName      = $SignIn.appDisplayName
+            ResourceDisplayName = $SignIn.resourceDisplayName
+            ClientAppUsed       = $SignIn.clientAppUsed
+            Status              = if ($SignIn.conditionalAccessStatus -in @('success', 'notApplied') -and $SignIn.status.errorCode -eq 0) { 'Success' } else { 'Failed' }
+            ErrorCode           = $SignIn.status.errorCode
+            IPAddress           = $SignIn.ipAddress
+            Country             = $Country
+            City                = $SignIn.location.city
+            UserAgent           = $SignIn.userAgent
+            IncomingTokenType   = $SignIn.incomingTokenType
+            TokenProtection     = $SignIn.tokenProtectionStatusDetails.signInSessionStatus
+            RiskLevelDuringSignIn = $SignIn.riskLevelDuringSignIn
+            RiskEventTypes      = @($SignIn.riskEventTypes_v2)
+            ASN                 = $SignIn.autonomousSystemNumber
+            DeviceCompliant     = $SignIn.deviceDetail.isCompliant
+            DeviceManaged       = $SignIn.deviceDetail.isManaged
+            OperatingSystem     = $SignIn.deviceDetail.operatingSystem
+            # tie audited mailbox and file actions back to this token and session
+            SessionId           = $SignIn.sessionId
+            UniqueTokenId       = $SignIn.uniqueTokenIdentifier
+            AppId               = $SignIn.appId
+            ForeignLocation     = $Foreign
+        }
+    }
+    $Data = @($Rows)
+    return New-CIPPBecCollectorResult -Data $Data
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecReceivedMailFindings.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecReceivedMailFindings.ps1
new file mode 100644
index 0000000000000..fe77694f5700a
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecReceivedMailFindings.ps1
@@ -0,0 +1,184 @@
+function Get-CIPPBecReceivedMailFindings {
+    <#
+    .SYNOPSIS
+        Finds phishing-shaped mail the investigated user received, from message-trace and Defender metadata.
+    .DESCRIPTION
+        Walks the message trace for mail delivered to the user and applies two heuristics to the
+        metadata: named phishing-subject patterns (urgency, account verification, suspension, prizes,
+        invoices) and look-alike sender domains within Levenshtein distance 1-2 of one of the tenant's
+        accepted domains. Where Defender for Office 365 Plan 2 is licensed it also reads the
+        analysedEmails metadata for the recipient (sender, subject, verdict, delivery action) and keeps
+        the rows Defender classified as a threat. Nothing here touches message bodies or attachments;
+        every field comes from trace or analysis metadata.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The recipient.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .PARAMETER EndDate
+        Window end (UTC).
+    .PARAMETER Heuristics
+        The BEC heuristics object.
+    .PARAMETER AcceptedDomains
+        The tenant's accepted domains (protected domains for the typosquat check).
+    .PARAMETER Anchor
+        Anchor mailbox for the EXO requests.
+    .PARAMETER IncludeDefender
+        Also query Defender analysedEmails metadata.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate,
+        [Parameter(Mandatory = $true)]$Heuristics,
+        [string[]]$AcceptedDomains = @(),
+        [string]$Anchor,
+        [switch]$IncludeDefender
+    )
+
+    $MinDistance = [int]($Heuristics.typosquat.minDistance ?? 1)
+    $MaxDistance = [int]($Heuristics.typosquat.maxDistance ?? 2)
+    $Patterns = @{}
+    if ($Heuristics.phishingSubjectPatterns) {
+        foreach ($Property in $Heuristics.phishingSubjectPatterns.PSObject.Properties) { $Patterns[$Property.Name] = [string]$Property.Value }
+    }
+    $KeywordPattern = [string]$Heuristics.phishingKeywordPattern
+    $Accepted = @($AcceptedDomains | Where-Object { $_ } | ForEach-Object { $_.ToLowerInvariant() } | Select-Object -Unique)
+
+    # Every received message's subject by internet message id, so the attacker-activity pass can name
+    # the messages the attacker opened without tracing them again (kept in memory, not stored).
+    $MessageIndex = @{}
+    $Findings = try {
+        $Trace = Get-CIPPBecMessageTrace -TenantFilter $TenantFilter -RecipientAddress $UserPrincipalName -StartDate $StartDate -EndDate $EndDate -Anchor $Anchor
+        $Rows = @($Trace.Rows)
+        foreach ($Row in $Rows) { if ($Row.MessageId -and -not $MessageIndex.ContainsKey([string]$Row.MessageId)) { $MessageIndex[[string]$Row.MessageId] = [string]$Row.Subject } }
+
+        # Typosquat is a property of the sender domain, so evaluate each distinct domain once.
+        $DomainVerdicts = @{}
+        foreach ($Domain in @($Rows | ForEach-Object { ([string]$_.SenderAddress -split '@')[-1].Trim().ToLowerInvariant() } | Where-Object { $_ } | Select-Object -Unique)) {
+            if ($Domain -in $Accepted) { continue }
+            foreach ($Protected in $Accepted) {
+                $Distance = Get-CIPPLevenshteinDistance -Source $Domain -Target $Protected
+                if ($Distance -ge $MinDistance -and $Distance -le $MaxDistance) {
+                    $DomainVerdicts[$Domain] = [pscustomobject]@{ ComparedDomain = $Protected; Distance = $Distance }
+                    break
+                }
+            }
+        }
+
+        $Seen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        $List = [System.Collections.Generic.List[object]]::new()
+        $Add = {
+            param($Row, $Type, $Severity, $Reason, $Compared, $Distance)
+            $Key = "$Type|$($Row.MessageTraceId)|$($Row.SenderAddress)|$Reason"
+            if (-not $Seen.Add($Key)) { return }
+            $List.Add([pscustomobject]@{
+                    FindingType    = $Type
+                    Severity       = $Severity
+                    Reason         = $Reason
+                    ComparedDomain = $Compared
+                    Distance       = $Distance
+                    SenderAddress  = $Row.SenderAddress
+                    SenderDomain   = ([string]$Row.SenderAddress -split '@')[-1]
+                    Subject        = $Row.Subject
+                    Received       = if ($Row.Received) { try { ([datetime]$Row.Received).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } catch { [string]$Row.Received } } else { $null }
+                    Status         = $Row.Status
+                    Size           = $Row.Size
+                    FromIP         = $Row.FromIP
+                    MessageTraceId = $Row.MessageTraceId
+                })
+        }
+        foreach ($Row in $Rows) {
+            $Subject = [string]$Row.Subject
+            $Domain = ([string]$Row.SenderAddress -split '@')[-1].Trim().ToLowerInvariant()
+            if ($DomainVerdicts.ContainsKey($Domain)) {
+                & $Add $Row 'PossibleTyposquat' 'ReviewHigh' "Sender domain is $($DomainVerdicts[$Domain].Distance) edit(s) from $($DomainVerdicts[$Domain].ComparedDomain)" $DomainVerdicts[$Domain].ComparedDomain $DomainVerdicts[$Domain].Distance
+            }
+            foreach ($Name in $Patterns.Keys) {
+                if ($Patterns[$Name] -and $Subject -match $Patterns[$Name]) { & $Add $Row 'SubjectPattern' 'Review' $Name $null $null }
+            }
+            if ($KeywordPattern -and $Subject -match $KeywordPattern -and -not ($Patterns.Values | Where-Object { $_ -and $Subject -match $_ })) {
+                & $Add $Row 'SubjectKeyword' 'Low' 'Subject contains a common phishing keyword' $null $null
+            }
+        }
+
+        $Summary = [pscustomobject]@{
+            TotalMessages    = @($Rows.MessageTraceId | Select-Object -Unique).Count
+            TotalRows        = $Rows.Count
+            UniqueSenders    = @($Rows.SenderAddress | Where-Object { $_ } | Select-Object -Unique).Count
+            TopSenderDomains = @($Rows | Where-Object { $_.SenderAddress } | Group-Object -Property { ([string]$_.SenderAddress -split '@')[-1].ToLowerInvariant() } | Sort-Object -Property Count -Descending | Select-Object -First 10 | ForEach-Object { [pscustomobject]@{ Domain = $_.Name; Count = $_.Count } })
+            TyposquatDomains = @($DomainVerdicts.Keys)
+        }
+        $Result = New-CIPPBecCollectorResult -Data @($List | Sort-Object -Property @{ Expression = { $_.Severity -eq 'ReviewHigh' }; Descending = $true }, @{ Expression = { $_.Received }; Descending = $true }) -Complete $Trace.Complete -Cap $Trace.Cap
+        $Result | Add-Member -NotePropertyName 'Summary' -NotePropertyValue $Summary -Force
+        $Result
+    } catch {
+        $Result = New-CIPPBecCollectorResult -Data @() -Error "Received message trace failed: $((Get-NormalizedError -message $_.Exception.Message))"
+        $Result | Add-Member -NotePropertyName 'Summary' -NotePropertyValue $null -Force
+        $Result
+    }
+
+    $Defender = if ($IncludeDefender) {
+        try {
+            $Now = (Get-Date).ToUniversalTime()
+            $End = if ($EndDate.ToUniversalTime() -gt $Now) { $Now } else { $EndDate.ToUniversalTime() }
+            # The service rejects $filter on recipientEmailAddress ("Invalid filter with propName"), so the whole
+            # window is read tenant-wide (metadata only) and matched to the mailbox here. The pages are streamed
+            # through the match, so only this mailbox's rows are ever held however busy the tenant is.
+            $Uri = "https://graph.microsoft.com/beta/security/collaboration/analyzedEmails?startTime=$($StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ'))&endTime=$($End.ToString('yyyy-MM-ddTHH:mm:ssZ'))&`$top=1000"
+            $Analyzed = @(New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true -Stream | Where-Object { $_ -and ([string]$_.recipientEmailAddress -eq $UserPrincipalName -or (@($_.recipientDetail.ccRecipients) -contains $UserPrincipalName)) })
+            $Threats = foreach ($Mail in $Analyzed) {
+                $ThreatTypes = @($Mail.threatTypes | Where-Object { $_ -and $_ -notin @('none', 'unknown', 'unknownFutureValue') })
+                if ($ThreatTypes.Count -eq 0) { continue }
+                $Action = [string]($Mail.latestDelivery.action ?? $Mail.deliveryAction)
+                $LatestLocation = [string]($Mail.latestDelivery.location ?? $Mail.latestDeliveryLocation)
+                [pscustomobject]@{
+                    NetworkMessageId         = $Mail.networkMessageId
+                    ReceivedDateTime         = $Mail.loggedDateTime ?? $Mail.receivedDateTime
+                    SenderAddress            = $Mail.senderDetail.fromAddress ?? $Mail.senderDetail.mailFromAddress ?? $Mail.p2Sender ?? $Mail.p1Sender
+                    SenderIP                 = $Mail.senderDetail.ipv4 ?? $Mail.senderDetail.ipv6 ?? $Mail.senderDetail.senderIPv4 ?? $Mail.senderDetail.senderIPv6
+                    Subject                  = $Mail.subject
+                    ThreatTypes              = $ThreatTypes
+                    DetectionMethods         = @($Mail.detectionMethods ?? $Mail.threatDetectionDetails)
+                    DeliveryAction           = $Action
+                    OriginalDeliveryLocation = $Mail.originalDelivery.location ?? $Mail.originalDeliveryLocation
+                    LatestDeliveryLocation   = $LatestLocation
+                    PhishConfidenceLevel     = $Mail.phishConfidenceLevel
+                    Delivered                = ($Action -match '^(delivered|deliveredAsSpam|replaced|deliveredToJunk)$' -or $LatestLocation -match '^(inbox|junkFolder|folder)')
+                }
+            }
+            $Result = New-CIPPBecCollectorResult -Data @($Threats | Sort-Object -Property @{ Expression = { $_.Delivered }; Descending = $true }, @{ Expression = { $_.ReceivedDateTime }; Descending = $true })
+            $Result | Add-Member -NotePropertyName 'AnalyzedCount' -NotePropertyValue $Analyzed.Count -Force
+            $Result | Add-Member -NotePropertyName 'Available' -NotePropertyValue $true -Force
+            $Result
+        } catch {
+            $Message = [string](Get-NormalizedError -message $_.Exception.Message)
+            $IsPermission = [bool]($Message -match '(?i)Authorization_RequestDenied|forbidden|insufficient privileges|do(es)? not have permission|Access(Is)?Denied')
+            $IsLicense = [bool]($Message -match '(?i)subscription|licen[cs]e|not enabled|Defender')
+            # A missing licence or permission is a skipped check (couldn't run), not a failure.
+            $Requirement = if ($IsLicense) { 'requires Defender for Office 365 Plan 2' } elseif ($IsPermission) { 'requires the Defender threat-hunting read permission' } else { $null }
+            $Result = New-CIPPBecCollectorResult -Data @() -Error "Defender analysed-email metadata unavailable: $Message" -Skipped ([bool]($IsLicense -or $IsPermission)) -Requirement $Requirement
+            $Result | Add-Member -NotePropertyName 'Available' -NotePropertyValue $false -Force
+            $Result | Add-Member -NotePropertyName 'PermissionError' -NotePropertyValue $IsPermission -Force
+            $Result | Add-Member -NotePropertyName 'LicenseError' -NotePropertyValue $IsLicense -Force
+            $Result
+        }
+    } else {
+        # Defender was not queried (the run's licence preflight found no Defender for Office 365 Plan 2):
+        # a skipped check, not a clean pass.
+        $Result = New-CIPPBecCollectorResult -Data @() -Skipped $true -Requirement 'requires Defender for Office 365 Plan 2'
+        $Result | Add-Member -NotePropertyName 'Available' -NotePropertyValue $false -Force
+        $Result
+    }
+
+    return [pscustomobject]@{
+        Findings     = $Findings
+        Defender     = $Defender
+        MessageIndex = $MessageIndex
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecRegisteredDevices.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRegisteredDevices.ps1
new file mode 100644
index 0000000000000..478474077ab18
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRegisteredDevices.ps1
@@ -0,0 +1,53 @@
+function Get-CIPPBecRegisteredDevices {
+    <#
+    .SYNOPSIS
+        Collects the Entra devices registered to the investigated user and flags registrations inside the window.
+    .DESCRIPTION
+        Reads users/{id}/registeredDevices. A device registered during the analysis window is a classic
+        persistence move (a VM or BYOD endpoint standing up under the identity, often followed by
+        Windows Hello for Business enrolment), so those rows are flagged and sorted first. Intune
+        managed devices are collected separately by the Quick scope.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [Parameter(Mandatory = $true)][datetime]$StartDate
+    )
+
+    $Uri = "https://graph.microsoft.com/v1.0/users/$UserId/registeredDevices/microsoft.graph.device?`$select=id,deviceId,displayName,operatingSystem,operatingSystemVersion,trustType,registrationDateTime,approximateLastSignInDateTime,accountEnabled,isCompliant,isManaged,profileType,enrollmentType,manufacturer,model"
+    $Devices = @(New-GraphGetRequest -uri $Uri -tenantid $TenantFilter -AsApp $true)
+    $Window = $StartDate.ToUniversalTime()
+    $Rows = foreach ($Device in $Devices) {
+        if (-not $Device.id) { continue }
+        $Registered = if ($Device.registrationDateTime) { ([datetime]$Device.registrationDateTime).ToUniversalTime() } else { $null }
+        [pscustomobject]@{
+            id                            = $Device.id
+            deviceId                      = $Device.deviceId
+            displayName                   = $Device.displayName
+            operatingSystem               = $Device.operatingSystem
+            operatingSystemVersion        = $Device.operatingSystemVersion
+            trustType                     = $Device.trustType
+            profileType                   = $Device.profileType
+            enrollmentType                = $Device.enrollmentType
+            manufacturer                  = $Device.manufacturer
+            model                         = $Device.model
+            accountEnabled                = $Device.accountEnabled
+            isCompliant                   = $Device.isCompliant
+            isManaged                     = $Device.isManaged
+            registrationDateTime          = if ($Registered) { $Registered.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+            approximateLastSignInDateTime = if ($Device.approximateLastSignInDateTime) { ([datetime]$Device.approximateLastSignInDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+            RegisteredInWindow            = [bool]($Registered -and $Registered -ge $Window)
+        }
+    }
+    $Data = @($Rows | Sort-Object -Property @{ Expression = { $_.RegisteredInWindow }; Descending = $true }, @{ Expression = { $_.registrationDateTime }; Descending = $true })
+    return New-CIPPBecCollectorResult -Data $Data
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecReport.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecReport.ps1
new file mode 100644
index 0000000000000..e4da80db203ff
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecReport.ps1
@@ -0,0 +1,73 @@
+function Get-CIPPBecReport {
+    <#
+    .SYNOPSIS
+        Reads BEC run rows from the BecReports table, optionally with the results payload.
+    .DESCRIPTION
+        Without -CaseId, lists the run rows for a tenant (or every tenant with -TenantFilter AllTenants),
+        optionally narrowed to one user - metadata only, newest first. With -CaseId, returns that
+        single run and, when -IncludeResults is set, fetches the run's row from the BecResults table
+        (reassembled from its part rows when the payload was split for size) and attaches the parsed
+        payload as the Results property. Everything comes from table storage.
+    .PARAMETER TenantFilter
+        Tenant default domain name, or AllTenants.
+    .PARAMETER CaseId
+        A specific run.
+    .PARAMETER UserId
+        Narrow the list to one user's runs.
+    .PARAMETER IncludeResults
+        Fetch and attach the results payload (single run only).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$CaseId,
+        [string]$UserId,
+        [switch]$IncludeResults
+    )
+
+    $Table = Get-CIPPTable -TableName 'BecReports'
+    $Clauses = [System.Collections.Generic.List[string]]::new()
+    if ($TenantFilter -ne 'AllTenants') {
+        $Clauses.Add("PartitionKey eq '$($TenantFilter -replace "'", "''")'")
+    }
+    if ($CaseId) {
+        $Clauses.Add("RowKey eq '$($CaseId -replace "'", "''")'")
+    }
+    if ($UserId) {
+        $Clauses.Add("UserId eq '$($UserId -replace "'", "''")'")
+    }
+    $Rows = if ($Clauses.Count -gt 0) {
+        Get-CIPPAzDataTableEntity @Table -Filter ($Clauses -join ' and ')
+    } else {
+        Get-CIPPAzDataTableEntity @Table
+    }
+    $Rows = @($Rows | Where-Object { $_ } | Sort-Object -Property RowKey -Descending)
+    foreach ($Row in $Rows) {
+        foreach ($JsonProp in @('Containment')) {
+            if ($Row.PSObject.Properties[$JsonProp] -and $Row.$JsonProp -is [string] -and $Row.$JsonProp) {
+                # @() because ConvertFrom-Json unrolls a JSON array: a one-entry history would come back as a bare object
+                try { $Row.$JsonProp = @($Row.$JsonProp | ConvertFrom-Json -ErrorAction Stop) } catch { Write-Verbose "BEC run $($Row.RowKey): $JsonProp is not valid JSON, leaving it as text" }
+            }
+        }
+        $Row | Add-Member -NotePropertyName 'CaseId' -NotePropertyValue $Row.RowKey -Force
+        $Row | Add-Member -NotePropertyName 'Tenant' -NotePropertyValue $Row.PartitionKey -Force
+    }
+    if ($CaseId) {
+        $Row = $Rows | Select-Object -First 1
+        # Only a completed run has a results payload; a queued, running or failed run has nothing
+        # to attach and must not be treated as broken.
+        if ($Row -and $IncludeResults -and $Row.Status -eq 'Completed') {
+            $ResultsTable = Get-CIPPTable -TableName 'BecResults'
+            $ResultsRow = Get-CIPPAzDataTableEntity @ResultsTable -Filter "PartitionKey eq '$($Row.PartitionKey -replace "'", "''")' and RowKey eq '$($Row.RowKey -replace "'", "''")'" | Select-Object -First 1
+            if ($ResultsRow -and $ResultsRow.Results) {
+                $Row | Add-Member -NotePropertyName 'Results' -NotePropertyValue ([string]$ResultsRow.Results | ConvertFrom-Json -Depth 20) -Force
+            } else {
+                throw "The results payload for case $CaseId was not found in the BecResults table"
+            }
+        }
+        return $Row
+    }
+    return $Rows
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecRiskState.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRiskState.ps1
new file mode 100644
index 0000000000000..01b3297e1a121
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRiskState.ps1
@@ -0,0 +1,94 @@
+function Get-CIPPBecRiskState {
+    <#
+    .SYNOPSIS
+        Collects the investigated user's Identity Protection risk state and recent risk detections.
+    .DESCRIPTION
+        Reads identityProtection/riskyUsers/{id} (a 404 means the user is not listed as risky) and the
+        risk detections for the user inside the window. Identity Protection needs Entra ID P2; a
+        licence or permission error is reported as an incomplete collector, never as "not risky".
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id.
+    .PARAMETER StartDate
+        Window start (UTC) for detections.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [Parameter(Mandatory = $true)][datetime]$StartDate
+    )
+
+    $SafeId = ConvertTo-CIPPODataFilterValue -Value $UserId -Type Guid
+    $State = [ordered]@{
+        Listed                  = $false
+        RiskLevel               = $null
+        RiskState               = $null
+        RiskDetail              = $null
+        RiskLastUpdatedDateTime = $null
+        IsProcessing            = $null
+        Detections              = @()
+    }
+    $Errors = [System.Collections.Generic.List[string]]::new()
+    $Skipped = $false
+    $Requirement = $null
+
+    try {
+        $RiskyUser = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers/$SafeId" -tenantid $TenantFilter -noPagination $true
+        if ($RiskyUser.id) {
+            $State.Listed = $true
+            $State.RiskLevel = $RiskyUser.riskLevel
+            $State.RiskState = $RiskyUser.riskState
+            $State.RiskDetail = $RiskyUser.riskDetail
+            $State.IsProcessing = $RiskyUser.isProcessing
+            $State.RiskLastUpdatedDateTime = if ($RiskyUser.riskLastUpdatedDateTime) { ([datetime]$RiskyUser.riskLastUpdatedDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+        }
+    } catch {
+        $Message = [string](Get-NormalizedError -message $_.Exception.Message)
+        if ($Message -notmatch '(?i)not ?found|404|does not exist|Request_ResourceNotFound') {
+            if ($Message -match '(?i)UnknownError|Authorization_RequestDenied|premium|licen') {
+                $Skipped = $true
+                $Requirement = 'requires Entra ID P2 (Identity Protection)'
+                $Errors.Add('Identity Protection is not available for this tenant (Entra ID P2 licence or consent missing)')
+            } else {
+                $Errors.Add("riskyUsers: $Message")
+            }
+        }
+    }
+
+    try {
+        $Start = $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+        $Detections = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/identityProtection/riskDetections?`$filter=userId eq '$SafeId' and detectedDateTime ge $Start&`$orderby=detectedDateTime desc" -tenantid $TenantFilter)
+        $State.Detections = @(foreach ($Detection in $Detections) {
+                if (-not $Detection.id) { continue }
+                [pscustomobject]@{
+                    id                = $Detection.id
+                    DetectedDateTime  = if ($Detection.detectedDateTime) { ([datetime]$Detection.detectedDateTime).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                    RiskEventType     = $Detection.riskEventType
+                    RiskLevel         = $Detection.riskLevel
+                    RiskState         = $Detection.riskState
+                    RiskDetail        = $Detection.riskDetail
+                    DetectionTiming   = $Detection.detectionTimingType
+                    Activity          = $Detection.activity
+                    IPAddress         = $Detection.ipAddress
+                    Country           = $Detection.location.countryOrRegion
+                    City              = $Detection.location.city
+                    Source            = $Detection.source
+                }
+            })
+    } catch {
+        $DetMessage = [string](Get-NormalizedError -message $_.Exception.Message)
+        if ($DetMessage -match '(?i)UnknownError|Authorization_RequestDenied|premium|licen') {
+            $Skipped = $true
+            if (-not $Requirement) { $Requirement = 'requires Entra ID P2 (Identity Protection)' }
+        }
+        $Errors.Add("riskDetections: $DetMessage")
+    }
+
+    $ErrorText = if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null }
+    $Result = New-CIPPBecCollectorResult -Data ([pscustomobject]$State) -Complete ($Errors.Count -eq 0) -Error $ErrorText -Skipped $Skipped -Requirement $Requirement -Count (@($State.Detections).Count)
+    return $Result
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecRogueAppFeed.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRogueAppFeed.ps1
new file mode 100644
index 0000000000000..74497daa477b1
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRogueAppFeed.ps1
@@ -0,0 +1,79 @@
+function Get-CIPPBecRogueAppFeed {
+    <#
+    .SYNOPSIS
+        Returns the merged rogue-application catalog (CIPP MaliciousApps.json + Huntress rogueapps) keyed by appId.
+    .DESCRIPTION
+        The Huntress feed (https://huntresslabs.github.io/rogueapps/rogueapps.json) is fetched with a
+        short timeout and memoised per worker for an hour, so bulk BEC runs do not hit GitHub Pages once
+        per user. CIPP's own curated list is always merged in; when the feed is unavailable the result
+        says so (HuntressAvailable = $false) and the curated list alone is used - a feed outage must
+        never fail a run or read as "no rogue apps".
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    $Now = (Get-Date).ToUniversalTime()
+    if ($script:CippBecRogueAppMemo -and $script:CippBecRogueAppMemo.Expires -gt $Now) {
+        return $script:CippBecRogueAppMemo.Feed
+    }
+
+    $Apps = @{}
+    $HuntressAvailable = $false
+    $HuntressUpdated = $null
+    $HuntressApps = @()
+    try {
+        $Feed = Invoke-RestMethod -Uri 'https://huntresslabs.github.io/rogueapps/rogueapps.json' -TimeoutSec 10 -ErrorAction Stop
+        # A GitHub Pages error page parses without throwing, so check the shape too.
+        if (@($Feed).Where({ $_.appId }, 'First')) {
+            $HuntressApps = @($Feed | Where-Object { $_.appId } | Select-Object appId, appDisplayName, description, tags, references, dateAdded)
+            $HuntressAvailable = $true
+            $HuntressUpdated = $Now.ToString('o')
+        }
+    } catch {
+        Write-Information "BEC rogue app feed: Huntress feed unavailable: $($_.Exception.Message)"
+    }
+
+    foreach ($App in $HuntressApps) {
+        if (-not $App.appId) { continue }
+        $Apps[([string]$App.appId).ToLowerInvariant()] = [pscustomobject]@{
+            Name        = $App.appDisplayName
+            Description = $App.description
+            Categories  = @()
+            Tags        = @($App.tags)
+            References  = @($App.references)
+            Added       = $App.dateAdded
+            Source      = 'Huntress'
+        }
+    }
+
+    try {
+        $CippApps = @((Get-Content -Path (Join-Path $env:CIPPRootPath 'Config\MaliciousApps.json') -ErrorAction Stop | ConvertFrom-Json).applications)
+        foreach ($App in $CippApps) {
+            if (-not $App.appId) { continue }
+            $Key = ([string]$App.appId).ToLowerInvariant()
+            # CIPP's entries carry categories and richer descriptions; they win over the feed copy.
+            $Apps[$Key] = [pscustomobject]@{
+                Name        = $App.name
+                Description = $App.description
+                Categories  = @($App.categories)
+                Tags        = @($App.tags)
+                References  = @($App.references)
+                Added       = $null
+                Source      = if ($Apps.ContainsKey($Key)) { 'CIPP, Huntress' } else { 'CIPP' }
+            }
+        }
+    } catch {
+        Write-Information "BEC rogue app feed: could not load MaliciousApps.json: $($_.Exception.Message)"
+    }
+
+    $Result = [pscustomobject]@{
+        Apps              = $Apps
+        Count             = $Apps.Count
+        HuntressAvailable = [bool]$HuntressAvailable
+        HuntressUpdated   = $HuntressUpdated
+    }
+    $script:CippBecRogueAppMemo = @{ Feed = $Result; Expires = $Now.AddHours(1) }
+    return $Result
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecRunSteps.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRunSteps.ps1
new file mode 100644
index 0000000000000..09d7228557ccb
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecRunSteps.ps1
@@ -0,0 +1,32 @@
+function Get-CIPPBecRunSteps {
+    <#
+    .SYNOPSIS
+        The ordered progress steps of a BEC investigation.
+    .DESCRIPTION
+        Push-BECRun reports its progress through the async-deployment rows (the same mechanism the
+        SharePoint template deployment uses), one step per phase. This is the single definition of
+        those phases so the run, the endpoint that queues it and the page that renders the steps
+        agree on the list. The last step is always the location analysis, score and report.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    @(
+        [pscustomobject]@{ Key = 'AuditLog'; Title = 'Unified audit log: rules, permissions, safelists and sharing' }
+        [pscustomobject]@{ Key = 'SignIns'; Title = 'Sign-ins and mobile devices' }
+        [pscustomobject]@{ Key = 'MailboxRules'; Title = 'Inbox rules, safelists and sharing links' }
+        [pscustomobject]@{ Key = 'SentMail'; Title = 'Sent message trace' }
+        [pscustomobject]@{ Key = 'Tenant'; Title = 'Tenant users, MFA methods and applications' }
+        [pscustomobject]@{ Key = 'MailboxInventory'; Title = 'Mailbox state, delegations and add-ins' }
+        [pscustomobject]@{ Key = 'Grants'; Title = 'Application consents' }
+        [pscustomobject]@{ Key = 'TransportRules'; Title = 'Transport rules' }
+        [pscustomobject]@{ Key = 'ReceivedMail'; Title = 'Received mail and Defender verdicts' }
+        [pscustomobject]@{ Key = 'Directory'; Title = 'Directory audits, registered devices and non-interactive sign-ins' }
+        [pscustomobject]@{ Key = 'Activity'; Title = 'Mailbox activity and Identity Protection' }
+        [pscustomobject]@{ Key = 'IPAnalysis'; Title = 'Attacker IPs: sign-in baseline, IP lists and other accounts' }
+        [pscustomobject]@{ Key = 'AttackerActivity'; Title = 'Attacker activity: mail, files, sharing links, Forms and delegated mailboxes' }
+        [pscustomobject]@{ Key = 'Score'; Title = 'Location analysis, threat score and report' }
+    )
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecScore.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecScore.ps1
new file mode 100644
index 0000000000000..8cbbdb47a4e8f
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecScore.ps1
@@ -0,0 +1,150 @@
+function Get-CIPPBecScore {
+    <#
+    .SYNOPSIS
+        Computes the BEC threat score and its breakdown from a results payload.
+    .DESCRIPTION
+        Pure function: takes the results object Push-BECRun assembles and the heuristics (weights +
+        thresholds) and returns { Value, Level, Thresholds, Breakdown }. The first fifteen signals
+        reproduce the additive score the PDF report computed client-side before the score moved
+        server-side - same counts, same weights, same High/Medium thresholds - so old and new reports
+        agree. The Full-scope signals (delegations, grants, transport rules, add-ins, received mail,
+        Defender, directory audits, registered devices, non-interactive sign-ins, mail activity, risk
+        state) add their weights only when their data is present in the payload.
+    .PARAMETER Results
+        The BEC results object.
+    .PARAMETER Heuristics
+        The BEC heuristics object (score.weights, score.thresholds, inboxRules.suspiciousFolderPattern).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]$Results,
+        [Parameter(Mandatory = $true)]$Heuristics
+    )
+
+    $W = $Heuristics.score.weights
+    $HighThreshold = [int]($Heuristics.score.thresholds.high ?? 7)
+    $MediumThreshold = [int]($Heuristics.score.thresholds.medium ?? 4)
+    $NewUsersThreshold = [int]($Heuristics.score.newUsersThreshold ?? 5)
+    $WindowDays = [int]($Results.AnalysisWindowDays ?? $Heuristics.window.days ?? 7)
+    $SuspiciousFolder = [string]($Heuristics.inboxRules.suspiciousFolderPattern ?? 'RSS')
+
+    $ExtractedAt = try { ([datetime]$Results.ExtractedAt).ToUniversalTime() } catch { (Get-Date).ToUniversalTime() }
+    $WindowStart = $ExtractedAt.AddDays(-$WindowDays)
+    $InWindow = { param($Value) if (-not $Value) { return $false }; try { ([datetime]$Value).ToUniversalTime() -ge $WindowStart } catch { $false } }
+    $Count = { param($Value) if ($null -eq $Value) { 0 } else { @($Value).Count } }
+
+    # --- the original fifteen signals (stats derivation mirrors the report) ---
+    $NewRules = @($Results.NewRules)
+    $LocationAnalysis = $Results.LocationAnalysis
+    $Stats = [ordered]@{
+        NewRules                       = & $Count $Results.NewRules
+        InboxRuleChanges               = & $Count $Results.InboxRuleChanges
+        PermissionChanges              = & $Count $Results.MailboxPermissionChanges
+        PermissionChangesTargetingUser = @($Results.MailboxPermissionChanges | Where-Object { $_.TargetsSuspect -eq $true }).Count
+        NewApps                        = & $Count $Results.AddedApps
+        NewUsers                       = & $Count $Results.NewUsers
+        SafelistChanges                = & $Count $Results.SafelistChanges
+        SuspiciousRules                = @($NewRules | Where-Object { $_.Suspicious -eq $true -or [string]$_.MoveToFolder -clike "*$SuspiciousFolder*" }).Count
+        MaliciousApps                  = @($Results.AddedApps | Where-Object { $_.MaliciousMatch }).Count + (& $Count $Results.MaliciousSPs)
+        ForeignSuccessfulSignIns       = [int]($LocationAnalysis.ForeignSuccessfulSignInCount ?? 0)
+        ForeignActivity                = [int]($LocationAnalysis.ForeignRuleChangeCount ?? 0) + [int]($LocationAnalysis.ForeignSafelistChangeCount ?? 0) + [int]($LocationAnalysis.ForeignSharingChangeCount ?? 0) + [int]($LocationAnalysis.ForeignSentMessageCount ?? 0)
+        AnonymousLinks                 = @($Results.SharingChanges | Where-Object { [string]$_.Operation -like 'AnonymousLink*' }).Count
+        MassMail                       = if ($Results.SentMessageAnalysis.Flagged -eq $true) { 1 } else { 0 }
+        RecentMfaMethods               = @($Results.MFADevices | Where-Object { & $InWindow $_.createdDateTime }).Count
+        RecentIntuneDevices            = @($Results.IntuneDevices | Where-Object { & $InWindow $_.enrolledDateTime }).Count
+        # --- Full-scope signals ---
+        FlaggedDelegations             = @($Results.Delegations | Where-Object { $_.Flagged -eq $true }).Count
+        RiskyUserGrants                = @($Results.UserGrants | Where-Object { $_.Risk -eq 'High' }).Count
+        CatalogUserGrants              = @($Results.UserGrants | Where-Object { $_.Risk -eq 'CatalogMatch' }).Count
+        RiskyTransportRuleChanges      = @($Results.TransportRuleChanges | Where-Object { $_.Flagged -eq $true }).Count
+        FlaggedMailboxAddIns           = @($Results.MailboxAddIns | Where-Object { $_.Flagged -eq $true }).Count
+        TyposquatSenders               = @($Results.ReceivedMailFindings | Where-Object { $_.FindingType -eq 'PossibleTyposquat' }).Count
+        DefenderDetections             = @($Results.DefenderDetections | Where-Object { $_.Delivered -eq $true }).Count
+        FlaggedDirectoryAudits         = @($Results.DirectoryAudits | Where-Object { $_.Flagged -eq $true }).Count
+        RecentRegisteredDevices        = @($Results.RegisteredDevices | Where-Object { $_.RegisteredInWindow -eq $true }).Count
+        ForeignNonInteractiveSignIns   = @($Results.NonInteractiveSignIns | Where-Object { $_.ForeignLocation -eq $true -and $_.Status -eq 'Success' }).Count
+        SuspiciousMailActivity         = [int]([bool]($Results.MailActivitySummary.HardDeleteExceeded -eq $true)) + @($Results.MailActivity | Where-Object { $_.Operation -eq 'MailItemsAccessed' -and $_.ForeignLocation -eq $true }).Count
+        RiskyUserHigh                  = if ($Results.RiskState.Listed -eq $true -and $Results.RiskState.RiskState -eq 'atRisk' -and $Results.RiskState.RiskLevel -eq 'high') { 1 } else { 0 }
+        RiskyUserMedium                = if ($Results.RiskState.Listed -eq $true -and $Results.RiskState.RiskState -eq 'atRisk' -and $Results.RiskState.RiskLevel -eq 'medium') { 1 } else { 0 }
+        RiskyUserLow                   = if ($Results.RiskState.Listed -eq $true -and $Results.RiskState.RiskState -eq 'atRisk' -and $Results.RiskState.RiskLevel -eq 'low') { 1 } else { 0 }
+        ConfirmedCompromised           = if ($Results.RiskState.RiskState -eq 'confirmedCompromised') { 1 } else { 0 }
+        # addresses judged the attacker's (by an investigator, the CIPP list or the heuristics) that got in or acted
+        AttackerIPs                    = @($Results.IPVerdicts | Where-Object { $_.Verdict -in @('Compromised', 'LikelyAttacker') -and ([int]$_.SuccessfulSignIns -gt 0 -or [int]$_.Activities -gt 0) }).Count
+        # item-level activity counts only from addresses judged the attacker's, not merely suspicious or unknown
+        AttackerMailAccess             = @($Results.AttackerMailActivity | Where-Object { $_.IPVerdict -in @('Compromised', 'LikelyAttacker') }).Count
+        AttackerFileAccess             = @($Results.AttackerFileActivity | Where-Object { $_.IPVerdict -in @('Compromised', 'LikelyAttacker') }).Count
+        AttackerForms                  = @($Results.FormsActivity | Where-Object { $_.Flagged -eq $true -and $_.IPVerdict -in @('Compromised', 'LikelyAttacker') }).Count
+        OtherAccountsReached           = @($Results.BlastRadius | Where-Object { $_.Reached -eq $true }).Count
+        DelegatedMailboxAttackerAccess = @($Results.AttackerMailActivity | Where-Object { $_.IPVerdict -in @('Compromised', 'LikelyAttacker') -and $_.MailboxOwner -and $Results.UserPrincipalName -and $_.MailboxOwner -ne $Results.UserPrincipalName } | ForEach-Object { $_.MailboxOwner } | Select-Object -Unique).Count
+    }
+
+    $Descriptions = @{
+        NewRules                       = 'Inbox rules exist on the mailbox'
+        InboxRuleChanges               = 'Inbox rules were created, changed or removed in the window'
+        PermissionChangesTargetingUser = 'Mailbox permission changes targeted this mailbox'
+        PermissionChanges              = 'Mailbox permission changes elsewhere in the tenant'
+        NewApps                        = 'New service principals appeared in the tenant'
+        NewUsers                       = "More than $NewUsersThreshold users were created in the window"
+        SafelistChanges                = 'Trusted/blocked sender lists were changed'
+        SuspiciousRules                = 'An inbox rule hides, forwards or deletes mail (or acts on all incoming mail)'
+        MaliciousApps                  = 'Applications match the known-malicious catalog'
+        ForeignSuccessfulSignIns       = 'Successful sign-ins from outside the usage location'
+        ForeignActivity                = 'Rule, safelist, sharing or mail activity from outside the usage location'
+        AnonymousLinks                 = 'Anonymous sharing links were created or changed'
+        MassMail                       = 'Mass-mail pattern in sent messages'
+        RecentMfaMethods               = 'MFA methods registered in the window'
+        RecentIntuneDevices            = 'Intune devices enrolled in the window'
+        FlaggedDelegations             = 'External, guest or catch-all mailbox delegations'
+        RiskyUserGrants                = 'Consent grants with high-risk scopes from unverified publishers'
+        CatalogUserGrants              = 'Consent grants to applications in the rogue-app catalog'
+        RiskyTransportRuleChanges      = 'Transport rules with diversion or suppression actions changed in the window'
+        FlaggedMailboxAddIns           = 'User-installed non-Microsoft mailbox add-ins'
+        TyposquatSenders               = 'Mail received from look-alike sender domains'
+        DefenderDetections             = 'Defender-classified threats delivered to the mailbox'
+        FlaggedDirectoryAudits         = 'Security-info, consent or device registration events in the directory audit'
+        RecentRegisteredDevices        = 'Entra devices registered in the window'
+        ForeignNonInteractiveSignIns   = 'Successful non-interactive sign-ins from outside the usage location'
+        SuspiciousMailActivity         = 'Excessive hard deletes or mailbox access from outside the usage location'
+        RiskyUserHigh                  = 'Identity Protection: user at high risk'
+        RiskyUserMedium                = 'Identity Protection: user at medium risk'
+        RiskyUserLow                   = 'Identity Protection: user at low risk'
+        ConfirmedCompromised           = 'Identity Protection: user confirmed compromised'
+        AttackerIPs                    = 'Sign-ins or activity from addresses judged to be the attacker'
+        AttackerMailAccess             = 'Mail opened, synced, deleted, moved or sent from an attacker address'
+        AttackerFileAccess             = 'OneDrive/SharePoint files touched from an attacker address'
+        AttackerForms                  = 'Microsoft Forms created, edited or shared from an attacker address'
+        OtherAccountsReached           = 'Another account in the tenant signed in or acted from an attacker address'
+        DelegatedMailboxAttackerAccess = "Another mailbox reached through this account's delegated access from an attacker address"
+    }
+
+    $Breakdown = [System.Collections.Generic.List[object]]::new()
+    $Total = 0
+    foreach ($Name in $Stats.Keys) {
+        $Value = [int]$Stats[$Name]
+        $Applied = switch ($Name) {
+            'NewUsers' { $Value -gt $NewUsersThreshold }
+            # a change to this mailbox outweighs unrelated tenant churn; only one of the two applies
+            'PermissionChanges' { $Value -gt 0 -and [int]$Stats['PermissionChangesTargetingUser'] -eq 0 }
+            default { $Value -gt 0 }
+        }
+        $Wt = [int]($W.$Name ?? 0)
+        if ($Applied) { $Total = $Total + $Wt }
+        $Breakdown.Add([pscustomobject]@{
+                Signal      = $Name
+                Description = $Descriptions[$Name]
+                Weight      = $Wt
+                Count       = $Value
+                Applied     = [bool]$Applied
+            })
+    }
+
+    $Level = if ($Total -ge $HighThreshold) { 'High' } elseif ($Total -ge $MediumThreshold) { 'Medium' } else { 'Low' }
+    return [pscustomobject]@{
+        Value      = [int]$Total
+        Level      = $Level
+        Thresholds = [pscustomobject]@{ High = $HighThreshold; Medium = $MediumThreshold }
+        Breakdown  = $Breakdown.ToArray()
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecSignInBaseline.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecSignInBaseline.ps1
new file mode 100644
index 0000000000000..f6eb1a0dd4209
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecSignInBaseline.ps1
@@ -0,0 +1,125 @@
+function Get-CIPPBecSignInBaseline {
+    <#
+    .SYNOPSIS
+        Profiles where the investigated user normally signs in from, before the investigation window.
+    .DESCRIPTION
+        Reads the user's interactive and non-interactive sign-ins (the second is where Exchange,
+        SharePoint and the other service tokens show up) for the baseline period in one Graph batch,
+        and reduces them to how often each IP, network (ASN) and location was used. Only successful
+        sign-ins make an address "known": failed attempts are spray noise and would otherwise teach
+        the baseline an attacker's address. No sign-in rows are kept, only the aggregates:
+        { From, To, SignIns, Successful, IPs[{ IP, SignIns, Interactive, NonInteractive, Share, Days,
+        FirstSeen, LastSeen, ASN, Country, City, Apps }], ASNs[{ ASN, SignIns, Share }],
+        Locations[{ Country, City, SignIns, Share }] }. Graph keeps sign-ins for 30 days (7 without
+        Entra P1), so a longer baseline simply returns what exists.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id.
+    .PARAMETER StartDate
+        Baseline start (UTC).
+    .PARAMETER EndDate
+        Baseline end (UTC) - the start of the investigation window.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate
+    )
+
+    $SafeId = ConvertTo-CIPPODataFilterValue -Value $UserId -Type Guid
+    $From = $StartDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $To = $EndDate.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $Select = 'createdDateTime,ipAddress,autonomousSystemNumber,location,status,conditionalAccessStatus,appDisplayName,resourceDisplayName'
+    $Filter = "userId eq '$SafeId' and createdDateTime ge $From and createdDateTime lt $To"
+    $Requests = @(
+        @{ id = 'Interactive'; method = 'GET'; url = "auditLogs/signIns?`$filter=$Filter&`$top=999&`$select=$Select" }
+        @{ id = 'NonInteractive'; method = 'GET'; url = "auditLogs/signIns?`$filter=$Filter and signInEventTypes/any(t: t eq 'nonInteractiveUser')&`$top=999&`$select=$Select" }
+    )
+    $Responses = @(New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter -asapp $true -Version 'beta')
+
+    $Errors = [System.Collections.Generic.List[string]]::new()
+    $Incomplete = $false
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    foreach ($Id in @('Interactive', 'NonInteractive')) {
+        $Response = @($Responses | Where-Object { $_.id -eq $Id })
+        $Failed = @($Response | Where-Object { [int]$_.status -ge 400 })
+        if ($Response.Count -eq 0 -or $Failed.Count -gt 0) {
+            $Errors.Add("$Id sign-ins: $(if ($Failed.Count -gt 0) { $Failed[0].body.error.message } else { 'no response' })")
+            continue
+        }
+        if (@($Response | Where-Object { $_.PagingIncomplete }).Count -gt 0) { $Incomplete = $true }
+        foreach ($SignIn in @($Response.body.value)) {
+            if ($SignIn) { $Rows.Add([pscustomobject]@{ Kind = $Id; SignIn = $SignIn }) }
+        }
+    }
+
+    $ByIP = @{}
+    $ByAsn = @{}
+    $ByLocation = @{}
+    $Successful = 0
+    foreach ($Row in $Rows) {
+        $SignIn = $Row.SignIn
+        $Ok = $SignIn.conditionalAccessStatus -in @('success', 'notApplied') -and $SignIn.status.errorCode -eq 0
+        if (-not $Ok) { continue }
+        $IP = ConvertTo-CIPPBecHostAddress -Address ([string]$SignIn.ipAddress)
+        if (-not $IP) { continue }
+        $Successful++
+        $When = try { ([datetime]$SignIn.createdDateTime).ToUniversalTime() } catch { $null }
+        $Country = [string]$SignIn.location.countryOrRegion
+        $City = [string]$SignIn.location.city
+        $Asn = [string]$SignIn.autonomousSystemNumber
+        if (-not $ByIP.ContainsKey($IP)) {
+            $ByIP[$IP] = [pscustomobject]@{ IP = $IP; SignIns = 0; Interactive = 0; NonInteractive = 0; Days = [System.Collections.Generic.HashSet[string]]::new(); FirstSeen = $null; LastSeen = $null; Asns = @{}; Places = @{}; Apps = [System.Collections.Generic.HashSet[string]]::new() }
+        }
+        $Entry = $ByIP[$IP]
+        $Entry.SignIns++
+        if ($Row.Kind -eq 'Interactive') { $Entry.Interactive++ } else { $Entry.NonInteractive++ }
+        if ($When) {
+            $null = $Entry.Days.Add($When.ToString('yyyy-MM-dd'))
+            if (-not $Entry.FirstSeen -or $When -lt $Entry.FirstSeen) { $Entry.FirstSeen = $When }
+            if (-not $Entry.LastSeen -or $When -gt $Entry.LastSeen) { $Entry.LastSeen = $When }
+        }
+        if ($Asn) { $Entry.Asns[$Asn] = [int]($Entry.Asns[$Asn] ?? 0) + 1; $ByAsn[$Asn] = [int]($ByAsn[$Asn] ?? 0) + 1 }
+        $Place = "$Country|$City"
+        if ($Country -or $City) { $Entry.Places[$Place] = [int]($Entry.Places[$Place] ?? 0) + 1; $ByLocation[$Place] = [int]($ByLocation[$Place] ?? 0) + 1 }
+        foreach ($App in @($SignIn.appDisplayName, $SignIn.resourceDisplayName)) { if ($App) { $null = $Entry.Apps.Add([string]$App) } }
+    }
+
+    $Share = { param($Count) if ($Successful -gt 0) { [math]::Round($Count / $Successful, 4) } else { 0 } }
+    $Top = { param([hashtable]$Counts) ($Counts.GetEnumerator() | Sort-Object -Property Value -Descending | Select-Object -First 1).Key }
+    $SignInProfile = [pscustomobject]@{
+        From       = $From
+        To         = $To
+        SignIns    = $Rows.Count
+        Successful = $Successful
+        IPs        = @($ByIP.Values | Sort-Object -Property SignIns -Descending | ForEach-Object {
+                $Place = [string](& $Top $_.Places)
+                [pscustomobject]@{
+                    IP             = $_.IP
+                    SignIns        = $_.SignIns
+                    Interactive    = $_.Interactive
+                    NonInteractive = $_.NonInteractive
+                    Share          = & $Share $_.SignIns
+                    Days           = $_.Days.Count
+                    FirstSeen      = if ($_.FirstSeen) { $_.FirstSeen.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                    LastSeen       = if ($_.LastSeen) { $_.LastSeen.ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                    ASN            = [string](& $Top $_.Asns)
+                    Country        = if ($Place) { ($Place -split '\|', 2)[0] } else { $null }
+                    City           = if ($Place) { ($Place -split '\|', 2)[1] } else { $null }
+                    Apps           = @($_.Apps | Select-Object -First 5)
+                }
+            })
+        ASNs       = @($ByAsn.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object { [pscustomobject]@{ ASN = [string]$_.Key; SignIns = [int]$_.Value; Share = & $Share $_.Value } })
+        Locations  = @($ByLocation.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object {
+                $Parts = ([string]$_.Key) -split '\|', 2
+                [pscustomobject]@{ Country = $Parts[0]; City = $Parts[1]; SignIns = [int]$_.Value; Share = & $Share $_.Value }
+            })
+    }
+    $ErrorText = if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null }
+    return New-CIPPBecCollectorResult -Data $SignInProfile -Complete (-not $Incomplete) -Cap $(if ($Incomplete) { 'Graph stopped paging part-way' } else { $null }) -Error $ErrorText -Count $Successful
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecTransportRules.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecTransportRules.ps1
new file mode 100644
index 0000000000000..c092f6f6ce80c
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecTransportRules.ps1
@@ -0,0 +1,122 @@
+function Get-CIPPBecTransportRules {
+    <#
+    .SYNOPSIS
+        Collects transport-rule changes in the window and the current transport rules that divert or suppress mail.
+    .DESCRIPTION
+        Attackers add a BCC/redirect/delete transport rule to keep a feed after the mailbox itself is
+        cleaned, so this is tenant-wide. Changes come from the unified audit log (New/Set/Enable/Disable/
+        Remove-TransportRule, attributed to the actor and client IP) and are flagged when a risky action
+        parameter was set. The current rules are read with Get-TransportRule and flagged on their
+        structured action properties (BlindCopyTo, RedirectMessageTo, DeleteMessage, Quarantine, SetSCL
+        ...) and on the description text; only flagged rules are returned, with the total count.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .PARAMETER EndDate
+        Window end (UTC).
+    .PARAMETER Heuristics
+        The BEC heuristics object (transportRules section, caps).
+    .PARAMETER Anchor
+        Anchor mailbox for the EXO requests.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate,
+        [Parameter(Mandatory = $true)]$Heuristics,
+        [string]$Anchor
+    )
+
+    # riskyParameterRegex: diversion/interception actions, always flagged. recentParameterRegex: suppression
+    # actions (delete, quarantine, SCL, headers) that admins use legitimately - flagged only on rules changed
+    # in the window (every audited change is in the window by definition).
+    $ParamRegex = [string]$Heuristics.transportRules.riskyParameterRegex
+    $RecentRegex = [string]$Heuristics.transportRules.recentParameterRegex
+    $DescriptionRegex = [string]$Heuristics.transportRules.descriptionRegex
+    $MatchesAny = { param($Name, [bool]$Recent) ($ParamRegex -and $Name -match $ParamRegex) -or ($Recent -and $RecentRegex -and $Name -match $RecentRegex) }
+    $Operations = @($Heuristics.transportRules.operations)
+    $MaxPages = [int]($Heuristics.caps.auditLogPages ?? 10)
+
+    $HasValue = { param($Value) if ($null -eq $Value) { $false } elseif ($Value -is [bool]) { $Value } elseif ($Value -is [string]) { -not [string]::IsNullOrWhiteSpace($Value) -and $Value -ne 'False' } elseif ($Value -is [System.Collections.IEnumerable]) { @($Value | Where-Object { $_ }).Count -gt 0 } else { [string]$Value -notin @('', '0', 'False') } }
+
+    # Changes in the window
+    $Changes = try {
+        $Search = Search-CIPPBecAuditLog -TenantFilter $TenantFilter -StartDate $StartDate -EndDate $EndDate -Operations $Operations -RecordType 'ExchangeAdmin' -Anchor $Anchor -MaxPages $MaxPages
+        $Rows = foreach ($Record in $Search.Records) {
+            $AD = $Record.AuditData
+            if (-not $AD) { continue }
+            $Params = @($AD.Parameters | Where-Object { $_ -and $_.Name })
+            $RuleName = ($Params | Where-Object { $_.Name -eq 'Name' } | Select-Object -First 1).Value ?? ($Params | Where-Object { $_.Name -eq 'Identity' } | Select-Object -First 1).Value ?? $AD.ObjectId
+            $Risky = @($Params | Where-Object { (& $MatchesAny $_.Name $true) -and (& $HasValue $_.Value) } | ForEach-Object { $_.Name })
+            $Described = @($Params | Where-Object { $_.Name -notin @('Identity', 'Name') } | ForEach-Object {
+                    $Value = [string]$_.Value
+                    if ($Value.Length -gt 200) { $Value = $Value.Substring(0, 200) + '...' }
+                    "$($_.Name)=$Value"
+                })
+            [pscustomobject]@{
+                Operation       = $AD.Operation
+                Date            = $AD.CreationTime
+                Actor           = $AD.UserId
+                ClientIP        = ConvertTo-CIPPBecHostAddress -Address ($AD.ClientIP ?? $AD.ClientIPAddress)
+                RuleName        = [string]$RuleName
+                Parameters      = ($Described -join '; ')
+                RiskyParameters = $Risky
+                Flagged         = ($Risky.Count -gt 0 -and $AD.Operation -in @('New-TransportRule', 'Set-TransportRule', 'Enable-TransportRule'))
+                AuditData       = $AD
+            }
+        }
+        $Rows = @($Rows | Sort-Object -Property @{ Expression = { $_.Flagged }; Descending = $true }, @{ Expression = { $_.Date }; Descending = $true })
+        New-CIPPBecCollectorResult -Data $Rows -Complete $Search.Complete -Cap $Search.Cap -Count $Rows.Count
+    } catch {
+        New-CIPPBecCollectorResult -Data @() -Error "Transport rule audit search failed: $((Get-NormalizedError -message $_.Exception.Message))"
+    }
+
+    # Current rules
+    $Flagged = try {
+        $Rules = @(New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-TransportRule' -cmdParams @{ ResultSize = 'Unlimited' } -Anchor $Anchor | Where-Object { $_ })
+        $Rows = foreach ($Rule in $Rules) {
+            $ChangedInWindow = [bool]($Rule.WhenChanged -and ([datetime]$Rule.WhenChanged).ToUniversalTime() -ge $StartDate.ToUniversalTime())
+            $Reasons = [System.Collections.Generic.List[string]]::new()
+            foreach ($Property in $Rule.PSObject.Properties) {
+                if ((& $MatchesAny $Property.Name $ChangedInWindow) -and (& $HasValue $Property.Value)) {
+                    $Value = [string](@($Property.Value) -join ', ')
+                    if ($Value.Length -gt 200) { $Value = $Value.Substring(0, 200) + '...' }
+                    $Reasons.Add("$($Property.Name) = $Value")
+                }
+            }
+            # a rule is flagged on what it does, never on its description alone
+            if ($Reasons.Count -eq 0) { continue }
+            if ($ChangedInWindow) { $Reasons.Add('Changed within the investigation window') }
+            if ($DescriptionRegex -and [string]$Rule.Description -match $DescriptionRegex) { $Reasons.Add('Description mentions a routing or disposition action') }
+            if ($Rule.Mode -and $Rule.Mode -ne 'Enforce') { $Reasons.Add("Rule is in $($Rule.Mode) mode") }
+            if ($Rule.State -eq 'Disabled') { $Reasons.Add('Rule is disabled') }
+            $Description = [string]$Rule.Description
+            if ($Description.Length -gt 500) { $Description = $Description.Substring(0, 500) + '...' }
+            [pscustomobject]@{
+                Identity    = [string]$Rule.Identity
+                Guid        = [string]$Rule.Guid
+                Name        = $Rule.Name
+                State       = $Rule.State
+                Mode        = $Rule.Mode
+                Priority    = $Rule.Priority
+                WhenChanged = $Rule.WhenChanged
+                ChangedInWindow = $ChangedInWindow
+                RiskReasons = $Reasons.ToArray()
+                Description = $Description
+                Flagged     = $true
+            }
+        }
+        New-CIPPBecCollectorResult -Data @($Rows | Sort-Object -Property @{ Expression = { $_.ChangedInWindow }; Descending = $true }, Name)
+    } catch {
+        New-CIPPBecCollectorResult -Data @() -Error "Get-TransportRule failed: $((Get-NormalizedError -message $_.Exception.Message))"
+    }
+
+    return [pscustomobject]@{
+        Changes = $Changes
+        Flagged = $Flagged
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Get-CIPPBecUserGrants.ps1 b/Modules/CIPPCore/Public/BEC/Get-CIPPBecUserGrants.ps1
new file mode 100644
index 0000000000000..e81c483146bc1
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Get-CIPPBecUserGrants.ps1
@@ -0,0 +1,148 @@
+function Get-CIPPBecUserGrants {
+    <#
+    .SYNOPSIS
+        Collects the investigated user's own OAuth consent grants and enterprise-app role assignments.
+    .DESCRIPTION
+        Reads users/{id}/oauth2PermissionGrants and users/{id}/appRoleAssignments, resolves the client
+        and resource service principals, and flags each entry when it carries a high-risk delegated
+        scope from an unverified, non-Microsoft publisher or when the application matches the rogue-app
+        catalog (CIPP MaliciousApps.json + Huntress). Consent-based access survives a password reset,
+        which is why this check exists. Metadata only: application identity, scopes and publisher.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id.
+    .PARAMETER Heuristics
+        The BEC heuristics object (riskyScopes regex + catalogNames).
+    .PARAMETER RogueAppFeed
+        Output of Get-CIPPBecRogueAppFeed. Fetched when not supplied.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [Parameter(Mandatory = $true)]$Heuristics,
+        $RogueAppFeed
+    )
+
+    if (-not $RogueAppFeed) { $RogueAppFeed = Get-CIPPBecRogueAppFeed }
+    $Catalog = $RogueAppFeed.Apps
+    $ScopeRegex = [string]$Heuristics.riskyScopes.regex
+    $CatalogScopes = @($Heuristics.riskyScopes.catalogNames)
+    # Microsoft's own multi-tenant apps are owned by these tenants; they are never "unverified third parties".
+    $MicrosoftTenantIds = @('f8cdef31-a31e-4b4a-93e4-5f571e91255a', '72f988bf-86f1-41af-91ab-2d7cd011db47')
+
+    $Requests = @(
+        @{ id = 'Grants'; method = 'GET'; url = "users/$UserId/oauth2PermissionGrants" }
+        @{ id = 'AppRoles'; method = 'GET'; url = "users/$UserId/appRoleAssignments" }
+    )
+    $Responses = New-GraphBulkRequest -Requests $Requests -tenantid $TenantFilter -asapp $true
+    $Errors = [System.Collections.Generic.List[string]]::new()
+    $GrantResponse = $Responses | Where-Object { $_.id -eq 'Grants' } | Select-Object -First 1
+    $AppRoleResponse = $Responses | Where-Object { $_.id -eq 'AppRoles' } | Select-Object -First 1
+    foreach ($Pair in @(@{ Name = 'oauth2PermissionGrants'; Response = $GrantResponse }, @{ Name = 'appRoleAssignments'; Response = $AppRoleResponse })) {
+        if (-not $Pair.Response) { $Errors.Add("$($Pair.Name) query returned no response") }
+        elseif ([int]$Pair.Response.status -ge 400) { $Errors.Add("$($Pair.Name): $($Pair.Response.body.error.message ?? "status $($Pair.Response.status)")") }
+    }
+    $Grants = @(if ($GrantResponse -and [int]$GrantResponse.status -lt 400) { $GrantResponse.body.value } else { @() })
+    $AppRoles = @(if ($AppRoleResponse -and [int]$AppRoleResponse.status -lt 400) { $AppRoleResponse.body.value } else { @() })
+
+    # Resolve every service principal referenced (client + resource) in chunks of 15 ids per filter.
+    $SpIds = @(@($Grants.clientId) + @($Grants.resourceId) + @($AppRoles.resourceId) | Where-Object { $_ } | Select-Object -Unique)
+    $ServicePrincipals = @{}
+    if ($SpIds.Count -gt 0) {
+        $SpRequests = for ($i = 0; $i -lt $SpIds.Count; $i += 15) {
+            $Chunk = $SpIds[$i..([Math]::Min($i + 14, $SpIds.Count - 1))]
+            @{
+                id     = "sp$i"
+                method = 'GET'
+                url    = "servicePrincipals?`$filter=id in ('$($Chunk -join "','")')&`$select=id,appId,displayName,publisherName,verifiedPublisher,appOwnerOrganizationId,accountEnabled,createdDateTime,servicePrincipalType"
+            }
+        }
+        try {
+            $SpResponses = New-GraphBulkRequest -Requests @($SpRequests) -tenantid $TenantFilter -asapp $true
+            foreach ($Response in $SpResponses) {
+                if ([int]$Response.status -ge 400) { $Errors.Add("servicePrincipal lookup: $($Response.body.error.message)"); continue }
+                foreach ($Sp in @($Response.body.value)) { if ($Sp.id) { $ServicePrincipals[[string]$Sp.id] = $Sp } }
+            }
+        } catch {
+            $Errors.Add("servicePrincipal lookup failed: $($_.Exception.Message)")
+        }
+    }
+
+    $Describe = {
+        param($Sp)
+        $AppId = if ($Sp.appId) { ([string]$Sp.appId).ToLowerInvariant() } else { $null }
+        $Match = if ($AppId -and $Catalog.ContainsKey($AppId)) { $Catalog[$AppId] } else { $null }
+        [pscustomobject]@{
+            DisplayName            = $Sp.displayName
+            AppId                  = $Sp.appId
+            Publisher              = $Sp.publisherName
+            PublisherVerified      = [bool]($Sp.verifiedPublisher.verifiedPublisherId)
+            AppOwnerOrganizationId = $Sp.appOwnerOrganizationId
+            IsMicrosoft            = ($Sp.appOwnerOrganizationId -in $MicrosoftTenantIds)
+            AccountEnabled         = $Sp.accountEnabled
+            CreatedDateTime        = $Sp.createdDateTime
+            CatalogMatch           = if ($Match) { [pscustomobject]@{ Name = $Match.Name; Source = $Match.Source; Categories = @($Match.Categories); Description = $Match.Description } } else { $null }
+        }
+    }
+
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    foreach ($Grant in $Grants) {
+        $Client = & $Describe ($ServicePrincipals[[string]$Grant.clientId])
+        $Resource = $ServicePrincipals[[string]$Grant.resourceId]
+        $Scopes = @(([string]$Grant.scope) -split '\s+' | Where-Object { $_ })
+        $HighRisk = @($Scopes | Where-Object { ($ScopeRegex -and $_ -match $ScopeRegex) -or ($_ -in $CatalogScopes) })
+        $Risk = if ($Client.CatalogMatch) { 'CatalogMatch' } elseif ($HighRisk.Count -gt 0 -and -not $Client.PublisherVerified -and -not $Client.IsMicrosoft) { 'High' } elseif ($HighRisk.Count -gt 0) { 'Review' } else { 'Low' }
+        $Rows.Add([pscustomobject]@{
+                Type                     = 'DelegatedGrant'
+                Id                       = $Grant.id
+                ConsentType              = $Grant.consentType
+                ClientDisplayName        = $Client.DisplayName
+                ClientAppId              = $Client.AppId
+                ClientServicePrincipalId = $Grant.clientId
+                Publisher                = $Client.Publisher
+                PublisherVerified        = $Client.PublisherVerified
+                IsMicrosoft              = $Client.IsMicrosoft
+                ClientAccountEnabled     = $Client.AccountEnabled
+                ClientCreatedDateTime    = $Client.CreatedDateTime
+                ResourceDisplayName      = $Resource.displayName
+                ResourceId               = $Grant.resourceId
+                Scope                    = $Grant.scope
+                HighRiskScopes           = $HighRisk
+                CatalogMatch             = $Client.CatalogMatch
+                Risk                     = $Risk
+                Flagged                  = ($Risk -in @('CatalogMatch', 'High'))
+            })
+    }
+    foreach ($Assignment in $AppRoles) {
+        $Resource = & $Describe ($ServicePrincipals[[string]$Assignment.resourceId])
+        $Risk = if ($Resource.CatalogMatch) { 'CatalogMatch' } else { 'Low' }
+        $Rows.Add([pscustomobject]@{
+                Type                     = 'AppRoleAssignment'
+                Id                       = $Assignment.id
+                ConsentType              = $null
+                ClientDisplayName        = $Assignment.resourceDisplayName ?? $Resource.DisplayName
+                ClientAppId              = $Resource.AppId
+                ClientServicePrincipalId = $Assignment.resourceId
+                Publisher                = $Resource.Publisher
+                PublisherVerified        = $Resource.PublisherVerified
+                IsMicrosoft              = $Resource.IsMicrosoft
+                ClientAccountEnabled     = $Resource.AccountEnabled
+                ClientCreatedDateTime    = $Assignment.createdDateTime
+                ResourceDisplayName      = $Assignment.resourceDisplayName
+                ResourceId               = $Assignment.resourceId
+                Scope                    = $Assignment.appRoleId
+                HighRiskScopes           = @()
+                CatalogMatch             = $Resource.CatalogMatch
+                Risk                     = $Risk
+                Flagged                  = ($Risk -eq 'CatalogMatch')
+            })
+    }
+
+    $Data = @($Rows | Sort-Object -Property @{ Expression = { $_.Flagged }; Descending = $true }, ClientDisplayName)
+    $ErrorText = if ($Errors.Count -gt 0) { $Errors -join '; ' } else { $null }
+    return New-CIPPBecCollectorResult -Data $Data -Complete ($Errors.Count -eq 0) -Error $ErrorText
+}
diff --git a/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1 b/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1
new file mode 100644
index 0000000000000..e5824a276abfd
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1
@@ -0,0 +1,379 @@
+function Invoke-CIPPBecContainment {
+    <#
+    .SYNOPSIS
+        Runs a selectable set of BEC containment actions for one user.
+    .DESCRIPTION
+        The single containment implementation shared by the ExecBECRemediate endpoint, the
+        'becremediate' audit-log alert action and the scheduler. Actions come from
+        Get-CIPPBecContainmentActions; with no selection the default set runs (the catalog's
+        DefaultSelected flags, which the instance-wide settings can change). Actions run in catalog
+        order, each in its own try/catch so one failure never stops the rest, and every action returns
+        result rows
+        ({ Action, Target, state, resultText, copyField }).
+
+        Targets come from Parameters (explicit ids the operator picked), else from the run's stored
+        results (flagged items), else - only when neither exists - from the live tenant.
+
+        Critical actions refuse to run unless -Confirmed is set; the endpoint sets it only after the
+        operator typed the user's UPN, automation sets it by design. Passwords never reach the log or
+        the stored containment history: the redacted copy of the rows is what gets persisted.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id (resolved from the UPN when omitted and needed).
+    .PARAMETER UserPrincipalName
+        The user's UPN.
+    .PARAMETER Actions
+        Action ids to run. Empty = the default set.
+    .PARAMETER Parameters
+        Per-action parameters (hashtable or object): MfaMethodIds, GrantIds, AppRoleAssignmentIds,
+        ServicePrincipalIds, RuleIds, Delegations, TransportRuleIds, AddInIds, Protocols,
+        MobileDeviceIds, RegisteredDeviceIds, CAPolicy { State, Controls, ExpiresHours }.
+    .PARAMETER Confirmed
+        The operator (or automation) confirmed the Critical actions.
+    .PARAMETER Redacted
+        Return the redacted rows (password replaced, copyField dropped) - for automation that forwards
+        the results into an alert payload.
+    .PARAMETER CaseId
+        The BEC case the containment belongs to; results are appended to its run.
+    .PARAMETER RunResults
+        The run's results payload, used to resolve default targets. Loaded from CaseId when omitted.
+    .PARAMETER DeploymentId
+        Live-progress job id (New-CIPPAsyncDeployment, one row named after the UPN). When set, the
+        row gets one step per selected action, updated as each runs - how a background run started
+        by ExecBECRemediate reports back. The step messages carry the unredacted result text so the
+        operator can still copy a new password; everything else stored stays redacted.
+    .PARAMETER Headers
+        CIPP request headers for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$UserId,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [string[]]$Actions = @(),
+        $Parameters,
+        [switch]$Confirmed,
+        [switch]$Redacted,
+        [string]$CaseId,
+        $RunResults,
+        [string]$DeploymentId,
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    $Catalog = Get-CIPPBecContainmentActions
+    $Selected = if (-not $Actions -or @($Actions | Where-Object { $_ }).Count -eq 0) {
+        @($Catalog | Where-Object { $_.DefaultSelected })
+    } else {
+        @(foreach ($Id in ($Actions | Where-Object { $_ } | Select-Object -Unique)) {
+                $Match = $Catalog | Where-Object { $_.Id -ieq [string]$Id } | Select-Object -First 1
+                if (-not $Match) { throw "Unknown containment action '$Id'" }
+                $Match
+            })
+    }
+    $Selected = @($Selected | Sort-Object -Property Order)
+    $CriticalSelected = @($Selected | Where-Object { $_.Impact -eq 'Critical' })
+    if ($CriticalSelected.Count -gt 0 -and -not $Confirmed) {
+        throw "Confirmation is required: the selected actions include Critical changes ($($CriticalSelected.Id -join ', '))"
+    }
+
+    # Parameters may arrive as a hashtable or a deserialised object; member access on either is case-insensitive.
+    $GetParam = { param($Name) $Parameters.$Name }
+    $AsList = { param($Value) @($Value | Where-Object { $null -ne $_ -and "$_" -ne '' }) }
+
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    $Add = {
+        param($Action, $Target, $State, $Text, $Copy)
+        $Rows.Add([pscustomobject]@{ Action = $Action; Target = $Target; state = $State; resultText = $Text; copyField = $Copy })
+    }
+    # Map a helper's own result rows onto the containment row shape
+    $AddMany = {
+        param($Action, $HelperRows)
+        foreach ($Row in @($HelperRows | Where-Object { $_ })) {
+            $Rows.Add([pscustomobject]@{ Action = $Action; Target = $Row.Target; state = $Row.state; resultText = $Row.resultText; copyField = $Row.copyField })
+        }
+    }
+
+    if ($CaseId -and -not $RunResults) {
+        try {
+            $RunResults = (Get-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -IncludeResults).Results
+        } catch {
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC run $CaseId could not be loaded for target resolution: $($_.Exception.Message)" -Sev 'Warning'
+        }
+    }
+
+    # Progress reporting never stops the containment: the helpers swallow their own write failures.
+    if ($DeploymentId) {
+        try {
+            $null = New-CIPPAsyncDeployment -JobId $DeploymentId -Names @($UserPrincipalName) -StepTitles @($Selected.Label) -Source 'BECRemediation' -TenantFilter $TenantFilter
+            Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $UserPrincipalName -Status 'running'
+        } catch {
+            Write-Information "BEC containment: could not create the progress row $DeploymentId`: $($_.Exception.Message)"
+        }
+    }
+    $Finished = $false
+
+    Set-CippBecCaseContext -CaseId $CaseId
+    try {
+        if (-not $UserId -and ($Selected.Id -contains 'RemoveOAuthGrants' -or $Selected.Id -contains 'TargetedCAPolicy')) {
+            try {
+                $UserId = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$([System.Web.HttpUtility]::UrlEncode($UserPrincipalName))?`$select=id" -tenantid $TenantFilter -AsApp $true).id
+            } catch {
+                Write-Information "BEC containment: could not resolve the object id of $UserPrincipalName`: $($_.Exception.Message)"
+            }
+        }
+
+        for ($StepIndex = 0; $StepIndex -lt $Selected.Count; $StepIndex++) {
+            $Action = $Selected[$StepIndex]
+            $Id = $Action.Id
+            $RowsBefore = $Rows.Count
+            if ($DeploymentId) { Set-CIPPAsyncDeploymentStep -JobId $DeploymentId -Name $UserPrincipalName -StepIndex $StepIndex -StepStatus 'running' -Message 'In progress' }
+            try {
+                switch ($Id) {
+                    'ResetPassword' {
+                        $R = Set-CIPPResetPassword -UserID $UserPrincipalName -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers
+                        & $Add $Id $UserPrincipalName ($R.state ?? 'success') ([string]$R.resultText) $R.copyField
+                    }
+                    'DisableAccount' {
+                        try {
+                            $R = Set-CIPPSignInState -UserID $UserPrincipalName -AccountEnabled $false -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers
+                            & $Add $Id $UserPrincipalName 'success' ([string]$R) $null
+                        } catch {
+                            if ($_.Exception.Message -match 'AD Sync enabled') {
+                                # the PATCH succeeded; the throw is the helper's way of flagging a synced account
+                                & $Add $Id $UserPrincipalName 'warning' "Sign-in blocked in Entra ID for $UserPrincipalName, but the account is directory-synced: disable it on-premises too or the next sync re-enables it." $null
+                            } else { throw }
+                        }
+                    }
+                    'RevokeSessions' {
+                        $R = Revoke-CIPPSessions -userid $UserPrincipalName -username $UserPrincipalName -Headers $Headers -APIName $APIName -tenantFilter $TenantFilter
+                        & $Add $Id $UserPrincipalName 'success' ([string]$R) $null
+                    }
+                    'RemoveMFA' {
+                        $MethodIds = & $AsList (& $GetParam 'MfaMethodIds')
+                        # an empty string stands for "every method"; a single-element array survives assignment where @($null) collapses
+                        if ($MethodIds.Count -eq 0) { $MethodIds = @('') }
+                        foreach ($MethodId in $MethodIds) {
+                            $Target = if ([string]::IsNullOrEmpty($MethodId)) { $UserPrincipalName } else { $MethodId }
+                            try {
+                                $R = if ([string]::IsNullOrEmpty($MethodId)) { Remove-CIPPUserMFA -UserPrincipalName $UserPrincipalName -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName } else { Remove-CIPPUserMFA -UserPrincipalName $UserPrincipalName -TenantFilter $TenantFilter -MethodId $MethodId -Headers $Headers -APIName $APIName }
+                                $State = if ([string]$R -like '*No MFA method*') { 'info' } else { 'success' }
+                                & $Add $Id $Target $State ([string]$R) $null
+                            } catch {
+                                # partial success is thrown as text that starts with 'Successfully removed ... However'
+                                $State = if ($_.Exception.Message -match '(?i)^Successfully removed.*However') { 'warning' } else { 'error' }
+                                & $Add $Id $Target $State $_.Exception.Message $null
+                            }
+                        }
+                    }
+                    'RemoveOAuthGrants' {
+                        $GrantIds = & $AsList (& $GetParam 'GrantIds')
+                        $AssignmentIds = & $AsList (& $GetParam 'AppRoleAssignmentIds')
+                        if ($GrantIds.Count -eq 0 -and $AssignmentIds.Count -eq 0 -and $RunResults) {
+                            $Flagged = @($RunResults.UserGrants | Where-Object { $_.Flagged -eq $true })
+                            $GrantIds = @($Flagged | Where-Object { $_.Type -eq 'DelegatedGrant' } | ForEach-Object { $_.Id })
+                            $AssignmentIds = @($Flagged | Where-Object { $_.Type -eq 'AppRoleAssignment' } | ForEach-Object { $_.Id })
+                        }
+                        if ($GrantIds.Count -eq 0 -and $AssignmentIds.Count -eq 0) { & $Add $Id $UserPrincipalName 'info' 'No flagged application consents to revoke' $null; break }
+                        & $AddMany $Id (Remove-CIPPUserOAuthGrant -TenantFilter $TenantFilter -UserId $UserId -GrantIds $GrantIds -AppRoleAssignmentIds $AssignmentIds -Headers $Headers -APIName $APIName)
+                    }
+                    'DisableServicePrincipals' {
+                        $SpIds = & $AsList (& $GetParam 'ServicePrincipalIds')
+                        if ($SpIds.Count -eq 0 -and $RunResults) {
+                            $SpIds = @($RunResults.UserGrants | Where-Object { $_.Risk -eq 'CatalogMatch' -and $_.ClientServicePrincipalId } | ForEach-Object { $_.ClientServicePrincipalId } | Select-Object -Unique)
+                        }
+                        if ($SpIds.Count -eq 0) { & $Add $Id $UserPrincipalName 'info' 'No catalog-matched applications to disable' $null; break }
+                        foreach ($SpId in $SpIds) {
+                            try {
+                                $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/servicePrincipals/$SpId" -tenantid $TenantFilter -type PATCH -body '{"accountEnabled":false}' -AsApp $true
+                                & $Add $Id $SpId 'success' "Disabled service principal $SpId tenant-wide" $null
+                            } catch { & $Add $Id $SpId 'error' "Failed to disable service principal $SpId`: $((Get-CippException -Exception $_).NormalizedError)" $null }
+                        }
+                    }
+                    'DisableInboxRules' {
+                        $RuleIds = & $AsList (& $GetParam 'RuleIds')
+                        $HelperRows = if ($RuleIds.Count -gt 0) { Disable-CIPPInboxRules -TenantFilter $TenantFilter -UserPrincipalName $UserPrincipalName -RuleIds $RuleIds -Headers $Headers -APIName $APIName } else { Disable-CIPPInboxRules -TenantFilter $TenantFilter -UserPrincipalName $UserPrincipalName -Headers $Headers -APIName $APIName }
+                        foreach ($Row in @($HelperRows)) { & $Add $Id $UserPrincipalName $Row.state $Row.resultText $null }
+                    }
+                    'ClearForwarding' {
+                        $R = Set-CIPPForwarding -UserID $UserPrincipalName -Username $UserPrincipalName -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName -Disable $true
+                        & $Add $Id $UserPrincipalName 'success' ([string]$R) $null
+                    }
+                    'ClearAutoReply' {
+                        $R = Set-CIPPOutOfOffice -UserID $UserPrincipalName -TenantFilter $TenantFilter -State 'Disabled' -Headers $Headers -APIName $APIName
+                        & $Add $Id $UserPrincipalName 'success' ([string]$R) $null
+                    }
+                    'RemoveDelegations' {
+                        $Delegations = @((& $GetParam 'Delegations') | Where-Object { $_ })
+                        if ($Delegations.Count -eq 0 -and $RunResults) { $Delegations = @($RunResults.Delegations | Where-Object { $_.Flagged -eq $true }) }
+                        if ($Delegations.Count -eq 0) { & $Add $Id $UserPrincipalName 'info' 'No flagged delegations to remove' $null; break }
+                        & $AddMany $Id (Remove-CIPPMailboxDelegation -TenantFilter $TenantFilter -UserPrincipalName $UserPrincipalName -Delegations $Delegations -Headers $Headers -APIName $APIName)
+                    }
+                    'DisableTransportRules' {
+                        $RuleIds = & $AsList (& $GetParam 'TransportRuleIds')
+                        if ($RuleIds.Count -eq 0 -and $RunResults) { $RuleIds = @($RunResults.TransportRulesFlagged | Where-Object { $_.ChangedInWindow -eq $true } | ForEach-Object { $_.Guid ?? $_.Identity ?? $_.Name }) }
+                        if ($RuleIds.Count -eq 0) { & $Add $Id $TenantFilter 'info' 'No flagged transport rules changed in the window to disable' $null; break }
+                        foreach ($RuleId in $RuleIds) {
+                            try {
+                                $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Disable-TransportRule' -cmdParams @{ Identity = $RuleId; Confirm = $false } -useSystemMailbox $true
+                                & $Add $Id $RuleId 'success' "Disabled transport rule '$RuleId'" $null
+                            } catch { & $Add $Id $RuleId 'error' "Failed to disable transport rule '$RuleId': $((Get-CippException -Exception $_).NormalizedError)" $null }
+                        }
+                    }
+                    'DisableMailboxAddIns' {
+                        $AddInIds = & $AsList (& $GetParam 'AddInIds')
+                        if ($AddInIds.Count -eq 0 -and $RunResults) { $AddInIds = @($RunResults.MailboxAddIns | Where-Object { $_.Flagged -eq $true } | ForEach-Object { $_.Identity ?? $_.AppId }) }
+                        if ($AddInIds.Count -eq 0) { & $Add $Id $UserPrincipalName 'info' 'No flagged add-ins to disable' $null; break }
+                        foreach ($AddInId in $AddInIds) {
+                            try {
+                                $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Disable-App' -cmdParams @{ Identity = $AddInId; Mailbox = $UserPrincipalName; Confirm = $false } -Anchor $UserPrincipalName
+                                & $Add $Id $AddInId 'success' "Disabled add-in $AddInId for $UserPrincipalName" $null
+                            } catch { & $Add $Id $AddInId 'error' "Failed to disable add-in $AddInId`: $((Get-CippException -Exception $_).NormalizedError)" $null }
+                        }
+                    }
+                    'BlockProtocols' {
+                        $Protocols = @((& $AsList (& $GetParam 'Protocols')) | Select-Object -Unique)
+                        if ($Protocols.Count -eq 0) { $Protocols = @('EWS', 'IMAP', 'POP', 'ActiveSync', 'SmtpAuth') }
+                        # Set-CASMailbox switch per protocol; SmtpAuth maps to SmtpClientAuthenticationDisabled, which is inverted.
+                        $ProtocolMap = @{ EWS = 'EWSEnabled'; IMAP = 'IMAPEnabled'; POP = 'POPEnabled'; ActiveSync = 'ActiveSyncEnabled'; OWA = 'OWAEnabled'; MAPI = 'MAPIEnabled'; ECP = 'ECPEnabled'; SmtpAuth = 'SmtpClientAuthenticationDisabled' }
+                        $Unknown = @($Protocols | Where-Object { -not $ProtocolMap.ContainsKey([string]$_) })
+                        if ($Unknown.Count -gt 0) { throw "Unknown protocol(s): $($Unknown -join ', ')" }
+                        $CasParams = @{ Identity = $UserPrincipalName }
+                        foreach ($Protocol in $Protocols) { $CasParams[$ProtocolMap[[string]$Protocol]] = ([string]$Protocol -eq 'SmtpAuth') }
+                        $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-CASMailbox' -cmdParams $CasParams -Anchor $UserPrincipalName
+                        & $Add $Id $UserPrincipalName 'success' "Disabled $($Protocols -join ', ') for $UserPrincipalName" $null
+                    }
+                    { $_ -in @('BlockMobileDevices', 'RemoveMobileDevices') } {
+                        $Picked = @((& $GetParam 'MobileDeviceIds') | Where-Object { $_ } | ForEach-Object { [string]$_ })
+                        $Known = @($RunResults.SuspectUserDevices | Where-Object { $_ })
+                        # The block list takes the DeviceID and the removal takes the partnership Guid, so a pick the run's
+                        # inventory does not know (no run, or an API caller) is looked up on the mailbox rather than guessed.
+                        $Unresolved = @($Picked | Where-Object { $_ -notin @($Known.DeviceID) -and $_ -notin @($Known.Guid) -and $_ -notin @($Known.Identity) })
+                        if ($Known.Count -eq 0 -or $Unresolved.Count -gt 0) {
+                            $Live = @(New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-MobileDevice' -cmdParams @{ Mailbox = $UserPrincipalName } -Anchor $UserPrincipalName | Where-Object { $_ })
+                            $Known = @($Known) + @($Live | Where-Object { $_.Guid -notin @($Known.Guid) })
+                        }
+                        $DeviceRows = if ($Picked.Count -gt 0) { @($Known | Where-Object { $_.DeviceID -in $Picked -or $_.Guid -in $Picked -or $_.Identity -in $Picked }) } else { @($Known) }
+                        foreach ($Missing in @($Picked | Where-Object { $_ -notin @($DeviceRows.DeviceID) -and $_ -notin @($DeviceRows.Guid) -and $_ -notin @($DeviceRows.Identity) })) {
+                            & $Add $Id $Missing 'error' "No mobile device partnership '$Missing' found on $UserPrincipalName" $null
+                        }
+                        if ($DeviceRows.Count -eq 0) { if ($Picked.Count -eq 0) { & $Add $Id $UserPrincipalName 'info' 'No mobile device partnerships found' $null }; break }
+                        foreach ($Device in $DeviceRows) {
+                            $Target = [string]($Device.DeviceID ?? $Device.Guid)
+                            try {
+                                $R = if ($Id -eq 'BlockMobileDevices') { Set-CIPPMobileDevice -Headers $Headers -Quarantine 'true' -UserId $UserPrincipalName -DeviceId ([string]$Device.DeviceID) -TenantFilter $TenantFilter -Delete 'false' -Guid ([string]$Device.Guid) -APIName $APIName } else { Set-CIPPMobileDevice -Headers $Headers -Quarantine 'false' -UserId $UserPrincipalName -DeviceId ([string]$Device.DeviceID) -TenantFilter $TenantFilter -Delete 'true' -Guid ([string]$Device.Guid) -APIName $APIName }
+                                & $Add $Id $Target ($(if ([string]$R -like 'Failed*') { 'error' } else { 'success' })) ([string]$R) $null
+                            } catch { & $Add $Id $Target 'error' $_.Exception.Message $null }
+                        }
+                    }
+                    { $_ -in @('DisableRegisteredDevices', 'RemoveRegisteredDevices') } {
+                        $DeviceIds = & $AsList (& $GetParam 'RegisteredDeviceIds')
+                        if ($DeviceIds.Count -eq 0 -and $RunResults) { $DeviceIds = @($RunResults.RegisteredDevices | Where-Object { $_.RegisteredInWindow -eq $true } | ForEach-Object { $_.id }) }
+                        if ($DeviceIds.Count -eq 0) { & $Add $Id $UserPrincipalName 'info' 'No registered devices from the window to act on' $null; break }
+                        $DeviceAction = if ($Id -eq 'DisableRegisteredDevices') { 'Disable' } else { 'Delete' }
+                        foreach ($DeviceId in $DeviceIds) {
+                            try {
+                                $R = Set-CIPPDeviceState -Action $DeviceAction -DeviceID $DeviceId -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName
+                                & $Add $Id $DeviceId 'success' ([string]$R) $null
+                            } catch { & $Add $Id $DeviceId 'error' $_.Exception.Message $null }
+                        }
+                    }
+                    'TargetedCAPolicy' {
+                        $Policy = & $GetParam 'CAPolicy'
+                        $State = if ([string]$Policy.State -in @('enabled', 'enabledForReportingButNotEnabled')) { [string]$Policy.State } elseif ([string]$Policy.State -eq 'reportOnly') { 'enabledForReportingButNotEnabled' } else { 'enabled' }
+                        $Controls = if ([string]$Policy.Controls -eq 'mfaAndCompliantDevice') { 'mfaAndCompliantDevice' } else { 'mfa' }
+                        $Hours = [int]($Policy.ExpiresHours ?? 24)
+                        if ($Hours -lt 1 -or $Hours -gt 168) { $Hours = 24 }
+                        if (-not $UserId) { throw "The user's object id is required to create a targeted Conditional Access policy" }
+                        $R = New-CIPPBecTargetedCAPolicy -TenantFilter $TenantFilter -UserId $UserId -UserPrincipalName $UserPrincipalName -State $State -Controls $Controls -ExpiresHours $Hours -CaseId $CaseId -Headers $Headers -APIName $APIName
+                        & $Add $Id $UserPrincipalName ($(if ([string]$R -like '*WARNING*') { 'warning' } else { 'success' })) ([string]$R) $null
+                    }
+                    'DisableOneDriveSharing' {
+                        $R = Set-CIPPOneDriveSharing -UserId $UserPrincipalName -TenantFilter $TenantFilter -SharingCapability 'Disabled' -APIName $APIName -Headers $Headers
+                        & $Add $Id $UserPrincipalName ($(if ([string]$R -like '*Successfully*') { 'success' } else { 'error' })) ([string]$R) $null
+                    }
+                    'RemoveSharingLinks' {
+                        # Explicit picks first, else the item URL of every sharing change the run recorded.
+                        $Urls = & $AsList (& $GetParam 'SharingLinkUrls')
+                        if ($Urls.Count -eq 0 -and $RunResults) {
+                            $Urls = @($RunResults.SharingChanges | ForEach-Object { $_.ItemUrl } | Where-Object { $_ } | Select-Object -Unique)
+                        }
+                        $Urls = @($Urls | Where-Object { $_ } | Select-Object -Unique)
+                        if ($Urls.Count -eq 0) { & $Add $Id $UserPrincipalName 'info' 'No sharing links from the run to remove' $null; break }
+                        & $AddMany $Id (Remove-CIPPBecSharingLinks -TenantFilter $TenantFilter -UserPrincipalName $UserPrincipalName -ItemUrls $Urls -Headers $Headers -APIName $APIName)
+                    }
+                    'BlockSenders' {
+                        # Explicit picks first, else every distinct phishing-shaped sender the run recorded.
+                        $Senders = & $AsList (& $GetParam 'BlockSenders')
+                        if ($Senders.Count -eq 0 -and $RunResults) {
+                            $Senders = @($RunResults.ReceivedMailFindings | ForEach-Object { $_.SenderAddress } | Where-Object { $_ } | Select-Object -Unique)
+                        }
+                        $Senders = @($Senders | Where-Object { $_ } | Select-Object -Unique)
+                        if ($Senders.Count -eq 0) { & $Add $Id $TenantFilter 'info' 'No phishing-shaped senders from the run to block' $null; break }
+                        # One New-TenantAllowBlockListItems call takes the whole set; emit a row per sender for the results table.
+                        try {
+                            $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'New-TenantAllowBlockListItems' -cmdParams @{
+                                Entries      = @($Senders)
+                                ListType     = 'Sender'
+                                Block        = $true
+                                NoExpiration = $true
+                                Notes        = "Blocked from BEC case $CaseId"
+                            }
+                            foreach ($Address in $Senders) { & $Add $Id $Address 'success' "Added $Address to the tenant Block list (Sender)" $null }
+                        } catch {
+                            $BlockError = Get-CippException -Exception $_
+                            foreach ($Address in $Senders) { & $Add $Id $Address 'error' "Failed to block $Address`: $($BlockError.NormalizedError)" $null }
+                        }
+                    }
+                    default { & $Add $Id $UserPrincipalName 'error' "Action '$Id' has no implementation" $null }
+                }
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                & $Add $Id $UserPrincipalName 'error' "$($Action.Label) failed: $($ErrorMessage.NormalizedError)" $null
+                Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC containment action $Id failed for $UserPrincipalName`: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+            }
+            if ($DeploymentId) {
+                $StepRows = @(for ($i = $RowsBefore; $i -lt $Rows.Count; $i++) { $Rows[$i] })
+                $StepStatus = if (@($StepRows | Where-Object { $_.state -eq 'error' }).Count -gt 0) { 'failed' } else { 'succeeded' }
+                $StepMessage = if ($StepRows.Count -gt 0) { @($StepRows.resultText) -join "`n" } else { 'Done' }
+                Set-CIPPAsyncDeploymentStep -JobId $DeploymentId -Name $UserPrincipalName -StepIndex $StepIndex -StepStatus $StepStatus -Message $StepMessage
+            }
+        }
+
+        # Persist and log a redacted copy: the password (copyField) must never reach the logbook or the run.
+        $RedactedRows = @(foreach ($Row in $Rows) {
+                $Text = [string]$Row.resultText
+                if ($Row.copyField) { $Text = $Text.Replace([string]$Row.copyField, '[redacted]') }
+                [pscustomobject]@{ Action = $Row.Action; Target = $Row.Target; state = $Row.state; resultText = $Text }
+            })
+        $Summary = "Executed BEC containment for $UserPrincipalName ($($Selected.Id -join ', '))$(if ($CaseId) { " [case $CaseId]" })"
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Summary -Sev 'Info' -LogData @($RedactedRows)
+        if ($CaseId) {
+            try {
+                $Run = Get-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId
+                if ($Run) {
+                    $By = if ($Headers -and $Headers.'x-ms-client-principal') { try { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } catch { 'CIPP' } } elseif ($Headers -is [string]) { $Headers } else { 'CIPP' }
+                    $History = @($Run.Containment | Where-Object { $_ }) + @([pscustomobject]@{ At = (Get-Date).ToUniversalTime().ToString('o'); By = [string]$By; Actions = @($Selected.Id); Results = $RedactedRows })
+                    $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Properties @{ Containment = $History; LastContainmentAt = (Get-Date).ToUniversalTime().ToString('o') }
+                }
+            } catch {
+                Write-Information "BEC containment: could not append the result to run $CaseId`: $($_.Exception.Message)"
+            }
+        }
+        if ($DeploymentId) {
+            $OverallStatus = if (@($Rows | Where-Object { $_.state -eq 'error' }).Count -gt 0) { 'failed' } else { 'succeeded' }
+            Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $UserPrincipalName -Status $OverallStatus
+        }
+        $Finished = $true
+    } finally {
+        # an unexpected throw must not leave the progress view spinning
+        if ($DeploymentId -and -not $Finished) { Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $UserPrincipalName -Status 'failed' }
+        Set-CippBecCaseContext -CaseId $null
+    }
+    return $(if ($Redacted) { $RedactedRows } else { $Rows.ToArray() })
+}
diff --git a/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecIPAnalysis.ps1 b/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecIPAnalysis.ps1
new file mode 100644
index 0000000000000..610eb6e9403dc
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecIPAnalysis.ps1
@@ -0,0 +1,165 @@
+function Invoke-CIPPBecIPAnalysis {
+    <#
+    .SYNOPSIS
+        Establishes which addresses behind a BEC case belong to the attacker and which to the user.
+    .DESCRIPTION
+        Shared by the investigation run and the IP review re-run:
+        1. Guidance: CIPP's IP allow/block list, trusted named locations and the Exchange IP lists
+           (always re-read, so a review that adds to the CIPP list takes effect).
+        2. Baseline: where the user signed in from before the window (re-used when passed in).
+        3. Geo for every address (cached by the geo helper), so hosting and proxy networks are known.
+        4. A first verdict pass, then the tenant-wide "who else signed in from here" lookup for every
+           address that is not already settled (Safe, Service or LikelyUser) - re-using peers already
+           looked up for this case - and, with -SampleColleagues, the sign-ins of a random sample of
+           recently active colleagues across the case's addresses (shared offices and VPNs show up
+           there), then the final verdict pass with all of it included.
+        Returns { Baseline, Guidance, Peers, PeersResult, Geo, Verdicts, Events } where Baseline,
+        Guidance and PeersResult are collector results for the completeness markers.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The investigated user's object id.
+    .PARAMETER UserPrincipalName
+        The investigated user.
+    .PARAMETER Results
+        The case payload so far (sign-ins, change sections, sent mail, mail activity, rules).
+    .PARAMETER Heuristics
+        The BEC heuristics object.
+    .PARAMETER WindowStart
+        Start of the investigation window (UTC).
+    .PARAMETER UsageLocation
+        The user's usage location.
+    .PARAMETER Anchor
+        Anchor mailbox for Exchange requests.
+    .PARAMETER Baseline
+        A baseline profile from an earlier run of this case; fetched when omitted.
+    .PARAMETER KnownPeers
+        Peer rows from an earlier run of this case, re-used instead of looked up again.
+    .PARAMETER Overrides
+        This case's investigator overrides.
+    .PARAMETER ExtraPeers
+        Hashtable of peer evidence gathered for users the investigator chose to correlate, merged in.
+    .PARAMETER TechnicianIPs
+        The addresses of the technicians who ran or reviewed the case ({ IP, By }).
+    .PARAMETER SampleColleagues
+        Correlate a random sample of recently active colleagues (the first run; a review re-uses the
+        peers stored on the case, which already include them).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [Parameter(Mandatory = $true)]$Results,
+        [Parameter(Mandatory = $true)]$Heuristics,
+        [Parameter(Mandatory = $true)][datetime]$WindowStart,
+        [string]$UsageLocation,
+        [string]$Anchor,
+        $Baseline,
+        [object[]]$KnownPeers = @(),
+        [object[]]$Overrides = @(),
+        [hashtable]$ExtraPeers = @{},
+        [object[]]$TechnicianIPs = @(),
+        [switch]$SampleColleagues
+    )
+
+    $BaselineDays = [int]($Heuristics.baseline.days ?? 30)
+    $BaselineStart = $WindowStart.ToUniversalTime().AddDays(-$BaselineDays)
+
+    $Guidance = try { Get-CIPPBecIPGuidance -TenantFilter $TenantFilter -Anchor $Anchor } catch { New-CIPPBecCollectorResult -Data @() -Error "IP guidance failed: $($_.Exception.Message)" }
+
+    $BaselineResult = if ($Baseline) {
+        New-CIPPBecCollectorResult -Data $Baseline -Count ([int]$Baseline.Successful)
+    } else {
+        try { Get-CIPPBecSignInBaseline -TenantFilter $TenantFilter -UserId $UserId -StartDate $BaselineStart -EndDate $WindowStart } catch {
+            New-CIPPBecCollectorResult -Data $null -Error "Sign-in baseline failed: $((Get-NormalizedError -message $_.Exception.Message))"
+        }
+    }
+
+    $Events = @(ConvertTo-CIPPBecIPEvents -Results $Results -UserPrincipalName $UserPrincipalName)
+    $SignIns = @($Results.SuspectUserSignIns | Where-Object { $_ })
+    $NonInteractive = @($Results.NonInteractiveSignIns | Where-Object { $_ })
+
+    $AllIPs = @(
+        @($SignIns.IPAddress) + @($NonInteractive.IPAddress) + @($Events.IP) |
+            Where-Object { $_ } | ForEach-Object { ConvertTo-CIPPBecHostAddress -Address ([string]$_) } | Where-Object { $_ } | Select-Object -Unique
+    )
+    $Geo = @{}
+    if ($AllIPs.Count -gt 0) {
+        try { $Geo = Get-CIPPGeoIPLocationBatch -IPs $AllIPs } catch { Write-Information "BEC IP analysis: geo lookup failed: $($_.Exception.Message)" }
+    }
+
+    $VerdictParams = @{
+        SignIns               = $SignIns
+        NonInteractiveSignIns = $NonInteractive
+        Events                = $Events
+        Baseline              = $BaselineResult.Data
+        Guidance              = @($Guidance.Data)
+        Overrides             = @($Overrides)
+        Geo                   = $Geo
+        UsageLocation         = $UsageLocation
+        Heuristics            = $Heuristics
+        TechnicianIPs         = @($TechnicianIPs)
+    }
+    $Preliminary = @(Get-CIPPBecIPVerdicts @VerdictParams -Peers $ExtraPeers)
+
+    $Peers = @{}
+    foreach ($Peer in @($KnownPeers | Where-Object { $_ -and $_.IP })) { $Peers[[string]$Peer.IP] = $Peer }
+    $ToLookUp = @($Preliminary | Where-Object { $_.Verdict -notin @('Safe', 'Service', 'LikelyUser') -and -not $Peers.ContainsKey($_.IP) } | ForEach-Object { $_.IP })
+    $PeerError = $null
+    if ($ToLookUp.Count -gt 0) {
+        try {
+            $Found = Get-CIPPBecIPPeers -TenantFilter $TenantFilter -UserId $UserId -IPs $ToLookUp -StartDate $BaselineStart -WindowStart $WindowStart
+            foreach ($Key in $Found.Keys) { $Peers[$Key] = $Found[$Key] }
+            $Failed = @($Found.Values | Where-Object { $_.Error })
+            if ($Failed.Count -gt 0) { $PeerError = "$($Failed.Count) address lookup(s) failed: $($Failed[0].Error)" }
+        } catch {
+            $PeerError = "Other-account lookup failed: $((Get-NormalizedError -message $_.Exception.Message))"
+        }
+    }
+    if ($SampleColleagues) {
+        try {
+            $Colleagues = @(Get-CIPPBecColleagueSample -TenantFilter $TenantFilter -ExcludeUserId $UserId -StartDate $WindowStart -Count ([int]($Heuristics.baseline.colleagueSample ?? 8)))
+            if ($Colleagues.Count -gt 0) {
+                $Sampled = Get-CIPPBecCorrelatedUserPeers -TenantFilter $TenantFilter -UserIds $Colleagues -IPs @($Preliminary.IP) -StartDate $BaselineStart -WindowStart $WindowStart
+                foreach ($Key in $Sampled.Keys) {
+                    if ($ExtraPeers.ContainsKey($Key)) { continue }
+                    $ExtraPeers[$Key] = $Sampled[$Key]
+                }
+            }
+        } catch {
+            $PeerError = (@($PeerError, "Colleague sample failed: $((Get-NormalizedError -message $_.Exception.Message))") | Where-Object { $_ }) -join '; '
+        }
+    }
+    # Correlated users (chosen, or sampled above) add to - never replace - the tenant-wide evidence
+    foreach ($Key in $ExtraPeers.Keys) {
+        $Extra = $ExtraPeers[$Key]
+        if (-not $Peers.ContainsKey($Key)) { $Peers[$Key] = $Extra; continue }
+        $Merged = $Peers[$Key]
+        $Users = @(@($Merged.Users) + @($Extra.Users) | Where-Object { $_ } | Select-Object -Unique)
+        $Peers[$Key] = [pscustomobject]@{
+            IP                     = $Key
+            OtherUsers             = $Users.Count
+            # the same colleague can be found by both lookups: take the larger count, never the sum
+            OtherUsersBefore       = [Math]::Max([int]$Merged.OtherUsersBefore, [int]$Extra.OtherUsersBefore)
+            OtherUsersInWindowOnly = [Math]::Max([int]$Merged.OtherUsersInWindowOnly, [int]$Extra.OtherUsersInWindowOnly)
+            Users                  = $Users
+            Accounts               = @($Merged.Accounts)
+            Sampled                = [bool]$Merged.Sampled
+            Error                  = $Merged.Error
+        }
+    }
+    $Verdicts = @(Get-CIPPBecIPVerdicts @VerdictParams -Peers $Peers)
+
+    [pscustomobject]@{
+        Baseline    = $BaselineResult
+        Guidance    = $Guidance
+        Peers       = $Peers
+        PeersResult = New-CIPPBecCollectorResult -Data @($Peers.Values) -Error $PeerError
+        Geo         = $Geo
+        Verdicts    = $Verdicts
+        Events      = $Events
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecIPReview.ps1 b/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecIPReview.ps1
new file mode 100644
index 0000000000000..f80c9515d2bf6
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Invoke-CIPPBecIPReview.ps1
@@ -0,0 +1,192 @@
+function Invoke-CIPPBecIPReview {
+    <#
+    .SYNOPSIS
+        Re-judges a BEC case's IP addresses with the investigator's input and re-reads what depends on them.
+    .DESCRIPTION
+        The background half of ExecBECIPReview. For a completed case it keeps the original window and
+        everything that does not depend on the verdicts, and replaces what does:
+        - the investigator's overrides (Safe / Compromised per address or CIDR range) become the case's
+          IPOverrides and decide those addresses outright;
+        - chosen accounts are correlated (Get-CIPPBecCorrelatedUserPeers) and added to the peers;
+        - the address lists are re-read, so an entry just added to CIPP's IP allow/block list counts;
+        - mailbox activity is re-read (its raw records feed the detail pass), the verdicts are
+          re-judged with the stored baseline and peers, and the attacker activity and delegated
+          mailboxes are re-collected;
+        - the rows are re-stamped, the score recomputed, and the review appended to IPReviewHistory.
+        Progress is reported per step on the DeploymentId row, like containment.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER CaseId
+        The BEC case (run) to review.
+    .PARAMETER Overrides
+        { IP (address or CIDR range), Verdict (Safe|Compromised), Note } - the complete set for the case.
+    .PARAMETER CorrelateUserIds
+        Object ids of accounts whose sign-ins to correlate with the case's addresses.
+    .PARAMETER DeploymentId
+        Live-progress job id.
+    .PARAMETER Headers
+        The requesting user's headers (for logging and the review history).
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$CaseId,
+        [object[]]$Overrides = @(),
+        [string[]]$CorrelateUserIds = @(),
+        [string]$DeploymentId,
+        $Headers,
+        [string]$APIName = 'BECIPReview'
+    )
+
+    $StepTitles = @('Loading the case', 'Correlating the chosen accounts', 'Re-reading mailbox activity', 'Re-judging the IP addresses', 'Re-reading attacker activity and delegated mailboxes', 'Scoring and saving')
+    $Name = $CaseId
+    $Step = { param($Index, $Status, $Message) if ($DeploymentId) { Set-CIPPAsyncDeploymentStep -JobId $DeploymentId -Name $Name -StepIndex $Index -StepStatus $Status -Message ([string]$Message) } }
+    if ($DeploymentId) {
+        try {
+            $null = New-CIPPAsyncDeployment -JobId $DeploymentId -Names @($Name) -StepTitles $StepTitles -Source 'BECIPReview' -TenantFilter $TenantFilter
+            Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $Name -Status 'running'
+        } catch { Write-Information "BEC IP review: progress unavailable: $($_.Exception.Message)" }
+    }
+    if (-not $PSCmdlet.ShouldProcess("$TenantFilter/$CaseId", 'Re-judge the case IP addresses')) { return }
+
+    $Current = 0
+    try {
+        & $Step 0 'running' 'In progress'
+        $Heuristics = Get-CIPPBecHeuristics
+        $Run = Get-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -IncludeResults
+        if (-not $Run -or $Run.Status -ne 'Completed' -or -not $Run.Results) { throw "Case $CaseId is not a completed investigation in $TenantFilter" }
+        $Results = $Run.Results
+        $UserName = [string]($Run.UserPrincipalName ?? $Results.UserPrincipalName)
+        $UserId = [string]$Run.UserId
+        $WindowDays = [int]($Results.AnalysisWindowDays ?? $Heuristics.window.days ?? 7)
+        $EndDate = ([datetime]$Results.ExtractedAt).ToUniversalTime()
+        $StartDate = $EndDate.AddDays(-$WindowDays)
+        $BaselineStart = $StartDate.AddDays(-[int]($Heuristics.baseline.days ?? 30))
+        $UsageLocation = [string]$Results.LocationAnalysis.UsageLocation
+        # the technicians who ran or reviewed the case: the reviewer's own address (first x-forwarded-for
+        # hop of the stored request headers) joins the ones already on the case
+        $ReviewerIP = ConvertTo-CIPPBecHostAddress -Address ([string](([string]$Headers.'x-forwarded-for' -split ',')[0])).Trim()
+        $ReviewerName = if ($Headers -and $Headers.'x-ms-client-principal') { try { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } catch { $null } } else { $null }
+        $TechnicianIPs = @(
+            @($Results.IPTechnicians | Where-Object { $_ -and $_.IP })
+            if ($ReviewerIP -and $ReviewerIP -notin @($Results.IPTechnicians.IP)) { [pscustomobject]@{ IP = $ReviewerIP; By = [string]$ReviewerName } }
+        )
+        $CaseOverrides = @(foreach ($Override in @($Overrides | Where-Object { $_ })) {
+                $Verdict = [string]($Override.Verdict.value ?? $Override.Verdict)
+                if ($Verdict -notin @('Safe', 'Compromised')) { continue }
+                [pscustomobject]@{ Range = ConvertTo-CIPPIPRange -Value ([string]($Override.IP ?? $Override.Range)); Verdict = $Verdict; Note = [string]$Override.Note }
+            })
+        $Completeness = $Results.Completeness
+        if (-not $Completeness) { $Completeness = [pscustomobject]@{}; $Results | Add-Member -NotePropertyName 'Completeness' -NotePropertyValue $Completeness -Force }
+        $Mark = {
+            param($MarkerName, $Result)
+            $Info = if ($Result.Error) { Get-CIPPBecErrorInfo -Message ([string]$Result.Error) } else { $null }
+            $Completeness | Add-Member -NotePropertyName $MarkerName -NotePropertyValue ([pscustomobject]@{
+                    Complete    = [bool]$Result.Complete
+                    Cap         = $Result.Cap
+                    Error       = if ($Info) { $Info.Message } else { $Result.Error }
+                    Skipped     = [bool]($Result.Skipped -or ($Info -and $Info.Skipped))
+                    Requirement = if ($Result.Requirement) { $Result.Requirement } elseif ($Info) { $Info.Requirement } else { $null }
+                    Count       = [int]$Result.Count
+                }) -Force
+        }
+        $Set = { param($Property, $Value) $Results | Add-Member -NotePropertyName $Property -NotePropertyValue $Value -Force }
+        & $Step 0 'succeeded' "Case $CaseId for $UserName"
+
+        $Current = 1
+        & $Step 1 'running' 'In progress'
+        $ExtraPeers = @{}
+        if (@($CorrelateUserIds | Where-Object { $_ }).Count -gt 0) {
+            $CaseIPs = @(@($Results.IPVerdicts.IP) + @($Results.SuspectUserSignIns.IPAddress) + @($Results.NonInteractiveSignIns.IPAddress) | Where-Object { $_ } | ForEach-Object { ConvertTo-CIPPBecHostAddress -Address ([string]$_) } | Where-Object { $_ } | Select-Object -Unique)
+            $ExtraPeers = Get-CIPPBecCorrelatedUserPeers -TenantFilter $TenantFilter -UserIds $CorrelateUserIds -IPs $CaseIPs -StartDate $BaselineStart -WindowStart $StartDate
+            & $Step 1 'succeeded' "$(@($CorrelateUserIds).Count) account(s) correlated; $($ExtraPeers.Count) of the case's addresses shared"
+        } else {
+            & $Step 1 'succeeded' 'No accounts chosen'
+        }
+
+        $Current = 2
+        & $Step 2 'running' 'In progress'
+        $Activity = try { Get-CIPPBecMailActivity -TenantFilter $TenantFilter -UserPrincipalName $UserName -StartDate $StartDate -EndDate $EndDate -Heuristics $Heuristics -Anchor $UserName } catch {
+            New-CIPPBecCollectorResult -Data @() -Error "Mailbox activity failed: $((Get-NormalizedError -message $_.Exception.Message))"
+        }
+        & $Mark 'MailActivity' $Activity
+        & $Set 'MailActivity' @($Activity.Data)
+        & $Set 'MailActivitySummary' $Activity.Summary
+        $MailRecords = @($Activity.Records | Where-Object { $_ })
+        & $Step 2 'succeeded' "$(@($Activity.Data).Count) activity group(s), $($MailRecords.Count) record(s)"
+
+        $Current = 3
+        & $Step 3 'running' 'In progress'
+        $Analysis = Invoke-CIPPBecIPAnalysis -TenantFilter $TenantFilter -UserId $UserId -UserPrincipalName $UserName -Results $Results -Heuristics $Heuristics -WindowStart $StartDate -UsageLocation $UsageLocation -Anchor $UserName -Baseline $Results.IPBaseline -KnownPeers @($Results.IPPeers) -Overrides $CaseOverrides -ExtraPeers $ExtraPeers -TechnicianIPs $TechnicianIPs
+        & $Mark 'SignInBaseline' $Analysis.Baseline
+        & $Mark 'IPGuidance' $Analysis.Guidance
+        & $Mark 'IPPeers' $Analysis.PeersResult
+        & $Mark 'IPVerdicts' ([pscustomobject]@{ Complete = $true; Count = @($Analysis.Verdicts).Count })
+        $Verdicts = @($Analysis.Verdicts)
+        & $Set 'IPVerdicts' $Verdicts
+        & $Set 'IPGuidance' @($Analysis.Guidance.Data)
+        & $Set 'IPPeers' @($Analysis.Peers.Values)
+        & $Set 'IPOverrides' @($CaseOverrides)
+        & $Set 'IPTechnicians' @($TechnicianIPs)
+        Set-CIPPBecIPVerdictStamp -Results $Results -Verdicts $Verdicts
+        $Attackers = @($Verdicts | Where-Object { $_.Verdict -in @('Compromised', 'LikelyAttacker') }).Count
+        & $Step 3 'succeeded' "$($Verdicts.Count) address(es): $Attackers attacker, $(@($Verdicts | Where-Object { $_.Verdict -in @('Suspicious', 'Unknown') }).Count) suspicious or unknown"
+
+        $Current = 4
+        & $Step 4 'running' 'In progress'
+        $Attacker = Get-CIPPBecAttackerActivity -TenantFilter $TenantFilter -UserPrincipalName $UserName -StartDate $StartDate -EndDate $EndDate -Heuristics $Heuristics -Verdicts $Verdicts -SignIns @($Results.SuspectUserSignIns) -NonInteractiveSignIns @($Results.NonInteractiveSignIns) -MailRecords $MailRecords -SharingChanges @($Results.SharingChanges) -Anchor $UserName
+        & $Mark 'AttackerMailActivity' $Attacker.Mail
+        & $Mark 'AttackerFileActivity' $Attacker.Files
+        & $Mark 'LinkUsage' $Attacker.LinkUsage
+        & $Mark 'FormsActivity' $Attacker.Forms
+        & $Set 'AttackerMailActivity' @($Attacker.Mail.Data)
+        & $Set 'AttackerMailSummary' $Attacker.Mail.Summary
+        & $Set 'AttackerFileActivity' @($Attacker.Files.Data)
+        & $Set 'AttackerFileSummary' $Attacker.Files.Summary
+        & $Set 'LinkUsage' @($Attacker.LinkUsage.Data)
+        & $Set 'FormsActivity' @($Attacker.Forms.Data)
+        & $Set 'FormsSummary' $Attacker.Forms.Summary
+        $Delegated = Get-CIPPBecDelegatedAccess -TenantFilter $TenantFilter -UserPrincipalName $UserName -UserDisplayName ([string]$Run.DisplayName) -PermissionChanges @($Results.MailboxPermissionChanges) -MailActivity @($Activity.Data) -AttackerMail @($Attacker.Mail.Data)
+        & $Mark 'DelegatedAccess' $Delegated
+        & $Set 'DelegatedAccess' @($Delegated.Data)
+        $Blast = Get-CIPPBecBlastRadius -TenantFilter $TenantFilter -UserId $UserId -UserPrincipalName $UserName -Verdicts $Verdicts -Peers $Analysis.Peers -StartDate $StartDate -EndDate $EndDate -Heuristics $Heuristics -Anchor $UserName
+        & $Mark 'BlastRadius' $Blast
+        & $Set 'BlastRadius' @($Blast.Data)
+        & $Step 4 'succeeded' "$(@($Attacker.Mail.Data).Count) mail row(s), $(@($Attacker.Files.Data).Count) file row(s), $(@($Attacker.Forms.Data).Count) Forms action(s), $(@($Delegated.Data).Count) delegated mailbox(es), $(@($Blast.Data | Where-Object { $_.Reached }).Count) other account(s) reached"
+
+        $Current = 5
+        & $Step 5 'running' 'In progress'
+        $By = if ($Headers -and $Headers.'x-ms-client-principal') { try { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } catch { 'CIPP' } } else { 'CIPP' }
+        $History = @(@($Results.IPReviewHistory | Where-Object { $_ }) + @([pscustomobject]@{
+                    At              = (Get-Date).ToUniversalTime().ToString('o')
+                    By              = [string]$By
+                    Overrides       = @($CaseOverrides)
+                    CorrelatedUsers = @($CorrelateUserIds | Where-Object { $_ })
+                    AttackerIPs     = $Attackers
+                }))
+        & $Set 'IPReviewHistory' $History
+        & $Set 'UserPrincipalName' $UserName
+        $Score = Get-CIPPBecScore -Results $Results -Heuristics $Heuristics
+        & $Set 'Score' $Score
+        $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Results $Results -Properties @{
+            Score           = [int]$Score.Value
+            Level           = [string]$Score.Level
+            LastIPReviewAt  = (Get-Date).ToUniversalTime().ToString('o')
+            IncompleteCount = @($Completeness.PSObject.Properties | Where-Object { -not $_.Value.Complete }).Count
+        }
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Reviewed the IP addresses of BEC case $CaseId for $UserName`: $Attackers attacker address(es), threat level $($Score.Level) ($($Score.Value))" -sev 'Info'
+        & $Step 5 'succeeded' "Threat level $($Score.Level) ($($Score.Value))"
+        if ($DeploymentId) { Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $Name -Status 'succeeded' }
+        return "Reviewed the IP addresses of case $CaseId`: $Attackers attacker address(es), threat level $($Score.Level) ($($Score.Value))"
+    } catch {
+        $Message = Get-NormalizedError -message $_.Exception.Message
+        & $Step $Current 'failed' $Message
+        if ($DeploymentId) { Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $Name -Status 'failed' }
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC IP review of case $CaseId failed: $Message" -sev 'Error'
+        throw
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/New-CIPPBecCaseId.ps1 b/Modules/CIPPCore/Public/BEC/New-CIPPBecCaseId.ps1
new file mode 100644
index 0000000000000..d159ba163feff
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/New-CIPPBecCaseId.ps1
@@ -0,0 +1,17 @@
+function New-CIPPBecCaseId {
+    <#
+    .SYNOPSIS
+        Mints a new BEC case id.
+    .DESCRIPTION
+        Case ids are BEC-<yyyyMMddHHmmss>-<6 hex>: the timestamp prefix keeps them chronologically
+        sortable as table RowKeys (so a user's run history lists in order) and the random suffix keeps
+        two runs queued in the same second distinct. The id is stamped on the run row, the results
+        row, every logbook entry written during the case and the evidence package.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    return 'BEC-{0}-{1}' -f (Get-Date).ToUniversalTime().ToString('yyyyMMddHHmmss'), [guid]::NewGuid().ToString('N').Substring(0, 6)
+}
diff --git a/Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1 b/Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1
new file mode 100644
index 0000000000000..a0f24a797c0c0
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1
@@ -0,0 +1,57 @@
+function New-CIPPBecCollectorResult {
+    <#
+    .SYNOPSIS
+        Builds the uniform result object every BEC collector returns.
+    .DESCRIPTION
+        Every collector in the BEC check returns { Data, Complete, Cap, Error, Skipped, Requirement, Count }
+        so Push-BECRun can flatten the data into the report and record an honest completeness marker per
+        collector. A collector that hit a paging cap reports Complete=$false with the cap it hit; one that
+        failed unexpectedly reports Complete=$false with the error text; one that could not run because a
+        licence or permission is missing reports Complete=$false, Skipped=$true and the Requirement (e.g.
+        'Entra ID P2'). All three keep an empty Data array, so an empty section is never mistaken for a
+        clean one - and a skipped check is never mistaken for a passed one.
+    .PARAMETER Data
+        The collected rows or object. Defaults to an empty array.
+    .PARAMETER Complete
+        Whether the collector saw everything it asked for. Defaults to $true.
+    .PARAMETER Cap
+        The cap that was hit (page count, row count) when Complete is $false because of a limit.
+    .PARAMETER Error
+        Error text when the collector failed.
+    .PARAMETER Count
+        Number of items in Data; computed when not supplied.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        $Data = @(),
+        [bool]$Complete = $true,
+        $Cap = $null,
+        # Exposed to callers as -Error; the variable avoids the $Error automatic variable.
+        [Alias('Error')][string]$ErrorText = $null,
+        # The check could not run because an entitlement is missing (licence or permission), not
+        # because it failed - so it is neither complete nor a pass.
+        [bool]$Skipped = $false,
+        # What the skipped check needs, shown to the analyst (e.g. 'Entra ID P2', 'Defender for Office 365 Plan 2').
+        [string]$Requirement = $null,
+        $Count = $null
+    )
+
+    if ($null -eq $Data) { $Data = @() }
+    if ($null -eq $Count) {
+        $Count = @($Data).Count
+    }
+    if (-not [string]::IsNullOrWhiteSpace($ErrorText)) { $Complete = $false }
+    if ($Skipped) { $Complete = $false }
+
+    return [pscustomobject]@{
+        Data        = $Data
+        Complete    = [bool]$Complete
+        Cap         = $Cap
+        Error       = if ([string]::IsNullOrWhiteSpace($ErrorText)) { $null } else { $ErrorText }
+        Skipped     = [bool]$Skipped
+        Requirement = if ([string]::IsNullOrWhiteSpace($Requirement)) { $null } else { $Requirement }
+        Count       = [int]$Count
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/New-CIPPBecEvidencePackage.ps1 b/Modules/CIPPCore/Public/BEC/New-CIPPBecEvidencePackage.ps1
new file mode 100644
index 0000000000000..76f7fe6a58763
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/New-CIPPBecEvidencePackage.ps1
@@ -0,0 +1,142 @@
+function New-CIPPBecEvidencePackage {
+    <#
+    .SYNOPSIS
+        Builds the evidence package (ZIP) for a BEC run.
+    .DESCRIPTION
+        Collates everything CIPP holds about a case into one ZIP: the results payload as JSON, one
+        CSV per finding set, the score, the containment history, every logbook line stamped with the
+        case id, and the full and C-suite-summary report PDFs rendered server-side. Nothing is stored:
+        the ZIP is returned to the caller to hand to the browser. Everything inside is metadata the run
+        already collected; passwords were redacted before they were stored and are scrubbed from the
+        logbook copy again here.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER CaseId
+        The run to package.
+    .PARAMETER Headers
+        CIPP request headers, for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$CaseId,
+        $Headers,
+        [string]$APIName = 'BECEvidenceExport'
+    )
+
+    $Run = Get-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -IncludeResults
+    if (-not $Run) { throw "BEC run $CaseId was not found for $TenantFilter" }
+    if ($Run.Status -ne 'Completed') { throw "BEC run $CaseId is $($Run.Status); only completed runs can be exported" }
+    $Results = $Run.Results
+    $GeneratedUtc = (Get-Date).ToUniversalTime()
+    $Utf8 = [System.Text.UTF8Encoding]::new($false)
+
+    # Flatten a row for CSV: arrays join, nested objects become compact JSON.
+    $Flatten = {
+        param($Row)
+        $Out = [ordered]@{}
+        foreach ($Property in $Row.PSObject.Properties) {
+            $Value = $Property.Value
+            $Out[$Property.Name] = if ($null -eq $Value) { '' }
+            elseif ($Value -is [string] -or $Value -is [ValueType]) { $Value }
+            elseif ($Value -is [System.Collections.IEnumerable]) { @($Value | ForEach-Object { if ($_ -is [string] -or $_ -is [ValueType]) { $_ } else { ConvertTo-Json -InputObject $_ -Compress -Depth 5 } }) -join '; ' }
+            else { ConvertTo-Json -InputObject $Value -Compress -Depth 5 }
+        }
+        [pscustomobject]$Out
+    }
+
+    $Files = [ordered]@{}
+    $Files['results.json'] = $Utf8.GetBytes((ConvertTo-Json -InputObject $Results -Depth 20))
+    $CsvSections = @('NewRules', 'InboxRuleChanges', 'MailboxPermissionChanges', 'SentMessages', 'SafelistChanges', 'SharingChanges', 'SuspectUserSignIns', 'SuspectUserDevices', 'NewUsers', 'ChangedPasswords', 'MFADevices', 'IntuneDevices', 'AddedApps', 'MaliciousSPs', 'Delegations', 'MailboxAddIns', 'UserGrants', 'TransportRuleChanges', 'TransportRulesFlagged', 'ReceivedMailFindings', 'DefenderDetections', 'DirectoryAudits', 'RegisteredDevices', 'NonInteractiveSignIns', 'MailActivity')
+    foreach ($Section in $CsvSections) {
+        $Rows = @($Results.$Section | Where-Object { $_ -and $_ -isnot [string] })
+        if ($Rows.Count -eq 0) { continue }
+        $Csv = @($Rows | ForEach-Object { & $Flatten $_ } | ConvertTo-Csv -NoTypeInformation) -join "`r`n"
+        $Files["findings/$Section.csv"] = $Utf8.GetBytes($Csv)
+    }
+    if ($Results.RiskState -and @($Results.RiskState.Detections).Count -gt 0) {
+        $Files['findings/RiskDetections.csv'] = $Utf8.GetBytes((@($Results.RiskState.Detections | ForEach-Object { & $Flatten $_ } | ConvertTo-Csv -NoTypeInformation) -join "`r`n"))
+    }
+    if ($Results.Score) { $Files['score.json'] = $Utf8.GetBytes((ConvertTo-Json -InputObject $Results.Score -Depth 10)) }
+    $Files['containment.json'] = $Utf8.GetBytes((ConvertTo-Json -InputObject @($Run.Containment | Where-Object { $_ }) -Depth 15))
+
+    # Logbook: every line stamped with the case id, across the day partitions the case spans.
+    $LogRows = @()
+    try {
+        $From = try { ([datetime]($Run.RequestedAt ?? $Run.ExtractedAt)).ToUniversalTime().AddDays(-1) } catch { $GeneratedUtc.AddDays(-30) }
+        if ($From -lt $GeneratedUtc.AddDays(-60)) { $From = $GeneratedUtc.AddDays(-60) }
+        $LogTable = Get-CIPPTable -TableName 'CippLogs'
+        $Filter = "BecCaseId eq '$($CaseId -replace "'", "''")' and PartitionKey ge '$($From.ToString('yyyyMMdd'))' and PartitionKey le '$($GeneratedUtc.AddDays(1).ToString('yyyyMMdd'))'"
+        $LogRows = @(Get-CIPPAzDataTableEntity @LogTable -Filter $Filter | Where-Object { $_ } | Sort-Object -Property Timestamp | ForEach-Object {
+                $LogData = [string]$_.LogData
+                # belt and braces: a copyField (password) never leaves the system through the package
+                $LogData = [regex]::Replace($LogData, '"copyField"\s*:\s*"[^"]*"', '"copyField":"[redacted]"')
+                [pscustomobject]@{
+                    Timestamp = $_.Timestamp
+                    Tenant    = $_.Tenant
+                    API       = $_.API
+                    Severity  = $_.Severity
+                    Username  = $_.Username
+                    Message   = $_.Message
+                    LogData   = $LogData
+                    RowKey    = $_.RowKey
+                }
+            })
+    } catch {
+        Write-Information "BEC evidence: logbook query failed for $CaseId`: $($_.Exception.Message)"
+    }
+    $Files['logbook.json'] = $Utf8.GetBytes((ConvertTo-Json -InputObject @($LogRows) -Depth 10))
+
+    # Render the report PDFs server-side (the full report and the C-suite summary) through the same
+    # builder and kit the report endpoint uses. The builder reads containment off becData.Run, so
+    # attach the run block exactly as ExecGetBecReportPdf does. A render failure must not lose the rest
+    # of the evidence, so it is caught and the package ships without the PDFs.
+    try {
+        $BecData = $Results
+        $RunBlock = [pscustomobject]@{
+            CaseId      = $Run.CaseId
+            Status      = $Run.Status
+            ExtractedAt = $Run.ExtractedAt
+            RequestedAt = $Run.RequestedAt
+            RequestedBy = $Run.RequestedBy
+            Containment = $Run.Containment
+        }
+        $BecData | Add-Member -NotePropertyName 'Run' -NotePropertyValue $RunBlock -Force
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter
+        $DisplayName = @($Run.DisplayName, $Run.UserPrincipalName, $Run.UserId) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 1
+        $UserData = [pscustomobject]@{ displayName = $DisplayName; userPrincipalName = $Run.UserPrincipalName; id = $Run.UserId }
+        $Full = Build-CippBecReportTree -UserData $UserData -BecData $BecData -TenantName $TenantName
+        $Files['report-full.pdf'] = ConvertTo-CippReportPdf -Blocks $Full.Blocks -Variables $Full.Variables -TenantName $TenantName -TenantFilter $TenantFilter -ReportName 'BEC Analysis Report'
+        $Summary = Build-CippBecReportTree -UserData $UserData -BecData $BecData -TenantName $TenantName -Variant summary
+        $Files['report-summary.pdf'] = ConvertTo-CippReportPdf -Blocks $Summary.Blocks -Variables $Summary.Variables -TenantName $TenantName -TenantFilter $TenantFilter -ReportName 'BEC Analysis Report'
+    } catch {
+        Write-Information "BEC evidence: server-side PDF render failed for $CaseId`: $($_.Exception.Message)"
+    }
+
+    $Stream = [System.IO.MemoryStream]::new()
+    $Archive = [System.IO.Compression.ZipArchive]::new($Stream, [System.IO.Compression.ZipArchiveMode]::Create, $true)
+    try {
+        foreach ($Name in $Files.Keys) {
+            $Entry = $Archive.CreateEntry($Name, [System.IO.Compression.CompressionLevel]::Optimal)
+            $EntryStream = $Entry.Open()
+            try { $EntryStream.Write($Files[$Name], 0, $Files[$Name].Length) } finally { $EntryStream.Dispose() }
+        }
+    } finally {
+        $Archive.Dispose()
+    }
+    $ZipBytes = $Stream.ToArray()
+    $Stream.Dispose()
+
+    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Exported the evidence package for BEC case $CaseId ($($Files.Count) files, $([math]::Round($ZipBytes.Length / 1KB)) KB); the package was handed to the requester and not stored" -Sev 'Info'
+
+    return [pscustomobject]@{
+        CaseId    = $CaseId
+        Bytes     = $ZipBytes.Length
+        FileCount = $Files.Count
+        ZipBytes  = $ZipBytes
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/New-CIPPBecRunRequest.ps1 b/Modules/CIPPCore/Public/BEC/New-CIPPBecRunRequest.ps1
new file mode 100644
index 0000000000000..523cc3f37bdec
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/New-CIPPBecRunRequest.ps1
@@ -0,0 +1,89 @@
+function New-CIPPBecRunRequest {
+    <#
+    .SYNOPSIS
+        Prepares a BEC investigation: the history row, the live-progress job and the queue item.
+    .DESCRIPTION
+        Every way of starting a run (the user's page, the bulk action) goes through here so the run
+        is visible the same way everywhere: a Waiting row in BecReports (the history), an
+        async-deployment job keyed on the case id (the live progress the page polls; Queued until a
+        worker picks it up) and the batch item to hand to Start-CIPPOrchestrator. Nothing is queued
+        here; the caller queues one or many items. Every run is the full investigation.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        Object id of the user to investigate.
+    .PARAMETER UserPrincipalName
+        UPN of the user (used by the run and as the progress row name).
+    .PARAMETER DisplayName
+        Display name for the history row.
+    .PARAMETER RequestedBy
+        Who asked for the run.
+    .PARAMETER QueueId
+        Optional CIPP queue entry id (bulk runs).
+    .PARAMETER RequestedFromIP
+        The requesting technician's address (first x-forwarded-for hop). The run treats it as the
+        technician's, never the user's or the attacker's.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [string]$UserPrincipalName,
+        [string]$DisplayName,
+        [string]$RequestedBy = 'CIPP',
+        [string]$QueueId,
+        [string]$RequestedFromIP
+    )
+
+    # The UPN drives every mailbox-scoped collector and the audit-record attribution in the run; a blank
+    # one makes those throw "empty string" and the tenant-wide record filter match everything. Resolve it
+    # from the object id when the caller didn't supply one (an API/MCP client, or a race on the page) so
+    # the run, the history row and the progress name all carry a real user.
+    if ([string]::IsNullOrWhiteSpace($UserPrincipalName)) {
+        try {
+            $Resolved = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$($UserId)?`$select=userPrincipalName,displayName" -tenantid $TenantFilter -AsApp $true
+            if (-not [string]::IsNullOrWhiteSpace($Resolved.userPrincipalName)) { $UserPrincipalName = [string]$Resolved.userPrincipalName }
+            if ([string]::IsNullOrWhiteSpace($DisplayName) -and -not [string]::IsNullOrWhiteSpace($Resolved.displayName)) { $DisplayName = [string]$Resolved.displayName }
+        } catch {
+            Write-Information "BEC: could not resolve a UPN for $UserId in $TenantFilter`: $($_.Exception.Message)"
+        }
+    }
+
+    $CaseId = New-CIPPBecCaseId
+    $Name = if ([string]::IsNullOrWhiteSpace($UserPrincipalName)) { $UserId } else { $UserPrincipalName }
+    if ($PSCmdlet.ShouldProcess("$Name in $TenantFilter", "Prepare BEC investigation $CaseId")) {
+        $Properties = @{
+            UserId            = $UserId
+            UserPrincipalName = [string]$UserPrincipalName
+            Status            = 'Waiting'
+            RequestedBy       = $RequestedBy
+            RequestedAt       = (Get-Date).ToUniversalTime().ToString('o')
+        }
+        if ($DisplayName) { $Properties.DisplayName = $DisplayName }
+        if ($QueueId) { $Properties.QueueId = $QueueId }
+        if ($RequestedFromIP) { $Properties.RequestedFromIP = $RequestedFromIP }
+        $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -Replace -Properties $Properties
+        # The progress job: every step pending, row status queued, until Push-BECRun takes over.
+        $null = New-CIPPAsyncDeployment -JobId $CaseId -Names @($Name) -StepTitles @((Get-CIPPBecRunSteps).Title) -Source 'BEC' -TenantFilter $TenantFilter
+    }
+
+    $Item = @{
+        FunctionName = 'BECRun'
+        UserID       = $UserId
+        TenantFilter = $TenantFilter
+        userName     = [string]$UserPrincipalName
+        CaseId       = $CaseId
+    }
+    if ($RequestedFromIP) { $Item.RequestedFromIP = $RequestedFromIP; $Item.RequestedBy = $RequestedBy }
+    if ($QueueId) {
+        $Item.QueueId = $QueueId
+        $Item.QueueName = "BEC investigation $Name"
+    }
+
+    return [pscustomobject]@{
+        CaseId = $CaseId
+        Item   = $Item
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/New-CIPPBecTargetedCAPolicy.ps1 b/Modules/CIPPCore/Public/BEC/New-CIPPBecTargetedCAPolicy.ps1
new file mode 100644
index 0000000000000..d228286e48dbe
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/New-CIPPBecTargetedCAPolicy.ps1
@@ -0,0 +1,100 @@
+function New-CIPPBecTargetedCAPolicy {
+    <#
+    .SYNOPSIS
+        Creates a temporary Conditional Access policy that targets one user, and schedules its removal.
+    .DESCRIPTION
+        The softer alternative to blocking sign-in for a VIP who must keep working: a policy scoped to
+        the investigated user that requires MFA (optionally plus a compliant device) for every
+        application, enabled or report-only. The policy description carries the case id and expiry,
+        a scheduled task runs Remove-CIPPBecTargetedCAPolicy at the expiry, and an existing policy for
+        the same user is reused rather than duplicated.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id.
+    .PARAMETER UserPrincipalName
+        The user's UPN (for the display name).
+    .PARAMETER State
+        enabled or enabledForReportingButNotEnabled.
+    .PARAMETER Controls
+        mfa, or mfaAndCompliantDevice.
+    .PARAMETER ExpiresHours
+        Lifetime in hours (1-168).
+    .PARAMETER CaseId
+        The BEC case id recorded in the description.
+    .PARAMETER Headers
+        CIPP request headers for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserId,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [ValidateSet('enabled', 'enabledForReportingButNotEnabled')][string]$State = 'enabled',
+        [ValidateSet('mfa', 'mfaAndCompliantDevice')][string]$Controls = 'mfa',
+        [ValidateRange(1, 168)][int]$ExpiresHours = 24,
+        [string]$CaseId,
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    $Tag = "ManagedBy=CIPP-BEC;Target=$UserId"
+    $Existing = @(New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?$select=id,displayName,description,state&$top=999' -tenantid $TenantFilter -AsApp $true | Where-Object { [string]$_.description -like "*$Tag*" })
+    if ($Existing.Count -gt 0) {
+        $Message = "A CIPP BEC containment policy already exists for $UserPrincipalName ('$($Existing[0].displayName)', $($Existing[0].state)); not creating another."
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info'
+        return $Message
+    }
+
+    $ExpiresUtc = (Get-Date).ToUniversalTime().AddHours($ExpiresHours)
+    $DisplayName = "CIPP BEC containment - $UserPrincipalName - expires $($ExpiresUtc.ToString('yyyy-MM-dd HH:mm'))Z"
+    $BuiltIn = if ($Controls -eq 'mfaAndCompliantDevice') { @('mfa', 'compliantDevice') } else { @('mfa') }
+    $Body = ConvertTo-Json -Depth 10 -InputObject @{
+        displayName   = $DisplayName
+        state         = $State
+        description   = "$Tag;CaseId=$CaseId;ExpiresUtc=$($ExpiresUtc.ToString('o'))"
+        conditions    = @{
+            users          = @{ includeUsers = @($UserId) }
+            applications   = @{ includeApplications = @('All') }
+            clientAppTypes = @('all')
+        }
+        grantControls = @{
+            operator        = if ($BuiltIn.Count -gt 1) { 'AND' } else { 'OR' }
+            builtInControls = $BuiltIn
+        }
+    }
+    if (-not $PSCmdlet.ShouldProcess($UserPrincipalName, "Create targeted CA policy ($State, $Controls, $ExpiresHours h)")) { return }
+    try {
+        $Policy = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies' -tenantid $TenantFilter -type POST -body $Body -AsApp $true
+        $Message = "Created Conditional Access policy '$DisplayName' ($State, $($BuiltIn -join ' + ')) for $UserPrincipalName"
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info'
+
+        # Expiry: a scheduled removal. The policy name carries the expiry too, so an operator can see it.
+        try {
+            $Task = [pscustomobject]@{
+                TenantFilter  = $TenantFilter
+                Name          = "Remove BEC containment CA policy for $UserPrincipalName"
+                Command       = @{ value = 'Remove-CIPPBecTargetedCAPolicy'; label = 'Remove-CIPPBecTargetedCAPolicy' }
+                Parameters    = [pscustomobject]@{ TenantFilter = $TenantFilter; PolicyId = $Policy.id }
+                ScheduledTime = [string][int64]([System.DateTimeOffset]$ExpiresUtc).ToUnixTimeSeconds()
+                PostExecution = @{ Webhook = $false; Email = $false; PSA = $false }
+                Reference     = $CaseId
+            }
+            $null = Add-CIPPScheduledTask -Task $Task -Hidden $false -Headers $Headers
+            $Message = "$Message; removal scheduled for $($ExpiresUtc.ToString('u'))"
+        } catch {
+            $Message = "$Message; WARNING: could not schedule its removal ($($_.Exception.Message)) - remove it manually after $($ExpiresUtc.ToString('u'))"
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Could not schedule removal of CA policy $($Policy.id): $($_.Exception.Message)" -Sev 'Warning'
+        }
+        return $Message
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Message = "Failed to create the targeted Conditional Access policy for $UserPrincipalName`: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Error' -LogData $ErrorMessage
+        throw $Message
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Remove-CIPPBecReport.ps1 b/Modules/CIPPCore/Public/BEC/Remove-CIPPBecReport.ps1
new file mode 100644
index 0000000000000..6c678758285b4
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Remove-CIPPBecReport.ps1
@@ -0,0 +1,40 @@
+function Remove-CIPPBecReport {
+    <#
+    .SYNOPSIS
+        Deletes a BEC run: its BecResults row and the BecReports row.
+    .DESCRIPTION
+        Runs are kept until someone deletes them; there is no automatic retention. Both deletes go
+        through the part-aware remover, so a results payload that was split across part rows for
+        size leaves nothing behind. The results row goes first so a failed delete never leaves an
+        orphaned payload without a run pointing at it.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER CaseId
+        The run to delete.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$CaseId
+    )
+
+    $Filter = "PartitionKey eq '$($TenantFilter -replace "'", "''")' and RowKey eq '$($CaseId -replace "'", "''")'"
+    $Table = Get-CIPPTable -TableName 'BecReports'
+    $Row = Get-CIPPAzDataTableEntity @Table -Filter $Filter | Select-Object -First 1
+    if (-not $Row) {
+        throw "BEC run $CaseId was not found for $TenantFilter"
+    }
+
+    $ResultsTable = Get-CIPPTable -TableName 'BecResults'
+    $ResultsRow = Get-CIPPAzDataTableEntity @ResultsTable -Filter $Filter | Select-Object -First 1
+    if ($ResultsRow -and $PSCmdlet.ShouldProcess("$TenantFilter/$CaseId", 'Delete BEC results row')) {
+        $null = Remove-CIPPAzDataTableEntity -Force @ResultsTable -Entity $ResultsRow
+    }
+
+    if ($PSCmdlet.ShouldProcess("$TenantFilter/$CaseId", 'Delete BEC run row')) {
+        $null = Remove-CIPPAzDataTableEntity -Force @Table -Entity $Row
+    }
+    return "Deleted BEC run $CaseId for $TenantFilter"
+}
diff --git a/Modules/CIPPCore/Public/BEC/Remove-CIPPBecSharingLinks.ps1 b/Modules/CIPPCore/Public/BEC/Remove-CIPPBecSharingLinks.ps1
new file mode 100644
index 0000000000000..7d8b7aa0c11de
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Remove-CIPPBecSharingLinks.ps1
@@ -0,0 +1,87 @@
+function Remove-CIPPBecSharingLinks {
+    <#
+    .SYNOPSIS
+        Revokes the sharing links a compromised user created on OneDrive/SharePoint items.
+    .DESCRIPTION
+        BEC containment for exfiltration links. The run records each sharing change as the item's URL
+        (the audit log's ObjectId), not as a drive/item/permission triple, so this resolves every URL
+        to its drive item through the Graph /shares endpoint, then deletes the link permissions on it.
+
+        Only link permissions are removed (anonymous "anyone" links and organization/company links) -
+        direct user grants and inherited permissions are left alone. Each URL is handled in its own
+        try/catch so one unreachable item never stops the rest, and a row is returned per outcome in
+        the { Target, state, resultText, copyField } shape the containment dispatcher expects.
+
+        Unlike disabling OneDrive sharing (which only turns off the capability), this revokes links that
+        already exist and are the actual exposure.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The user the links belong to (for logging).
+    .PARAMETER ItemUrls
+        The item URLs to revoke links on - the ItemUrl of each flagged sharing change.
+    .PARAMETER Headers
+        CIPP request headers for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$UserPrincipalName,
+        [string[]]$ItemUrls,
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    $Add = {
+        param($Target, $State, $Text)
+        $Rows.Add([pscustomobject]@{ Target = $Target; state = $State; resultText = $Text; copyField = $null })
+    }
+
+    # Graph addresses a shared item by "u!" + base64url of its URL (no padding, +/ -> -_). Any item URL
+    # the caller can reach resolves this way, which is why the audit-log ObjectId is enough to act on.
+    $ToShareId = {
+        param($Url)
+        $Bytes = [System.Text.Encoding]::UTF8.GetBytes([string]$Url)
+        'u!' + ([System.Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('/', '_').Replace('+', '-'))
+    }
+
+    foreach ($Url in @($ItemUrls | Where-Object { $_ } | Select-Object -Unique)) {
+        try {
+            $ShareId = & $ToShareId $Url
+            $Item = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/shares/$ShareId/driveItem?`$select=id,name,webUrl,parentReference&`$expand=permissions" -tenantid $TenantFilter -AsApp $true -noPagination $true
+            $DriveId = $Item.parentReference.driveId
+            $ItemId = $Item.id
+            $Name = $Item.name ?? $Url
+            if (-not $DriveId -or -not $ItemId) { & $Add $Url 'error' "Could not resolve a drive item for $Url"; continue }
+
+            # Only link permissions are sharing links; a direct grant has no .link. Inherited ones cannot
+            # be deleted on the child, so skip them rather than fail on the 400 they return.
+            $Links = @($Item.permissions | Where-Object { $_.link -and -not $_.inheritedFrom })
+            if ($Links.Count -eq 0) { & $Add $Name 'info' "No sharing-link permissions remain on $Name"; continue }
+            foreach ($Perm in $Links) {
+                $Scope = $Perm.link.scope ?? 'link'
+                if (-not $PSCmdlet.ShouldProcess($Name, "Remove the $Scope sharing link")) { continue }
+                try {
+                    $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/drives/$DriveId/items/$ItemId/permissions/$($Perm.id)" -tenantid $TenantFilter -type DELETE -AsApp $true
+                    & $Add $Name 'success' "Removed the $Scope sharing link on $Name"
+                } catch {
+                    $PermError = Get-CippException -Exception $_
+                    & $Add $Name 'error' "Failed to remove the $Scope link on $Name`: $($PermError.NormalizedError)"
+                }
+            }
+        } catch {
+            $ItemError = Get-CippException -Exception $_
+            & $Add $Url 'error' "Could not read sharing links for $Url`: $($ItemError.NormalizedError)"
+        }
+    }
+
+    if ($Headers) {
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Removed sharing links for $UserPrincipalName ($(@($Rows | Where-Object { $_.state -eq 'success' }).Count) link(s) revoked)" -Sev 'Info'
+    }
+    return $Rows.ToArray()
+}
diff --git a/Modules/CIPPCore/Public/BEC/Remove-CIPPBecTargetedCAPolicy.ps1 b/Modules/CIPPCore/Public/BEC/Remove-CIPPBecTargetedCAPolicy.ps1
new file mode 100644
index 0000000000000..a984c8cf6173b
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Remove-CIPPBecTargetedCAPolicy.ps1
@@ -0,0 +1,62 @@
+function Remove-CIPPBecTargetedCAPolicy {
+    <#
+    .SYNOPSIS
+        Removes a CIPP BEC containment Conditional Access policy.
+    .DESCRIPTION
+        Deletes the policy by id, or every CIPP-BEC-managed policy for a user when -UserId is given
+        instead. Schedulable (the containment action schedules it at the policy's expiry); a policy
+        that is already gone is reported, not failed.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER PolicyId
+        The policy id.
+    .PARAMETER UserId
+        Alternatively, remove every CIPP-BEC policy targeting this user.
+    .PARAMETER Headers
+        CIPP request headers for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$PolicyId,
+        [string]$UserId,
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    if (-not $PolicyId -and -not $UserId) { throw 'PolicyId or UserId is required' }
+    $Ids = @()
+    if ($PolicyId) {
+        $Ids = @($PolicyId)
+    } else {
+        $Ids = @(New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?$select=id,description&$top=999' -tenantid $TenantFilter -AsApp $true | Where-Object { [string]$_.description -like "*ManagedBy=CIPP-BEC;Target=$UserId*" } | ForEach-Object { $_.id })
+        if ($Ids.Count -eq 0) {
+            $Message = "No CIPP BEC containment policy exists for user $UserId"
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info'
+            return $Message
+        }
+    }
+    $Messages = foreach ($Id in $Ids) {
+        if (-not $PSCmdlet.ShouldProcess($Id, 'Delete Conditional Access policy')) { continue }
+        try {
+            $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/$Id" -tenantid $TenantFilter -type DELETE -AsApp $true
+            $Message = "Removed BEC containment Conditional Access policy $Id"
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Info'
+            $Message
+        } catch {
+            $ErrorMessage = Get-CippException -Exception $_
+            if ($ErrorMessage.NormalizedError -match '(?i)not ?found|404|does not exist') {
+                "BEC containment Conditional Access policy $Id was already removed"
+            } else {
+                $Message = "Failed to remove BEC containment Conditional Access policy $Id`: $($ErrorMessage.NormalizedError)"
+                Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev 'Error' -LogData $ErrorMessage
+                throw $Message
+            }
+        }
+    }
+    return ($Messages -join '; ')
+}
diff --git a/Modules/CIPPCore/Public/BEC/Remove-CIPPMailboxDelegation.ps1 b/Modules/CIPPCore/Public/BEC/Remove-CIPPMailboxDelegation.ps1
new file mode 100644
index 0000000000000..7f2601b0fac94
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Remove-CIPPMailboxDelegation.ps1
@@ -0,0 +1,71 @@
+function Remove-CIPPMailboxDelegation {
+    <#
+    .SYNOPSIS
+        Removes mailbox delegations of every type the BEC inventory reports.
+    .DESCRIPTION
+        Takes delegation rows shaped like Get-CIPPBecMailboxInventory's Delegations output
+        ({ PermissionType, Trustee, Identity, AccessRights }) and removes each one: FullAccess, SendAs
+        and SendOnBehalf through Set-CIPPMailboxPermission, folder rights through
+        Remove-CIPPFolderPermission (by folder id, so localised folder names do not matter) and
+        resource delegates through Set-CalendarProcessing. One failure never stops the rest.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserPrincipalName
+        The mailbox.
+    .PARAMETER Delegations
+        The delegation rows to remove.
+    .PARAMETER Headers
+        CIPP request headers for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [Parameter(Mandatory = $true)]$Delegations,
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    $Results = [System.Collections.Generic.List[object]]::new()
+    foreach ($Delegation in @($Delegations | Where-Object { $_ })) {
+        $Type = [string]$Delegation.PermissionType
+        $Trustee = [string]$Delegation.Trustee
+        $Target = "$Type $Trustee"
+        if ([string]::IsNullOrWhiteSpace($Trustee)) {
+            $Results.Add([pscustomobject]@{ Target = $Target; state = 'error'; resultText = "A $Type delegation without a trustee cannot be removed" })
+            continue
+        }
+        if (-not $PSCmdlet.ShouldProcess("$UserPrincipalName $Target", 'Remove delegation')) { continue }
+        try {
+            switch ($Type) {
+                { $_ -in @('FullAccess', 'SendAs', 'SendOnBehalf') } {
+                    $null = Set-CIPPMailboxPermission -UserId $UserPrincipalName -AccessUser $Trustee -PermissionLevel $Type -Action 'Remove' -TenantFilter $TenantFilter -APIName $APIName -Headers $Headers
+                    $Text = "Removed $Type for $Trustee from $UserPrincipalName"
+                }
+                'Folder' {
+                    $FolderIdentity = if ($Delegation.Identity) { [string]$Delegation.Identity } else { [string]$Delegation.Resource }
+                    $null = Remove-CIPPFolderPermission -TenantFilter $TenantFilter -FolderIdentity $FolderIdentity -User $Trustee -AccessRights ([string]$Delegation.AccessRights) -Anchor $UserPrincipalName
+                    $Text = "Removed folder permission for $Trustee on $($Delegation.Resource ?? $FolderIdentity)"
+                    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Text -Sev 'Info'
+                }
+                'ResourceDelegate' {
+                    $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-CalendarProcessing' -cmdParams @{ Identity = $UserPrincipalName; ResourceDelegates = @{ '@odata.type' = '#Exchange.GenericHashTable'; remove = @($Trustee) } } -Anchor $UserPrincipalName
+                    $Text = "Removed resource delegate $Trustee from $UserPrincipalName"
+                    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Text -Sev 'Info'
+                }
+                default { throw "Unknown delegation type '$Type'" }
+            }
+            $Results.Add([pscustomobject]@{ Target = $Target; state = 'success'; resultText = $Text })
+        } catch {
+            $ErrorMessage = Get-CippException -Exception $_
+            $Text = "Failed to remove $Type for $Trustee from $UserPrincipalName`: $($ErrorMessage.NormalizedError)"
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Text -Sev 'Error' -LogData $ErrorMessage
+            $Results.Add([pscustomobject]@{ Target = $Target; state = 'error'; resultText = $Text })
+        }
+    }
+    return $Results.ToArray()
+}
diff --git a/Modules/CIPPCore/Public/BEC/Remove-CIPPUserOAuthGrant.ps1 b/Modules/CIPPCore/Public/BEC/Remove-CIPPUserOAuthGrant.ps1
new file mode 100644
index 0000000000000..5510e27117a05
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Remove-CIPPUserOAuthGrant.ps1
@@ -0,0 +1,59 @@
+function Remove-CIPPUserOAuthGrant {
+    <#
+    .SYNOPSIS
+        Deletes a user's OAuth consent grants and app-role assignments.
+    .DESCRIPTION
+        Removes the delegated consent grants (oauth2PermissionGrants) and enterprise-app role
+        assignments identified by id. Removing a grant revokes that consent only; it does not disable
+        the application for other users and existing access tokens keep working until they expire, so
+        pair it with a session revocation.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER UserId
+        The user's object id (needed for app-role assignment deletes).
+    .PARAMETER GrantIds
+        oauth2PermissionGrant ids to delete.
+    .PARAMETER AppRoleAssignmentIds
+        appRoleAssignment ids to delete.
+    .PARAMETER Headers
+        CIPP request headers for logging.
+    .PARAMETER APIName
+        Logging API name.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$UserId,
+        [string[]]$GrantIds = @(),
+        [string[]]$AppRoleAssignmentIds = @(),
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    $Sets = @(
+        @{ Ids = $GrantIds; Uri = 'oauth2PermissionGrants/{0}'; Noun = 'consent grant'; NeedsUser = $false }
+        @{ Ids = $AppRoleAssignmentIds; Uri = "users/$UserId/appRoleAssignments/{0}"; Noun = 'app-role assignment'; NeedsUser = $true }
+    )
+    $Results = [System.Collections.Generic.List[object]]::new()
+    foreach ($Set in $Sets) {
+        foreach ($Id in @($Set.Ids | Where-Object { $_ })) {
+            if ($Set.NeedsUser -and -not $UserId) {
+                $Results.Add([pscustomobject]@{ Target = $Id; state = 'error'; resultText = "The user object id is required to remove an $($Set.Noun)" })
+                continue
+            }
+            if (-not $PSCmdlet.ShouldProcess($Id, "Delete $($Set.Noun)")) { continue }
+            try {
+                $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/$($Set.Uri -f $Id)" -tenantid $TenantFilter -type DELETE -AsApp $true
+                Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Deleted $($Set.Noun) $Id" -Sev 'Info'
+                $Results.Add([pscustomobject]@{ Target = $Id; state = 'success'; resultText = "Deleted $($Set.Noun) $Id" })
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Failed to delete $($Set.Noun) $Id`: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+                $Results.Add([pscustomobject]@{ Target = $Id; state = 'error'; resultText = "Failed to delete $($Set.Noun) $Id`: $($ErrorMessage.NormalizedError)" })
+            }
+        }
+    }
+    return $Results.ToArray()
+}
diff --git a/Modules/CIPPCore/Public/BEC/Resolve-CIPPBecMessageSubjects.ps1 b/Modules/CIPPCore/Public/BEC/Resolve-CIPPBecMessageSubjects.ps1
new file mode 100644
index 0000000000000..f4daf9e77e868
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Resolve-CIPPBecMessageSubjects.ps1
@@ -0,0 +1,83 @@
+function Resolve-CIPPBecMessageSubjects {
+    <#
+    .SYNOPSIS
+        Names the messages an attacker touched, by internet message id, from the message trace.
+    .DESCRIPTION
+        Audit records for opened (bound) messages carry only the internet message id. Subjects already
+        known from the run's own sent and received traces are used first; the rest are looked up with
+        Get-MessageTraceV2 -MessageId in batches, walking back in 10-day slices (the cmdlet's limit)
+        up to LookbackDays (the trace keeps 90 days), newest slice first, stopping as soon as every id
+        is named. A message older than the trace keeps its id only. Returns { Subjects (hashtable
+        id -> subject), Resolved, Unresolved, Error }. Trace metadata only - never message content.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER MessageIds
+        The internet message ids to name.
+    .PARAMETER Known
+        Subjects already known (hashtable id -> subject), e.g. from the run's sent and received traces.
+    .PARAMETER LookbackDays
+        How far back to trace (at most 90).
+    .PARAMETER Anchor
+        Anchor mailbox for the Exchange requests.
+    .PARAMETER BatchSize
+        Message ids per trace call.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string[]]$MessageIds = @(),
+        [hashtable]$Known = @{},
+        [ValidateRange(1, 90)][int]$LookbackDays = 90,
+        [string]$Anchor,
+        [ValidateRange(1, 500)][int]$BatchSize = 50
+    )
+
+    $Subjects = @{}
+    $Pending = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($Id in @($MessageIds | Where-Object { $_ } | Select-Object -Unique)) {
+        $Key = [string]$Id
+        if ($Known.ContainsKey($Key) -and $Known[$Key]) { $Subjects[$Key] = [string]$Known[$Key] } else { $null = $Pending.Add($Key) }
+    }
+
+    $ErrorText = $null
+    $End = (Get-Date).ToUniversalTime()
+    $Oldest = $End.AddDays(-$LookbackDays)
+    while ($Pending.Count -gt 0 -and $End -gt $Oldest) {
+        $Start = $End.AddDays(-10)
+        if ($Start -lt $Oldest) { $Start = $Oldest }
+        $Batch = @($Pending)
+        for ($i = 0; $i -lt $Batch.Count; $i += $BatchSize) {
+            $Chunk = @($Batch[$i..([Math]::Min($i + $BatchSize - 1, $Batch.Count - 1))])
+            $ExoParams = @{
+                tenantid  = $TenantFilter
+                cmdlet    = 'Get-MessageTraceV2'
+                # an array: the cmdlet silently matches nothing for a joined string
+                cmdParams = @{ MessageId = $Chunk; StartDate = $Start.ToString('s'); EndDate = $End.ToString('s'); ResultSize = 5000 }
+            }
+            if ($Anchor) { $ExoParams.Anchor = $Anchor }
+            try {
+                foreach ($Row in @(New-ExoRequest @ExoParams)) {
+                    $Key = [string]$Row.MessageId
+                    if ($Key -and $Pending.Contains($Key)) {
+                        $Subjects[$Key] = [string]$Row.Subject
+                        $null = $Pending.Remove($Key)
+                    }
+                }
+            } catch {
+                $ErrorText = "Message trace lookup failed: $((Get-NormalizedError -message $_.Exception.Message))"
+                $Pending.Clear()
+                break
+            }
+        }
+        $End = $Start
+    }
+
+    [pscustomobject]@{
+        Subjects   = $Subjects
+        Resolved   = $Subjects.Count
+        Unresolved = @($MessageIds | Where-Object { $_ -and -not $Subjects.ContainsKey([string]$_) } | Select-Object -Unique).Count
+        Error      = $ErrorText
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Search-CIPPBecAuditLog.ps1 b/Modules/CIPPCore/Public/BEC/Search-CIPPBecAuditLog.ps1
new file mode 100644
index 0000000000000..80dd51572b798
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Search-CIPPBecAuditLog.ps1
@@ -0,0 +1,178 @@
+function Search-CIPPBecAuditLog {
+    <#
+    .SYNOPSIS
+        Pages Search-UnifiedAuditLog for the BEC check with an explicit completeness marker.
+    .DESCRIPTION
+        Runs a ReturnLargeSet session with a stable session id and a fixed page size, follows the
+        pages until the service reports the last row (ResultIndex = ResultCount), a short page comes
+        back, or a page adds nothing new, and stops at MaxPages. Rows are de-duplicated on Identity and
+        their AuditData JSON is parsed once. The caller gets { Records, Complete, Pages, Cap } so a
+        capped search is reported as partial instead of silently truncated.
+
+        Only metadata is read: the records are the audit log's own descriptions of what happened,
+        never message content.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER StartDate
+        Window start (UTC).
+    .PARAMETER EndDate
+        Window end (UTC).
+    .PARAMETER Operations
+        Operations to search for.
+    .PARAMETER UserIds
+        Restrict to records attributed to these users. Always sent as an array - a bare string binds to
+        the cmdlet's String[] as a scalar and EXO rejects it.
+    .PARAMETER RecordType
+        Optional record type filter (e.g. ExchangeAdmin).
+    .PARAMETER ObjectIds
+        Optional object id filter.
+    .PARAMETER IPAddresses
+        Optional client address filter. Takes bare addresses (a ':port' is stripped here - the service
+        rejects it) and matches records stored with a port.
+    .PARAMETER FreeText
+        Optional text the record must contain (e.g. a form id).
+    .PARAMETER Anchor
+        Anchor mailbox for the EXO request.
+    .PARAMETER PageSize
+        Rows per page (max 5000).
+    .PARAMETER MaxPages
+        Page cap for one time slice; a slice that hits it is bisected on time (see MinSliceMinutes)
+        rather than reported truncated, so coverage is bounded by TIME, not by a log count.
+    .PARAMETER MinSliceMinutes
+        The smallest window a busy slice is bisected down to. A count cap silently drops IOCs on a busy
+        account - splitting the window in half and searching each half with its own page budget keeps
+        the whole period covered. Only a slice this small that still caps is reported incomplete.
+    .PARAMETER MaxSliceDepth
+        Recursion ceiling for the bisection, a safety stop against pathological density.
+    .PARAMETER SliceDepth
+        Internal: current bisection depth. Callers leave it at 0.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][datetime]$StartDate,
+        [Parameter(Mandatory = $true)][datetime]$EndDate,
+        [string[]]$Operations,
+        [string[]]$UserIds,
+        [string]$RecordType,
+        [string[]]$ObjectIds,
+        [string[]]$IPAddresses,
+        [string]$FreeText,
+        [string]$Anchor,
+        [ValidateRange(1, 5000)][int]$PageSize = 5000,
+        [ValidateRange(1, 200)][int]$MaxPages = 10,
+        [ValidateRange(1, 10080)][int]$MinSliceMinutes = 60,
+        [ValidateRange(1, 16)][int]$MaxSliceDepth = 8,
+        [ValidateRange(0, 16)][int]$SliceDepth = 0
+    )
+
+    $SearchParam = @{
+        SessionCommand = 'ReturnLargeSet'
+        SessionId      = "CIPP-BEC-$([guid]::NewGuid().ToString('N'))"
+        StartDate      = $StartDate
+        EndDate        = $EndDate
+        ResultSize     = $PageSize
+    }
+    if ($Operations) { $SearchParam.Operations = @($Operations) }
+    if ($UserIds) { $SearchParam.UserIds = @($UserIds) }
+    if ($RecordType) { $SearchParam.RecordType = $RecordType }
+    if ($ObjectIds) { $SearchParam.ObjectIds = @($ObjectIds) }
+    if ($IPAddresses) {
+        $IPAddresses = @($IPAddresses | ForEach-Object { ConvertTo-CIPPBecHostAddress -Address ([string]$_) } | Where-Object { $_ } | Select-Object -Unique)
+        $SearchParam.IPAddresses = @($IPAddresses)
+    }
+    if ($FreeText) { $SearchParam.FreeText = $FreeText }
+
+    $ExoParams = @{ tenantid = $TenantFilter; cmdlet = 'Search-UnifiedAuditLog'; cmdParams = $SearchParam }
+    if ($Anchor) { $ExoParams.Anchor = $Anchor }
+
+    $Records = [System.Collections.Generic.List[object]]::new()
+    $Seen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    $Pages = 0
+    $Done = $false
+    $Stalled = $false
+    $PageError = $null
+    do {
+        $Pages++
+        # A search with no hits returns nothing at all rather than an empty page. A transient failure on
+        # a later page must not discard the pages already collected: stop here and report what we have as
+        # partial, rather than letting the whole search throw and the caller record it as empty.
+        try {
+            $Batch = @(New-ExoRequest @ExoParams | Where-Object { $_ })
+        } catch {
+            $PageError = $_.Exception.Message
+            break
+        }
+        $NewCount = 0
+        foreach ($Item in $Batch) {
+            $Key = if ($Item.Identity) { [string]$Item.Identity } else { "$($Item.CreationDate)|$($Item.Operations)|$($Item.UserIds)|$($Item.AuditData)" }
+            if (-not $Seen.Add($Key)) { continue }
+            $AuditData = try { $Item.AuditData | ConvertFrom-Json -ErrorAction Stop } catch { $null }
+            $Records.Add([pscustomobject]@{
+                    Identity     = $Item.Identity
+                    CreationDate = $Item.CreationDate
+                    Operation    = $Item.Operations ?? $AuditData.Operation
+                    UserId       = $Item.UserIds ?? $AuditData.UserId
+                    RecordType   = $Item.RecordType
+                    AuditData    = $AuditData
+                })
+            $NewCount++
+        }
+        $Last = if ($Batch.Count -gt 0) { $Batch[-1] } else { $null }
+        $ServiceSaysDone = $Last -and $Last.ResultCount -and $Last.ResultIndex -and ([int]$Last.ResultIndex -ge [int]$Last.ResultCount)
+        $Done = ($Batch.Count -eq 0) -or ($Batch.Count -lt $PageSize) -or $ServiceSaysDone
+        # A full page that adds nothing new means the session is replaying: stop, but do not call it complete.
+        if (-not $Done -and $NewCount -eq 0) { $Stalled = $true; break }
+    } while (-not $Done -and $Pages -lt $MaxPages)
+
+    # Capped on pages (not finished, not stalled) and there is still time to give: the window is denser
+    # than one page budget can hold, so bisect it and cover each half with its own budget. This is what
+    # makes coverage time-bound rather than count-bound - the partial from this pass is discarded because
+    # the two halves re-cover the whole window between them.
+    $WindowMinutes = ($EndDate - $StartDate).TotalMinutes
+    # A page error is not density, so it does not bisect - it just returns the partial set below.
+    $CappedByPages = (-not $Done) -and (-not $Stalled) -and (-not $PageError)
+    if ($CappedByPages -and $SliceDepth -lt $MaxSliceDepth -and $WindowMinutes -gt $MinSliceMinutes) {
+        $Mid = $StartDate.AddTicks([long](($EndDate - $StartDate).Ticks / 2))
+        $Common = @{
+            TenantFilter    = $TenantFilter
+            PageSize        = $PageSize
+            MaxPages        = $MaxPages
+            MinSliceMinutes = $MinSliceMinutes
+            MaxSliceDepth   = $MaxSliceDepth
+            SliceDepth      = $SliceDepth + 1
+        }
+        if ($Operations) { $Common.Operations = $Operations }
+        if ($UserIds) { $Common.UserIds = $UserIds }
+        if ($RecordType) { $Common.RecordType = $RecordType }
+        if ($ObjectIds) { $Common.ObjectIds = $ObjectIds }
+        if ($IPAddresses) { $Common.IPAddresses = $IPAddresses }
+        if ($FreeText) { $Common.FreeText = $FreeText }
+        if ($Anchor) { $Common.Anchor = $Anchor }
+
+        $Left = Search-CIPPBecAuditLog @Common -StartDate $StartDate -EndDate $Mid
+        $Right = Search-CIPPBecAuditLog @Common -StartDate $Mid -EndDate $EndDate
+
+        $Merged = [System.Collections.Generic.List[object]]::new()
+        $MergedSeen = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        foreach ($Rec in (@($Left.Records) + @($Right.Records))) {
+            $Key = if ($Rec.Identity) { [string]$Rec.Identity } else { "$($Rec.CreationDate)|$($Rec.Operation)|$($Rec.UserId)" }
+            if ($MergedSeen.Add($Key)) { $Merged.Add($Rec) }
+        }
+        return [pscustomobject]@{
+            Records  = $Merged.ToArray()
+            Complete = [bool]($Left.Complete -and $Right.Complete)
+            Pages    = $Pages + $Left.Pages + $Right.Pages
+            Cap      = if ($Left.Complete -and $Right.Complete) { $null } else { ($Left.Cap ?? $Right.Cap) }
+        }
+    }
+
+    return [pscustomobject]@{
+        Records  = $Records.ToArray()
+        Complete = [bool]$Done
+        Pages    = $Pages
+        Cap      = if ($Done) { $null } elseif ($PageError) { "stopped after $($Records.Count) record(s) on a page error: $PageError" } elseif ($Stalled) { 'paging stalled (duplicate page returned)' } else { "$MaxPages pages of $PageSize records in a $([int]$WindowMinutes)-minute slice" }
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Set-CIPPBecIPVerdictStamp.ps1 b/Modules/CIPPCore/Public/BEC/Set-CIPPBecIPVerdictStamp.ps1
new file mode 100644
index 0000000000000..d1f296601f6c5
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Set-CIPPBecIPVerdictStamp.ps1
@@ -0,0 +1,44 @@
+function Set-CIPPBecIPVerdictStamp {
+    <#
+    .SYNOPSIS
+        Stamps each address's verdict onto the case rows that carry it.
+    .DESCRIPTION
+        Adds IPVerdict (Compromised, LikelyAttacker, Suspicious, Unknown, LikelyUser, Safe, Service) to
+        every sign-in, change, sent-mail and mailbox-activity row whose address has a verdict, so the
+        existing finding tables show which activity came from where. Rows are changed in place;
+        a row whose address has no verdict gets none.
+    .PARAMETER Results
+        The case payload (or the draft of it) whose rows are stamped.
+    .PARAMETER Verdicts
+        The IP verdict rows (Get-CIPPBecIPVerdicts).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)]$Results,
+        [object[]]$Verdicts = @()
+    )
+
+    $ByIP = @{}
+    foreach ($Row in @($Verdicts | Where-Object { $_ -and $_.IP })) { $ByIP[[string]$Row.IP] = [string]$Row.Verdict }
+    if ($ByIP.Count -eq 0 -or -not $PSCmdlet.ShouldProcess('BEC case rows', 'Stamp IP verdicts')) { return }
+    $Sections = @(
+        @{ Name = 'SuspectUserSignIns'; Field = 'IPAddress' }
+        @{ Name = 'NonInteractiveSignIns'; Field = 'IPAddress' }
+        @{ Name = 'InboxRuleChanges'; Field = 'ClientIP' }
+        @{ Name = 'MailboxPermissionChanges'; Field = 'ClientIP' }
+        @{ Name = 'SafelistChanges'; Field = 'ClientIP' }
+        @{ Name = 'SharingChanges'; Field = 'ClientIP' }
+        @{ Name = 'TransportRuleChanges'; Field = 'ClientIP' }
+        @{ Name = 'DirectoryAudits'; Field = 'ClientIP' }
+        @{ Name = 'SentMessages'; Field = 'FromIP' }
+        @{ Name = 'MailActivity'; Field = 'ClientIP' }
+    )
+    foreach ($Section in $Sections) {
+        foreach ($Row in @($Results.($Section.Name) | Where-Object { $_ })) {
+            $IP = ConvertTo-CIPPBecHostAddress -Address ([string]$Row.($Section.Field))
+            if ($IP -and $ByIP.ContainsKey($IP)) { $Row | Add-Member -NotePropertyName 'IPVerdict' -NotePropertyValue $ByIP[$IP] -Force }
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/BEC/Set-CIPPBecReport.ps1 b/Modules/CIPPCore/Public/BEC/Set-CIPPBecReport.ps1
new file mode 100644
index 0000000000000..e1d9cedf72351
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Set-CIPPBecReport.ps1
@@ -0,0 +1,72 @@
+function Set-CIPPBecReport {
+    <#
+    .SYNOPSIS
+        Writes or updates a BEC run: the row in the BecReports table and, optionally, its results row.
+    .DESCRIPTION
+        One row per run (PartitionKey = tenant default domain, RowKey = case id) holds the small,
+        listable metadata - user, status, scope, score, timestamps, containment history, evidence
+        export records. The full results payload goes to its own row in the BecResults table (same
+        keys) so history lists never read megabytes of JSON; the large-entity writer splits an
+        oversized payload across part rows transparently and cleans stale parts up when a rewritten
+        payload shrinks. Row properties are merged (UpsertMerge): a status/score update does not
+        clobber the containment history another request appended, and null values are dropped
+        before the write. Everything lives in table storage; nothing is written to blobs.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER CaseId
+        The run's case id.
+    .PARAMETER Properties
+        Hashtable of row properties to set/merge (Status, Score, Level, UserId, ...).
+    .PARAMETER Results
+        When supplied, serialised to JSON and written to the run's BecResults row (replace).
+    .PARAMETER Replace
+        Replace the whole run row instead of merging (used when a run is first created).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$CaseId,
+        [hashtable]$Properties = @{},
+        $Results,
+        [switch]$Replace
+    )
+
+    $Entity = @{
+        PartitionKey = [string]$TenantFilter
+        RowKey       = [string]$CaseId
+    }
+    foreach ($Key in $Properties.Keys) {
+        $Value = $Properties[$Key]
+        if ($null -eq $Value) { continue }
+        # Table properties are scalars; anything structured is stored as compact JSON.
+        if ($Value -is [string] -or $Value -is [bool] -or $Value -is [int] -or $Value -is [long] -or $Value -is [double] -or $Value -is [datetime] -or $Value -is [guid]) {
+            $Entity[$Key] = $Value
+        } else {
+            $Entity[$Key] = [string](ConvertTo-Json -InputObject $Value -Depth 15 -Compress)
+        }
+    }
+
+    if ($PSBoundParameters.ContainsKey('Results') -and $null -ne $Results) {
+        $Json = ConvertTo-Json -InputObject $Results -Depth 15 -Compress
+        $ResultsTable = Get-CIPPTable -TableName 'BecResults'
+        if ($PSCmdlet.ShouldProcess("$TenantFilter/$CaseId", 'Write BEC results row')) {
+            Add-CIPPAzDataTableEntity @ResultsTable -Entity @{
+                PartitionKey = [string]$TenantFilter
+                RowKey       = [string]$CaseId
+                Results      = $Json
+            } -Force
+        }
+    }
+
+    $Table = Get-CIPPTable -TableName 'BecReports'
+    if ($PSCmdlet.ShouldProcess("$TenantFilter/$CaseId", 'Write BEC run row')) {
+        if ($Replace) {
+            Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
+        } else {
+            Add-CIPPAzDataTableEntity @Table -Entity $Entity -OperationType UpsertMerge
+        }
+    }
+    return $Entity
+}
diff --git a/Modules/CIPPCore/Public/BEC/Start-CIPPBecContainmentJob.ps1 b/Modules/CIPPCore/Public/BEC/Start-CIPPBecContainmentJob.ps1
new file mode 100644
index 0000000000000..fa7a904008504
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Start-CIPPBecContainmentJob.ps1
@@ -0,0 +1,53 @@
+function Start-CIPPBecContainmentJob {
+    <#
+    .SYNOPSIS
+        Queues BEC containment as a background scheduled task with live progress.
+    .DESCRIPTION
+        The background path of ExecBECRemediate, shaped like offboarding: creates the progress row
+        (so the caller can poll straight away), then queues Invoke-CIPPBecContainment as a run-now
+        scheduled task that fills the row with one step per action. The caller has already validated
+        the selection and the typed confirmation, so the task runs with -Confirmed. Its stored results
+        are the redacted rows; only the progress step messages carry a new password.
+        Returns the DeploymentId to poll with ListOffboardingProgress.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [string]$UserId,
+        [Parameter(Mandatory = $true)][string]$UserPrincipalName,
+        [Parameter(Mandatory = $true)][string[]]$Actions,
+        $Parameters,
+        [string]$CaseId,
+        $Headers,
+        [string]$APIName = 'BECRemediate'
+    )
+
+    if (-not $PSCmdlet.ShouldProcess($UserPrincipalName, "Queue BEC containment ($($Actions -join ', '))")) { return }
+
+    $DeploymentId = New-CIPPAsyncDeployment -Names @($UserPrincipalName) -Source 'BECRemediation' -TenantFilter $TenantFilter
+    $Task = [pscustomobject]@{
+        TenantFilter = $TenantFilter
+        Name         = "BEC remediation: $UserPrincipalName"
+        Command      = @{ value = 'Invoke-CIPPBecContainment' }
+        Parameters   = [pscustomobject]@{
+            UserId            = $UserId
+            UserPrincipalName = $UserPrincipalName
+            Actions           = @($Actions)
+            Parameters        = $Parameters
+            Confirmed         = $true
+            Redacted          = $true
+            CaseId            = $CaseId
+            DeploymentId      = $DeploymentId
+            APIName           = $APIName
+        }
+    }
+    # the scheduler reports a refused task as a returned 'Error - ...' string, not a throw
+    $Queued = Add-CIPPScheduledTask -Task $Task -hidden $false -RunNow -Headers $Headers
+    if ([string]$Queued -match '^(Error|Could not)') {
+        Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $UserPrincipalName -Status 'failed'
+        throw [string]$Queued
+    }
+    return $DeploymentId
+}
diff --git a/Modules/CIPPCore/Public/BEC/Start-CIPPBecIPReviewJob.ps1 b/Modules/CIPPCore/Public/BEC/Start-CIPPBecIPReviewJob.ps1
new file mode 100644
index 0000000000000..9f4c6ccae59a2
--- /dev/null
+++ b/Modules/CIPPCore/Public/BEC/Start-CIPPBecIPReviewJob.ps1
@@ -0,0 +1,55 @@
+function Start-CIPPBecIPReviewJob {
+    <#
+    .SYNOPSIS
+        Queues a BEC IP review as a background scheduled task with live progress.
+    .DESCRIPTION
+        The background path of ExecBECIPReview, shaped like containment: creates the progress row so the
+        caller can poll at once, then queues Invoke-CIPPBecIPReview as a run-now scheduled task that fills
+        it with one step per stage. Returns the DeploymentId to poll with ListOffboardingProgress.
+    .PARAMETER TenantFilter
+        Tenant default domain name.
+    .PARAMETER CaseId
+        The BEC case to review.
+    .PARAMETER Overrides
+        The validated overrides ({ IP, Verdict, Note }).
+    .PARAMETER CorrelateUserIds
+        Object ids of accounts to correlate.
+    .PARAMETER UserPrincipalName
+        The investigated user (for the task name).
+    .PARAMETER Headers
+        The requesting user's headers.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)][string]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$CaseId,
+        [object[]]$Overrides = @(),
+        [string[]]$CorrelateUserIds = @(),
+        [string]$UserPrincipalName,
+        $Headers
+    )
+
+    if (-not $PSCmdlet.ShouldProcess("$TenantFilter/$CaseId", 'Queue BEC IP review')) { return }
+    $DeploymentId = New-CIPPAsyncDeployment -Names @($CaseId) -Source 'BECIPReview' -TenantFilter $TenantFilter
+    $Task = [pscustomobject]@{
+        TenantFilter = $TenantFilter
+        Name         = "BEC IP review: $(if ($UserPrincipalName) { $UserPrincipalName } else { $CaseId })"
+        Command      = @{ value = 'Invoke-CIPPBecIPReview' }
+        Parameters   = [pscustomobject]@{
+            CaseId           = $CaseId
+            Overrides        = @($Overrides)
+            CorrelateUserIds = @($CorrelateUserIds)
+            DeploymentId     = $DeploymentId
+            APIName          = 'BECIPReview'
+        }
+    }
+    # the scheduler reports a refused task as a returned 'Error - ...' string, not a throw
+    $Queued = Add-CIPPScheduledTask -Task $Task -hidden $false -RunNow -Headers $Headers
+    if ([string]$Queued -match '^(Error|Could not)') {
+        Set-CIPPAsyncDeploymentStatus -JobId $DeploymentId -Name $CaseId -Status 'failed'
+        throw [string]$Queued
+    }
+    return $DeploymentId
+}
diff --git a/Modules/CIPPCore/Public/Baselines/Export-CIPPBaselineTemplate.ps1 b/Modules/CIPPCore/Public/Baselines/Export-CIPPBaselineTemplate.ps1
index 5717ff6a15fe9..a55c830a72763 100644
--- a/Modules/CIPPCore/Public/Baselines/Export-CIPPBaselineTemplate.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Export-CIPPBaselineTemplate.ps1
@@ -135,6 +135,7 @@ function Export-CIPPBaselineTemplate {
         excludedTenants     = @()
         alertEmails         = ''
         alertWebhookUrl     = ''
+        disableAlerts       = $false
         stages              = @($ExportStages)
         referencedTemplates = @($Manifest)
     }
diff --git a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaseline.ps1 b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaseline.ps1
index b488440cdc769..e62f16d04aaae 100644
--- a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaseline.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaseline.ps1
@@ -32,6 +32,9 @@ function Get-CIPPBaseline {
     $RolloutRows = Get-CIPPAzDataTableEntity @RolloutTable -Filter $Filter
     if (-not $RolloutRows) { return }
 
+    $RepoTable = Get-CippTable -tablename 'CommunityRepos'
+    $Repos = @(Get-CIPPAzDataTableEntity @RepoTable -Filter "PartitionKey eq 'CommunityRepos'")
+
     $DeltaTable = Get-CippTable -tablename 'Baselines'
     $StateTable = Get-CippTable -tablename 'BaselineRolloutState'
 
@@ -113,6 +116,13 @@ function Get-CIPPBaseline {
             $StageDefinitions = @($RolloutRow.Stages | ConvertFrom-Json -ErrorAction Stop)
             $ExcludedTenants = @()
             try { if ($RolloutRow.excludedTenants) { $ExcludedTenants = @($RolloutRow.excludedTenants | ConvertFrom-Json) } } catch { }
+            # Expand a stored group Id to its member domains, same as assignment scopes. Raw
+            # values (including group Ids) stay in $ExcludedTenants for the exclusions display.
+            $ExpandedExcludedTenants = @($ExcludedTenants | ForEach-Object {
+                    $Value = $_
+                    $Group = $Groups | Where-Object { $_.Id -eq $Value } | Select-Object -First 1
+                    if ($Group) { $Group.Members.defaultDomainName } else { $Value }
+                } | Select-Object -Unique)
 
             # The standards per stage come from the delta rows for this baseline.
             $SafeGuid = ConvertTo-CIPPODataFilterValue -Value $GUID
@@ -234,7 +244,7 @@ function Get-CIPPBaseline {
                     $Assignment.scopeId
                 }
             }
-            $AssignedDomains = @($AssignedDomains | Where-Object { $_ -and $_ -ne 'Exported Template' -and $ExcludedTenants -notcontains $_ } | Select-Object -Unique)
+            $AssignedDomains = @($AssignedDomains | Where-Object { $_ -and $_ -ne 'Exported Template' -and $ExpandedExcludedTenants -notcontains $_ } | Select-Object -Unique)
             foreach ($Domain in $AssignedDomains) {
                 if ($TenantStates.tenantFilter -notcontains $Domain) {
                     $TenantStates.Add((& $NewState $Domain 1 $RolloutRow.updatedAt))
@@ -257,6 +267,7 @@ function Get-CIPPBaseline {
                 }
             }
 
+            $IsRepoSource = Test-CIPPRepoSource -Source $RolloutRow.Source
             [PSCustomObject]@{
                 GUID               = $GUID
                 templateName       = $RolloutRow.templateName
@@ -265,10 +276,15 @@ function Get-CIPPBaseline {
                 assignedTenants    = $AssignedTenants
                 assignments        = $(if ($AssignedTo.Count -gt 0) { $AssignedTo } else { $Assignments })
                 exclusions         = $(if ($ExcludedTo.Count -gt 0) { $ExcludedTo } else { @($ExcludedTenants | ForEach-Object { [PSCustomObject]@{ label = $_; value = $_ } }) })
-                excludedTenants    = $ExcludedTenants
+                excludedTenants    = $ExpandedExcludedTenants
                 alertEmails        = $RolloutRow.alertEmails
                 alertWebhookUrl    = $RolloutRow.alertWebhookUrl
+                disableAlerts      = [bool]$RolloutRow.disableAlerts
                 disableScheduledRuns = [bool]$RolloutRow.disableScheduledRuns
+                source             = $(if ($IsRepoSource) { $RolloutRow.Source } else { $null })
+                isSynced           = ($IsRepoSource -and ![string]::IsNullOrEmpty($RolloutRow.SHA))
+                sourceUrl          = $(if ($IsRepoSource) { Get-CIPPTemplateSourceUrl -Source $RolloutRow.Source -SourcePath $RolloutRow.SourcePath -Repos $Repos } else { $null })
+                hasLocalChanges    = $(if ($IsRepoSource) { [bool]$RolloutRow.LocalChanges } else { $null })
                 standardsCount     = $UniqueStandards.Count
                 stageNames         = @($Stages.name)
                 stages             = $Stages
diff --git a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAlignment.ps1 b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAlignment.ps1
index 6e76a10c3ce29..e6c8acf48ff3a 100644
--- a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAlignment.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineAlignment.ps1
@@ -475,14 +475,14 @@ function Get-CIPPBaselineAlignment {
         }
 
         $Fleet = & $ScoreRows $Rows
-        # Trend = the daily rollups Set-CIPPBaselineTrendPoint writes after every run (last
-        # 90 days), with today's point always replaced by the LIVE score so the chart never
-        # lags the rest of the page.
+        # Trend = the daily rollups Set-CIPPBaselineTrendPoint writes after every run, capped
+        # at 14 days (13 stored days + today), with today's point always replaced by the LIVE
+        # score so the chart never lags the rest of the page.
         $Today = (Get-Date).ToUniversalTime().ToString('yyyy-MM-dd')
         $Trend = [System.Collections.Generic.List[object]]::new()
         try {
             $TrendTable = Get-CippTable -tablename 'BaselineTrend'
-            $Cutoff = (Get-Date).ToUniversalTime().AddDays(-90).ToString('yyyy-MM-dd')
+            $Cutoff = (Get-Date).ToUniversalTime().AddDays(-13).ToString('yyyy-MM-dd')
             $TrendRows = @(Get-CIPPAzDataTableEntity @TrendTable -Filter "PartitionKey eq 'fleet' and RowKey ge '$Cutoff' and RowKey lt '$Today'") | Sort-Object -Property RowKey
             foreach ($Point in $TrendRows) {
                 $Trend.Add([PSCustomObject]@{ date = $Point.RowKey; aligned = [int]$Point.Aligned; verified = [int]$Point.Verified })
diff --git a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineDevicePrepProfileState.ps1 b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineDevicePrepProfileState.ps1
index 98bbd953c2f36..78897ef978969 100644
--- a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineDevicePrepProfileState.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineDevicePrepProfileState.ps1
@@ -7,7 +7,10 @@ function Get-CIPPBaselineDevicePrepProfileState {
         parses the enrollment_autopilot_dpp settings back into the classic's property set.
         The device security group resolves by name LIVE (the classic did the same lookup for
         its expected value); a group that does not exist yet grades as an empty id - the
-        executor creates it when CreateNewGroup allows.
+        executor creates it when CreateNewGroup allows. The group Intune actually enrols devices
+        into is read LIVE too, from the marker CIPP wrote when it applied one or from the
+        membership target action - never from the settings string the portal displays, which
+        every create writes whether or not the group was ever applied.
 
         The assignment grades separately through Compare-CIPPIntuneAssignments off the cached
         assignments; a failed or unknown lookup leaves the dimension out entirely, because a
@@ -36,7 +39,7 @@ function Get-CIPPBaselineDevicePrepProfileState {
 
     $DeploymentType = [string]($V.DeploymentType.value ?? $V.DeploymentType ?? '0')
     $JoinType = [string]($V.JoinType.value ?? $V.JoinType ?? '0')
-    $AccountType = [string]($V.AccountType.value ?? $V.AccountType ?? '0')
+    $AccountType = [string]($V.AccountType.value ?? $V.AccountType ?? '1') # 1 = Standard user, 0 = Administrator
     # Empty string means unset, exactly like a pruned remediate key: '' ?? falls through
     # and [int]'' is 0, which graded timeout 0 against the 60 the executor writes.
     $Timeout = if ([string]::IsNullOrWhiteSpace("$($V.Timeout)")) { 60 } else { [int]"$($V.Timeout)" }
@@ -70,7 +73,6 @@ function Get-CIPPBaselineDevicePrepProfileState {
     $SimpleSettingMap = @{
         'enrollment_autopilot_dpp_timeout'                = 'timeout'
         'enrollment_autopilot_dpp_customerrormessage'     = 'customErrorMessage'
-        'enrollment_autopilot_dpp_devicesecuritygroupids' = 'deviceGroupId'
     }
     $Parsed = @{}
     foreach ($Setting in @($Policy.settings)) {
@@ -93,7 +95,6 @@ function Get-CIPPBaselineDevicePrepProfileState {
         customErrorMessage = $CustomErrorMessage
         allowSkip          = $AllowSkip
         allowDiagnostics   = $AllowDiagnostics
-        deviceGroupId      = $DeviceGroupId
     }
     $Current = [PSCustomObject]@{
         profileExists      = ($null -ne $Policy)
@@ -105,7 +106,17 @@ function Get-CIPPBaselineDevicePrepProfileState {
         customErrorMessage = [string]($Parsed.customErrorMessage ?? '')
         allowSkip          = [string]($Parsed.allowSkip ?? '')
         allowDiagnostics   = [string]($Parsed.allowDiagnostics ?? '')
-        deviceGroupId      = [string]($Parsed.deviceGroupId ?? '')
+    }
+
+    # The applied group comes from the marker CIPP wrote, or from the membership target action
+    # where it routes. The cached settings string is not consulted: every create writes it while
+    # the group itself stays unapplied, so it would report a half-deployed profile as healthy.
+    # An expected group that resolved to nothing is a deviation nothing here could clear - the
+    # prepare hook never writes - so the dimension stays out until it exists.
+    if ($null -ne $Policy -and -not [string]::IsNullOrWhiteSpace($DeviceGroupId)) {
+        $MembershipTarget = Get-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId "$($Policy.id)" -TenantFilter $TenantFilter
+        $Expected | Add-Member -NotePropertyName 'deviceGroupId' -NotePropertyValue $DeviceGroupId
+        $Current | Add-Member -NotePropertyName 'deviceGroupId' -NotePropertyValue ([string]$MembershipTarget.GroupId)
     }
 
     # Assignment dimension: graded only when requested AND readable.
@@ -125,7 +136,9 @@ function Get-CIPPBaselineDevicePrepProfileState {
     # Carried for the executor: repair-in-place needs to know the settings verdict alone.
     $SettingsCorrect = $null -ne $Policy
     if ($SettingsCorrect) {
-        foreach ($Prop in @('deploymentMode', 'deploymentType', 'joinType', 'accountType', 'allowSkip', 'allowDiagnostics', 'customErrorMessage', 'deviceGroupId')) {
+        # deviceGroupId stays out: the executor applies it to the existing policy, so grading it
+        # here would send a present-but-unassigned group down the delete-and-recreate path.
+        foreach ($Prop in @('deploymentMode', 'deploymentType', 'joinType', 'accountType', 'allowSkip', 'allowDiagnostics', 'customErrorMessage')) {
             if ("$($Current.$Prop)" -ne "$($Expected.$Prop)") { $SettingsCorrect = $false; break }
         }
         if ($SettingsCorrect -and [int]$Current.timeout -ne [int]$Expected.timeout) { $SettingsCorrect = $false }
diff --git a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1 b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1
index cbadb4b959646..9f096e7e32a76 100644
--- a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineEnableAppConsentRequestsState.ps1
@@ -35,8 +35,12 @@ function Get-CIPPBaselineEnableAppConsentRequestsState {
     $Roles = @(@($Item.Variables.ReviewerRoles) | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
     if ($Roles.Count -eq 0) { $Roles = @('62e90394-69f5-4237-9190-012177145e10') }
 
+    # Missing roles are reported by name (the classic standard does the same), falling back to the id
+    $RoleLabels = @{ '62e90394-69f5-4237-9190-012177145e10' = 'Global Administrator' }
+    foreach ($Role in @($Item.Variables.ReviewerRoles)) { if ($Role.value) { $RoleLabels["$($Role.value)"] = $Role.label ?? $Role.value } }
+
     $ReviewerQueries = @(@($Policy.reviewers) | ForEach-Object { "$($_.query)" })
-    $MissingRoles = @($Roles | Where-Object { $Role = $_; -not ($ReviewerQueries | Where-Object { $_ -match $Role }) })
+    $MissingRoles = @($Roles | Where-Object { $Role = $_; -not ($ReviewerQueries | Where-Object { $_ -match [regex]::Escape($Role) }) } | ForEach-Object { $RoleLabels[$_] ?? $_ })
 
     $UserNames = @(@($Item.Variables.ReviewerUsers) | ForEach-Object { "$($_.value ?? $_)" } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
     $MissingUsers = @()
diff --git a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineUsageLocationState.ps1 b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineUsageLocationState.ps1
new file mode 100644
index 0000000000000..e5cf445b160f8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineUsageLocationState.ps1
@@ -0,0 +1,114 @@
+function Get-CIPPBaselineUsageLocationState {
+    <#
+    .SYNOPSIS
+        Prepare hook for UsageLocation: member accounts whose usage location is not the
+        configured country.
+    .DESCRIPTION
+        Members only - guests are never licensed through the tenant and their location is
+        their own organisation's business. Directory-synced accounts ARE included: usage
+        location is cloud-managed and the admin centre lets you set it on synced users, so
+        skipping them would leave exactly the accounts a hybrid tenant most needs fixed.
+
+        Group scoping works on display names because a baseline applies to many tenants and
+        a group id only exists in one. Names resolve against the Groups cache (collected on a
+        miss) and expand LIVE to transitive user members - the cache holds direct members
+        only and nothing for dynamic groups, and a nested group's users are still members.
+        A name that resolves to no group, or a membership lookup that fails, returns a null
+        Current (No Data): sweeping with a half-resolved exclusion list is how an overseas
+        office ends up with the wrong country and broken licences.
+
+        'onlyWhenBlank' turns the compare from 'equals the configured country' into 'has any
+        value at all', for tenants where locations were set by hand per user.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        $Item,
+        $TenantFilter
+    )
+
+    $Users = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Users' | Where-Object { $_ })
+    if ($Users.Count -eq 0) { return @{ Current = $null } }
+
+    $Wanted = "$($Item.Variables.usageLocation.value ?? $Item.Variables.usageLocation)".Trim().ToUpperInvariant()
+    if ($Wanted -notmatch '^[A-Z]{2}$') {
+        Write-Information "Baselines: UsageLocation on $TenantFilter has no valid two-letter country code configured ('$Wanted')."
+        return @{ Current = $null }
+    }
+    $OnlyWhenBlank = [bool]($Item.Variables.onlyWhenBlank -eq $true)
+
+    # Picker values arrive flattened by the engine, but a one-off or a test may still hand
+    # over the {label, value} wrappers the form saves.
+    $ToNames = {
+        param($Value)
+        @(@($Value) | ForEach-Object {
+                if ($_ -is [string]) { $_ } else { "$($_.value ?? $_.label)" }
+            } | ForEach-Object { $_.Trim() } | Where-Object { $_ } | Select-Object -Unique)
+    }
+    $IncludeNames = & $ToNames $Item.Variables.includeGroups
+    $ExcludeNames = & $ToNames $Item.Variables.excludeGroups
+
+    $IncludedIds = @{}
+    $ExcludedIds = @{}
+    if ($IncludeNames.Count -gt 0 -or $ExcludeNames.Count -gt 0) {
+        $Groups = @(Get-CIPPBaselineCacheRows -TenantFilter $TenantFilter -Type 'Groups')
+        $GroupIdsByName = @{}
+        foreach ($Group in $Groups) {
+            $Name = "$($Group.displayName)".Trim()
+            if (-not $Name -or -not $Group.id) { continue }
+            if (-not $GroupIdsByName.ContainsKey($Name)) { $GroupIdsByName[$Name] = [System.Collections.Generic.List[string]]::new() }
+            $GroupIdsByName[$Name].Add("$($Group.id)")
+        }
+        # Case-insensitive lookup: the hashtable literal above is case-insensitive already,
+        # this just makes the intent explicit for the reader.
+        $Unresolved = @(@($IncludeNames) + @($ExcludeNames) | Where-Object { -not $GroupIdsByName.ContainsKey($_) })
+        if ($Unresolved.Count -gt 0) {
+            Write-Information "Baselines: UsageLocation on $TenantFilter cannot resolve group(s) $($Unresolved -join ', ') - refusing to sweep with a partial scope."
+            return @{ Current = $null }
+        }
+
+        $Requests = [System.Collections.Generic.List[hashtable]]::new()
+        foreach ($Name in $IncludeNames) {
+            foreach ($GroupId in $GroupIdsByName[$Name]) {
+                $Requests.Add(@{ id = "include-$GroupId"; method = 'GET'; url = "groups/$GroupId/transitiveMembers/microsoft.graph.user?`$select=id&`$top=999" })
+            }
+        }
+        foreach ($Name in $ExcludeNames) {
+            foreach ($GroupId in $GroupIdsByName[$Name]) {
+                $Requests.Add(@{ id = "exclude-$GroupId"; method = 'GET'; url = "groups/$GroupId/transitiveMembers/microsoft.graph.user?`$select=id&`$top=999" })
+            }
+        }
+
+        try {
+            $Responses = @(New-GraphBulkRequest -tenantid $TenantFilter -Requests @($Requests) -asapp $true -Version 'v1.0')
+        } catch {
+            Write-Information "Baselines: UsageLocation group membership lookup on $TenantFilter failed, refusing to sweep: $($_.Exception.Message)"
+            return @{ Current = $null }
+        }
+        foreach ($Response in $Responses) {
+            if ([int]$Response.status -lt 200 -or [int]$Response.status -gt 299) {
+                Write-Information "Baselines: UsageLocation group membership lookup on $TenantFilter returned $($Response.status) for $($Response.id), refusing to sweep."
+                return @{ Current = $null }
+            }
+            $Bucket = if ("$($Response.id)".StartsWith('include-')) { $IncludedIds } else { $ExcludedIds }
+            foreach ($MemberId in @($Response.body.value.id | Where-Object { $_ })) { $Bucket["$MemberId"] = $true }
+        }
+    }
+
+    $Candidates = @($Users | Where-Object { $_.userType -eq 'Member' -and $_.id })
+    if ($IncludeNames.Count -gt 0) { $Candidates = @($Candidates | Where-Object { $IncludedIds.ContainsKey("$($_.id)") }) }
+    if ($ExcludeNames.Count -gt 0) { $Candidates = @($Candidates | Where-Object { -not $ExcludedIds.ContainsKey("$($_.id)") }) }
+
+    $Incorrect = @($Candidates | Where-Object {
+            $Location = "$($_.usageLocation)".Trim().ToUpperInvariant()
+            if ($OnlyWhenBlank) { [string]::IsNullOrWhiteSpace($Location) } else { $Location -ne $Wanted }
+        })
+
+    @{
+        Current = [PSCustomObject]@{
+            offenders = @($Incorrect.userPrincipalName | Sort-Object)
+            targets   = @($Incorrect | ForEach-Object { [PSCustomObject]@{ id = "$($_.id)" } })
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineWorkItems.ps1 b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineWorkItems.ps1
index 9d96137d4aec3..fb2e3a21b85c8 100644
--- a/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineWorkItems.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineWorkItems.ps1
@@ -150,8 +150,10 @@ function Get-CIPPBaselineWorkItems {
                         TemplateName     = $Baseline.templateName
                         Variables        = ($Config.variables ?? [PSCustomObject]@{})
                         RemediateEnabled = [bool]$Config.remediateEnabled
-                        AlertEnabled     = [bool]$Config.alertEnabled
-                        AlertOnRemediate = [bool]$Config.alertOnRemediate
+                        # 'Disable Alerts' on the baseline silences every standard in it,
+                        # regardless of the per-standard alert switches.
+                        AlertEnabled     = [bool]$Config.alertEnabled -and -not [bool]$Baseline.disableAlerts
+                        AlertOnRemediate = [bool]$Config.alertOnRemediate -and -not [bool]$Baseline.disableAlerts
                         SourceScope      = $Scope
                         # Package members attribute their origin so the alignment view
                         # reads 'Baseline X (PackageName)' instead of hiding the bundle.
diff --git a/Modules/CIPPCore/Public/Baselines/Import-CIPPBaselineTemplate.ps1 b/Modules/CIPPCore/Public/Baselines/Import-CIPPBaselineTemplate.ps1
index 523c61dcb9ad9..cfaaadc1cbcd3 100644
--- a/Modules/CIPPCore/Public/Baselines/Import-CIPPBaselineTemplate.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Import-CIPPBaselineTemplate.ps1
@@ -26,6 +26,7 @@ function Import-CIPPBaselineTemplate {
         $FullName,
         $Branch,
         $SHA,
+        $Path,
         $User,
         [switch]$Force
     )
@@ -49,8 +50,9 @@ function Import-CIPPBaselineTemplate {
         if (-not $Reference) { continue }
         try {
             $File = $null
+            $FilePath = $null
             if ("$($Reference.path)") {
-                try { $File = Get-GitHubFileContents -FullName $FullName -Path $Reference.path -Branch $Branch } catch { $File = $null }
+                try { $File = Get-GitHubFileContents -FullName $FullName -Path $Reference.path -Branch $Branch; $FilePath = $Reference.path } catch { $File = $null }
             }
             if (-not $File) {
                 # The file moved or was renamed: find it by sanitized display name under
@@ -61,14 +63,14 @@ function Import-CIPPBaselineTemplate {
                     $_.path -match '\.json$' -and $_.path -like "$($Reference.partition)/*" -and
                     (((($_.path -split '/')[-1]) -replace '\.json$', '') -eq $Sanitized)
                 } | Select-Object -First 1
-                if ($Candidate) { $File = Get-GitHubFileContents -FullName $FullName -Path $Candidate.path -Branch $Branch }
+                if ($Candidate) { $File = Get-GitHubFileContents -FullName $FullName -Path $Candidate.path -Branch $Branch; $FilePath = $Candidate.path }
             }
             if (-not $File) {
                 $Failures.Add("$($Reference.displayName) ($($Reference.partition)) was not found in the repository")
                 continue
             }
             $Content = $File.content | ConvertFrom-Json -Depth 100
-            $null = Import-CommunityTemplate -Template $Content -SHA $File.sha -Source $FullName -Force:$Force
+            $null = Import-CommunityTemplate -Template $Content -SHA $File.sha -Source $FullName -Path $FilePath -Force:$Force
             $ImportedCount++
         } catch {
             $Failures.Add("$($Reference.displayName): $($_.Exception.Message)")
@@ -83,9 +85,11 @@ function Import-CIPPBaselineTemplate {
         excludedTenants = @()
         alertEmails     = ''
         alertWebhookUrl = ''
+        disableAlerts   = $false
         stages          = @($Baseline.stages)
     }
-    $Saved = New-CIPPBaseline -Baseline $Payload -User ("$User" ? "$User" : 'GitHub Import') -Source "$FullName" -SHA "$SHA"
+    # An import lands the repo copy exactly as-is, so there is nothing local yet to push back.
+    $Saved = New-CIPPBaseline -Baseline $Payload -User ("$User" ? "$User" : 'GitHub Import') -Source "$FullName" -SHA "$SHA" -SourcePath "$Path" -LocalChanges:$false
 
     $Message = "Imported baseline '$($Baseline.templateName)' ($($Saved.DeltaCount) delta rows) with $ImportedCount related template$(if ($ImportedCount -eq 1) { '' } else { 's' }). Assign it to real tenants in the editor - it arrives assigned to the 'Exported Template' placeholder."
     if ($Failures.Count -gt 0) {
diff --git a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineDevicePrepProfile.ps1 b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineDevicePrepProfile.ps1
index fef9cdf59181f..fb243677aedd2 100644
--- a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineDevicePrepProfile.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineDevicePrepProfile.ps1
@@ -6,9 +6,11 @@ function Invoke-CIPPBaselineDevicePrepProfile {
         The classic's three-way write. Settings correct but assignment wrong: repair the
         assignment IN PLACE through /assign - recreating would sever the enrollment-time
         device group linkage over a delta the endpoint can fix. Otherwise: delete the drifted
-        profile and recreate it with the classic's exact settings body, resolving (or, when
-        CreateNewGroup allows, creating with the Intune Provisioning Client as owner) the
-        device security group first.
+        profile and recreate it with the classic's exact settings body. The device security group
+        is resolved (or, when CreateNewGroup allows, created with the Intune Provisioning Client as
+        owner) before either branch, because the group Intune enrols devices into is applied
+        through setEnrollmentTimeDeviceMembershipTarget on the policy rather than by the settings
+        string, so both branches have to write it.
     .FUNCTIONALITY
         Internal
     #>
@@ -25,7 +27,7 @@ function Invoke-CIPPBaselineDevicePrepProfile {
     $DeploymentMode = '0' # Device Prep only supports self-deploying mode
     $DeploymentType = [string]($Remediate.deploymentType.value ?? $Remediate.deploymentType ?? '0')
     $JoinType = [string]($Remediate.joinType.value ?? $Remediate.joinType ?? '0')
-    $AccountType = [string]($Remediate.accountType.value ?? $Remediate.accountType ?? '0')
+    $AccountType = [string]($Remediate.accountType.value ?? $Remediate.accountType ?? '1') # 1 = Standard user, 0 = Administrator
     $Timeout = if ([string]::IsNullOrWhiteSpace("$($Remediate.timeout)")) { 60 } else { [int]"$($Remediate.timeout)" }
     $CustomErrorMessage = if ([string]::IsNullOrWhiteSpace("$($Remediate.customErrorMessage)")) { "Contact your organization$([char]0x2019)s support person for help." } else { "$($Remediate.customErrorMessage)" }
     $AllowSkip = $(if ($Remediate.allowSkip -eq $true) { '1' } else { '0' })
@@ -40,15 +42,6 @@ function Invoke-CIPPBaselineDevicePrepProfile {
         Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "DevicePrepProfile: $($AssignmentTarget.Unsupported)" -Sev 'Warning'
     }
 
-    # Settings already correct means only the assignment drifted: repair it in place.
-    if ($Current.settingsCorrect -eq $true -and -not [string]::IsNullOrWhiteSpace("$($Current.policyId)")) {
-        if ($AssignmentBody) {
-            $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($Current.policyId)')/assign" -tenantid $TenantFilter -body $AssignmentBody -type POST
-            Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Repaired the assignment for Device Prep profile '$ProfileName'." -Sev 'Info'
-        }
-        return
-    }
-
     # Resolve or create the device security group, the classic's flow.
     $DeviceGroupId = ''
     if (-not [string]::IsNullOrWhiteSpace("$($Remediate.deviceGroupName)")) {
@@ -84,8 +77,26 @@ function Invoke-CIPPBaselineDevicePrepProfile {
         }
     }
 
+    # Settings already correct means only the assignment or the membership target drifted:
+    # repair them in place.
+    if ($Current.settingsCorrect -eq $true -and -not [string]::IsNullOrWhiteSpace("$($Current.policyId)")) {
+        # isAssigned is absent when the assignment could not be graded, and a blind re-post is
+        # the safe answer there; a graded-correct assignment is left alone.
+        if ($AssignmentBody -and $Current.isAssigned -ne $true) {
+            $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($Current.policyId)')/assign" -tenantid $TenantFilter -body $AssignmentBody -type POST
+            Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Repaired the assignment for Device Prep profile '$ProfileName'." -Sev 'Info'
+        }
+        if (-not [string]::IsNullOrWhiteSpace($DeviceGroupId) -and "$($Current.deviceGroupId)" -ne $DeviceGroupId) {
+            $null = Set-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId "$($Current.policyId)" -GroupId $DeviceGroupId -TenantFilter $TenantFilter
+            Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Applied the enrollment time device membership target for Device Prep profile '$ProfileName'." -Sev 'Info'
+        }
+        return
+    }
+
     if (-not [string]::IsNullOrWhiteSpace("$($Current.policyId)")) {
         $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($Current.policyId)')" -tenantid $TenantFilter -type DELETE
+        # The recreated profile gets a new id, so the old marker must not survive it.
+        Remove-CIPPEnrollmentTimeDeviceMembershipMarker -PolicyId "$($Current.policyId)" -TenantFilter $TenantFilter
         Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Deleted the drifted Device Prep profile '$ProfileName' for recreation." -Sev 'Info'
     }
 
@@ -163,5 +174,8 @@ function Invoke-CIPPBaselineDevicePrepProfile {
     if ("$($NewPolicy.id)" -and $AssignmentBody) {
         $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($NewPolicy.id)')/assign" -tenantid $TenantFilter -body $AssignmentBody -type POST
     }
+    if ("$($NewPolicy.id)" -and -not [string]::IsNullOrWhiteSpace($DeviceGroupId)) {
+        $null = Set-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId "$($NewPolicy.id)" -GroupId $DeviceGroupId -TenantFilter $TenantFilter
+    }
     Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Deployed the Device Prep profile '$ProfileName'." -Sev 'Info'
 }
diff --git a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineExoRequest.ps1 b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineExoRequest.ps1
index e0440757d662d..b0fb829efbdb7 100644
--- a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineExoRequest.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineExoRequest.ps1
@@ -28,6 +28,35 @@ function Invoke-CIPPBaselineExoRequest {
         foreach ($Property in ($Step.params ?? [PSCustomObject]@{}).PSObject.Properties) {
             $CmdParams[$Property.Name] = $Property.Value
         }
+
+        # A GenericHashTable edit (e.g. AllowList Add/Remove) with nothing but empty
+        # values still shapes as a real edit and Exchange rejects it with "MultiValuedProperty
+        # collections cannot contain null values". Strip empties from Add/Remove, then drop
+        # the whole param when nothing real is left.
+        foreach ($Key in @($CmdParams.Keys)) {
+            $Value = $CmdParams[$Key]
+            # Only an object/dictionary can carry an @odata.type edit - null, strings,
+            # numbers and bools indexed the same way threw "Cannot index into a null array."
+            if ($null -eq $Value -or $Value -is [string] -or $Value -is [ValueType]) { continue }
+            $IsHash = $Value -is [System.Collections.IDictionary]
+            $ODataType = if ($IsHash) { $Value['@odata.type'] } else { $Value.PSObject.Properties['@odata.type'].Value }
+            if ("$ODataType" -ne '#Exchange.GenericHashTable') { continue }
+
+            $AnyReal = $false
+            foreach ($EditKey in @('Add', 'Remove')) {
+                $HasEditKey = if ($IsHash) { $Value.Contains($EditKey) } else { $null -ne $Value.PSObject.Properties[$EditKey] }
+                if (-not $HasEditKey) { continue }
+                $EditValue = if ($IsHash) { $Value[$EditKey] } else { $Value.PSObject.Properties[$EditKey].Value }
+                $Cleaned = @($EditValue | Where-Object { $null -ne $_ -and -not ($_ -is [string] -and [string]::IsNullOrWhiteSpace($_)) })
+                if ($Cleaned.Count -gt 0) { $AnyReal = $true }
+                if ($IsHash) { $Value[$EditKey] = $Cleaned } else { $Value.$EditKey = $Cleaned }
+            }
+            if (-not $AnyReal) { $CmdParams.Remove($Key) }
+        }
+        # .Count would collide with a cmdlet param literally named "Count" (the hashtable
+        # returns that key's VALUE, not the entry count) - .Keys.Count is unambiguous.
+        if ($CmdParams.Keys.Count -eq 0 -and @(($Step.params ?? [PSCustomObject]@{}).PSObject.Properties).Count -gt 0) { continue }
+
         try {
             $null = New-ExoRequest -tenantid $TenantFilter -cmdlet $Step.cmdlet -cmdParams $CmdParams -useSystemMailbox $true -Compliance:([bool]($Step.compliance ?? $false))
         } catch {
diff --git a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineIntuneTemplate.ps1 b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineIntuneTemplate.ps1
index dda0b8a06e45c..2ca327573366b 100644
--- a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineIntuneTemplate.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineIntuneTemplate.ps1
@@ -36,12 +36,20 @@ function Invoke-CIPPBaselineIntuneTemplate {
     if ($Synced.RawJSON) { $RawJson = $Synced.RawJSON }
     $RawJson = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $RawJson -EscapeForJson
 
+    # Resolve %variables% in the identity columns the same way. Column-named types deploy under this
+    # name and are looked up by it, so a raw token creates a duplicate on every deploy. Plain text,
+    # not JSON-escaped, since these fill bare string slots. Names without a variable are untouched.
+    $DisplayName = "$($Template.Displayname)"
+    if ($DisplayName -match '%') { $DisplayName = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $DisplayName }
+    $Description = "$($Template.Description)"
+    if ($Description -match '%') { $Description = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $Description }
+
     # customGroup overrides AssignTo, matching the old engine's behavior.
     $AssignTo = if ("$($Remediate.customGroup)") { "$($Remediate.customGroup)" } else { "$($Remediate.assignTo)" }
     $PolicyParams = @{
         TemplateType = $TemplateType
-        Description  = "$($Template.Description)"
-        DisplayName  = "$($Template.Displayname)"
+        Description  = $Description
+        DisplayName  = $DisplayName
         RawJSON      = $RawJson
         AssignTo     = $AssignTo
         ExcludeGroup = "$($Remediate.excludeGroup)"
diff --git a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1 b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1
index 475937dcc5978..27fca4064c0f9 100644
--- a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1
@@ -57,6 +57,8 @@ function Invoke-CIPPBaselineMigration {
         AutopilotStatusPage           = @{ drop = @('AllowRetry'); dropNotes = @{ AllowRetry = "a leftover from an old classic-standard version - the current classic standard ignores it too (the 'Block device usage during setup' switch drives the retry setting)" } }
         Bookings                      = @{ rename = @{ state = 'enabled' } }
         CloudMessageRecall            = @{ rename = @{ state = 'enabled' } }
+        # V2 stored the SPO enum name; the V3 definition speaks SPO numerics.
+        DefaultSharingLink            = @{ value = @{ sharingLinkType = @{ Direct = 1; Internal = 2 } } }
         ConditionalAccessTemplate     = @{ rename = @{ TemplateList = 'caTemplate' }; value = @{ state = @{ Enabled = 'enabled'; Disabled = 'disabled' } } }
         DisableAddShortcutsToOneDrive = @{ rename = @{ state = 'disableAddToOneDrive' } }
         EnableMailTips                = @{ rename = @{ MailTipsLargeAudienceThreshold = 'largeAudienceThreshold' } }
@@ -68,6 +70,8 @@ function Invoke-CIPPBaselineMigration {
         sharingCapability             = @{ rename = @{ Level = 'sharingCapability' }; value = @{ sharingCapability = @{ disabled = 0; externalUserSharingOnly = 1; externalUserAndGuestSharing = 2; existingExternalUserSharingOnly = 3 } } }
         SpoofWarn                     = @{ rename = @{ state = 'externalWarningEnabled' }; value = @{ externalWarningEnabled = @{ enabled = $true; disabled = $false } } }
         SPSyncButtonState             = @{ rename = @{ state = 'hideSyncButton' } }
+        # V2 were switches (bool); V3 passes the Teams cmdlet's 'Enabled'/'Disabled' strings.
+        TeamsChatProtection           = @{ value = @{ FileTypeCheck = @{ True = 'Enabled'; False = 'Disabled' }; UrlReputationCheck = @{ True = 'Enabled'; False = 'Disabled' } } }
         TAP                           = @{ rename = @{ config = 'isUsableOnce' } }
         unmanagedSync                 = @{ rename = @{ state = 'conditionalAccessPolicy' } }
         BitLockerKeysForOwnedDevice   = @{ rename = @{ state = 'allowed' }; value = @{ allowed = @{ allow = $true; restrict = $false } } }
@@ -365,7 +369,7 @@ function Invoke-CIPPBaselineMigration {
         $SourceMarker = "StandardsTemplateV2:$V2Guid"
         # mapper= is the migration logic version: bump it when the MAPPING changes (not the
         # source data) so unchanged V2 templates still re-commit once with the improved output.
-        $Sha = [System.Convert]::ToHexString([System.Security.Cryptography.SHA256]::HashData([System.Text.Encoding]::UTF8.GetBytes("$($Row.JSON)|reportOnly=$ReportOnly|detect=$AddDetectStandards|mapper=2"))).ToLower()
+        $Sha = [System.Convert]::ToHexString([System.Security.Cryptography.SHA256]::HashData([System.Text.Encoding]::UTF8.GetBytes("$($Row.JSON)|reportOnly=$ReportOnly|detect=$AddDetectStandards|mapper=3"))).ToLower()
         $SafeSource = ConvertTo-CIPPODataFilterValue -Value $SourceMarker
         $Existing = Get-CIPPAzDataTableEntity @RolloutTable -Filter "PartitionKey eq 'rollout' and Source eq '$SafeSource'" | Select-Object -First 1
         if ($Existing -and "$($Existing.SHA)" -eq $Sha) {
diff --git a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineStandard.ps1 b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineStandard.ps1
index 800f3419e9214..9e028befe9555 100644
--- a/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineStandard.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineStandard.ps1
@@ -260,7 +260,7 @@ function Invoke-CIPPBaselineStandard {
         # Per-property verdicts default to 'accept' (tolerate); 'denyDelete' marks the path's
         # object for deletion. Both filter the diff; deny-delete parks the row at Delete
         # Pending instead of scoring it Accepted.
-        $AcceptedPaths = $(try { $Prior.AcceptedPaths | ConvertFrom-Json } catch { $null })
+        $AcceptedPaths = $(try { if ($Prior.AcceptedPaths) { $Prior.AcceptedPaths | ConvertFrom-Json -ErrorAction Stop } } catch { $null })
         $AcceptedKeys = @($AcceptedPaths.PSObject.Properties.Name | Where-Object { $_ })
         $DenyDeleteKeys = @($AcceptedPaths.PSObject.Properties | Where-Object { $_.Name -and $_.Value.verdict -eq 'denyDelete' } | ForEach-Object { $_.Name })
         $ExpectedTemplate = & $Render $Definition.expected $Item.Variables
@@ -360,7 +360,7 @@ function Invoke-CIPPBaselineStandard {
             if ($GradeOnly) { return $null }
             $Manual = & $Render $Definition.manual $Item.Variables
             $Result.Manual = $Manual
-            $Completed = [bool]($(try { $Prior.CurrentValue | ConvertFrom-Json } catch { $null })?.completed)
+            $Completed = [bool]($(try { if ($Prior.CurrentValue) { $Prior.CurrentValue | ConvertFrom-Json -ErrorAction Stop } } catch { $null })?.completed)
             $LastDone = if ("$($Prior.LastRemediated)" -match '^\d+$') { [int64]$Prior.LastRemediated } else { 0 }
             $ReopenSeconds = switch ($Manual.reopen) {
                 'weekly' { 7 * 86400 }
diff --git a/Modules/CIPPCore/Public/Baselines/New-CIPPBaseline.ps1 b/Modules/CIPPCore/Public/Baselines/New-CIPPBaseline.ps1
index 7e07b5aeae903..774fefbf93815 100644
--- a/Modules/CIPPCore/Public/Baselines/New-CIPPBaseline.ps1
+++ b/Modules/CIPPCore/Public/Baselines/New-CIPPBaseline.ps1
@@ -24,7 +24,9 @@ function New-CIPPBaseline {
         $Baseline,
         $User,
         $Source,
-        $SHA
+        $SHA,
+        $SourcePath,
+        [bool]$LocalChanges
     )
 
     if (-not $Baseline.templateName) {
@@ -49,13 +51,16 @@ function New-CIPPBaseline {
     $SafeGuid = ConvertTo-CIPPODataFilterValue -Value $GUID
     $ExistingRollout = Get-CIPPAzDataTableEntity @RolloutTable -Filter "PartitionKey eq 'rollout' and RowKey eq '$SafeGuid'" | Select-Object -First 1
     $RolloutTable.Force = $true
+    # Explicit -LocalChanges wins; otherwise carry the existing rollout row's flag across,
+    # same as Source/SHA/SourcePath, so an editor re-save doesn't silently clear it.
+    $LocalChangesValue = if ($PSBoundParameters.ContainsKey('LocalChanges')) { $LocalChanges } else { $ExistingRollout.LocalChanges }
     # The editor round-trips the tenant selector's own option objects ({label, value,
     # type}) verbatim via assignedTo/excludedTo; the flat excludedTenants values keep
     # the exclusion logic simple. Raw string values are accepted everywhere too.
     $ExcludedValues = @($Baseline.excludedTenants | ForEach-Object {
             if ($null -eq $_) { } elseif ($_ -is [string]) { $_ } else { "$($_.value)" }
         } | Where-Object { $_ })
-    Add-CIPPAzDataTableEntity @RolloutTable -Entity @{
+    $RolloutEntity = @{
         PartitionKey    = 'rollout'
         RowKey          = "$GUID"
         templateName    = "$($Baseline.templateName)"
@@ -65,6 +70,10 @@ function New-CIPPBaseline {
         excludedTenants = (ConvertTo-Json -Compress -Depth 10 -InputObject $ExcludedValues)
         alertEmails     = "$($Baseline.alertEmails)"
         alertWebhookUrl = "$($Baseline.alertWebhookUrl)"
+        # 'Disable Alerts': deviations are still detected and shown, but no email, webhook
+        # or PSA notification fires for this baseline. Negative flag on purpose: rows saved
+        # before the column existed keep alerting, exactly right.
+        disableAlerts   = [bool]$Baseline.disableAlerts
         # 'Disable Scheduled Runs': the baseline only executes when an operator runs it.
         # Negative flag on purpose: rows saved before the column existed default to
         # scheduled, exactly right.
@@ -74,7 +83,13 @@ function New-CIPPBaseline {
         updatedAt       = $Now
         Source          = "$($Source ?? $ExistingRollout.Source)"
         SHA             = "$($SHA ?? $ExistingRollout.SHA)"
+        SourcePath      = "$($SourcePath ?? $ExistingRollout.SourcePath)"
     }
+    # A brand-new baseline with no Source and no explicit flag gets no LocalChanges column at all.
+    if ($null -ne $LocalChangesValue) {
+        $RolloutEntity.LocalChanges = [bool]$LocalChangesValue
+    }
+    Add-CIPPAzDataTableEntity @RolloutTable -Entity $RolloutEntity
 
     # Explode into delta rows: RK <scopeSegment>-<standardName>-s<stage>-<templateId>.
     # The stage is part of the key so the same standard can exist in two stages (the
diff --git a/Modules/CIPPCore/Public/Baselines/Send-CIPPBaselineAlert.ps1 b/Modules/CIPPCore/Public/Baselines/Send-CIPPBaselineAlert.ps1
index 37420933171fd..98b32195f591c 100644
--- a/Modules/CIPPCore/Public/Baselines/Send-CIPPBaselineAlert.ps1
+++ b/Modules/CIPPCore/Public/Baselines/Send-CIPPBaselineAlert.ps1
@@ -1,55 +1,80 @@
 function Send-CIPPBaselineAlert {
     <#
     .SYNOPSIS
-        Delivers a baseline deviation/remediation alert.
+        Queues a baseline deviation/remediation alert for the end-of-run digest.
     .DESCRIPTION
-        Fires on the transition into Drift (alertEnabled) and on auto-remediation
-        (alertOnRemediate). When the baseline configures its own alertEmails/alertWebhookUrl
-        those destinations OVERRIDE the instance-wide channels; otherwise the alert goes through
-        the standard CippNotifications config (email + webhook + PSA each no-op when unset).
+        Fires on the transition into Drift (alertEnabled), on auto-remediation
+        (alertOnRemediate) 
     .FUNCTIONALITY
         Internal
     #>
     [CmdletBinding()]
     param($Result)
 
-    $Item = $Result.Item
-    $AlertEvent = $Result.AlertEvent
-    $Title = if ($AlertEvent -eq 'Remediated') {
-        "Baseline standard auto-remediated: $($Item.Standard) on $($Item.TenantFilter)"
-    } elseif ($AlertEvent -eq 'Conflict') {
-        "Baseline conflict: $($Item.Standard) on $($Item.TenantFilter) is configured differently by $(@($Item.ConflictWith) -join ' and ')"
-    } else {
-        "Baseline drift detected: $($Item.Standard) on $($Item.TenantFilter)"
-    }
-    $DiffLines = @($Result.Diff | ForEach-Object {
-            "<li><b>$($_.Property)</b>: expected '$($_.ExpectedValue)', found '$($_.ReceivedValue)'</li>"
-        }) -join ''
-    $HTMLContent = "<p>$Title (baseline: $($Item.SourceTemplate), stage $($Item.Stage)).</p>" + $(if ($DiffLines) { "<ul>$DiffLines</ul>" } else { '' })
-    $JSONContent = ConvertTo-Json -Compress -Depth 100 -InputObject ([PSCustomObject]@{
-            Event        = $AlertEvent
-            Tenant       = $Item.TenantFilter
-            Standard     = $Item.Standard
-            Baseline     = $Item.SourceTemplate
-            Stage        = $Item.Stage
-            Differences  = @($Result.Diff)
-        })
-
     try {
-        if ($Item.AlertEmails -or $Item.AlertWebhookUrl) {
-            # Baseline-level destinations override the instance-wide channels.
-            if ($Item.AlertEmails) {
-                Send-CIPPAlert -Type 'email' -Title $Title -HTMLContent $HTMLContent -TenantFilter $Item.TenantFilter -altEmail $Item.AlertEmails -APIName 'Baselines'
-            }
-            if ($Item.AlertWebhookUrl) {
-                Send-CIPPAlert -Type 'webhook' -Title $Title -JSONContent $JSONContent -TenantFilter $Item.TenantFilter -altWebhook $Item.AlertWebhookUrl -APIName 'Baselines'
+        $Item = $Result.Item
+        $Definition = $null
+        try { $Definition = Get-CIPPBaselineDefinition -Name $Item.BaseName } catch {}
+        $Label = $Definition.label ?? $Item.BaseName ?? $Item.Standard
+        $PolicyName = $Result.ExpectedValue.displayName
+        if ($PolicyName -is [string] -and -not [string]::IsNullOrWhiteSpace($PolicyName) -and $PolicyName -notmatch '\.json$') {
+            $Label = $PolicyName
+        }
+        $Description = "$($Definition.executiveText ?? $Definition.helpText)"
+        if ($Description.Length -gt 280) { $Description = "$($Description.Substring(0, 277))..." }
+
+        $SettingLabels = @{}
+        $SettingOptions = @{}
+        foreach ($ExpectedProperty in (($Definition.expected ?? [PSCustomObject]@{}).PSObject.Properties)) {
+            if ($ExpectedProperty.Value -is [string] -and $ExpectedProperty.Value -match '^%(\w+)%$') {
+                $Variable = $Definition.variables.($Matches[1])
+                if ($Variable.label -and $Variable.label -notmatch '\?\s*$') { $SettingLabels[$ExpectedProperty.Name] = "$($Variable.label)" }
+                if ($Variable.options) { $SettingOptions[$ExpectedProperty.Name] = @($Variable.options) }
             }
-        } else {
-            Send-CIPPAlert -Type 'email' -Title $Title -HTMLContent $HTMLContent -TenantFilter $Item.TenantFilter -APIName 'Baselines'
-            Send-CIPPAlert -Type 'webhook' -Title $Title -JSONContent $JSONContent -TenantFilter $Item.TenantFilter -APIName 'Baselines'
-            Send-CIPPAlert -Type 'psa' -Title $Title -HTMLContent $HTMLContent -TenantFilter $Item.TenantFilter -APIName 'Baselines'
+        }
+        $FriendlySetting = {
+            param($PropertyName)
+            if ($SettingLabels.ContainsKey("$PropertyName")) { return $SettingLabels["$PropertyName"] }
+            $Leaf = @("$PropertyName" -split '\.')[-1]
+            $Spaced = $Leaf -creplace '([a-z0-9])([A-Z])', '$1 $2'
+            if ($Spaced.Length -gt 0) { $Spaced.Substring(0, 1).ToUpper() + $Spaced.Substring(1) } else { "$PropertyName" }
+        }
+        $FriendlyValue = {
+            param($PropertyName, $Value)
+            if ($Value -is [bool]) { return $Value } # the template renders On/Off
+            $Text = "$Value"
+            $Option = @($SettingOptions["$PropertyName"]) | Where-Object { "$($_.value)" -eq $Text } | Select-Object -First 1
+            if ($Option) { return "$($Option.label)" }
+            if ($Text.Length -gt 200) { return "$($Text.Substring(0, 197))..." }
+            $Text
+        }
+        $Differences = @(($Result.Diff ?? $Result.RowDiff) | Where-Object { $_ } | Select-Object -First 12 | ForEach-Object {
+                [PSCustomObject]@{
+                    Property      = & $FriendlySetting $_.Property
+                    ExpectedValue = & $FriendlyValue $_.Property $_.ExpectedValue
+                    ReceivedValue = & $FriendlyValue $_.Property $_.ReceivedValue
+                }
+            })
+
+        $RunId = if ($script:CippBaselineRunIdStorage) { $script:CippBaselineRunIdStorage.Value } else { '' }
+        $Table = Get-CippTable -tablename 'BaselineAlertQueue'
+        Add-CIPPAzDataTableEntity @Table -Entity @{
+            PartitionKey    = "$($Item.TenantFilter)"
+            RowKey          = [string](New-Guid).Guid
+            Event           = "$($Result.AlertEvent)"
+            Standard        = "$($Item.Standard)"
+            Label           = "$Label"
+            Description     = "$Description"
+            Category        = "$($Definition.cat)"
+            Baseline        = "$($Item.SourceTemplate)"
+            Stage           = "$($Item.Stage)"
+            Differences     = "$(ConvertTo-Json -Compress -Depth 10 -InputObject $Differences)"
+            ConflictWith    = "$(@($Item.ConflictWith) -join ', ')"
+            AlertEmails     = "$($Item.AlertEmails)"
+            AlertWebhookUrl = "$($Item.AlertWebhookUrl)"
+            RunId           = "$RunId"
         }
     } catch {
-        Write-LogMessage -API 'Baselines' -tenant $Item.TenantFilter -message "Failed to send baseline alert for $($Item.Standard): $($_.Exception.Message)" -Sev 'Error'
+        Write-LogMessage -API 'Baselines' -tenant $Result.Item.TenantFilter -message "Failed to queue baseline alert for $($Result.Item.Standard): $($_.Exception.Message)" -Sev 'Error'
     }
 }
diff --git a/Modules/CIPPCore/Public/Baselines/Send-CIPPBaselineAlertDigest.ps1 b/Modules/CIPPCore/Public/Baselines/Send-CIPPBaselineAlertDigest.ps1
new file mode 100644
index 0000000000000..3033bb1a98452
--- /dev/null
+++ b/Modules/CIPPCore/Public/Baselines/Send-CIPPBaselineAlertDigest.ps1
@@ -0,0 +1,100 @@
+function Send-CIPPBaselineAlertDigest {
+    <#
+    .SYNOPSIS
+        Ships all queued baseline alerts as one notification per tenant.
+    .DESCRIPTION
+       
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    try {
+        $Table = Get-CippTable -tablename 'BaselineAlertQueue'
+        $Queued = @(Get-CIPPAzDataTableEntity @Table)
+        if ($Queued.Count -eq 0) { return }
+
+        $ConfigTable = Get-CIPPTable -TableName SchedulerConfig
+        $Config = [pscustomobject](Get-CIPPAzDataTableEntity @ConfigTable -Filter "RowKey eq 'CippNotifications' and PartitionKey eq 'CippNotifications'")
+
+        $CippConfigTable = Get-CippTable -tablename Config
+        $CippConfig = Get-CIPPAzDataTableEntity @CippConfigTable -Filter "PartitionKey eq 'InstanceProperties' and RowKey eq 'CIPPURL'"
+        $CIPPURL = 'https://{0}' -f $CippConfig.Value
+
+        foreach ($TenantGroup in ($Queued | Group-Object -Property PartitionKey)) {
+            $TenantFilter = $TenantGroup.Name
+
+            # Newest event wins when the same (standard, event) queued twice across runs.
+            $Rows = @($TenantGroup.Group | Sort-Object -Property Timestamp -Descending |
+                Group-Object -Property { '{0}|{1}' -f $_.Standard, $_.Event } |
+                ForEach-Object { $_.Group[0] })
+
+            # A baseline with its own destinations ships separately from the default
+            # channels, so one digest per destination set.
+            foreach ($DestinationGroup in ($Rows | Group-Object -Property { '{0}|{1}' -f $_.AlertEmails, $_.AlertWebhookUrl })) {
+                $GroupRows = @($DestinationGroup.Group)
+                $AlertEmails = "$($GroupRows[0].AlertEmails)"
+                $AlertWebhookUrl = "$($GroupRows[0].AlertWebhookUrl)"
+                $HasOverride = -not ([string]::IsNullOrWhiteSpace($AlertEmails) -and [string]::IsNullOrWhiteSpace($AlertWebhookUrl))
+
+                $Alerts = @($GroupRows | ForEach-Object {
+                        [PSCustomObject]@{
+                            Event        = $_.Event
+                            Standard     = $_.Standard
+                            Label        = $_.Label
+                            Description  = $_.Description
+                            Category     = $_.Category
+                            Baseline     = $_.Baseline
+                            Stage        = $_.Stage
+                            Differences  = @($_.Differences | ConvertFrom-Json -ErrorAction SilentlyContinue)
+                            ConflictWith = @("$($_.ConflictWith)" -split ', ' | Where-Object { $_ })
+                            RunId        = $_.RunId
+                        }
+                    })
+
+                $EmailTemplate = New-CIPPAlertTemplate -Format 'html' -InputObject 'baseline' -Data $Alerts -CIPPURL $CIPPURL -Tenant $TenantFilter
+                $Title = $EmailTemplate.title
+
+                $WebhookData = [PSCustomObject]@{
+                    Title           = $Title
+                    Tenant          = $TenantFilter
+                    DriftCount      = @($Alerts | Where-Object { $_.Event -eq 'Drift' }).Count
+                    RemediatedCount = @($Alerts | Where-Object { $_.Event -eq 'Remediated' }).Count
+                    ConflictCount   = @($Alerts | Where-Object { $_.Event -eq 'Conflict' }).Count
+                    Standards       = @($Alerts | Select-Object Event, Standard, Label, Category, Baseline, Stage, Differences, ConflictWith, RunId)
+                } | ConvertTo-Json -Depth 10 -Compress
+
+                if ($HasOverride) {
+                    if (![string]::IsNullOrWhiteSpace($AlertEmails)) {
+                        $null = Send-CIPPAlert -Type 'email' -Title $Title -HTMLContent $EmailTemplate.htmlcontent -TenantFilter $TenantFilter -altEmail $AlertEmails -APIName 'Baselines'
+                    }
+                    if (![string]::IsNullOrWhiteSpace($AlertWebhookUrl)) {
+                        $null = Send-CIPPAlert -Type 'webhook' -Title $Title -JSONContent $WebhookData -TenantFilter $TenantFilter -altWebhook $AlertWebhookUrl `
+                            -APIName 'Baselines' -SchemaSource 'Baseline Alert' -InvokingCommand 'Invoke-CIPPBaselineStandard' `
+                            -UseStandardizedSchema:$([boolean]$Config.UseStandardizedSchema)
+                    }
+                } else {
+                    $null = Send-CIPPAlert -Type 'email' -Title $Title -HTMLContent $EmailTemplate.htmlcontent -TenantFilter $TenantFilter -APIName 'Baselines'
+                    $null = Send-CIPPAlert -Type 'webhook' -Title $Title -JSONContent $WebhookData -TenantFilter $TenantFilter `
+                        -APIName 'Baselines' -SchemaSource 'Baseline Alert' -InvokingCommand 'Invoke-CIPPBaselineStandard' `
+                        -UseStandardizedSchema:$([boolean]$Config.UseStandardizedSchema)
+                    # Gate here so Send-CIPPAlert's skip warning only fires for deliveries someone asked for.
+                    if ($Config.sendtoIntegration) {
+                        # PSA tickets get the style-free fragment: Halo stores the full email's
+                        # <style> block but never applies it, which strips the tables bare.
+                        $PsaTemplate = New-CIPPAlertTemplate -Format 'psa' -InputObject 'baseline' -Data $Alerts -CIPPURL $CIPPURL -Tenant $TenantFilter
+                        $null = Send-CIPPAlert -Type 'psa' -Title $Title -HTMLContent $PsaTemplate.htmlcontent -TenantFilter $TenantFilter -APIName 'Baselines'
+                    }
+                }
+            }
+
+            # Processed - drained whether or not every channel accepted it, so a failing
+            # channel cannot replay the same digest at every following run.
+            Remove-CIPPAzDataTableEntity -Force @Table -Entity @($TenantGroup.Group)
+            Write-LogMessage -API 'Baselines' -tenant $TenantFilter -message "Sent baseline alert digest: $($Rows.Count) event$(if ($Rows.Count -ne 1) { 's' })" -Sev 'Info'
+        }
+    } catch {
+        Write-LogMessage -API 'Baselines' -message "Baseline alert digest failed: $($_.Exception.Message)" -Sev 'Error'
+    }
+}
diff --git a/Modules/CIPPCore/Public/Clear-CIPPImmutableId.ps1 b/Modules/CIPPCore/Public/Clear-CIPPImmutableId.ps1
index 4f4f11e1ad2eb..6bb99fe824fc6 100644
--- a/Modules/CIPPCore/Public/Clear-CIPPImmutableId.ps1
+++ b/Modules/CIPPCore/Public/Clear-CIPPImmutableId.ps1
@@ -1,4 +1,7 @@
 function Clear-CIPPImmutableId {
+    # Legacy: kept for offboarding and already-queued scheduled tasks. New code should prolly use Clear-CIPPOnPremisesAttributes instead -bobby
+    # TODO: Move Invoke-CIPPOffboardingJob(User Offboarding) to use Clear-CIPPOnPremisesAttributes instead
+
     [CmdletBinding()]
     param (
         $TenantFilter,
@@ -9,18 +12,17 @@ function Clear-CIPPImmutableId {
         $APIName = 'Clear Immutable ID'
     )
 
-    try {
-        # If User object is provided, check if we need to schedule instead of clearing immediately
-        if ($User) {
+    # If User object is provided, check if we need to schedule instead of clearing immediately
+    if ($User) {
+        $DisplayName = $Username ?? $UserID
+        try {
             # User has ImmutableID but is not synced from on-premises - safe to clear immediately
             if ($User.onPremisesSyncEnabled -ne $true -and ![string]::IsNullOrEmpty($User.onPremisesImmutableId)) {
-                $DisplayName = $Username ?? $UserID
                 Write-LogMessage -Message "User $DisplayName has an ImmutableID set but is not synced from on-premises. Proceeding to clear the ImmutableID." -TenantFilter $TenantFilter -Severity 'Warning' -APIName $APIName -headers $Headers
                 # Continue to clear below
             }
             # User is synced from on-premises - must schedule for after deletion
             elseif ($User.onPremisesSyncEnabled -eq $true -and ![string]::IsNullOrEmpty($User.onPremisesImmutableId)) {
-                $DisplayName = $Username ?? $UserID
                 Write-LogMessage -Message "User $DisplayName is synced from on-premises. Scheduling an Immutable ID clear for when the user account has been soft deleted." -TenantFilter $TenantFilter -Severity 'Warning' -APIName $APIName -headers $Headers
 
                 $ScheduledTask = @{
@@ -54,38 +56,18 @@ function Clear-CIPPImmutableId {
             }
             # User has no ImmutableID or is already clear
             else {
-                $DisplayName = $Username ?? $UserID
                 $Result = "User $DisplayName does not have an ImmutableID set or it is already cleared."
                 Write-LogMessage -headers $Headers -API $APIName -message $Result -sev Info -tenant $TenantFilter
                 return $Result
             }
-        }
-
-        # Perform the actual clear operation
-        try {
-            $UserObj = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$UserID" -tenantid $TenantFilter -ErrorAction SilentlyContinue
         } catch {
-            # User might be deleted, try to restore it
-            $DeletedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/directory/deletedItems/$UserID" -tenantid $TenantFilter
-            if ($DeletedUser.id) {
-                # Restore deleted user object
-                $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/directory/deletedItems/$UserID/restore" -tenantid $TenantFilter -type POST
-                Write-LogMessage -headers $Headers -API $APIName -message "Restored deleted user $UserID to clear immutable ID" -sev Info -tenant $TenantFilter
-            }
+            $ErrorMessage = Get-CippException -Exception $_
+            $Result = "Failed to schedule immutable ID clear for $DisplayName. Error: $($ErrorMessage.NormalizedError)"
+            Write-LogMessage -headers $Headers -API $APIName -message $Result -sev Error -tenant $TenantFilter -LogData $ErrorMessage
+            throw $Result
         }
-
-        $Body = [pscustomobject]@{ onPremisesImmutableId = $null }
-        $Body = ConvertTo-Json -InputObject $Body -Depth 5 -Compress
-        $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$UserID" -tenantid $TenantFilter -type PATCH -body $Body
-        $DisplayName = $Username ?? $UserID
-        $Result = "Successfully cleared immutable ID for user $DisplayName"
-        Write-LogMessage -headers $Headers -API $APIName -message $Result -sev Info -tenant $TenantFilter
-        return $Result
-    } catch {
-        $ErrorMessage = Get-CippException -Exception $_
-        $DisplayName = $Username ?? $UserID
-        $Result = "Failed to clear immutable ID for $DisplayName. Error: $($ErrorMessage.NormalizedError)"
-        Write-LogMessage -headers $Headers -API $APIName -message $Result -sev Error -tenant $TenantFilter -LogData $ErrorMessage
-        throw $Result
     }
+
+    # The clear itself (including restoring a soft-deleted user) lives in the shared on-premises attribute helper
+    return (Clear-CIPPOnPremisesAttributes -TenantFilter $TenantFilter -UserID $UserID -Username $Username -Headers $Headers -APIName $APIName -Attributes 'onPremisesImmutableId')
 }
diff --git a/Modules/CIPPCore/Public/Clear-CIPPOnPremisesAttributes.ps1 b/Modules/CIPPCore/Public/Clear-CIPPOnPremisesAttributes.ps1
new file mode 100644
index 0000000000000..ef6ed2769e8e7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Clear-CIPPOnPremisesAttributes.ps1
@@ -0,0 +1,69 @@
+function Clear-CIPPOnPremisesAttributes {
+    <#
+    .SYNOPSIS
+        Clears leftover on-premises attributes from a cloud-only user.
+    .DESCRIPTION
+        PATCHes the selected onPremises* attributes to null via Graph beta. Only cloud-only users can be
+        updated (Graph rejects synced ones). The values being cleared are written to the log entry as the
+        rollback record Microsoft recommends keeping.
+        https://learn.microsoft.com/entra/identity/hybrid/connect/tshoot-clear-on-premises-attributes
+    #>
+    [CmdletBinding()]
+    param (
+        $TenantFilter,
+        $UserID,
+        $Username, # Optional - used for better logging
+        $Headers,
+        $APIName = 'Clear On-Premises Attributes',
+        [string[]]$Attributes # Attribute names to clear; empty clears every clearable attribute
+    )
+
+    # The on-premises attributes Microsoft documents as clearable on cloud-only users
+    $ClearableAttributes = @(
+        'onPremisesDistinguishedName', 'onPremisesDomainName', 'onPremisesImmutableId', 'onPremisesObjectIdentifier',
+        'onPremisesSamAccountName', 'onPremisesSecurityIdentifier', 'onPremisesUserPrincipalName'
+    )
+    $DisplayName = $Username ?? $UserID
+
+    try {
+        # Names arrive from the request body: normalise casing and reject anything outside the documented list
+        if (-not $Attributes) { $Attributes = $ClearableAttributes }
+        $Attributes = @(foreach ($Attribute in $Attributes) {
+                $Match = $ClearableAttributes | Where-Object { $_ -eq $Attribute } | Select-Object -First 1
+                if (-not $Match) { throw "'$Attribute' is not a clearable on-premises attribute. Allowed: $($ClearableAttributes -join ', ')" }
+                $Match
+            })
+        $AttributeList = $Attributes -join ', '
+
+        try {
+            $SelectProps = (@('id', 'userPrincipalName', 'displayName') + $ClearableAttributes) -join ','
+            $UserObj = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$($UserID)?`$select=$SelectProps" -tenantid $TenantFilter -ErrorAction SilentlyContinue
+        } catch {
+            # User might be soft deleted (offboarding flow), restore it so the attributes can be cleared
+            $DeletedUser = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/directory/deletedItems/$UserID" -tenantid $TenantFilter
+            if ($DeletedUser.id) {
+                $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/directory/deletedItems/$UserID/restore" -tenantid $TenantFilter -type POST
+                Write-LogMessage -headers $Headers -API $APIName -message "Restored deleted user $UserID to clear on-premises attributes" -sev Info -tenant $TenantFilter
+            }
+        }
+
+        # Keep the values being wiped in the log entry: Microsoft advises backing them up first, and the log is the rollback record
+        $Previous = [ordered]@{}
+        $Body = @{}
+        foreach ($Attribute in $Attributes) {
+            $Previous[$Attribute] = $UserObj.$Attribute
+            $Body[$Attribute] = $null
+        }
+        $Body = ConvertTo-Json -InputObject $Body -Depth 5 -Compress
+        $null = New-GraphPostRequest -uri "https://graph.microsoft.com/beta/users/$UserID" -tenantid $TenantFilter -type PATCH -body $Body -AsApp $true
+
+        $Result = "Successfully cleared $AttributeList for user $DisplayName"
+        Write-LogMessage -headers $Headers -API $APIName -message $Result -sev Info -tenant $TenantFilter -LogData $Previous
+        return $Result
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to clear on-premises attributes ($($Attributes -join ', ')) for $DisplayName. Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Result -sev Error -tenant $TenantFilter -LogData $ErrorMessage
+        throw $Result
+    }
+}
diff --git a/Modules/CIPPCore/Public/Compare-CIPPIntuneAssignments.ps1 b/Modules/CIPPCore/Public/Compare-CIPPIntuneAssignments.ps1
index 98bbaf305ea31..544d222698776 100644
--- a/Modules/CIPPCore/Public/Compare-CIPPIntuneAssignments.ps1
+++ b/Modules/CIPPCore/Public/Compare-CIPPIntuneAssignments.ps1
@@ -112,6 +112,18 @@ function Compare-CIPPIntuneAssignments {
         # expected group, not an unexpected extra one.
         $BroadGroupIds = @($BroadTarget.Targets | Where-Object { $_.groupId } | ForEach-Object { $_.groupId })
 
+        # Intune reports some broad group targets back under an equivalent type. Accepting only the
+        # shape remediation writes flags a working assignment as a deviation on every run.
+        $EquivalentTypes = [System.Collections.Generic.List[string]]::new()
+        $SatisfiedBroadIds = [System.Collections.Generic.List[string]]::new()
+        foreach ($BroadId in @($BroadTarget.Equivalents.Keys)) {
+            $Types = @($BroadTarget.Equivalents[$BroadId])
+            $EquivalentTypes.AddRange([string[]]$Types)
+            if (@($Types | Where-Object { $_ -in $ExistingIncludeTypes }).Count -gt 0) {
+                $SatisfiedBroadIds.Add($BroadId)
+            }
+        }
+
         # Groups are looked up once and reused for name->id resolution and for naming the ids that
         # turn out to differ.
         $AllGroupsCache = $null
@@ -143,7 +155,7 @@ function Compare-CIPPIntuneAssignments {
         $TargetTypeMatch = $true
         if ($Target.Managed) {
             $MissingTypes = @($ExpectedIncludeTypes | Where-Object { $_ -ne $GroupType -and $_ -notin $ExistingIncludeTypes })
-            $ExtraTypes = @($ExistingIncludeTypes | Where-Object { $_ -ne $GroupType -and $_ -notin $ExpectedIncludeTypes })
+            $ExtraTypes = @($ExistingIncludeTypes | Where-Object { $_ -ne $GroupType -and $_ -notin $ExpectedIncludeTypes -and $_ -notin $EquivalentTypes })
             if ($MissingTypes.Count -gt 0) {
                 $TargetTypeMatch = $false
                 $Reasons.Add("Policy is not assigned to $(($MissingTypes -replace '#microsoft\.graph\.', '') -join ', ')")
@@ -163,7 +175,7 @@ function Compare-CIPPIntuneAssignments {
             foreach ($Name in $Resolved.Unresolved) { $UnresolvedGroups.Add($Name) }
         }
         $ExpectedGroupIds = @($ExpectedGroupIds) + $BroadGroupIds
-        $MissingIncludeIds = @($ExpectedGroupIds | Where-Object { $_ -notin $ExistingIncludeGroupIds })
+        $MissingIncludeIds = @($ExpectedGroupIds | Where-Object { $_ -notin $ExistingIncludeGroupIds -and $_ -notin $SatisfiedBroadIds })
         $ExtraIncludeIds = if ($Target.Managed) {
             @($ExistingIncludeGroupIds | Where-Object { $_ -notin $ExpectedGroupIds })
         } else { @() }
diff --git a/Modules/CIPPCore/Public/ConvertTo-CIPPSensitivityLabelDomainToken.ps1 b/Modules/CIPPCore/Public/ConvertTo-CIPPSensitivityLabelDomainToken.ps1
new file mode 100644
index 0000000000000..f5750eeebeacc
--- /dev/null
+++ b/Modules/CIPPCore/Public/ConvertTo-CIPPSensitivityLabelDomainToken.ps1
@@ -0,0 +1,40 @@
+function ConvertTo-CIPPSensitivityLabelDomainToken {
+    <#
+    .SYNOPSIS
+        Replace the source tenant's domains in a captured sensitivity label's encryption rights with %defaultdomain%.
+    .DESCRIPTION
+        A label that encrypts for "everyone in my organization" records that as a rights definition whose
+        identity is the tenant's own domain:
+
+            [{"Identity":"contoso.com","Rights":"VIEW,DOCEDIT,PRINT"}]
+
+        Deployed as-is to another tenant, that grants the rights to the tenant the label was captured from
+        rather than to the tenant it lands in. Swapping the domain for the %defaultdomain% replacement token
+        at capture time lets Set-CIPPSensitivityLabel resolve it to each target tenant's own default domain.
+
+        Get-Label reports rights both as objects on the flat EncryptionRightsDefinitions property and as a
+        JSON string nested inside the (itself JSON-encoded) encrypt LabelAction, so the same identity shows
+        up in the serialized template at several levels of quote escaping. The match therefore runs over
+        the serialized template and tolerates any number of escaping backslashes around the quotes.
+
+        Only identities that are exactly one of the tenant's domains are replaced. Users and groups
+        ('user@contoso.com') do not exist in other tenants under any name and are left untouched.
+    .PARAMETER Json
+        The serialized label template.
+    .PARAMETER Domains
+        The domains that belong to the tenant the label was captured from.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)] [string] $Json,
+        [string[]] $Domains
+    )
+
+    $DomainPattern = @($Domains | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { [regex]::Escape($_.Trim()) }) -join '|'
+    if (-not $DomainPattern) { return $Json }
+
+    $Pattern = '(?i)(?<=Identity\\*"\s*:\s*\\*")(?:{0})(?=\\*")' -f $DomainPattern
+    return [regex]::Replace($Json, $Pattern, '%defaultdomain%')
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Resolve-CIPPOrchestratorPriority.ps1 b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Resolve-CIPPOrchestratorPriority.ps1
new file mode 100644
index 0000000000000..3e1160b3be047
--- /dev/null
+++ b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Resolve-CIPPOrchestratorPriority.ps1	
@@ -0,0 +1,31 @@
+function Resolve-CIPPOrchestratorPriority {
+    <#
+    .SYNOPSIS
+        Pick the queue priority bucket for a new orchestration.
+    .DESCRIPTION
+        The queue claims strictly by bucket (P00 first), so this decides who runs when the
+        limiter is saturated. Resolution order: an explicit valid Priority on the input object;
+        the enclosing run's priority from the stamped context; P1 for HTTP-triggered work so a
+        user's click never queues behind the P2 scheduled-task band; otherwise the background
+        default of P4.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    [OutputType([int])]
+    param(
+        $InputObject,
+        $OpContext
+    )
+
+    # Out-of-range explicit values take the fallback: the store clamps into 0-99 buckets, so a
+    # stray negative would otherwise silently land in the critical P00 bucket.
+    $Priority = if ($null -ne $InputObject.Priority) { [int]$InputObject.Priority }
+    if ($null -eq $Priority -or $Priority -lt 0 -or $Priority -gt 99) {
+        $Priority = if ($null -ne $OpContext) { $OpContext.PSObject.Properties['Priority'].Value }
+        if ($null -eq $Priority) {
+            $Priority = if ($null -ne $OpContext -and $OpContext.Category -eq 'HTTP') { 1 } else { 4 }
+        }
+    }
+    return [int]$Priority
+}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-BPAOrchestrator.ps1 b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-BPAOrchestrator.ps1
deleted file mode 100644
index a39329d9df812..0000000000000
--- a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-BPAOrchestrator.ps1	
+++ /dev/null
@@ -1,105 +0,0 @@
-function Start-BPAOrchestrator {
-    <#
-    .SYNOPSIS
-        Start the Best Practice Analyser
-    .DESCRIPTION
-        This function starts the Best Practice Analyser
-    .FUNCTIONALITY
-        Entrypoint
-    #>
-    [CmdletBinding(SupportsShouldProcess = $true)]
-    param(
-        $TenantFilter = 'AllTenants',
-        [switch]$Force
-    )
-
-    try {
-        # Check feature flag
-        $FeatureFlag = Get-CIPPFeatureFlag -Id 'BestPracticeAnalyser'
-        if ($FeatureFlag -and $FeatureFlag.Enabled -eq $false) {
-            Write-LogMessage -API 'BestPracticeAnalyser' -message 'Best Practice Analyser is disabled via feature flag' -sev Info
-            return $false
-        }
-        if ($TenantFilter -ne 'AllTenants') {
-            Write-Verbose "TenantFilter: $TenantFilter"
-            if ($TenantFilter -notmatch '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$') {
-                $TenantFilter = @($TenantFilter)
-            } else {
-                Write-Verbose 'Got GUID: Looking up tenant'
-                $TenantFilter = Get-Tenants -TenantFilter $TenantFilter | Select-Object -ExpandProperty defaultDomainName
-            }
-            $TenantList = @($TenantFilter)
-            $Name = "Best Practice Analyser ($TenantFilter)"
-        } else {
-            $TenantList = (Get-Tenants).defaultDomainName
-            $Name = 'Best Practice Analyser'
-        }
-
-        Write-Verbose 'Getting BPA templates'
-
-
-        $BPATemplateTable = Get-CippTable -tablename 'templates'
-        $Filter = "PartitionKey eq 'BPATemplate'"
-        try {
-            $TemplateRows = Get-CIPPAzDataTableEntity @BPATemplateTable -Filter $Filter
-
-            if (!$TemplateRows) {
-                $null = Get-ChildItem (Join-Path $env:CIPPRootPath 'Config\*.BPATemplate.json') | ForEach-Object {
-                    $TemplateJson = Get-Content $_ | ConvertFrom-Json | ConvertTo-Json -Compress -Depth 10
-                    $Entity = @{
-                        JSON         = "$TemplateJson"
-                        RowKey       = "$($_.name)"
-                        PartitionKey = 'BPATemplate'
-                        GUID         = "$($_.name)"
-                    }
-                    Add-CIPPAzDataTableEntity @BPATemplateTable -Entity $Entity -Force
-                }
-                $TemplateRows = Get-CIPPAzDataTableEntity @BPATemplateTable -Filter $Filter
-            }
-
-            $Templates = ($TemplateRows.JSON | ConvertFrom-Json).Name
-        } catch {
-            Write-LogMessage -API 'BestPracticeAnalyser' -message 'Could not get BPA templates' -sev Error
-            return $false
-        }
-        Write-Verbose 'Creating orchestrator batch'
-        $BPAReports = foreach ($Tenant in $TenantList) {
-            foreach ($Template in $Templates) {
-                [PSCustomObject]@{
-                    FunctionName = 'BPACollectData'
-                    Tenant       = $Tenant
-                    Template     = $Template
-                    QueueName    = '{0} - {1}' -f $Template, $Tenant
-                }
-            }
-        }
-
-        if ($Force.IsPresent) {
-            Write-Host 'Clearing Rerun Cache'
-            foreach ($Report in $BPAReports) {
-                $null = Test-CIPPRerun -Type BPA -Tenant $Report.Tenant -API $Report.Template -Clear
-            }
-        }
-
-        if (($BPAReports | Measure-Object).Count -eq 0) {
-            Write-Information 'No BPA reports to run'
-            return 0
-        }
-
-        if ($PSCmdlet.ShouldProcess($Name, 'Starting Orchestrator')) {
-            Write-LogMessage -API 'BestPracticeAnalyser' -message 'Starting Best Practice Analyser' -sev Info
-            $Queue = New-CippQueueEntry -Name $Name -TotalTasks ($BPAReports | Measure-Object).Count
-            $BPAReports = $BPAReports | Select-Object *, @{Name = 'QueueId'; Expression = { $Queue.RowKey } }
-            $InputObject = [PSCustomObject]@{
-                Batch            = @($BPAReports)
-                OrchestratorName = 'BPAOrchestrator'
-                SkipLog          = $true
-            }
-            return Start-CIPPOrchestrator -InputObject $InputObject
-        }
-    } catch {
-        $ErrorMessage = Get-CippException -Exception $_
-        Write-LogMessage -API 'BestPracticeAnalyser' -message "Could not start Best Practice Analyser: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
-        return $false
-    }
-}
diff --git a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPOrchestrator.ps1 b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPOrchestrator.ps1
index 29a90d26f7945..8a8e5e1f6a301 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPOrchestrator.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPOrchestrator.ps1	
@@ -17,7 +17,7 @@ function Start-CIPPOrchestrator {
         Indicates the caller is already running in a queue trigger context.
         Skips queuing and starts orchestration directly to avoid double-queuing.
     .EXAMPLE
-        Start-CIPPOrchestrator -InputObject @{OrchestratorName='BPA'; Batch=@($Tenants)}
+        Start-CIPPOrchestrator -InputObject @{OrchestratorName='UpdatePermissionsOrchestrator'; Batch=@($Tenants)}
     .EXAMPLE
         Start-CIPPOrchestrator -InputObject $InputObject -CallerIsQueueTrigger
     .FUNCTIONALITY
@@ -106,24 +106,9 @@ function Start-CIPPOrchestrator {
         # Both the priority default and the parent-run lineage below come from it.
         $OpContext = Get-Variable -Name 'CraftOperationContext' -Scope Global -ValueOnly -ErrorAction SilentlyContinue
 
-        # The queue claims strictly by priority bucket (P00 first), so this decides who runs
-        # when the limiter is saturated. Resolution order:
-        #   1. Explicit Priority on the InputObject, when it is a valid bucket (out-of-range values
-        #      take the fallback: the store clamps into 0-99 buckets, so a stray negative would
-        #      otherwise silently land in the critical P00 bucket).
-        #   2. The enclosing run's priority (from the stamped context) — a child run belongs to
-        #      its parent's band, so a baseline run's follow-up no longer drops back to the default.
-        #   3. P2 for HTTP-triggered orchestrations — user-initiated work must not queue behind
-        #      background fan-outs.
-        #   4. The historical default 4 (timers and other background starters).
-        $Priority = if ($null -ne $InputObject.Priority) { [int]$InputObject.Priority }
-        if ($null -eq $Priority -or $Priority -lt 0 -or $Priority -gt 99) {
-            $Priority = if ($null -ne $OpContext) { $OpContext.PSObject.Properties['Priority'].Value }
-            if ($null -eq $Priority) {
-                $Priority = if ($null -ne $OpContext -and $OpContext.Category -eq 'HTTP') { 2 } else { 4 }
-            }
-            $Priority = [int]$Priority
-        }
+        # Bucket resolution lives in Resolve-CIPPOrchestratorPriority: explicit value, then the
+        # enclosing run's band, then P1 for HTTP-triggered work, else the background default P4.
+        $Priority = Resolve-CIPPOrchestratorPriority -InputObject $InputObject -OpContext $OpContext
 
         # Lineage: pass the enclosing run explicitly as the new run's parent, so Craft holds the
         # parent's finalize (and PostExecution) until this child completes. The bridge cannot see
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1
index ba040541271ff..c2e91a4e8137c 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1	
@@ -102,7 +102,6 @@ function Start-CIPPStatsTimer {
             PWPush                 = $RawExt.PWPush.Enabled
             CFZTNA                 = $RawExt.CFZTNA.Enabled
             GitHub                 = $RawExt.GitHub.Enabled
-            BestPracticeAnalyser   = $FeatureFlags.BestPracticeAnalyser
             SuperAdminNG           = $FeatureFlags.SuperAdminNG
             MCPServer              = $FeatureFlags.MCPServer
             SSOMigrationStatus     = $MigrationStatus
diff --git a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1
index 30a7909022a9c..c41271b99ba70 100644
--- a/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1	
+++ b/Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1	
@@ -155,7 +155,7 @@ function Start-TableCleanup {
         @{
             FunctionName = 'TableCleanupTask'
             Type         = 'DeleteTable'
-            Tables       = @('knownlocationdb', 'CacheExtensionSync', 'ExtensionSync')
+            Tables       = @('knownlocationdb', 'CacheExtensionSync', 'ExtensionSync', 'cachebpav2')
         }
     )
 
diff --git a/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1 b/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1
index 49ce40b910c84..0c67adefe8e60 100644
--- a/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1
+++ b/Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1
@@ -304,8 +304,11 @@ function Get-CIPPTenantAlignment {
                         }
                     }
                 }
-                # Handle Reusable Settings templates — TemplateList is multi-select, one key per template id
-                elseif ($StandardKey -eq 'ReusableSettingsTemplate' -and $StandardConfig) {
+                # Handle Reusable Settings templates — TemplateList is multi-select, one key per template id.
+                # Match on the key alone (not truthiness): an empty template value (@()) must stay in this
+                # branch and emit nothing, not fall through to the catch-all below and produce a bare
+                # 'standards.ReusableSettingsTemplate' id that can never match a report row (shows as NOT FOUND).
+                elseif ($StandardKey -eq 'ReusableSettingsTemplate') {
                     foreach ($RSTemplate in @($StandardConfig)) {
                         $RSActions = if ($RSTemplate.action) { $RSTemplate.action } else { @() }
                         $RSReportingEnabled = ($RSActions | Where-Object { $_.value -and ($_.value.ToLower() -eq 'report' -or $_.value.ToLower() -eq 'remediate') }).Count -gt 0
diff --git a/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1 b/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1
index 04c1ada114d5c..cd5dbdd32808a 100644
--- a/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPAuthentication.ps1
@@ -93,6 +93,26 @@ function Get-CIPPAuthentication {
                 }
             }
 
+            if (-not $env:SAMCertificate -and $env:SAMCertProvisionAttempted -ne 'true') {
+                # Another worker may have just written the cert — re-read before minting.
+                if ($IsDevMode) {
+                    $Table = Get-CIPPTable -tablename 'DevSecrets'
+                    $Secret = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Secret' and RowKey eq 'Secret'"
+                    if ($Secret.SAMCertificate) {
+                        $env:SAMCertificate = $Secret.SAMCertificate
+                    }
+                } else {
+                    try {
+                        $SAMCertificateRetry = Get-CippKeyVaultSecret -VaultName $keyvaultname -Name 'SAMCertificate' -AsPlainText -ErrorAction Stop
+                        if ($SAMCertificateRetry) {
+                            $env:SAMCertificate = $SAMCertificateRetry
+                        }
+                    } catch {
+                        Write-Information "SAM certificate still not found on re-read: $($_.Exception.Message)"
+                    }
+                }
+            }
+
             if (-not $env:SAMCertificate -and $env:SAMCertProvisionAttempted -ne 'true') {
                 # First run on this instance: provision the certificate now, at most once per
                 # process. The guard also breaks a recursion loop: Update-CIPPSAMCertificate
diff --git a/Modules/CIPPCore/Public/Get-CIPPBitlockerKey.ps1 b/Modules/CIPPCore/Public/Get-CIPPBitlockerKey.ps1
index 0b159e9807bea..edd4d86bf0781 100644
--- a/Modules/CIPPCore/Public/Get-CIPPBitlockerKey.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPBitlockerKey.ps1
@@ -22,6 +22,7 @@
     Array of PSCustomObject with properties:
     - resultText: Formatted string containing the key ID and key value
     - copyField: The raw key value
+    - keyId: The BitLocker recovery key ID
     - state: Status of the operation ('success')
 
     Or a string message if no keys are found.
@@ -30,19 +31,27 @@
 function Get-CIPPBitLockerKey {
     [CmdletBinding()]
     param (
-        $Device,
-        $TenantFilter,
-        $APIName = 'Get BitLocker key',
-        $Headers
+        [Parameter(Mandatory = $true)]
+        [string]$Device,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [string]$APIName = 'Get BitLocker key',
+
+        [Parameter(Mandatory = $false)]
+        [object]$Headers
     )
 
     try {
-        $GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys?`$filter=deviceId eq '$($Device)'" -tenantid $TenantFilter |
+        $GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys?`$filter=deviceId eq '$Device'" -tenantid $TenantFilter -ErrorAction Stop |
             ForEach-Object {
-                $BitLockerKeyObject = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys/$($_.id)?`$select=key" -tenantid $TenantFilter)
+                $BitLockerKeyObject = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys/$($_.id)?`$select=key" -tenantid $TenantFilter -ErrorAction Stop
                 [PSCustomObject]@{
                     resultText = "Id: $($_.id) Key: $($BitLockerKeyObject.key)"
                     copyField  = $BitLockerKeyObject.key
+                    keyId      = $_.id
                     state      = 'success'
                 }
             }
diff --git a/Modules/CIPPCore/Public/Get-CIPPBrandingPreset.ps1 b/Modules/CIPPCore/Public/Get-CIPPBrandingPreset.ps1
index 76de098da4bbe..b32b3e60a7571 100644
--- a/Modules/CIPPCore/Public/Get-CIPPBrandingPreset.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPBrandingPreset.ps1
@@ -90,6 +90,7 @@ function Get-CIPPBrandingPreset {
             showPageNumbers  = if ($null -eq $Entity.showPageNumbers) { $true } else { [bool]$Entity.showPageNumbers }
             watermarkText    = if ($Entity.watermarkText) { "$($Entity.watermarkText)" } else { '' }
             watermarkEnabled = if ($null -eq $Entity.watermarkEnabled) { $true } else { [bool]$Entity.watermarkEnabled }
+            tenantLabel      = if (@('alias', 'name', 'domain') -contains "$($Entity.tenantLabel)") { "$($Entity.tenantLabel)" } else { 'alias' }
         }
     }
 
diff --git a/Modules/CIPPCore/Public/Get-CIPPBrandingSettings.ps1 b/Modules/CIPPCore/Public/Get-CIPPBrandingSettings.ps1
index 3548ad5333a7b..db5590381bca5 100644
--- a/Modules/CIPPCore/Public/Get-CIPPBrandingSettings.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPBrandingSettings.ps1
@@ -265,6 +265,13 @@ function Get-CIPPBrandingSettings {
     $ShowPageNumbers = if ($null -eq $BrandingConfig.showPageNumbers) { $true } else { [bool]$BrandingConfig.showPageNumbers }
     $WatermarkEnabled = if ($null -eq $BrandingConfig.watermarkEnabled) { $true } else { [bool]$BrandingConfig.watermarkEnabled }
 
+    # The gallery covers by id and name, without their data: what a picker elsewhere (an Infographic
+    # page's background in the report builder) needs to offer them.
+    $CoverNames = Get-CIPPImageNameMap -PartitionKey 'brandingCover'
+    $CoverImages = @(foreach ($Cid in $CoverImageIds) {
+            [pscustomobject]@{ id = [string]$Cid; name = if ($CoverNames.ContainsKey([string]$Cid)) { $CoverNames[[string]$Cid] } else { '' } }
+        })
+
     return [pscustomobject]@{
         colour           = if ($BrandingConfig.colour) { $BrandingConfig.colour } else { '#F77F00' }
         secondaryColour  = $SecondaryColour
@@ -277,6 +284,7 @@ function Get-CIPPBrandingSettings {
         logoUploads      = [string[]]@($LogoUploads)
         coverImage       = $CoverImageData
         coverUploads     = [string[]]@($CoverUploads)
+        coverImages      = $CoverImages
         footerText       = $FooterText
         coverFooterText  = $CoverFooterText
         showFooter       = $ShowFooter
@@ -285,5 +293,7 @@ function Get-CIPPBrandingSettings {
         watermarkEnabled = $WatermarkEnabled
         reportDefaults   = $ReportDefaults
         roleColours      = $RoleColours
+        # Which of the tenant's names a report prints; 'alias' is the name CIPP shows, the old behaviour.
+        tenantLabel      = if (@('alias', 'name', 'domain') -contains "$($BrandingConfig.tenantLabel)") { "$($BrandingConfig.tenantLabel)" } else { 'alias' }
     }
 }
diff --git a/Modules/CIPPCore/Public/Get-CIPPDbItem.ps1 b/Modules/CIPPCore/Public/Get-CIPPDbItem.ps1
index ba4f2d4a5d034..3fd2708e64d40 100644
--- a/Modules/CIPPCore/Public/Get-CIPPDbItem.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPDbItem.ps1
@@ -30,7 +30,11 @@ function Get-CIPPDbItem {
         [string]$Type,
 
         [Parameter(Mandatory = $false)]
-        [switch]$CountsOnly
+        [switch]$CountsOnly,
+
+        # With -CountsOnly: also return each collection's recorded Shape (fields and types).
+        [Parameter(Mandatory = $false)]
+        [switch]$IncludeShape
     )
 
     try {
@@ -64,7 +68,8 @@ function Get-CIPPDbItem {
             $Filter = [string]::Join(' and ', $Conditions)
             # -Property does the projection server-side; the trailing Select-Object was
             # redundant (and rebuilt every row as a NoteProperty bag, slowing later filters).
-            $Results = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property 'PartitionKey', 'RowKey', 'DataCount', 'Timestamp'
+            $Properties = @('PartitionKey', 'RowKey', 'DataCount', 'Timestamp'; if ($IncludeShape) { 'Shape' })
+            $Results = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property $Properties
         } else {
             if (-not $Type) {
                 throw 'Type parameter is required when CountsOnly is not specified'
diff --git a/Modules/CIPPCore/Public/Get-CIPPEnrollmentTimeDeviceMembershipTarget.ps1 b/Modules/CIPPCore/Public/Get-CIPPEnrollmentTimeDeviceMembershipTarget.ps1
new file mode 100644
index 0000000000000..fdfaa99e6dcfd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPEnrollmentTimeDeviceMembershipTarget.ps1
@@ -0,0 +1,58 @@
+function Get-CIPPEnrollmentTimeDeviceMembershipTarget {
+    <#
+    .SYNOPSIS
+        The enrollment-time device group applied to a Device Preparation policy.
+    .DESCRIPTION
+        Resolution order: the retrieveEnrollmentTimeDeviceMembershipTarget action, then the
+        marker CIPP wrote when it last applied a group, then nothing.
+
+        The live action comes first so a group swapped or cleared in the portal is seen and
+        repaired; the marker only carries the comparison on tenants where the action does not
+        route, and it is stale by definition on those where it does. The
+        enrollment_autopilot_dpp_devicesecuritygroupids setting string is deliberately NOT a
+        fallback: every build writes it on create while the group itself stays unapplied, so it
+        reports a half-deployed profile as healthy. No answer at all grades as no group applied,
+        which is the state the repair path can act on.
+
+        This is the only place the read-side URI is built.
+    .PARAMETER PolicyId
+        The configuration policy id.
+    .PARAMETER TenantFilter
+        The tenant to query.
+    .OUTPUTS
+        PSCustomObject with GroupId (empty when no group is applied) and Source, one of 'Marker',
+        'Retrieved' or 'None'.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$PolicyId,
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        $Result = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$PolicyId')/retrieveEnrollmentTimeDeviceMembershipTarget" -tenantid $TenantFilter -type POST
+        # The action result arrives both directly and wrapped in a value collection.
+        $Payload = if ($null -ne $Result.value) { $Result.value } else { $Result }
+        $Targets = @($Payload | ForEach-Object { $_.enrollmentTimeDeviceMembershipTargets } | Where-Object { $_ })
+        $Static = @($Targets | Where-Object { $_.targetType -eq 'staticSecurityGroup' -and $_.targetId }) | Select-Object -First 1
+        return [PSCustomObject]@{ GroupId = [string]$Static.targetId; Source = 'Retrieved' }
+    } catch {
+        Write-Information "Enrollment time device membership target is unavailable for policy $PolicyId : $($_.Exception.Message)"
+    }
+
+    try {
+        $Table = Get-CIPPTable -TableName 'EnrollmentTimeMembershipTargets'
+        $Marker = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$TenantFilter' and RowKey eq '$PolicyId'" | Select-Object -First 1
+        if ($Marker) {
+            return [PSCustomObject]@{ GroupId = [string]$Marker.GroupId; Source = 'Marker' }
+        }
+    } catch {
+        Write-Information "Could not read the enrollment time device membership marker for policy $PolicyId : $($_.Exception.Message)"
+    }
+
+    [PSCustomObject]@{ GroupId = ''; Source = 'None' }
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPImageNameMap.ps1 b/Modules/CIPPCore/Public/Get-CIPPImageNameMap.ps1
new file mode 100644
index 0000000000000..90448b8520ffa
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPImageNameMap.ps1
@@ -0,0 +1,32 @@
+function Get-CIPPImageNameMap {
+    <#
+    .FUNCTIONALITY
+        Internal
+    .SYNOPSIS
+        The names given to the gallery images of one kind, as a hashtable of image id -> name.
+    .DESCRIPTION
+        A name lives on a small row of its own (PartitionKey imageMeta, RowKey the image id) rather
+        than on the image row: an image payload is split across several entities, and renaming it
+        must not mean rewriting them. Images that were never named are simply absent from the map.
+    .PARAMETER PartitionKey
+        The image kind the names belong to (logo, brandingCover).
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$PartitionKey
+    )
+
+    $Map = @{}
+    try {
+        $Table = Get-CIPPTable -TableName 'Images'
+        $Rows = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'imageMeta' and kind eq '$($PartitionKey.Replace("'", "''"))'"
+        foreach ($Row in @($Rows)) {
+            if ($Row.RowKey -and -not [string]::IsNullOrWhiteSpace([string]$Row.name)) { $Map[[string]$Row.RowKey] = [string]$Row.name }
+        }
+    } catch {
+        Write-Warning "Failed to read image names for '$PartitionKey': $($_.Exception.Message)"
+    }
+    return $Map
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPIntuneAdminTemplateDefinitionValue.ps1 b/Modules/CIPPCore/Public/Get-CIPPIntuneAdminTemplateDefinitionValue.ps1
new file mode 100644
index 0000000000000..29c168fe9fdcf
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPIntuneAdminTemplateDefinitionValue.ps1
@@ -0,0 +1,116 @@
+function Get-CIPPIntuneAdminTemplateDefinitionValue {
+    <#
+    .SYNOPSIS
+        Reads an administrative template policy's settings as an updateDefinitionValues payload.
+    .DESCRIPTION
+        Builds the {added, updated, deletedIds} payload that deploys a groupPolicyConfiguration's
+        settings: one entry per definition value with its groupPolicyDefinitions('<id>') bind, enabled
+        state and presentation values. This is the shape stored in an Admin template's RAWJson and the
+        shape Get-CIPPIntunePolicy compares a live policy against.
+
+        With -IncludeIdentity each entry also carries the setting's identity next to its bind
+        (definition: displayName, categoryPath, classType, policyType; presentation: label, type and
+        position within the definition). Definitions from an imported ADMX file are minted with a new id
+        in every tenant, so this is what lets Resolve-CIPPIntuneAdminTemplateBinding find the same
+        setting in another tenant at deployment. Graph does not accept these properties on a definition
+        value, so the resolver removes them before posting.
+    .PARAMETER PolicyId
+        The groupPolicyConfiguration id.
+    .PARAMETER TenantFilter
+        The tenant the policy lives in.
+    .PARAMETER IncludeIdentity
+        Record each setting's identity next to its bind, for a template that will be deployed elsewhere.
+    .PARAMETER DefinitionValues
+        The policy's definition values when the caller has already read them (with $expand=definition),
+        so they are not read twice.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$PolicyId,
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [switch]$IncludeIdentity,
+        $DefinitionValues
+    )
+
+    $PolicyUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations('$PolicyId')"
+    if (-not $PSBoundParameters.ContainsKey('DefinitionValues')) {
+        # Without the expand the value carries no definition at all, and the bind would be built on
+        # an empty id.
+        $DefinitionValues = New-GraphGetRequest -uri "$PolicyUri/definitionValues?`$expand=definition" -tenantid $TenantFilter
+    }
+    $DefinitionValues = @($DefinitionValues | Where-Object { $_.id })
+
+    $Identities = @{}
+    $Presentations = @{}
+    if ($IncludeIdentity -and $DefinitionValues.Count -gt 0) {
+        # The expanded definition does not reliably carry categoryPath; read each definition and its
+        # presentation list (in ADMX order) in one batch.
+        $Requests = [System.Collections.Generic.List[object]]::new()
+        foreach ($DefinitionId in @($DefinitionValues.definition.id | Where-Object { $_ } | Select-Object -Unique)) {
+            $Requests.Add([PSCustomObject]@{ id = "definition-$DefinitionId"; method = 'GET'; url = "/deviceManagement/groupPolicyDefinitions('$DefinitionId')?`$select=id,displayName,categoryPath,classType,policyType" })
+            $Requests.Add([PSCustomObject]@{ id = "presentations-$DefinitionId"; method = 'GET'; url = "/deviceManagement/groupPolicyDefinitions('$DefinitionId')/presentations" })
+        }
+        foreach ($Reply in @(New-GraphBulkRequest -Requests @($Requests) -tenantid $TenantFilter)) {
+            if ($Reply.status -ne 200 -or -not $Reply.id) { continue }
+            if ($Reply.id -like 'definition-*') {
+                $Identities[$Reply.id.Substring(11)] = $Reply.body
+            } elseif ($Reply.id -like 'presentations-*') {
+                $Body = if ($null -ne $Reply.body.value) { $Reply.body.value } else { $Reply.body }
+                $Presentations[$Reply.id.Substring(14)] = @($Body | Where-Object { $_.id })
+            }
+        }
+    }
+
+    $Added = foreach ($DefinitionValue in $DefinitionValues) {
+        $DefinitionId = [string]$DefinitionValue.definition.id
+        $DefinitionUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$DefinitionId')"
+        $PresentationValues = New-GraphGetRequest -uri "$PolicyUri/definitionValues('$($DefinitionValue.id)')/presentationValues?`$expand=presentation" -tenantid $TenantFilter | ForEach-Object {
+            $Value = $_
+            if (-not $Value.id) { return }
+            $Entry = [ordered]@{
+                id                        = $Value.id
+                'presentation@odata.bind' = "$DefinitionUri/presentations('$($Value.presentation.id)')"
+            }
+            if ($Value.values) { $Entry['values'] = $Value.values }
+            if ($null -ne $Value.value) { $Entry['value'] = $Value.value }
+            if ($Value.'@odata.type') { $Entry['@odata.type'] = $Value.'@odata.type' }
+            if ($IncludeIdentity) {
+                $List = if ($Presentations.ContainsKey($DefinitionId)) { $Presentations[$DefinitionId] } else { @() }
+                $Position = [array]::FindIndex([object[]]$List, [Predicate[object]] { param($P) [string]$P.id -eq [string]$Value.presentation.id })
+                $Entry['presentation'] = [ordered]@{
+                    id            = $Value.presentation.id
+                    label         = [string]$Value.presentation.label
+                    '@odata.type' = [string]$Value.presentation.'@odata.type'
+                    index         = if ($Position -ge 0) { $Position } else { $null }
+                }
+            }
+            [pscustomobject]$Entry
+        }
+        $Item = [ordered]@{
+            'definition@odata.bind' = $DefinitionUri
+            enabled                 = $DefinitionValue.enabled
+            presentationValues      = @($PresentationValues)
+        }
+        if ($IncludeIdentity) {
+            $Detail = if ($Identities.ContainsKey($DefinitionId)) { $Identities[$DefinitionId] } else { $DefinitionValue.definition }
+            $Item['definition'] = [ordered]@{
+                id           = $DefinitionId
+                displayName  = [string]$Detail.displayName
+                categoryPath = [string]$Detail.categoryPath
+                classType    = [string]$Detail.classType
+                policyType   = [string]$Detail.policyType
+            }
+        }
+        [pscustomobject]$Item
+    }
+
+    return [pscustomobject]@{
+        added      = @($Added)
+        updated    = @()
+        deletedIds = @()
+    }
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPIntuneAssignmentTarget.ps1 b/Modules/CIPPCore/Public/Get-CIPPIntuneAssignmentTarget.ps1
index 0d92f92cafbf0..131afab35eec4 100644
--- a/Modules/CIPPCore/Public/Get-CIPPIntuneAssignmentTarget.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPIntuneAssignmentTarget.ps1
@@ -43,6 +43,9 @@ function Get-CIPPIntuneAssignmentTarget {
                           the request still can
             GroupNames  - display names for any virtual group a broad target resolved to, keyed by
                           id, so the comparison can name it instead of printing a bare GUID
+            Equivalents - assignment types that express the same audience as a broad group target,
+                          keyed by that target's group id. Remediation keeps writing the group
+                          target; the comparison accepts either shape.
 
     .EXAMPLE
         Get-CIPPIntuneAssignmentTarget -AssignTo 'allLicensedUsers' -PolicyType 'iosManagedAppProtections'
@@ -122,11 +125,20 @@ function Get-CIPPIntuneAssignmentTarget {
         $GroupNames[$MamAllUsersGroupId] = 'All Users'
     }
 
+    # Outside MAM, the device management service reports an All Users group assignment back as
+    # allLicensedUsersAssignmentTarget, so both shapes describe the same working assignment and the
+    # comparison must accept either. The MAM service rejects that type outright, so it stays out.
+    $Equivalents = @{}
+    if (-not $IsMam -and $Targets.groupId -contains $MamAllUsersGroupId) {
+        $Equivalents[$MamAllUsersGroupId] = @('#microsoft.graph.allLicensedUsersAssignmentTarget')
+    }
+
     [PSCustomObject]@{
         Targets     = @($Targets)
         Unsupported = $Unsupported
         Dropped     = @($Dropped)
         GroupNames  = $GroupNames
+        Equivalents = $Equivalents
         IsMam       = $IsMam
     }
 }
diff --git a/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1 b/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1
index 565771296eb04..90447b2a3714b 100644
--- a/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPIntunePolicy.ps1
@@ -9,6 +9,24 @@ function Get-CIPPIntunePolicy {
         $tenantFilter
     )
 
+    # Custom (OMA-URI) device configurations read back from Graph with their secret values encrypted
+    # (value 'PGEvPg==', isEncrypted, secretReferenceValueId), whereas the template captured by
+    # New-CIPPIntuneTemplate stores them decrypted. Without decrypting the read-back copy the drift
+    # compare can never converge and the template re-deploys on every standards run. Decrypt here the
+    # same way capture and the DB cache already do, but never let a decrypt failure sink the whole
+    # policy read - fall back to the undecrypted object so the rest of the policy still returns.
+    function Get-CIPPIntunePolicyOmaDecryptedValue {
+        param($DeviceConfiguration, $DeviceConfigurationId, $TenantFilter)
+        if (@($DeviceConfiguration.omaSettings | Where-Object { $_.secretReferenceValueId }).Count -gt 0) {
+            try {
+                $DeviceConfiguration = Get-CIPPOmaSettingDecryptedValue -DeviceConfiguration $DeviceConfiguration -DeviceConfigurationId $DeviceConfigurationId -TenantFilter $TenantFilter
+            } catch {
+                Write-Information "Failed to decrypt OMA settings for device configuration '$($DeviceConfiguration.displayName)': $($_.Exception.Message)"
+            }
+        }
+        return $DeviceConfiguration
+    }
+
     try {
         switch ($TemplateType) {
             'AppProtection' {
@@ -135,35 +153,11 @@ function Get-CIPPIntunePolicy {
                     $policies = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL" -tenantid $tenantFilter
                     $policy = $policies | Where-Object -Property displayName -EQ $DisplayName | Sort-Object -Property lastModifiedDateTime -Descending | Select-Object -First 1
                     if ($policy) {
-                        $definitionValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')/definitionValues" -tenantid $tenantFilter
+                        # The definition must be expanded: without it every bind is built on an empty id
+                        # and the compare against a template can never match.
+                        $definitionValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')/definitionValues?`$expand=definition" -tenantid $tenantFilter
                         $policy | Add-Member -MemberType NoteProperty -Name 'definitionValues' -Value $definitionValues -Force
-
-                        $templateJsonItems = $definitionValues
-                        $templateJsonSource = foreach ($templateJsonItem in $templateJsonItems) {
-                            $presentationValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')/definitionValues('$($templateJsonItem.id)')/presentationValues?`$expand=presentation" -tenantid $tenantFilter | ForEach-Object {
-                                $obj = $_
-                                if ($obj.id) {
-                                    $presObj = @{
-                                        id                        = $obj.id
-                                        'presentation@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($templateJsonItem.definition.id)')/presentations('$($obj.presentation.id)')"
-                                    }
-                                    if ($obj.values) { $presObj['values'] = $obj.values }
-                                    if ($obj.value) { $presObj['value'] = $obj.value }
-                                    if ($obj.'@odata.type') { $presObj['@odata.type'] = $obj.'@odata.type' }
-                                    [pscustomobject]$presObj
-                                }
-                            }
-                            [PSCustomObject]@{
-                                'definition@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($templateJsonItem.definition.id)')"
-                                enabled                 = $templateJsonItem.enabled
-                                presentationValues      = @($presentationValues)
-                            }
-                        }
-                        $inputvar = [pscustomobject]@{
-                            added      = @($templateJsonSource)
-                            updated    = @()
-                            deletedIds = @()
-                        }
+                        $inputvar = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $policy.id -TenantFilter $tenantFilter -DefinitionValues $definitionValues
                         $policyJson = ConvertTo-Json -InputObject $inputvar -Depth 100 -Compress
                         $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force
                     }
@@ -171,35 +165,9 @@ function Get-CIPPIntunePolicy {
                 } elseif ($PolicyId) {
                     $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')" -tenantid $tenantFilter
                     if ($policy) {
-                        $definitionValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')/definitionValues" -tenantid $tenantFilter
+                        $definitionValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')/definitionValues?`$expand=definition" -tenantid $tenantFilter
                         $policy | Add-Member -MemberType NoteProperty -Name 'definitionValues' -Value $definitionValues -Force
-
-                        $templateJsonItems = $definitionValues
-                        $templateJsonSource = foreach ($templateJsonItem in $templateJsonItems) {
-                            $presentationValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')/definitionValues('$($templateJsonItem.id)')/presentationValues?`$expand=presentation" -tenantid $tenantFilter | ForEach-Object {
-                                $obj = $_
-                                if ($obj.id) {
-                                    $presObj = @{
-                                        id                        = $obj.id
-                                        'presentation@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($templateJsonItem.definition.id)')/presentations('$($obj.presentation.id)')"
-                                    }
-                                    if ($obj.values) { $presObj['values'] = $obj.values }
-                                    if ($obj.value) { $presObj['value'] = $obj.value }
-                                    if ($obj.'@odata.type') { $presObj['@odata.type'] = $obj.'@odata.type' }
-                                    [pscustomobject]$presObj
-                                }
-                            }
-                            [PSCustomObject]@{
-                                'definition@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($templateJsonItem.definition.id)')"
-                                enabled                 = $templateJsonItem.enabled
-                                presentationValues      = @($presentationValues)
-                            }
-                        }
-                        $inputvar = [pscustomobject]@{
-                            added      = @($templateJsonSource)
-                            updated    = @()
-                            deletedIds = @()
-                        }
+                        $inputvar = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $PolicyId -TenantFilter $tenantFilter -DefinitionValues $definitionValues
                         $policyJson = ConvertTo-Json -InputObject $inputvar -Depth 100 -Compress
                         $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force
                     }
@@ -207,35 +175,11 @@ function Get-CIPPIntunePolicy {
                 } else {
                     $policies = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL" -tenantid $tenantFilter
                     foreach ($policy in $policies) {
-                        $definitionValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')/definitionValues" -tenantid $tenantFilter
+                        # The definition must be expanded: without it every bind is built on an empty id
+                        # and the compare against a template can never match.
+                        $definitionValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')/definitionValues?`$expand=definition" -tenantid $tenantFilter
                         $policy | Add-Member -MemberType NoteProperty -Name 'definitionValues' -Value $definitionValues -Force
-
-                        $templateJsonItems = $definitionValues
-                        $templateJsonSource = foreach ($templateJsonItem in $templateJsonItems) {
-                            $presentationValues = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')/definitionValues('$($templateJsonItem.id)')/presentationValues?`$expand=presentation" -tenantid $tenantFilter | ForEach-Object {
-                                $obj = $_
-                                if ($obj.id) {
-                                    $presObj = @{
-                                        id                        = $obj.id
-                                        'presentation@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($templateJsonItem.definition.id)')/presentations('$($obj.presentation.id)')"
-                                    }
-                                    if ($obj.values) { $presObj['values'] = $obj.values }
-                                    if ($obj.value) { $presObj['value'] = $obj.value }
-                                    if ($obj.'@odata.type') { $presObj['@odata.type'] = $obj.'@odata.type' }
-                                    [pscustomobject]$presObj
-                                }
-                            }
-                            [PSCustomObject]@{
-                                'definition@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($templateJsonItem.definition.id)')"
-                                enabled                 = $templateJsonItem.enabled
-                                presentationValues      = @($presentationValues)
-                            }
-                        }
-                        $inputvar = [pscustomobject]@{
-                            added      = @($templateJsonSource)
-                            updated    = @()
-                            deletedIds = @()
-                        }
+                        $inputvar = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $policy.id -TenantFilter $tenantFilter -DefinitionValues $definitionValues
                         $policyJson = ConvertTo-Json -InputObject $inputvar -Depth 100 -Compress
                         $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force
                     }
@@ -287,8 +231,12 @@ function Get-CIPPIntunePolicy {
                     $policies = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL" -tenantid $tenantFilter
                     $policy = $policies | Where-Object -Property displayName -EQ $DisplayName | Sort-Object -Property lastModifiedDateTime -Descending | Select-Object -First 1
                     if ($policy) {
+                        # Capture the id before Select-Object strips it - the decrypt helper needs it to
+                        # resolve each OMA secret.
+                        $DeviceConfigurationId = $policy.id
                         $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter
                         $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime'
+                        $policyDetails = Get-CIPPIntunePolicyOmaDecryptedValue -DeviceConfiguration $policyDetails -DeviceConfigurationId $DeviceConfigurationId -TenantFilter $tenantFilter
                         $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress
                         $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force
                     }
@@ -296,7 +244,11 @@ function Get-CIPPIntunePolicy {
                 } elseif ($PolicyId) {
                     $policy = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$PolicyId')" -tenantid $tenantFilter
                     if ($policy) {
+                        # Capture the id before Select-Object strips it - the decrypt helper needs it to
+                        # resolve each OMA secret.
+                        $DeviceConfigurationId = $policy.id
                         $policyDetails = $policy | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime'
+                        $policyDetails = Get-CIPPIntunePolicyOmaDecryptedValue -DeviceConfiguration $policyDetails -DeviceConfigurationId $DeviceConfigurationId -TenantFilter $tenantFilter
                         $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress
                         $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force
                     }
@@ -304,8 +256,12 @@ function Get-CIPPIntunePolicy {
                 } else {
                     $policies = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL" -tenantid $tenantFilter
                     foreach ($policy in $policies) {
+                        # Capture the id before Select-Object strips it - the decrypt helper needs it to
+                        # resolve each OMA secret.
+                        $DeviceConfigurationId = $policy.id
                         $policyDetails = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL('$($policy.id)')" -tenantid $tenantFilter
                         $policyDetails = $policyDetails | Select-Object * -ExcludeProperty id, lastModifiedDateTime, '@odata.context', 'ScopeTagIds', 'supportsScopeTags', 'createdDateTime'
+                        $policyDetails = Get-CIPPIntunePolicyOmaDecryptedValue -DeviceConfiguration $policyDetails -DeviceConfigurationId $DeviceConfigurationId -TenantFilter $tenantFilter
                         $policyJson = ConvertTo-Json -InputObject $policyDetails -Depth 100 -Compress
                         $policy | Add-Member -MemberType NoteProperty -Name 'cippconfiguration' -Value $policyJson -Force
                     }
diff --git a/Modules/CIPPCore/Public/Get-CIPPIntuneReportExportRows.ps1 b/Modules/CIPPCore/Public/Get-CIPPIntuneReportExportRows.ps1
new file mode 100644
index 0000000000000..7c0815b05bfa5
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPIntuneReportExportRows.ps1
@@ -0,0 +1,49 @@
+function Get-CIPPIntuneReportExportRows {
+    <#
+    .SYNOPSIS
+        Streams the rows of a completed Intune report export (JSON format), one at a time.
+    .DESCRIPTION
+        Reads the export zip straight off its SAS download URL and deserialises each row of the
+        "values" array as it arrives, emitting it as a Dictionary[string, object]. Peak memory is
+        one row plus the compressed zip, which ZipArchive buffers to reach the central directory
+        at the end of the file - never the whole decompressed JSON text or a parse tree of every
+        row. Values are typed as ConvertFrom-Json would type them.
+    .PARAMETER Url
+        The url of a completed deviceManagement/reports/exportJobs job.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$Url
+    )
+
+    $Client = [System.Net.Http.HttpClient]::new()
+    $Client.Timeout = [TimeSpan]::FromMinutes(30)
+    try {
+        $Download = $Client.GetStreamAsync($Url).GetAwaiter().GetResult()
+        $Archive = [System.IO.Compression.ZipArchive]::new($Download, [System.IO.Compression.ZipArchiveMode]::Read)
+        try {
+            $Entry = $Archive.Entries | Where-Object { $_.Name -like '*.json' } | Select-Object -First 1
+            if (-not $Entry) { throw 'No JSON entry in the report export archive' }
+            $Reader = [Newtonsoft.Json.JsonTextReader]::new([System.IO.StreamReader]::new($Entry.Open()))
+            try {
+                # Deserialising each row straight into a dictionary skips the intermediate JObject
+                # tree, roughly halving allocations against JObject.Load.
+                $Serializer = [Newtonsoft.Json.JsonSerializer]::CreateDefault()
+                $RowType = [System.Collections.Generic.Dictionary[string, object]]
+                $InValues = $false
+                while ($Reader.Read()) {
+                    $Token = $Reader.TokenType
+                    if (-not $InValues) {
+                        $InValues = $Token -eq [Newtonsoft.Json.JsonToken]::PropertyName -and $Reader.Value -eq 'values'
+                        continue
+                    }
+                    if ($Token -eq [Newtonsoft.Json.JsonToken]::StartObject) {
+                        $Serializer.Deserialize($Reader, $RowType)
+                    } elseif ($Token -eq [Newtonsoft.Json.JsonToken]::EndArray) {
+                        break
+                    }
+                }
+            } finally { $Reader.Close() }
+        } finally { $Archive.Dispose() }
+    } finally { $Client.Dispose() }
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1 b/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1
index f54212d7e6699..921025f70f26e 100644
--- a/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPLAPSPassword.ps1
@@ -2,34 +2,42 @@
 function Get-CIPPLapsPassword {
     [CmdletBinding()]
     param (
-        $device,
-        $TenantFilter,
-        $APIName = 'Get LAPS Password',
-        $Headers
+        [Parameter(Mandatory = $true)]
+        [string]$Device,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        [Parameter(Mandatory = $false)]
+        [string]$APIName = 'Get LAPS Password',
+
+        [Parameter(Mandatory = $false)]
+        [object]$Headers
     )
 
     try {
-        $GraphRequest = (New-GraphGetRequest -NoAuthCheck $true -uri "https://graph.microsoft.com/beta/directory/deviceLocalCredentials/$($device)?`$select=credentials" -tenantid $TenantFilter).credentials | Select-Object -First 1 | ForEach-Object {
+        $GraphRequest = (New-GraphGetRequest -NoAuthCheck $true -uri "https://graph.microsoft.com/beta/directory/deviceLocalCredentials/$($Device)?`$select=credentials" -tenantid $TenantFilter -ErrorAction Stop).credentials | Select-Object -First 1 | ForEach-Object {
             $PlainText = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($_.passwordBase64))
-            $date = $_.BackupDateTime
+            $BackupDate = $_.BackupDateTime
             [PSCustomObject]@{
-                resultText = "LAPS password retrieved for $($_.accountName), generated at $($date). Copy the password by clicking the copy button"
-                copyField  = $PlainText
-                state      = 'success'
+                resultText     = "LAPS password retrieved for $($_.accountName), generated at $BackupDate. Copy the password by clicking the copy button"
+                copyField      = $PlainText
+                accountName    = $_.accountName
+                backupDateTime = $_.BackupDateTime
+                state          = 'success'
             }
         }
         if ($GraphRequest) {
-            Write-LogMessage -headers $Headers -API $APIName -message "Retrieved LAPS password for $device" -Sev 'Info' -tenant $TenantFilter
+            Write-LogMessage -headers $Headers -API $APIName -message "Retrieved LAPS password for $Device" -Sev 'Info' -tenant $TenantFilter
             return $GraphRequest
         } else {
-            Write-LogMessage -headers $Headers -API $APIName -message "No LAPS password found for $device" -Sev 'Info' -tenant $TenantFilter
-            return "No LAPS password found for $device"
+            Write-LogMessage -headers $Headers -API $APIName -message "No LAPS password found for $Device" -Sev 'Info' -tenant $TenantFilter
+            return "No LAPS password found for $Device"
         }
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
-        Write-LogMessage -headers $Headers -API $APIName -message "Could not retrieve LAPS password for $($device). Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage
-        return "Could not retrieve LAPS password for $($device). Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -message "Could not retrieve LAPS password for $Device. Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage
+        return "Could not retrieve LAPS password for $Device. Error: $($ErrorMessage.NormalizedError)"
     }
 }
 
-
diff --git a/Modules/CIPPCore/Public/Get-CIPPLegacyInfrastructureNotice.ps1 b/Modules/CIPPCore/Public/Get-CIPPLegacyInfrastructureNotice.ps1
new file mode 100644
index 0000000000000..939897542dd60
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPLegacyInfrastructureNotice.ps1
@@ -0,0 +1,36 @@
+function Get-CIPPLegacyInfrastructureNotice {
+    <#
+    .SYNOPSIS
+    Build the legacy infrastructure warning for instances still running on Azure Function Apps.
+
+    .DESCRIPTION
+    CIPP now ships as a single Linux container Web App. Instances that are still on the original
+    Function App and Static Web App deployment are on legacy infrastructure that will stop receiving
+    updates. This returns a warning shaped as a GetCippAlerts maintenance alert so the frontend
+    renders it in the same full-width banner as a hosted maintenance notice, or $null when the
+    instance is already on the new infrastructure (CIPPNG) or is running locally   This runs on every page load for every user, so it never throws and never touches Graph or table
+    storage.
+
+    .EXAMPLE
+    Get-CIPPLegacyInfrastructureNotice
+    #>
+    [CmdletBinding()]
+    param()
+    if ($env:CIPPNG -eq 'true' -or $env:CIPP_HOSTED -eq 'true') { return $null }
+    if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true') { return $null }
+    $Message = 'This CIPP instance is running on the legacy Function App infrastructure, which will soon stop receiving updates. Migrate to the new infrastructure to keep receiving new features and fixes. The migration keeps your storage account and Key Vault, so your configuration carries across.'
+
+    return @{
+        title       = 'Legacy infrastructure'
+        Alert       = $Message
+        link        = 'https://docs.cipp.app/setup/maintaining-cipp/migrating-to-the-new-infrastructure'
+        linkText    = 'Migration guide'
+        type        = 'warning'
+        maintenance = $true
+        noticeId    = 'legacy-function-app-infrastructure'
+        startTime   = $null
+        endTime     = $null
+        active      = $false
+        dismissible = $false
+    }
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPLicenseCatalog.ps1 b/Modules/CIPPCore/Public/Get-CIPPLicenseCatalog.ps1
new file mode 100644
index 0000000000000..2f43619121467
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPLicenseCatalog.ps1
@@ -0,0 +1,38 @@
+function Get-CIPPLicenseCatalog {
+    <#
+    .SYNOPSIS
+        Load the shipped license catalog (Config\LicenseCatalog.json).
+
+    .DESCRIPTION
+        The catalog carries, for every SKU the optimization report can reason about:
+        - prices   : public per-user/month list price per ISO currency (annual commitment)
+        - family   : the product ladder it belongs to (business, enterprise, frontline, ...)
+        - tier     : its position in that ladder
+        - eligibleTarget : whether it may be recommended to users outside its own family
+
+        plus the capability map (plain-language feature -> Microsoft service plan ids) and the
+        family definitions. Parsed once per process and cached in script scope.
+
+    .PARAMETER Force
+        Re-read the file even when a parsed copy is cached.
+
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [switch]$Force
+    )
+
+    if ($script:CIPPLicenseCatalog -and -not $Force) { return $script:CIPPLicenseCatalog }
+
+    $Path = Join-Path $env:CIPPRootPath 'Config\LicenseCatalog.json'
+    if (-not (Test-Path $Path)) {
+        Write-Information "Get-CIPPLicenseCatalog: catalog not found at $Path"
+        return [pscustomobject]@{ meta = [pscustomobject]@{}; capabilities = @(); families = @(); products = @() }
+    }
+
+    $Catalog = Get-Content -Path $Path -Raw | ConvertFrom-Json
+    $script:CIPPLicenseCatalog = $Catalog
+    return $Catalog
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1 b/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1
index 8994e35166dac..8c27dcddbb714 100644
--- a/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPLicensePrice.ps1
@@ -4,14 +4,14 @@ function Get-CIPPLicensePrice {
         Resolve the monthly price for one or all license SKUs, in a given currency.
 
     .DESCRIPTION
-        Merges the shipped MSRP estimate list (Config\LicensePricingDefaults.csv) with the
-        MSP-maintained override table (LicensePricing). An override always wins over the estimate.
-        Both are multi-currency: each SKU can have a row per ISO currency. Prices are MSP-global
-        (not per-tenant).
+        Merges the shipped list-price catalog (Config\LicenseCatalog.json, see
+        Get-CIPPLicenseCatalog) with the MSP-maintained override table (LicensePricing). An override
+        always wins over the estimate. Both are multi-currency: each SKU can carry a price per ISO
+        currency. Prices are MSP-global (not per-tenant).
 
         Returns one price object per SKU for the requested -Currency, with a Source of:
         - 'Override' : an explicit price the MSP entered for this currency
-        - 'Estimate' : the shipped public MSRP fallback for this currency (subject to drift)
+        - 'Estimate' : the shipped public list price for this currency (subject to drift)
         - 'Unknown'  : the SKU has no price in the requested currency (MonthlyPrice is $null)
 
         There is no cross-currency conversion: asking for AUD returns only AUD prices. A single
@@ -29,6 +29,11 @@ function Get-CIPPLicensePrice {
         Return the sorted list of currency codes present in the estimates + overrides instead of
         prices. Used to populate the currency selector.
 
+    .PARAMETER IncludeUnknown
+        In the full list, also return every SKU in the shipped SKU list (Config\ConversionTable.csv)
+        that has no price in the requested currency (Source 'Unknown', null price), so the
+        price-management page shows every SKU and each can be priced.
+
     .FUNCTIONALITY
         Internal
     #>
@@ -36,7 +41,8 @@ function Get-CIPPLicensePrice {
     param(
         [string]$SkuId,
         [string]$Currency = 'USD',
-        [switch]$ListCurrencies
+        [switch]$ListCurrencies,
+        [switch]$IncludeUnknown
     )
 
     # currency (lower) -> @{ skuId (lower) -> price object }
@@ -46,32 +52,49 @@ function Get-CIPPLicensePrice {
     $SkuMeta = @{}
     $CurrencySet = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
 
-    # Shipped MSRP estimates (public list prices, subject to drift - labelled Estimate)
+    # Every SKU Microsoft publishes (names and part numbers) comes from the shipped SKU list; the
+    # catalog only carries prices keyed by GUID, so there is one SKU database, not two.
     try {
-        $CsvPath = Join-Path $env:CIPPRootPath 'Config\LicensePricingDefaults.csv'
-        if (Test-Path $CsvPath) {
-            foreach ($Row in (Import-Csv -Path $CsvPath)) {
-                $Key = ([string]$Row.skuId).ToLowerInvariant()
-                if ([string]::IsNullOrWhiteSpace($Key)) { continue }
-                $Cur = if ($Row.Currency) { [string]$Row.Currency } else { 'USD' }
+        $TablePath = Join-Path $env:CIPPRootPath 'Config\ConversionTable.csv'
+        if (Test-Path $TablePath) {
+            foreach ($Row in (Get-Content -Path $TablePath -Raw | ConvertFrom-Csv)) {
+                $Key = ([string]$Row.GUID).ToLowerInvariant()
+                if ([string]::IsNullOrWhiteSpace($Key) -or $SkuMeta.ContainsKey($Key)) { continue }
+                $SkuMeta[$Key] = [pscustomobject]@{ skuPartNumber = [string]$Row.String_Id; Product_Display_Name = [string]$Row.Product_Display_Name }
+            }
+        }
+    } catch {
+        Write-Information "Get-CIPPLicensePrice: failed to read the SKU list: $($_.Exception.Message)"
+    }
+
+    # Shipped list prices (public, subject to drift - labelled Estimate)
+    try {
+        $Catalog = Get-CIPPLicenseCatalog
+        foreach ($Product in @($Catalog.products)) {
+            $Key = ([string]$Product.skuId).ToLowerInvariant()
+            if ([string]::IsNullOrWhiteSpace($Key)) { continue }
+            if (-not $SkuMeta.ContainsKey($Key)) {
+                $SkuMeta[$Key] = [pscustomobject]@{ skuPartNumber = [string]$Product.skuPartNumber; Product_Display_Name = if ($Product.name) { [string]$Product.name } else { $Key } }
+            }
+            if ($null -eq $Product.prices) { continue }
+            foreach ($PriceProp in $Product.prices.PSObject.Properties) {
+                $Cur = [string]$PriceProp.Name
+                if ([string]::IsNullOrWhiteSpace($Cur) -or $null -eq $PriceProp.Value) { continue }
                 $null = $CurrencySet.Add($Cur)
                 $CurKey = $Cur.ToLowerInvariant()
                 if (-not $Estimate.ContainsKey($CurKey)) { $Estimate[$CurKey] = @{} }
                 $Estimate[$CurKey][$Key] = [pscustomobject]@{
                     skuId                = $Key
-                    skuPartNumber        = [string]$Row.skuPartNumber
-                    Product_Display_Name = [string]$Row.Product_Display_Name
-                    MonthlyPrice         = [double]$Row.MonthlyPrice
+                    skuPartNumber        = $SkuMeta[$Key].skuPartNumber
+                    Product_Display_Name = $SkuMeta[$Key].Product_Display_Name
+                    MonthlyPrice         = [double]$PriceProp.Value
                     Currency             = $Cur
                     Source               = 'Estimate'
                 }
-                if (-not $SkuMeta.ContainsKey($Key)) {
-                    $SkuMeta[$Key] = [pscustomobject]@{ skuPartNumber = [string]$Row.skuPartNumber; Product_Display_Name = [string]$Row.Product_Display_Name }
-                }
             }
         }
     } catch {
-        Write-Information "Get-CIPPLicensePrice: failed to read defaults CSV: $($_.Exception.Message)"
+        Write-Information "Get-CIPPLicensePrice: failed to read the license catalog: $($_.Exception.Message)"
     }
 
     # MSP overrides (win over estimates, per currency)
@@ -127,5 +150,6 @@ function Get-CIPPLicensePrice {
     # The full list is the price matrix: only SKUs that actually carry a price in this currency
     # (a SKU priced in USD but not the requested currency is omitted, not shown as 'Unknown').
     $Result = foreach ($Sku in $SkuMeta.Keys) { & $ResolveOne $Sku }
+    if ($IncludeUnknown) { return @($Result | Sort-Object -Property Product_Display_Name) }
     return @($Result | Where-Object { $null -ne $_.MonthlyPrice } | Sort-Object -Property Product_Display_Name)
 }
diff --git a/Modules/CIPPCore/Public/Get-CIPPLicenseRecommendation.ps1 b/Modules/CIPPCore/Public/Get-CIPPLicenseRecommendation.ps1
new file mode 100644
index 0000000000000..1a2046ea342c1
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPLicenseRecommendation.ps1
@@ -0,0 +1,816 @@
+function Get-CIPPLicenseRecommendation {
+    <#
+    .SYNOPSIS
+        Build the full license recommendation report for a tenant.
+
+    .DESCRIPTION
+        Extends Get-CIPPLicenseOptimization (unassigned / disabled / inactive / overlapping seats)
+        with three evidence-based recommendation sets, all priced through Get-CIPPLicensePrice:
+
+        Downgrades  - for every active licensed user, the capabilities of each plan they hold are
+                      split into measurable ones (email, Teams, files, desktop apps, large mailbox,
+                      Copilot - each backed by a Microsoft usage report) and unmeasurable ones
+                      (Intune, Entra P1/P2, Defender, Purview, ...). The cheapest catalog plan that
+                      still covers every capability the user actually used - and, when
+                      -ProtectSecurityFeatures is on, every unmeasurable capability of the current
+                      plan - is the recommended target. No cheaper plan means no recommendation.
+                      A plan whose measurable capabilities are all unused and that carries nothing
+                      unmeasurable (a Copilot add-on nobody opens) is recommended for removal.
+        Upgrades    - 'Consolidate': a user holding several plans whose combined capabilities a
+                      single cheaper plan covers. 'Protect': users whose plans include no device
+                      management, sign-in security or device threat protection, with the cheapest
+                      plan that adds all three (an investment, reported separately from savings).
+        Terms       - per owned SKU, how many assigned seats have been held for at least
+                      -TenureMonths (licenseAssignmentStates.lastUpdatedDateTime is the floor of
+                      the assignment age), the current monthly/annual split from the tenant's
+                      subscriptions, and the recommended split. Seats on a monthly term that are
+                      stable enough to commit annually are valued at the catalog's monthly-commitment
+                      uplift (20%).
+
+        Every input defaults to the reporting-DB cache. License overview and the two usage reports
+        fall back to a live Graph read when the cache is empty, so the report works on a tenant the
+        nightly collection has not reached yet.
+
+    .PARAMETER TenantFilter
+        The tenant (domain or GUID) to report on.
+
+    .PARAMETER Currency
+        ISO currency code the money figures are resolved in. Default USD.
+
+    .PARAMETER RecommendDowngrades
+        Include the downgrade analysis. Default $true.
+
+    .PARAMETER RecommendUpgrades
+        Include the consolidation and protection analysis. Default $true.
+
+    .PARAMETER RecommendTerms
+        Include the annual/monthly commitment analysis. Default $true.
+
+    .PARAMETER ProtectSecurityFeatures
+        When $true (default) a downgrade target must keep every security, compliance, identity and
+        device-management capability of the current plan, since usage reports cannot show whether
+        those are relied on. When $false only the capabilities the user measurably used must be kept
+        and the report lists what would be lost.
+
+    .PARAMETER TenureMonths
+        Months a seat must have been assigned to count as stable for an annual commitment. Default 6.
+
+    .PARAMETER InactiveDays
+        Sign-in / activity age in days past which a user counts as inactive. Default 90.
+        Usage evidence comes from Microsoft's D180 active-user and app-usage reports; this value
+        filters within that window.
+
+    .PARAMETER Licenses
+        Optional. LicenseOverview records (Get-CIPPLicenseOverview shape).
+
+    .PARAMETER Users
+        Optional. User records with assignedLicenses, licenseAssignmentStates and signInActivity.
+
+    .PARAMETER ActivityDetail
+        Optional. getOffice365ActiveUserDetail rows.
+
+    .PARAMETER AppUsage
+        Optional. getM365AppUserDetail rows.
+
+    .PARAMETER MailboxUsage
+        Optional. getMailboxUsageDetail rows.
+
+    .PARAMETER CopilotUsage
+        Optional. getMicrosoft365CopilotUsageUserDetail rows.
+
+    .PARAMETER PlanIdsBySku
+        Optional. Hashtable of skuId (lower) -> string[] service plan ids. Defaults to ConversionTable.csv.
+
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [string]$Currency = 'USD',
+        [bool]$RecommendDowngrades = $true,
+        [bool]$RecommendUpgrades = $true,
+        [bool]$RecommendTerms = $true,
+        [bool]$ProtectSecurityFeatures = $true,
+        [int]$TenureMonths = 6,
+        [int]$InactiveDays = 90,
+        $Licenses,
+        $Users,
+        $ActivityDetail,
+        $AppUsage,
+        $MailboxUsage,
+        $CopilotUsage,
+        [hashtable]$PlanIdsBySku
+    )
+
+    if ($TenureMonths -le 0) { $TenureMonths = 6 }
+    if ($InactiveDays -le 0) { $InactiveDays = 90 }
+    $Now = Get-Date
+    $Cutoff = $Now.AddDays(-$InactiveDays)
+    $Sources = [ordered]@{}
+
+    # ------------------------------------------------------------------ inputs (cache, then live)
+    if (-not $PSBoundParameters.ContainsKey('Licenses')) {
+        $Licenses = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'LicenseOverview')
+        $Sources.Licenses = 'Cache'
+        if ($Licenses.Count -eq 0) {
+            try { $Licenses = @(Get-CIPPLicenseOverview -TenantFilter $TenantFilter); $Sources.Licenses = 'Live' } catch { Write-Information "License overview live fallback failed: $($_.Exception.Message)" }
+        }
+    }
+    if (-not $PSBoundParameters.ContainsKey('Users')) {
+        $Users = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Users')
+        $Sources.Users = 'Cache'
+        if ($Users.Count -eq 0) {
+            $Select = 'id,userPrincipalName,displayName,accountEnabled,userType,createdDateTime,assignedLicenses,licenseAssignmentStates,isResourceAccount'
+            try {
+                $Users = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=500&`$select=$Select,signInActivity&`$count=true" -ComplexFilter -tenantid $TenantFilter)
+                $Sources.Users = 'Live'
+            } catch {
+                try { $Users = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$top=999&`$select=$Select" -tenantid $TenantFilter); $Sources.Users = 'Live' } catch { Write-Information "Users live fallback failed: $($_.Exception.Message)" }
+            }
+        }
+    }
+    if (-not $PSBoundParameters.ContainsKey('ActivityDetail')) {
+        $ActivityDetail = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'ActiveUserDetail')
+        $Sources.ActivityDetail = 'Cache'
+        if ($ActivityDetail.Count -eq 0) {
+            try { $ActivityDetail = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getOffice365ActiveUserDetail(period='D180')?`$format=application%2fjson" -tenantid $TenantFilter); $Sources.ActivityDetail = 'Live' } catch { Write-Information "Active user detail live fallback failed: $($_.Exception.Message)" }
+        }
+    }
+    if (-not $PSBoundParameters.ContainsKey('AppUsage')) {
+        $AppUsage = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'M365AppUserDetail')
+        $Sources.AppUsage = 'Cache'
+        if ($AppUsage.Count -eq 0) {
+            try { $AppUsage = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getM365AppUserDetail(period='D180')?`$format=application%2fjson" -tenantid $TenantFilter); $Sources.AppUsage = 'Live' } catch { Write-Information "App usage live fallback failed: $($_.Exception.Message)" }
+        }
+    }
+    if (-not $PSBoundParameters.ContainsKey('MailboxUsage')) { $MailboxUsage = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'MailboxUsage'); $Sources.MailboxUsage = 'Cache' }
+    if (-not $PSBoundParameters.ContainsKey('CopilotUsage')) { $CopilotUsage = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'CopilotUsageUserDetail'); $Sources.CopilotUsage = 'Cache' }
+
+    $Licenses = @($Licenses)
+    $Users = @($Users)
+    $ActivityDetail = @($ActivityDetail)
+    $AppUsage = @($AppUsage)
+    $MailboxUsage = @($MailboxUsage)
+    $CopilotUsage = @($CopilotUsage)
+
+    $Catalog = Get-CIPPLicenseCatalog
+    $Uplift = if ($Catalog.meta.monthlyCommitmentUplift) { [double]$Catalog.meta.monthlyCommitmentUplift } else { 0.20 }
+
+    # ------------------------------------------------------------------ service plans per SKU
+    if (-not $PlanIdsBySku) {
+        $PlanIdsBySku = @{}
+        try {
+            $TablePath = Join-Path $env:CIPPRootPath 'Config\ConversionTable.csv'
+            if (Test-Path $TablePath) {
+                foreach ($Row in ([System.IO.File]::ReadAllText($TablePath) | ConvertFrom-Csv)) {
+                    $Key = ([string]$Row.GUID).ToLowerInvariant()
+                    if (-not $Key -or -not $Row.Service_Plan_Id) { continue }
+                    if (-not $PlanIdsBySku.ContainsKey($Key)) { $PlanIdsBySku[$Key] = [System.Collections.Generic.List[string]]::new() }
+                    $PlanIdsBySku[$Key].Add(([string]$Row.Service_Plan_Id).ToLowerInvariant())
+                }
+            }
+        } catch { Write-Information "ConversionTable read failed: $($_.Exception.Message)" }
+    }
+    $PlanSetOf = @{}
+    $GetPlanSet = {
+        param($Sku)
+        $Key = ([string]$Sku).ToLowerInvariant()
+        if ($PlanSetOf.ContainsKey($Key)) { return , $PlanSetOf[$Key] }
+        $Set = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        if ($PlanIdsBySku.ContainsKey($Key)) { foreach ($Id in @($PlanIdsBySku[$Key])) { $null = $Set.Add([string]$Id) } }
+        $PlanSetOf[$Key] = $Set
+        return , $Set
+    }
+    # The tenant's own subscribedSkus service plans top up the table (new plans land there first)
+    foreach ($Lic in $Licenses) {
+        if (-not $Lic.skuId) { continue }
+        $Set = & $GetPlanSet $Lic.skuId
+        foreach ($Plan in @($Lic.ServicePlans)) { if ($Plan.servicePlanId) { $null = $Set.Add(([string]$Plan.servicePlanId).ToLowerInvariant()) } }
+    }
+
+    # ------------------------------------------------------------------ capabilities
+    $Capabilities = @($Catalog.capabilities)
+    $CapById = @{}
+    foreach ($Cap in $Capabilities) { $CapById[[string]$Cap.id] = $Cap }
+    # cap id -> which capability ids a plan set includes (respecting per-user disabled plans)
+    $CapsOfPlans = {
+        param($PlanSet, $Disabled)
+        $Result = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        foreach ($Cap in $Capabilities) {
+            foreach ($Id in @($Cap.servicePlanIds)) {
+                $Id = ([string]$Id).ToLowerInvariant()
+                if ($PlanSet.Contains($Id) -and -not ($Disabled -and $Disabled.Contains($Id))) { $null = $Result.Add([string]$Cap.id); break }
+            }
+        }
+        return , $Result
+    }
+    $CapLabel = { param($Id) if ($CapById.ContainsKey($Id)) { [string]$CapById[$Id].label } else { $Id } }
+    $Measurable = { param($Id) $CapById.ContainsKey($Id) -and -not [string]::IsNullOrWhiteSpace([string]$CapById[$Id].signal) }
+
+    # ------------------------------------------------------------------ prices + catalog products
+    $PriceBySku = @{}
+    foreach ($Price in @(Get-CIPPLicensePrice -Currency $Currency)) {
+        if ($Price.skuId) { $PriceBySku[([string]$Price.skuId).ToLowerInvariant()] = $Price }
+    }
+    $PriceOf = {
+        param($Sku)
+        $Key = ([string]$Sku).ToLowerInvariant()
+        if ($PriceBySku.ContainsKey($Key) -and $null -ne $PriceBySku[$Key].MonthlyPrice) { return [double]$PriceBySku[$Key].MonthlyPrice }
+        return $null
+    }
+    $ProductBySku = @{}
+    foreach ($Product in @($Catalog.products)) {
+        $Key = ([string]$Product.skuId).ToLowerInvariant()
+        $ProductBySku[$Key] = [pscustomobject]@{
+            skuId          = $Key
+            # Names come from the SKU list via the price resolver; the catalog holds no names.
+            name           = if ($PriceBySku.ContainsKey($Key) -and $PriceBySku[$Key].Product_Display_Name) { [string]$PriceBySku[$Key].Product_Display_Name } elseif ($Product.name) { [string]$Product.name } else { $Key }
+            family         = [string]$Product.family
+            tier           = [int]$Product.tier
+            eligibleTarget = [bool]$Product.eligibleTarget
+            price          = & $PriceOf $Key
+            caps           = & $CapsOfPlans (& $GetPlanSet $Key) $null
+        }
+    }
+    $SeatLimits = @{}
+    if ($Catalog.meta.seatLimits) { foreach ($P in $Catalog.meta.seatLimits.PSObject.Properties) { $SeatLimits[[string]$P.Name] = [int]$P.Value } }
+
+    # ------------------------------------------------------------------ SKU info from the overview
+    $SkuInfo = @{}
+    foreach ($Lic in $Licenses) {
+        if (-not $Lic.skuId) { continue }
+        $Key = ([string]$Lic.skuId).ToLowerInvariant()
+        $Total = [int]($Lic.TotalLicenses -as [int])
+        $Used = [int]($Lic.CountUsed -as [int])
+        $SkuInfo[$Key] = [pscustomobject]@{
+            skuId    = $Key
+            License  = if ($Lic.License) { [string]$Lic.License } elseif ($ProductBySku.ContainsKey($Key)) { $ProductBySku[$Key].name } else { $Key }
+            Total    = $Total
+            Used     = $Used
+            TermInfo = @($Lic.TermInfo)
+        }
+    }
+    $NameOf = {
+        param($Sku)
+        $Key = ([string]$Sku).ToLowerInvariant()
+        if ($SkuInfo.ContainsKey($Key)) { return $SkuInfo[$Key].License }
+        if ($ProductBySku.ContainsKey($Key)) { return $ProductBySku[$Key].name }
+        if ($PriceBySku.ContainsKey($Key) -and $PriceBySku[$Key].Product_Display_Name) { return [string]$PriceBySku[$Key].Product_Display_Name }
+        return $Key
+    }
+
+    # ------------------------------------------------------------------ usage signals per user
+    $ParseDate = {
+        param($Value)
+        if ([string]::IsNullOrWhiteSpace([string]$Value)) { return $null }
+        $Parsed = [datetime]::MinValue
+        if ([datetime]::TryParse([string]$Value, [ref]$Parsed)) { return $Parsed }
+        return $null
+    }
+    $Recent = { param($Value) $D = & $ParseDate $Value; ($null -ne $D) -and ($D -ge $Cutoff) }
+
+    $ActivityByUpn = @{}
+    foreach ($Row in $ActivityDetail) { if ($Row.userPrincipalName) { $ActivityByUpn[([string]$Row.userPrincipalName).ToLowerInvariant()] = $Row } }
+    $AppByUpn = @{}
+    foreach ($Row in $AppUsage) { if ($Row.userPrincipalName) { $AppByUpn[([string]$Row.userPrincipalName).ToLowerInvariant()] = $Row } }
+    $MailboxByUpn = @{}
+    foreach ($Row in $MailboxUsage) { if ($Row.userPrincipalName) { $MailboxByUpn[([string]$Row.userPrincipalName).ToLowerInvariant()] = $Row } }
+    $CopilotByUpn = @{}
+    foreach ($Row in $CopilotUsage) { if ($Row.userPrincipalName) { $CopilotByUpn[([string]$Row.userPrincipalName).ToLowerInvariant()] = $Row } }
+
+    # Real (member, non-resource, licensed) users
+    $RealUsers = @($Users | Where-Object {
+            $_.assignedLicenses -and @($_.assignedLicenses).Count -gt 0 -and
+            $_.userType -ne 'Guest' -and $_.isResourceAccount -ne $true
+        })
+    $LicensedUserCount = $RealUsers.Count
+
+    # Anonymized usage reports: rows exist but almost none join to a real user
+    $AnonymizedReports = $false
+    if ($ActivityByUpn.Count -gt 0 -and $RealUsers.Count -gt 0) {
+        $MatchCount = @($RealUsers | Where-Object { $ActivityByUpn.ContainsKey(([string]$_.userPrincipalName).ToLowerInvariant()) }).Count
+        if (($MatchCount / [double]$RealUsers.Count) -lt 0.1) { $AnonymizedReports = $true }
+    }
+
+    # Which measurable capabilities a user demonstrably used in the window. $null = no usage
+    # data for this user at all (the report then makes no claim about them).
+    $UsedCapsOf = {
+        param($Upn)
+        $Key = ([string]$Upn).ToLowerInvariant()
+        $Activity = $ActivityByUpn[$Key]
+        $Apps = $AppByUpn[$Key]
+        if (-not $Activity -and -not $Apps) { return $null }
+        $Used = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        if ($Activity) {
+            if (& $Recent $Activity.exchangeLastActivityDate) { $null = $Used.Add('email') }
+            if (& $Recent $Activity.teamsLastActivityDate) { $null = $Used.Add('teams') }
+            if ((& $Recent $Activity.oneDriveLastActivityDate) -or (& $Recent $Activity.sharePointLastActivityDate)) { $null = $Used.Add('files') }
+        }
+        if ($Apps) {
+            $Detail = @($Apps.details) | Select-Object -First 1
+            if ($Detail -and (($Detail.windows -eq $true) -or ($Detail.mac -eq $true))) { $null = $Used.Add('desktopApps') }
+        }
+        $Mailbox = $MailboxByUpn[$Key]
+        if ($Mailbox) {
+            $Bytes = [double]($Mailbox.storageUsedInBytes -as [double])
+            if ($Mailbox.hasArchive -eq $true -or $Bytes -gt 40GB) { $null = $Used.Add('largeMailbox'); $null = $Used.Add('email') }
+        }
+        $Copilot = $CopilotByUpn[$Key]
+        if ($Copilot -and (& $Recent $Copilot.lastActivityDate)) { $null = $Used.Add('copilot') }
+        return , $Used
+    }
+
+    $LastSignInOf = {
+        param($User)
+        $Last = $null
+        foreach ($Prop in @('lastSignInDateTime', 'lastNonInteractiveSignInDateTime')) {
+            $D = & $ParseDate $User.signInActivity.$Prop
+            if ($D -and ($null -eq $Last -or $D -gt $Last)) { $Last = $D }
+        }
+        return $Last
+    }
+
+    # ------------------------------------------------------------------ waste tiers (existing engine)
+    $Optimization = Get-CIPPLicenseOptimization -TenantFilter $TenantFilter -Licenses $Licenses -Users $Users -ActivityDetail $ActivityDetail -InactiveDays $InactiveDays -Currency $Currency
+
+    # Tenant-level SKUs (extra file storage, server protection, capacity) are consumed without a
+    # user assignment, so their unassigned seats are not waste. Drop those findings and recount.
+    $TenantLevel = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($Id in @($Catalog.meta.tenantLevelSkus)) { if ($Id) { $null = $TenantLevel.Add([string]$Id) } }
+    $Opportunities = @($Optimization.Opportunities | Where-Object { -not ($_.Tier -eq 'UnassignedSeats' -and $TenantLevel.Contains([string]$_.skuId)) })
+    $OptReclaimableMonthly = 0.0; $OptReclaimableSeats = 0
+    foreach ($Opp in $Opportunities) {
+        $OptReclaimableMonthly += [double]$Opp.MonthlySaving
+        if ($Opp.Tier -in @('UnassignedSeats', 'DisabledAccount', 'Inactive')) { $OptReclaimableSeats += [int]$Opp.Seats }
+    }
+    $Optimization = [pscustomobject]@{ Summary = $Optimization.Summary; Opportunities = $Opportunities }
+    $OverlapUpns = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($Opp in @($Optimization.Opportunities)) {
+        if ($Opp.Tier -eq 'Overlap') { foreach ($U in @($Opp.Users)) { $null = $OverlapUpns.Add([string]$U) } }
+    }
+
+    # Users the recommendation passes look at: enabled and active in the window. Disabled and
+    # stale accounts are already a removal finding.
+    #
+    # Sign-in dates need Entra ID P1; a tenant without it has no signInActivity at all. There the
+    # usage reports (Exchange, Teams, OneDrive, SharePoint, Viva Engage last-activity dates, no P1
+    # needed) are the activity signal: a user with a report row and no activity in the window is
+    # inactive, and becomes its own removal finding below.
+    $ActiveUsers = [System.Collections.Generic.List[object]]::new()
+    $NoActivityUsers = [System.Collections.Generic.List[object]]::new()
+    $ActivityProps = @('exchangeLastActivityDate', 'teamsLastActivityDate', 'oneDriveLastActivityDate', 'sharePointLastActivityDate', 'yammerLastActivityDate')
+    foreach ($User in $RealUsers) {
+        if ($User.accountEnabled -eq $false) { continue }
+        $Last = & $LastSignInOf $User
+        if ($null -ne $Last -and $Last -lt $Cutoff) { continue }
+        if ($null -eq $Last -and -not $AnonymizedReports) {
+            $Activity = $ActivityByUpn[([string]$User.userPrincipalName).ToLowerInvariant()]
+            if ($Activity) {
+                $Seen = $false
+                foreach ($Prop in $ActivityProps) { if (& $Recent $Activity.$Prop) { $Seen = $true; break } }
+                if (-not $Seen) { $NoActivityUsers.Add($User); continue }
+            }
+        }
+        $ActiveUsers.Add($User)
+    }
+
+    # Target eligibility: priced, cheaper than the seats it replaces, allowed for this user, and
+    # within the family seat limit.
+    $IsEligibleTarget = {
+        param($Product, $CurrentFamilies)
+        if ($null -eq $Product.price) { return $false }
+        if (-not $Product.eligibleTarget -and -not ($CurrentFamilies -contains $Product.family)) { return $false }
+        if ($SeatLimits.ContainsKey($Product.family) -and $LicensedUserCount -gt $SeatLimits[$Product.family] -and -not ($CurrentFamilies -contains $Product.family)) { return $false }
+        return $true
+    }
+    $CheapestCovering = {
+        param($Required, $CurrentFamilies, $MaxPrice)
+        $Best = $null
+        foreach ($Product in $ProductBySku.Values) {
+            if (-not (& $IsEligibleTarget $Product $CurrentFamilies)) { continue }
+            if ($Product.price -ge $MaxPrice) { continue }
+            if (-not $Product.caps.IsSupersetOf($Required)) { continue }
+            if ($null -eq $Best -or $Product.price -lt $Best.price -or ($Product.price -eq $Best.price -and $Product.caps.Count -gt $Best.caps.Count)) { $Best = $Product }
+        }
+        return $Best
+    }
+
+    # ------------------------------------------------------------------ downgrades
+    $DowngradeGroups = @{}
+    $DowngradeUserCount = 0
+    if ($RecommendDowngrades -and -not $AnonymizedReports) {
+        foreach ($User in $ActiveUsers) {
+            $Upn = [string]$User.userPrincipalName
+            $Used = & $UsedCapsOf $Upn
+            if ($null -eq $Used) { continue }
+            foreach ($Assigned in @($User.assignedLicenses)) {
+                if (-not $Assigned.skuId) { continue }
+                $Key = ([string]$Assigned.skuId).ToLowerInvariant()
+                if (-not $ProductBySku.ContainsKey($Key)) { continue }
+                $Current = $ProductBySku[$Key]
+                if ($null -eq $Current.price) { continue }
+                $Disabled = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+                foreach ($D in @($Assigned.disabledPlans)) { if ($D) { $null = $Disabled.Add(([string]$D).ToLowerInvariant()) } }
+                $Held = & $CapsOfPlans (& $GetPlanSet $Key) $Disabled
+                if ($Held.Count -eq 0) { continue }
+
+                $Required = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+                $UsedHere = [System.Collections.Generic.List[string]]::new()
+                $HasUnmeasurable = $false
+                foreach ($CapId in $Held) {
+                    if (& $Measurable $CapId) {
+                        if ($Used.Contains($CapId)) { $null = $Required.Add($CapId); $UsedHere.Add($CapId) }
+                    } else {
+                        $HasUnmeasurable = $true
+                        if ($ProtectSecurityFeatures) { $null = $Required.Add($CapId) }
+                    }
+                }
+
+                $Target = $null
+                $TargetKey = 'none'
+                if ($Required.Count -eq 0) {
+                    # Nothing this plan provides is in evidence: remove it (or, when security
+                    # features are protected and present, nothing can be said).
+                    if ($HasUnmeasurable -and $ProtectSecurityFeatures) { continue }
+                } else {
+                    $Target = & $CheapestCovering $Required @($Current.family) $Current.price
+                    if ($null -eq $Target) { continue }
+                    $TargetKey = $Target.skuId
+                }
+
+                $Saving = if ($Target) { $Current.price - $Target.price } else { $Current.price }
+                $GroupKey = "$Key|$TargetKey"
+                if (-not $DowngradeGroups.ContainsKey($GroupKey)) {
+                    $Lost = [System.Collections.Generic.List[string]]::new()
+                    $Kept = [System.Collections.Generic.List[string]]::new()
+                    foreach ($CapId in ($Held | Sort-Object)) {
+                        if ($Target -and $Target.caps.Contains($CapId)) { $Kept.Add((& $CapLabel $CapId)) } else { $Lost.Add((& $CapLabel $CapId)) }
+                    }
+                    $DowngradeGroups[$GroupKey] = [pscustomobject]@{
+                        FromLicense   = $Current.name
+                        FromSkuId     = $Key
+                        ToLicense     = if ($Target) { $Target.name } else { 'No license' }
+                        ToSkuId       = if ($Target) { $Target.skuId } else { $null }
+                        Action        = if ($Target) { 'Downgrade' } else { 'Remove' }
+                        Seats         = 0
+                        UnitCost      = $Current.price
+                        TargetCost    = if ($Target) { $Target.price } else { 0 }
+                        UnitSaving    = [math]::Round($Saving, 2)
+                        MonthlySaving = 0.0
+                        Keeps         = @($Kept)
+                        Loses         = @($Lost)
+                        Users         = [System.Collections.Generic.List[object]]::new()
+                    }
+                }
+                $Group = $DowngradeGroups[$GroupKey]
+                $Group.Seats = $Group.Seats + 1
+                $Group.MonthlySaving = [math]::Round($Group.MonthlySaving + $Saving, 2)
+                $Group.Users.Add([pscustomobject]@{ userPrincipalName = $Upn; displayName = [string]$User.displayName; usedCapabilities = @($UsedHere | ForEach-Object { & $CapLabel $_ }) })
+                $DowngradeUserCount++
+            }
+        }
+    }
+    $Downgrades = @($DowngradeGroups.Values | ForEach-Object { $_.Users = @($_.Users); $_ } | Sort-Object -Property MonthlySaving -Descending)
+
+    # ------------------------------------------------------------------ upgrades
+    $UpgradeGroups = @{}
+    $ProtectCaps = [System.Collections.Generic.HashSet[string]]::new([string[]]@('deviceManagement', 'signInSecurity', 'endpointSecurity'), [System.StringComparer]::OrdinalIgnoreCase)
+    if ($RecommendUpgrades) {
+        foreach ($User in $ActiveUsers) {
+            $Upn = [string]$User.userPrincipalName
+            $HeldProducts = [System.Collections.Generic.List[object]]::new()
+            $UnionCaps = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+            $Families = [System.Collections.Generic.List[string]]::new()
+            $Sum = 0.0
+            $Unpriced = $false
+            foreach ($Assigned in @($User.assignedLicenses)) {
+                if (-not $Assigned.skuId) { continue }
+                $Key = ([string]$Assigned.skuId).ToLowerInvariant()
+                if (-not $ProductBySku.ContainsKey($Key)) { $Unpriced = $true; continue }
+                $Product = $ProductBySku[$Key]
+                if ($null -eq $Product.price) { $Unpriced = $true; continue }
+                $HeldProducts.Add($Product)
+                $Families.Add($Product.family)
+                $Sum += $Product.price
+                $Disabled = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+                foreach ($D in @($Assigned.disabledPlans)) { if ($D) { $null = $Disabled.Add(([string]$D).ToLowerInvariant()) } }
+                $UnionCaps.UnionWith((& $CapsOfPlans (& $GetPlanSet $Key) $Disabled))
+            }
+            if ($HeldProducts.Count -eq 0 -or $Unpriced) { continue }
+            $FromNames = @($HeldProducts | Sort-Object -Property name | Select-Object -ExpandProperty name -Unique)
+            $FromKey = ($HeldProducts.skuId | Sort-Object) -join '+'
+
+            # Consolidate: several plans -> one cheaper plan covering the same capabilities
+            if ($HeldProducts.Count -ge 2 -and -not $OverlapUpns.Contains($Upn)) {
+                $Target = & $CheapestCovering $UnionCaps @($Families) $Sum
+                if ($Target) {
+                    $GroupKey = "Consolidate|$FromKey|$($Target.skuId)"
+                    if (-not $UpgradeGroups.ContainsKey($GroupKey)) {
+                        $UpgradeGroups[$GroupKey] = [pscustomobject]@{
+                            Type          = 'Consolidate'
+                            FromLicenses  = $FromNames
+                            FromSkuIds    = @($HeldProducts.skuId)
+                            ToLicense     = $Target.name
+                            ToSkuId       = $Target.skuId
+                            Seats         = 0
+                            UnitCost      = [math]::Round($Sum, 2)
+                            TargetCost    = $Target.price
+                            UnitDelta     = [math]::Round($Target.price - $Sum, 2)
+                            MonthlyDelta  = 0.0
+                            Gains         = @(($Target.caps | Where-Object { -not $UnionCaps.Contains($_) } | Sort-Object) | ForEach-Object { & $CapLabel $_ })
+                            Users         = [System.Collections.Generic.List[object]]::new()
+                        }
+                    }
+                    $Group = $UpgradeGroups[$GroupKey]
+                    $Group.Seats = $Group.Seats + 1
+                    $Group.MonthlyDelta = [math]::Round($Group.MonthlyDelta + ($Target.price - $Sum), 2)
+                    $Group.Users.Add([pscustomobject]@{ userPrincipalName = $Upn; displayName = [string]$User.displayName })
+                }
+            }
+
+            # Protect: no device management / sign-in security / device threat protection at all
+            if (-not $UnionCaps.Overlaps($ProtectCaps)) {
+                $Required = [System.Collections.Generic.HashSet[string]]::new($UnionCaps, [System.StringComparer]::OrdinalIgnoreCase)
+                $Required.UnionWith($ProtectCaps)
+                $Target = & $CheapestCovering $Required @($Families) ([double]::MaxValue)
+                if ($Target) {
+                    $GroupKey = "Protect|$FromKey|$($Target.skuId)"
+                    if (-not $UpgradeGroups.ContainsKey($GroupKey)) {
+                        $UpgradeGroups[$GroupKey] = [pscustomobject]@{
+                            Type          = 'Protect'
+                            FromLicenses  = $FromNames
+                            FromSkuIds    = @($HeldProducts.skuId)
+                            ToLicense     = $Target.name
+                            ToSkuId       = $Target.skuId
+                            Seats         = 0
+                            UnitCost      = [math]::Round($Sum, 2)
+                            TargetCost    = $Target.price
+                            UnitDelta     = [math]::Round($Target.price - $Sum, 2)
+                            MonthlyDelta  = 0.0
+                            Gains         = @(($Target.caps | Where-Object { -not $UnionCaps.Contains($_) } | Sort-Object) | ForEach-Object { & $CapLabel $_ })
+                            Users         = [System.Collections.Generic.List[object]]::new()
+                        }
+                    }
+                    $Group = $UpgradeGroups[$GroupKey]
+                    $Group.Seats = $Group.Seats + 1
+                    $Group.MonthlyDelta = [math]::Round($Group.MonthlyDelta + ($Target.price - $Sum), 2)
+                    $Group.Users.Add([pscustomobject]@{ userPrincipalName = $Upn; displayName = [string]$User.displayName })
+                }
+            }
+        }
+    }
+    $Upgrades = @($UpgradeGroups.Values | ForEach-Object { $_.Users = @($_.Users); $_ } | Sort-Object -Property @{ Expression = 'Type' }, @{ Expression = 'MonthlyDelta' })
+
+    # ------------------------------------------------------------------ terms (annual vs monthly)
+    $Terms = [System.Collections.Generic.List[object]]::new()
+    if ($RecommendTerms) {
+        $TenureCutoff = $Now.AddMonths(-$TenureMonths)
+        # skuId -> count of stable assignments among active users
+        $StableBySku = @{}
+        $AssignedActiveBySku = @{}
+        foreach ($User in $ActiveUsers) {
+            $Created = & $ParseDate $User.createdDateTime
+            $StateBySku = @{}
+            foreach ($State in @($User.licenseAssignmentStates)) {
+                if (-not $State.skuId) { continue }
+                if ($State.state -and $State.state -ne 'Active') { continue }
+                $StateBySku[([string]$State.skuId).ToLowerInvariant()] = $State
+            }
+            foreach ($Assigned in @($User.assignedLicenses)) {
+                if (-not $Assigned.skuId) { continue }
+                $Key = ([string]$Assigned.skuId).ToLowerInvariant()
+                if (-not $AssignedActiveBySku.ContainsKey($Key)) { $AssignedActiveBySku[$Key] = 0; $StableBySku[$Key] = 0 }
+                $AssignedActiveBySku[$Key] = $AssignedActiveBySku[$Key] + 1
+                $Since = $null
+                if ($StateBySku.ContainsKey($Key)) { $Since = & $ParseDate $StateBySku[$Key].lastUpdatedDateTime }
+                if ($null -eq $Since) { $Since = $Created }
+                if ($null -ne $Since -and $Since -le $TenureCutoff) { $StableBySku[$Key] = $StableBySku[$Key] + 1 }
+            }
+        }
+        foreach ($Sku in $SkuInfo.Values) {
+            if ($Sku.Used -le 0 -and $Sku.Total -le 0) { continue }
+            if ($TenantLevel.Contains($Sku.skuId)) { continue }
+            $UnitPrice = & $PriceOf $Sku.skuId
+            $MonthlySeats = 0; $YearlySeats = 0; $UnknownSeats = 0; $NextRenewal = $null
+            foreach ($Term in @($Sku.TermInfo)) {
+                if ($null -eq $Term) { continue }
+                if ($Term.Status -and $Term.Status -notin @('Enabled', 'Warning')) { continue }
+                $Seats = [int]($Term.TotalLicenses -as [int])
+                switch ([string]$Term.Term) {
+                    'Monthly' { $MonthlySeats += $Seats }
+                    'Yearly' { $YearlySeats += $Seats }
+                    '3 Year' { $YearlySeats += $Seats }
+                    default { $UnknownSeats += $Seats }
+                }
+                $Days = $Term.DaysUntilRenew -as [int]
+                if ($null -ne $Days -and ($null -eq $NextRenewal -or $Days -lt $NextRenewal)) { $NextRenewal = $Days }
+            }
+            $Stable = if ($StableBySku.ContainsKey($Sku.skuId)) { [int]$StableBySku[$Sku.skuId] } else { 0 }
+            $Assigned = [int]$Sku.Used
+            $RecommendedAnnual = [math]::Min($Stable, $Assigned)
+            $RecommendedMonthly = [math]::Max(0, $Assigned - $RecommendedAnnual)
+            $TermKnown = ($MonthlySeats + $YearlySeats) -gt 0
+            $Convertible = if ($TermKnown) { [math]::Max(0, [math]::Min($MonthlySeats, $RecommendedAnnual - $YearlySeats)) } else { $null }
+            $Saving = if ($TermKnown -and $null -ne $UnitPrice) { [math]::Round($Convertible * $UnitPrice * $Uplift, 2) } else { 0.0 }
+            $LockedUnused = if ($TermKnown) { [math]::Max(0, $YearlySeats - $Assigned) } else { 0 }
+            $Terms.Add([pscustomobject]@{
+                    License            = $Sku.License
+                    skuId              = $Sku.skuId
+                    TotalSeats         = [int]$Sku.Total
+                    AssignedSeats      = $Assigned
+                    StableSeats        = $Stable
+                    MonthlySeats       = $MonthlySeats
+                    YearlySeats        = $YearlySeats
+                    UnknownTermSeats   = $UnknownSeats
+                    TermKnown          = $TermKnown
+                    RecommendedAnnual  = $RecommendedAnnual
+                    RecommendedMonthly = $RecommendedMonthly
+                    ConvertibleSeats   = $Convertible
+                    UnitCost           = $UnitPrice
+                    MonthlySaving      = $Saving
+                    LockedUnusedSeats  = $LockedUnused
+                    NextRenewalDays    = $NextRenewal
+                    PriceKnown         = ($null -ne $UnitPrice)
+                })
+        }
+    }
+    $Terms = @($Terms | Sort-Object -Property MonthlySaving -Descending)
+
+    # ------------------------------------------------------------------ products (what is paid for)
+    $Products = [System.Collections.Generic.List[object]]::new()
+    foreach ($Sku in $SkuInfo.Values) {
+        $UnitPrice = & $PriceOf $Sku.skuId
+        $Caps = & $CapsOfPlans (& $GetPlanSet $Sku.skuId) $null
+        $Products.Add([pscustomobject]@{
+                License      = $Sku.License
+                skuId        = $Sku.skuId
+                Family       = if ($ProductBySku.ContainsKey($Sku.skuId)) { $ProductBySku[$Sku.skuId].family } else { $null }
+                TotalSeats   = [int]$Sku.Total
+                AssignedSeats = [int]$Sku.Used
+                UnusedSeats  = if ($TenantLevel.Contains($Sku.skuId)) { 0 } else { [math]::Max(0, [int]$Sku.Total - [int]$Sku.Used) }
+                TenantLevel  = $TenantLevel.Contains($Sku.skuId)
+                UnitCost     = $UnitPrice
+                MonthlySpend = if ($null -ne $UnitPrice) { [math]::Round($UnitPrice * [int]$Sku.Used, 2) } else { $null }
+                PriceKnown   = ($null -ne $UnitPrice)
+                Capabilities = @($Caps | Sort-Object | ForEach-Object { & $CapLabel $_ })
+            })
+    }
+    $Products = @($Products | Sort-Object -Property @{ Expression = 'MonthlySpend'; Descending = $true }, 'License')
+
+    # ------------------------------------------------------------------ flat suggestion list
+    # One row per action someone can take: "remove the license from X because Y". Seat-level
+    # findings (unassigned seats, term changes) have no user. The mailbox-only review tier is left
+    # out: the evidence-based downgrade pass above supersedes it.
+    $Suggestions = [System.Collections.Generic.List[object]]::new()
+    $UserByUpn = @{}
+    foreach ($User in $RealUsers) { if ($User.userPrincipalName) { $UserByUpn[([string]$User.userPrincipalName).ToLowerInvariant()] = $User } }
+    $UpliftPct = [int][math]::Round($Uplift * 100)
+    $AddSuggestion = {
+        param($Type, $Upn, $License, $Sku, $Target, $Suggestion, $Reason, $Seats, $Saving, $PriceKnown, $Evidence, $Loses)
+        $User = if ($Upn) { $UserByUpn[([string]$Upn).ToLowerInvariant()] } else { $null }
+        $Monthly = [math]::Round([double]$Saving, 2)
+        $Suggestions.Add([pscustomobject]@{
+                Type          = $Type
+                User          = [string]$Upn
+                UserId        = if ($User) { [string]$User.id } else { '' }
+                DisplayName   = if ($User) { [string]$User.displayName } else { '' }
+                License       = [string]$License
+                skuId         = ([string]$Sku).ToLowerInvariant()
+                TargetLicense = [string]$Target
+                Suggestion    = $Suggestion
+                Reason        = $Reason
+                Seats         = [int]$Seats
+                MonthlySaving = $Monthly
+                AnnualSaving  = [math]::Round($Monthly * 12, 2)
+                PriceKnown    = [bool]$PriceKnown
+                Evidence      = @($Evidence)
+                Loses         = @($Loses)
+            })
+    }
+    foreach ($Opp in @($Optimization.Opportunities)) {
+        $Unit = if ($null -ne $Opp.UnitCost) { [double]$Opp.UnitCost } else { 0.0 }
+        switch ([string]$Opp.Tier) {
+            'UnassignedSeats' {
+                & $AddSuggestion 'Reduce seats' '' $Opp.License $Opp.skuId '' "Reduce the seat count by $($Opp.Seats)" "$($Opp.Seats) seats are bought but assigned to nobody" $Opp.Seats $Opp.MonthlySaving $Opp.PriceKnown @() @()
+            }
+            'DisabledAccount' {
+                foreach ($Upn in @($Opp.Users)) { & $AddSuggestion 'Remove license' $Upn $Opp.License $Opp.skuId '' "Remove $($Opp.License)" 'The account is disabled' 1 $Unit $Opp.PriceKnown @() @() }
+            }
+            'Inactive' {
+                foreach ($Upn in @($Opp.Users)) {
+                    $User = $UserByUpn[([string]$Upn).ToLowerInvariant()]
+                    $Last = if ($User) { & $LastSignInOf $User } else { $null }
+                    $Reason = if ($Last) { 'No sign-in for {0} days (last sign-in {1:yyyy-MM-dd})' -f [int]($Now - $Last).TotalDays, $Last } else { "No sign-in for more than $InactiveDays days" }
+                    & $AddSuggestion 'Remove license' $Upn $Opp.License $Opp.skuId '' "Remove $($Opp.License)" $Reason 1 $Unit $Opp.PriceKnown @() @()
+                }
+            }
+            'Overlap' {
+                foreach ($Upn in @($Opp.Users)) { & $AddSuggestion 'Remove license' $Upn $Opp.License $Opp.skuId '' "Remove $($Opp.License)" 'Another assigned license already includes everything this one provides' 1 $Unit $Opp.PriceKnown @() @() }
+            }
+        }
+    }
+    # No sign-in data (no Entra ID P1) and nothing used in the window: remove every priced license
+    $NoActivityMonthly = 0.0
+    $NoActivitySeats = 0
+    foreach ($User in $NoActivityUsers) {
+        foreach ($Assigned in @($User.assignedLicenses)) {
+            if (-not $Assigned.skuId) { continue }
+            $Key = ([string]$Assigned.skuId).ToLowerInvariant()
+            $Unit = & $PriceOf $Key
+            $Name = & $NameOf $Key
+            & $AddSuggestion 'Remove license' $User.userPrincipalName $Name $Key '' "Remove $Name" "No activity in email, Teams, OneDrive or SharePoint for $InactiveDays days (sign-in dates need Entra ID P1, which this tenant does not report)" 1 ($Unit ?? 0) ($null -ne $Unit) @() @()
+            $NoActivityMonthly += ($Unit ?? 0)
+            $NoActivitySeats++
+        }
+    }
+
+    foreach ($D in $Downgrades) {
+        foreach ($U in @($D.Users)) {
+            $Used = @($U.usedCapabilities)
+            $Reason = if ($Used.Count -gt 0) { "Used only $($Used -join ', ') in the last $InactiveDays days" } else { "Nothing this license provides was used in the last $InactiveDays days" }
+            if (@($D.Loses).Count -gt 0 -and $D.Action -ne 'Remove') { $Reason += "; would lose $(@($D.Loses) -join ', ')" }
+            if ($D.Action -eq 'Remove') {
+                & $AddSuggestion 'Remove license' $U.userPrincipalName $D.FromLicense $D.FromSkuId '' "Remove $($D.FromLicense)" $Reason 1 $D.UnitSaving $true $Used $D.Loses
+            } else {
+                & $AddSuggestion 'Change license' $U.userPrincipalName $D.FromLicense $D.FromSkuId $D.ToLicense "Change $($D.FromLicense) to $($D.ToLicense)" $Reason 1 $D.UnitSaving $true $Used $D.Loses
+            }
+        }
+    }
+    foreach ($Up in $Upgrades) {
+        foreach ($U in @($Up.Users)) {
+            $From = @($Up.FromLicenses) -join ' + '
+            if ($Up.Type -eq 'Consolidate') {
+                & $AddSuggestion 'Combine licenses' $U.userPrincipalName $From $Up.FromSkuIds[0] $Up.ToLicense "Replace $From with $($Up.ToLicense)" 'One bundle covers the same features for less' 1 (-1 * [double]$Up.UnitDelta) $true @() @()
+            } else {
+                & $AddSuggestion 'Add protection' $U.userPrincipalName $From $Up.FromSkuIds[0] $Up.ToLicense "Change $From to $($Up.ToLicense)" "No device management, sign-in security or device threat protection; adds $(@($Up.Gains) -join ', ')" 1 (-1 * [double]$Up.UnitDelta) $true @() @()
+            }
+        }
+    }
+    foreach ($T in $Terms) {
+        if ($null -ne $T.ConvertibleSeats -and [int]$T.ConvertibleSeats -gt 0) {
+            & $AddSuggestion 'Change term' '' $T.License $T.skuId '' "Move $($T.ConvertibleSeats) seats to a yearly commitment" "$($T.StableSeats) of $($T.AssignedSeats) assigned seats have been held for $TenureMonths+ months; a monthly commitment costs $UpliftPct% more" $T.ConvertibleSeats $T.MonthlySaving $T.PriceKnown @() @()
+        }
+    }
+    $Suggestions = @($Suggestions | Sort-Object -Property @{ Expression = 'MonthlySaving'; Descending = $true }, 'User')
+
+    # ------------------------------------------------------------------ summary
+    $DowngradeMonthly = 0.0; foreach ($D in $Downgrades) { $DowngradeMonthly += [double]$D.MonthlySaving }
+    $ConsolidateMonthly = 0.0; $ProtectMonthly = 0.0; $ProtectSeats = 0
+    foreach ($U in $Upgrades) {
+        if ($U.Type -eq 'Consolidate') { $ConsolidateMonthly += -1 * [double]$U.MonthlyDelta } else { $ProtectMonthly += [double]$U.MonthlyDelta; $ProtectSeats += [int]$U.Seats }
+    }
+    $TermMonthly = 0.0; foreach ($T in $Terms) { $TermMonthly += [double]$T.MonthlySaving }
+    $Reclaimable = $OptReclaimableMonthly + $NoActivityMonthly
+    $TotalSeats = 0; foreach ($Sku in $SkuInfo.Values) { $TotalSeats += [int]$Sku.Total }
+    $TotalMonthly = $Reclaimable + $DowngradeMonthly + $ConsolidateMonthly + $TermMonthly
+
+    $Summary = [pscustomobject]@{
+        Tenant                    = $TenantFilter
+        Currency                  = $Currency
+        GeneratedAt               = $Now.ToString('o')
+        ReportPeriodDays          = 180
+        InactiveDays              = $InactiveDays
+        TenureMonths              = $TenureMonths
+        RecommendDowngrades       = $RecommendDowngrades
+        RecommendUpgrades         = $RecommendUpgrades
+        RecommendTerms            = $RecommendTerms
+        ProtectSecurityFeatures   = $ProtectSecurityFeatures
+        MonthlySpend              = [double]$Optimization.Summary.MonthlySpend
+        AssignedSeats             = [int]$Optimization.Summary.AssignedSeats
+        TotalSeats                = $TotalSeats
+        LicensedUsers             = $LicensedUserCount
+        PriceCoverage             = $Optimization.Summary.PriceCoverage
+        ReclaimableMonthly        = [math]::Round($Reclaimable, 2)
+        ReclaimableSeats          = $OptReclaimableSeats + $NoActivitySeats
+        SignInDataAvailable       = [bool](@($RealUsers | Where-Object { $null -ne (& $LastSignInOf $_) }).Count -gt 0)
+        DowngradeMonthly          = [math]::Round($DowngradeMonthly, 2)
+        DowngradeSeats            = $DowngradeUserCount
+        ConsolidationMonthly      = [math]::Round($ConsolidateMonthly, 2)
+        TermMonthly               = [math]::Round($TermMonthly, 2)
+        ProtectInvestmentMonthly  = [math]::Round($ProtectMonthly, 2)
+        ProtectSeats              = $ProtectSeats
+        TotalPotentialMonthly     = [math]::Round($TotalMonthly, 2)
+        TotalPotentialAnnual      = [math]::Round($TotalMonthly * 12, 2)
+        MonthlyCommitmentUplift   = $Uplift
+        SuggestionCount           = $Suggestions.Count
+        AnonymizedReports         = $AnonymizedReports
+        DataAvailable             = ($Licenses.Count -gt 0)
+        UsageDataAvailable        = ($ActivityDetail.Count -gt 0)
+        AppUsageDataAvailable     = ($AppUsage.Count -gt 0)
+        MailboxUsageDataAvailable = ($MailboxUsage.Count -gt 0)
+        Sources                   = [pscustomobject]$Sources
+    }
+
+    return [pscustomobject]@{
+        Summary      = $Summary
+        Suggestions  = $Suggestions
+        Optimization = $Optimization
+        Downgrades   = $Downgrades
+        Upgrades     = $Upgrades
+        Terms        = $Terms
+        Products     = $Products
+        Capabilities = @($Capabilities | ForEach-Object { [pscustomobject]@{ id = $_.id; label = $_.label; description = $_.description; measurable = (-not [string]::IsNullOrWhiteSpace([string]$_.signal)) } })
+    }
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPMicrosoftFirstPartyApp.ps1 b/Modules/CIPPCore/Public/Get-CIPPMicrosoftFirstPartyApp.ps1
new file mode 100644
index 0000000000000..da62e55f2f712
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPMicrosoftFirstPartyApp.ps1
@@ -0,0 +1,35 @@
+function Get-CIPPMicrosoftFirstPartyApp {
+    <#
+    .SYNOPSIS
+        Resolves Microsoft first-party application ids to display names.
+    .DESCRIPTION
+        Single source for the Microsoft first-party application list in Config/MicrosoftFirstPartyApps.json.
+        Without -AppId the whole table is returned as a hashtable keyed by lower-case application id. With
+        -AppId the display name is returned, or $null when the id is not a known Microsoft application.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [AllowEmptyString()]
+        [string]$AppId
+    )
+
+    if ($null -eq $script:CIPPMicrosoftFirstPartyApps) {
+        $Table = @{}
+        $Path = Join-Path $env:CIPPRootPath 'Config\MicrosoftFirstPartyApps.json'
+        try {
+            $Json = [System.IO.File]::ReadAllText($Path) | ConvertFrom-Json -ErrorAction Stop
+            foreach ($Property in $Json.PSObject.Properties) { $Table["$($Property.Name)".ToLowerInvariant()] = "$($Property.Value)" }
+        } catch {
+            Write-Information "Get-CIPPMicrosoftFirstPartyApp: could not load $Path - $($_.Exception.Message)"
+        }
+        $script:CIPPMicrosoftFirstPartyApps = $Table
+    }
+
+    if ($PSBoundParameters.ContainsKey('AppId')) {
+        if ([string]::IsNullOrWhiteSpace($AppId)) { return $null }
+        return $script:CIPPMicrosoftFirstPartyApps["$AppId".Trim().ToLowerInvariant()]
+    }
+    $script:CIPPMicrosoftFirstPartyApps
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPSAMCertificateVersions.ps1 b/Modules/CIPPCore/Public/Get-CIPPSAMCertificateVersions.ps1
new file mode 100644
index 0000000000000..1a5989a95b86b
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPSAMCertificateVersions.ps1
@@ -0,0 +1,181 @@
+function Get-CIPPSAMCertificateVersions {
+    <#
+    .SYNOPSIS
+    Loads current, previous, and historical SAM certificate thumbprints from storage
+
+    .DESCRIPTION
+    Reads version history for the SAMCertificate Key Vault secret (or DevSecrets in local
+    mode). Current and previous are the keep-set for Entra keyCredentials; older loaded
+    versions supply HistoricalThumbprints used to prove a credential was CIPP-generated
+    before removing it. Caps full PFX materialization at 50 newest enabled versions.
+
+    .PARAMETER Name
+    Storage name. Defaults to SAMCertificate.
+
+    .PARAMETER VaultName
+    Key Vault name. Derived via Get-CippKeyVaultName when omitted.
+
+    .PARAMETER MaxVersions
+    Maximum enabled versions to materialize. Defaults to 50.
+
+    .EXAMPLE
+    $Versions = Get-CIPPSAMCertificateVersions
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $false)]
+        [string]$Name = 'SAMCertificate',
+
+        [Parameter(Mandatory = $false)]
+        [string]$VaultName,
+
+        [Parameter(Mandatory = $false)]
+        [int]$MaxVersions = 50
+    )
+
+    $Empty = [PSCustomObject]@{
+        Current               = $null
+        Previous              = $null
+        HistoricalThumbprints = [string[]]@()
+        AllKnownThumbprints   = [string[]]@()
+    }
+
+    $Materialized = [System.Collections.Generic.List[object]]::new()
+
+    if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true') {
+        $Table = Get-CIPPTable -tablename 'DevSecrets'
+        $Secret = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'Secret' and RowKey eq 'Secret'"
+        if ($Secret.$Name) {
+            $CurrentInfo = ConvertTo-CIPPSAMCertificateInfo -PfxBase64 $Secret.$Name
+            if ($CurrentInfo) { $Materialized.Add($CurrentInfo) }
+        }
+        $PreviousProp = "${Name}Previous"
+        if ($Secret.$PreviousProp) {
+            $PreviousInfo = ConvertTo-CIPPSAMCertificateInfo -PfxBase64 $Secret.$PreviousProp
+            if ($PreviousInfo) { $Materialized.Add($PreviousInfo) }
+        }
+    } else {
+        if (-not $VaultName) {
+            $VaultName = Get-CippKeyVaultName
+            if (-not $VaultName) {
+                throw 'VaultName not provided and could not be derived (WEBSITE_SITE_NAME / WEBSITE_DEPLOYMENT_ID not set)'
+            }
+        }
+
+        $Token = Get-CIPPAzIdentityToken -ResourceUrl 'https://vault.azure.net'
+        $Headers = @{ Authorization = "Bearer $Token" }
+
+        $VersionEntries = [System.Collections.Generic.List[object]]::new()
+        $ListUri = "https://$VaultName.vault.azure.net/secrets/$Name/versions?api-version=7.4"
+        try {
+            while ($ListUri) {
+                $ListResponse = Invoke-CIPPRestMethod -Uri $ListUri -Headers $Headers -Method Get -ErrorAction Stop
+                foreach ($Entry in @($ListResponse.value)) {
+                    $VersionEntries.Add($Entry)
+                }
+                $ListUri = $ListResponse.nextLink
+            }
+        } catch {
+            if ($_.Exception.Message -match 'SecretNotFound|404') {
+                return $Empty
+            }
+            throw
+        }
+
+        $Enabled = @(
+            $VersionEntries |
+                Where-Object { $_.attributes.enabled -ne $false } |
+                Sort-Object { $_.attributes.created } -Descending |
+                Select-Object -First $MaxVersions
+        )
+
+        foreach ($Entry in $Enabled) {
+            $VersionId = ($Entry.id -split '/')[-1]
+            try {
+                $SecretUri = "https://$VaultName.vault.azure.net/secrets/$Name/$VersionId`?api-version=7.4"
+                $SecretResponse = Invoke-CIPPRestMethod -Uri $SecretUri -Headers $Headers -Method Get -ErrorAction Stop
+                if ([string]::IsNullOrEmpty($SecretResponse.value)) { continue }
+                $Info = ConvertTo-CIPPSAMCertificateInfo -PfxBase64 $SecretResponse.value
+                if ($Info) { $Materialized.Add($Info) }
+            } catch {
+                Write-Warning "Could not materialize SAM certificate version $VersionId : $($_.Exception.Message)"
+            }
+        }
+    }
+
+    if ($Materialized.Count -eq 0) {
+        return $Empty
+    }
+
+    $Current = $Materialized[0]
+    $Previous = if ($Materialized.Count -gt 1) { $Materialized[1] } else { $null }
+    $Historical = [System.Collections.Generic.List[string]]::new()
+    for ($i = 2; $i -lt $Materialized.Count; $i++) {
+        if ($Materialized[$i].Thumbprint) {
+            $Historical.Add($Materialized[$i].Thumbprint)
+        }
+    }
+
+    $AllKnown = [System.Collections.Generic.List[string]]::new()
+    if ($Current.Thumbprint) { $AllKnown.Add($Current.Thumbprint) }
+    if ($Previous.Thumbprint) { $AllKnown.Add($Previous.Thumbprint) }
+    foreach ($Tp in $Historical) { $AllKnown.Add($Tp) }
+
+    return [PSCustomObject]@{
+        Current               = $Current
+        Previous              = $Previous
+        HistoricalThumbprints = @($Historical)
+        AllKnownThumbprints   = @($AllKnown)
+    }
+}
+
+function ConvertTo-CIPPSAMCertificateInfo {
+    <#
+    .SYNOPSIS
+    Materializes a base64 PFX into thumbprint / public key metadata for SAM cert rotation
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$PfxBase64
+    )
+
+    if ([string]::IsNullOrEmpty($PfxBase64)) {
+        return $null
+    }
+
+    try {
+        $PfxBytes = [Convert]::FromBase64String($PfxBase64)
+        $KeyFlags = if ($IsLinux -or $IsMacOS) {
+            [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::EphemeralKeySet
+        } else {
+            [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::MachineKeySet
+        }
+        $Certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new(
+            $PfxBytes,
+            [string]::Empty,
+            $KeyFlags
+        )
+        try {
+            $PublicKeyBase64 = [Convert]::ToBase64String(
+                $Certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert)
+            )
+            return [PSCustomObject]@{
+                Certificate     = $Certificate
+                Thumbprint      = $Certificate.Thumbprint
+                NotBefore       = $Certificate.NotBefore.ToUniversalTime()
+                NotAfter        = $Certificate.NotAfter.ToUniversalTime()
+                PfxBase64       = $PfxBase64
+                PublicKeyBase64 = $PublicKeyBase64
+            }
+        } catch {
+            $Certificate.Dispose()
+            throw
+        }
+    } catch {
+        Write-Warning "Could not parse SAM certificate PFX: $($_.Exception.Message)"
+        return $null
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListShadowAI.ps1 b/Modules/CIPPCore/Public/Get-CIPPShadowAIReport.ps1
similarity index 69%
rename from Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListShadowAI.ps1
rename to Modules/CIPPCore/Public/Get-CIPPShadowAIReport.ps1
index ff806f1c5aaa2..c121c58351e7d 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListShadowAI.ps1	
+++ b/Modules/CIPPCore/Public/Get-CIPPShadowAIReport.ps1
@@ -1,20 +1,22 @@
-function Invoke-ListShadowAI {
+function Get-CIPPShadowAIReport {
     <#
     .FUNCTIONALITY
-        Entrypoint
-    .ROLE
-        Tenant.Standards.Read
+        Internal
+    .SYNOPSIS
+        The Shadow AI overview for a tenant, compiled from the CIPP reporting cache.
     .DESCRIPTION
-        Compiles a Shadow AI overview for a tenant by matching CACHED data from the CIPP reporting
-        database (DetectedApps, ServicePrincipals, OAuth2PermissionGrants) against the curated AI
-        catalog (Config/ShadowAI.json). No live Graph enumeration is performed - refresh the data by
-        syncing those caches (ExecCIPPDBCache). The only live call is a bounded, best-effort 7-day
-        sign-in lookup for the matched AI applications.
+        Matches the cached DetectedApps, ServicePrincipals and OAuth2PermissionGrants datasets against
+        the curated AI catalog (Config/ShadowAI.json) into the shape the Shadow AI page (ListShadowAI)
+        and the Shadow AI PDF consume: a summary, tools by category and risk, the top tools across both
+        sources, the AI software found on managed devices and the AI applications in Entra. No live
+        Graph enumeration is performed (refresh via ExecCIPPDBCache); the only live call is a bounded,
+        best-effort 7-day sign-in lookup for the matched AI applications.
     #>
     [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-
-    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
 
     # Curated, PR-editable catalog of known AI tools/apps.
     try {
@@ -50,22 +52,13 @@ function Invoke-ListShadowAI {
     }
 
     # --- Cached datasets from the CIPP reporting database (no live Graph enumeration) ---
-    $CacheTypes = @('DetectedApps', 'ServicePrincipals', 'OAuth2PermissionGrants')
     $CacheData = @{}
     $CacheTimestamps = [System.Collections.Generic.List[object]]::new()
-    foreach ($Type in $CacheTypes) {
-        try {
-            $CacheData[$Type] = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type)
-        } catch {
-            $CacheData[$Type] = @()
-        }
-        try {
-            $CountRow = Get-CIPPDbItem -TenantFilter $TenantFilter -Type $Type -CountsOnly | Select-Object -First 1
-            if ($CountRow.Timestamp) { $CacheTimestamps.Add($CountRow.Timestamp) }
-        } catch {}
+    foreach ($Type in @('DetectedApps', 'ServicePrincipals', 'OAuth2PermissionGrants')) {
+        $CacheData[$Type] = try { @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type) } catch { @() }
+        $CountRow = try { Get-CIPPDbItem -TenantFilter $TenantFilter -Type $Type -CountsOnly | Select-Object -First 1 } catch { $null }
+        if ($CountRow.Timestamp) { $CacheTimestamps.Add($CountRow.Timestamp) }
     }
-    $IntuneSynced = $CacheData['DetectedApps'].Count -gt 0
-    $EntraSynced = $CacheData['ServicePrincipals'].Count -gt 0
     $LastDataRefresh = $CacheTimestamps | Sort-Object | Select-Object -First 1
 
     # 1) Installed AI tools from the cached Intune detected apps. The inventory reports a separate
@@ -99,12 +92,9 @@ function Invoke-ListShadowAI {
         }
     }
 
-    $DetectedApps = [System.Collections.Generic.List[object]]::new()
-    foreach ($Entry in $DetectedAppMap.Values) {
-        $Match = $Entry.Match
-        # Inventory rows mix clean publisher names with full certificate subjects - show the shortest
-        $Publisher = $Entry.Publishers | Sort-Object -Property Length | Select-Object -First 1
-        $DetectedApps.Add([PSCustomObject]@{
+    $DetectedApps = @(foreach ($Entry in $DetectedAppMap.Values) {
+            $Match = $Entry.Match
+            [PSCustomObject]@{
                 application     = ($Entry.Applications | Sort-Object) -join ', '
                 aiTool          = $Match.name
                 vendor          = $Match.vendor
@@ -114,24 +104,21 @@ function Invoke-ListShadowAI {
                 status          = if ($Entry.Sanctioned) { 'Sanctioned' } else { 'Unsanctioned' }
                 toolDescription = $Match.description
                 riskReason      = $Match.riskReason
-                publisher       = $Publisher
+                # Inventory rows mix clean publisher names with full certificate subjects - show the shortest.
+                publisher       = $Entry.Publishers | Sort-Object -Property Length | Select-Object -First 1
                 version         = ($Entry.Versions | Sort-Object) -join ', '
                 platform        = ($Entry.Platforms | Sort-Object) -join ', '
                 deviceCount     = $Entry.Devices.Count
                 managedDevices  = @($Entry.Devices.Values)
-            })
-    }
+            }
+        })
 
     # 2) AI applications in Entra: match ALL cached service principals (not only those with
     #    delegated grants), then attach any granted permissions. First consented = when the
     #    service principal was created in the tenant (the oauth2 grant startTime is unreliable).
     $GrantsBySp = @{}
-    foreach ($Grant in $CacheData['OAuth2PermissionGrants']) {
-        if (-not $Grant.clientId) { continue }
-        if (-not $GrantsBySp.ContainsKey($Grant.clientId)) {
-            $GrantsBySp[$Grant.clientId] = [System.Collections.Generic.List[object]]::new()
-        }
-        $GrantsBySp[$Grant.clientId].Add($Grant)
+    foreach ($Group in ($CacheData['OAuth2PermissionGrants'] | Where-Object { $_.clientId } | Group-Object clientId)) {
+        $GrantsBySp[$Group.Name] = $Group.Group
     }
 
     $ConsentedApps = [System.Collections.Generic.List[object]]::new()
@@ -199,55 +186,55 @@ function Invoke-ListShadowAI {
         }
     }
 
-    # --- Roll up distinct AI tools across BOTH sources for the summary and charts ---
-    $ToolMap = @{}
-    foreach ($App in $DetectedApps) {
-        if (-not $ToolMap.ContainsKey($App.aiTool)) {
-            $ToolMap[$App.aiTool] = [PSCustomObject]@{ Tool = $App.aiTool; Category = $App.category; Risk = $App.risk; Status = $App.status; Devices = 0; Users = 0 }
-        }
-        $ToolMap[$App.aiTool].Devices += $App.deviceCount
-    }
-    foreach ($App in $ConsentedApps) {
-        if (-not $ToolMap.ContainsKey($App.aiTool)) {
-            $ToolMap[$App.aiTool] = [PSCustomObject]@{ Tool = $App.aiTool; Category = $App.category; Risk = $App.risk; Status = $App.status; Devices = 0; Users = 0 }
-        }
-        $ToolMap[$App.aiTool].Users += [int]$App.activeUsersLast7Days
-    }
+    # --- Roll up distinct AI tools across BOTH sources for the summary and charts: device installs
+    #     from the Intune rows, active users (last 7 days) from the Entra rows, the first row seen
+    #     (Intune first) naming the tool's category, risk and status. ---
+    $Tools = @($DetectedApps + @($ConsentedApps) | Group-Object aiTool | ForEach-Object {
+            [PSCustomObject]@{
+                Tool     = $_.Name
+                Category = $_.Group[0].category
+                Risk     = $_.Group[0].risk
+                Status   = $_.Group[0].status
+                Devices  = [int](($_.Group | ForEach-Object { [int]($_.deviceCount ?? 0) } | Measure-Object -Sum).Sum)
+                Users    = [int](($_.Group | ForEach-Object { [int]($_.activeUsersLast7Days ?? 0) } | Measure-Object -Sum).Sum)
+            }
+        })
 
-    $ByCategory = foreach ($Group in ($ToolMap.Values | Group-Object Category)) {
-        [PSCustomObject]@{
-            category = $Group.Name
-            tools    = $Group.Count
-            devices  = [int](($Group.Group | Measure-Object -Property Devices -Sum).Sum)
-        }
-    }
-    $ByRisk = foreach ($Group in ($ToolMap.Values | Group-Object Risk)) {
-        [PSCustomObject]@{
-            risk  = $Group.Name
-            tools = $Group.Count
-        }
-    }
+    # Built as @(...) so a tenant with no AI tools gets empty lists, not a single null entry.
+    $ByCategory = @(foreach ($Group in ($Tools | Group-Object Category)) {
+            [PSCustomObject]@{
+                category = $Group.Name
+                tools    = $Group.Count
+                devices  = [int](($Group.Group | Measure-Object -Property Devices -Sum).Sum)
+            }
+        })
+    $ByRisk = @(foreach ($Group in ($Tools | Group-Object Risk)) {
+            [PSCustomObject]@{
+                risk  = $Group.Name
+                tools = $Group.Count
+            }
+        })
     # Top tools across BOTH sources: device installs (Intune) + active users (Entra, last 7 days).
-    $TopTools = $ToolMap.Values | Sort-Object -Property { $_.Devices + $_.Users } -Descending | Select-Object -First 8 | ForEach-Object {
-        [PSCustomObject]@{
-            tool      = $_.Tool
-            devices   = $_.Devices
-            users     = $_.Users
-            footprint = $_.Devices + $_.Users
-            category  = $_.Category
-            status    = $_.Status
-        }
-    }
+    $TopTools = @($Tools | Sort-Object -Property { $_.Devices + $_.Users } -Descending | Select-Object -First 8 | ForEach-Object {
+            [PSCustomObject]@{
+                tool      = $_.Tool
+                devices   = $_.Devices
+                users     = $_.Users
+                footprint = $_.Devices + $_.Users
+                category  = $_.Category
+                status    = $_.Status
+            }
+        })
 
     $Body = [PSCustomObject]@{
         summary       = [PSCustomObject]@{
-            aiToolsDetected = $ToolMap.Count
+            aiToolsDetected = $Tools.Count
             deviceInstalls  = [int](($DetectedApps | Measure-Object -Property deviceCount -Sum).Sum)
             consentedAiApps = $ConsentedApps.Count
-            highRiskTools   = @($ToolMap.Values | Where-Object { $_.Risk -eq 'High' }).Count
-            sanctionedTools = @($ToolMap.Values | Where-Object { $_.Status -eq 'Sanctioned' }).Count
-            intuneSynced    = $IntuneSynced
-            entraSynced     = $EntraSynced
+            highRiskTools   = @($Tools | Where-Object { $_.Risk -eq 'High' }).Count
+            sanctionedTools = @($Tools | Where-Object { $_.Status -eq 'Sanctioned' }).Count
+            intuneSynced    = $CacheData['DetectedApps'].Count -gt 0
+            entraSynced     = $CacheData['ServicePrincipals'].Count -gt 0
             lastDataRefresh = $LastDataRefresh
         }
         byCategory    = @($ByCategory)
@@ -256,9 +243,5 @@ function Invoke-ListShadowAI {
         detectedApps  = @($DetectedApps)
         consentedApps = @($ConsentedApps)
     }
-
-    return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = $Body
-        })
+    return $Body
 }
diff --git a/Modules/CIPPCore/Public/Get-CIPPSharePointPermissionsReport.ps1 b/Modules/CIPPCore/Public/Get-CIPPSharePointPermissionsReport.ps1
new file mode 100644
index 0000000000000..b142255987521
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPSharePointPermissionsReport.ps1
@@ -0,0 +1,111 @@
+function Get-CIPPSharePointPermissionsReport {
+    <#
+    .FUNCTIONALITY
+        Internal
+    .SYNOPSIS
+        The SharePoint permissions report for a tenant, compiled from the CIPP reporting cache.
+    .DESCRIPTION
+        Rolls up the cached SharePointPermissions dataset into the shape the Permissions page
+        (ListSharePointPermissions) and the permissions PDF consume: the scan summary, the oversharing
+        signals worth acting on, chart datasets and the individual permission assignments. No live
+        enumeration is performed; refresh the data by syncing that cache (ExecCIPPDBCache).
+
+        Signals reported:
+        - Broad claims: grants to Everyone, Everyone except external users, or All Users. A library
+          carrying one of these is reachable by the whole tenant regardless of who was meant to
+          have it, which is the classic oversharing footgun.
+        - External grants: permissions held by guest or external identities.
+        - Direct Full Control: Full Control held by something other than a SharePoint group, i.e.
+          granted to a user or directory group rather than through the site's Owners group.
+        - Unique permission libraries: libraries that no longer inherit from their site, so site
+          level permission changes no longer reach them.
+
+        Limited Access assignments (isSystemManaged) are excluded from every signal - SharePoint
+        creates them itself so a user can traverse to an item, and they grant nothing on their own.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    # A readable label for a site that has no display name, taken from the last path segment of
+    # its URL: '.../sites/AllCompany' becomes 'AllCompany', '.../search' becomes 'search'.
+    function Get-CIPPSiteLabel {
+        param([string]$SiteUrl)
+        if ([string]::IsNullOrWhiteSpace($SiteUrl)) { return 'Unnamed site' }
+        try {
+            $Path = ([System.Uri]$SiteUrl).AbsolutePath.Trim('/')
+            if ($Path) { return ($Path -split '/')[-1] }
+            return 'Root site'
+        } catch {
+            return 'Unnamed site'
+        }
+    }
+    # Counts per key, largest first, as { <KeyName>; <ValueName> } rows for the charts and tables.
+    function Get-RankedCount($Rows, [scriptblock]$Key, [string]$KeyName, [string]$ValueName) {
+        @($Rows | Group-Object $Key | Where-Object { $_.Name } | Sort-Object -Property Count -Descending |
+                ForEach-Object { [PSCustomObject]@{ $KeyName = $_.Name; $ValueName = $_.Count } })
+    }
+
+    # --- Cached dataset from the CIPP reporting database ---
+    $CacheRows = try { @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'SharePointPermissions') } catch { @() }
+    $CountRow = try { Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointPermissions' -CountsOnly | Select-Object -First 1 } catch { $null }
+
+    $SiteRows = @($CacheRows | Where-Object { $_.rowType -eq 'Site' })
+    $Assignments = @($CacheRows | Where-Object { $_.rowType -eq 'Assignment' })
+    $SkippedSites = @($SiteRows | Where-Object { $_.collectionStatus -eq 'Skipped' } | ForEach-Object {
+            [PSCustomObject]@{ siteName = $_.siteName; siteUrl = $_.siteUrl; error = $_.collectionError }
+        })
+    # Placeholder rows for a unique-permission library with nothing granted carry no principal, and
+    # SharePoint maintains Limited Access itself; neither grants anything on its own.
+    $RealAssignments = @($Assignments | Where-Object { $_.principalId -and $_.isSystemManaged -ne $true })
+    $Level = { [string]($_.permissionLevel ?? 'Unknown') }
+
+    $Body = [PSCustomObject]@{
+        summary                   = [PSCustomObject]@{
+            sitesScanned              = $SiteRows.Count
+            sitesSkipped              = $SkippedSites.Count
+            librariesScanned          = [int](($SiteRows | ForEach-Object { [int]($_.librariesScanned ?? 0) } | Measure-Object -Sum).Sum)
+            uniquePermissionLibraries = [int](($SiteRows | ForEach-Object { [int]($_.librariesWithUniquePermissions ?? 0) } | Measure-Object -Sum).Sum)
+            totalAssignments          = $RealAssignments.Count
+            broadClaimGrants          = @($RealAssignments | Where-Object { $_.broadClaim }).Count
+            externalGrants            = @($RealAssignments | Where-Object { $_.isGuest -eq $true }).Count
+            # Full Control held by anything other than a SharePoint group was granted directly rather
+            # than through the site's Owners group, which every site has by default.
+            directFullControlGrants   = @($RealAssignments | Where-Object { (& $Level) -eq 'Full Control' -and $_.principalType -ne 'SharePoint Group' }).Count
+            permissionsSynced         = [bool]$CountRow
+            lastDataRefresh           = $CountRow.Timestamp
+        }
+        byPermissionLevel         = @(Get-RankedCount $RealAssignments $Level 'level' 'grants')
+        byPrincipalType           = @(Get-RankedCount $RealAssignments { [string]($_.principalType ?? 'Other') } 'type' 'grants')
+        byBroadClaim              = @(Get-RankedCount @($RealAssignments | Where-Object { $_.broadClaim }) { [string]$_.broadClaim } 'claim' 'grants')
+        # Libraries that no longer inherit, counted per site for the chart.
+        topSitesByUniqueLibraries = @($SiteRows | Where-Object { [int]($_.librariesWithUniquePermissions ?? 0) -gt 0 } |
+                Group-Object { [string]($_.siteName ?? $_.siteUrl) } | Where-Object { $_.Name } |
+                ForEach-Object { [PSCustomObject]@{ site = $_.Name; libraries = [int](($_.Group | ForEach-Object { [int]$_.librariesWithUniquePermissions } | Measure-Object -Sum).Sum) } } |
+                Sort-Object -Property libraries -Descending | Select-Object -First 10)
+        skippedSites              = @($SkippedSites)
+        # Display fields are derived here rather than stored, so existing cached data gains them
+        # without waiting for a re-scan.
+        #
+        # appliesTo spells out what scope means for a reader scanning the table. Every Library row
+        # is by definition a library that stopped inheriting - libraries that still inherit are not
+        # collected, because their permissions are the site's repeated.
+        #
+        # siteName falls back to a label built from the URL for the handful of system sites that
+        # have no name. The URL itself is not used: the tables render any value starting with http
+        # as a link, and a column of links where names should be is worse than a plain label.
+        assignments               = @($Assignments | ForEach-Object {
+                $AppliesTo = if ($_.scope -eq 'Library') { 'This library only' } else { 'Whole site' }
+                $_ | Add-Member -NotePropertyName 'appliesTo' -NotePropertyValue $AppliesTo -Force
+
+                $SiteName = [string]$_.siteName
+                if ([string]::IsNullOrWhiteSpace($SiteName) -or $SiteName -like 'http*') {
+                    $_ | Add-Member -NotePropertyName 'siteName' -NotePropertyValue (Get-CIPPSiteLabel -SiteUrl $_.siteUrl) -Force
+                }
+                $_
+            })
+    }
+    return $Body
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPSharePointSharingReport.ps1 b/Modules/CIPPCore/Public/Get-CIPPSharePointSharingReport.ps1
new file mode 100644
index 0000000000000..caf8f441287fe
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-CIPPSharePointSharingReport.ps1
@@ -0,0 +1,103 @@
+function Get-CIPPSharePointSharingReport {
+    <#
+    .FUNCTIONALITY
+        Internal
+    .SYNOPSIS
+        The SharePoint & OneDrive sharing report for a tenant, compiled from the CIPP reporting cache.
+    .DESCRIPTION
+        Rolls up the cached SharePointSharingLinks, SharePointSiteUsage and OneDriveUsage datasets into
+        the shape the Sharing page (ListSharePointSharing) and the sharing PDF consume: environment,
+        file and storage summaries per workload, link counts by classification, the sharing sprawl
+        signals (anonymous links that allow editing, anonymous links with no expiry, folder-level
+        external shares, password-protected links), the busiest sites, libraries and external
+        recipients, and the individual link rows. No live Graph enumeration is performed; refresh the
+        data by syncing those caches (ExecCIPPDBCache).
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    # Usage report values can arrive as numbers, strings or empty strings depending on the tenant.
+    function ConvertTo-SafeDouble {
+        param($Value)
+        $Parsed = [double]0
+        if ($null -ne $Value -and [double]::TryParse("$Value", [ref]$Parsed)) { return $Parsed }
+        return [double]0
+    }
+    function Get-Total($Rows, [string]$Property) {
+        ($Rows | ForEach-Object { ConvertTo-SafeDouble -Value $_.$Property } | Measure-Object -Sum).Sum
+    }
+    # Counts per key, largest first, as { <KeyName>; <ValueName> } rows for the charts and tables.
+    function Get-RankedCount($Rows, [scriptblock]$Key, [string]$KeyName, [string]$ValueName, [int]$First = 0) {
+        $Groups = @($Rows | Group-Object $Key | Where-Object { $_.Name } | Sort-Object -Property Count -Descending)
+        if ($First -gt 0) { $Groups = @($Groups | Select-Object -First $First) }
+        @($Groups | ForEach-Object { [PSCustomObject]@{ $KeyName = $_.Name; $ValueName = $_.Count } })
+    }
+
+    # --- Cached datasets, whether each has ever synced, and the oldest refresh across them ---
+    $CacheData = @{}
+    $CacheSynced = @{}
+    $CacheTimestamps = [System.Collections.Generic.List[object]]::new()
+    foreach ($Type in @('SharePointSharingLinks', 'SharePointSiteUsage', 'OneDriveUsage')) {
+        $CacheData[$Type] = try { @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type) } catch { @() }
+        $CountRow = try { Get-CIPPDbItem -TenantFilter $TenantFilter -Type $Type -CountsOnly | Select-Object -First 1 } catch { $null }
+        $CacheSynced[$Type] = [bool]$CountRow
+        if ($CountRow.Timestamp) { $CacheTimestamps.Add($CountRow.Timestamp) }
+    }
+    $LastDataRefresh = $CacheTimestamps | Sort-Object | Select-Object -First 1
+
+    # --- Environment summaries per workload. Teams-connected sites (rootWebTemplate 'Group' and 'Team Channel') are
+    #     reported separately from the remaining SharePoint sites; OneDrive is per account. ---
+    $TeamsSiteRows = @($CacheData['SharePointSiteUsage'] | Where-Object { $_.rootWebTemplate -in @('Group', 'Team Channel') })
+    $SharePointSiteRows = @($CacheData['SharePointSiteUsage'] | Where-Object { $_.rootWebTemplate -notin @('Group', 'Team Channel') })
+    $OneDriveRows = $CacheData['OneDriveUsage']
+
+    # --- Sharing link rollups ---
+    $Links = $CacheData['SharePointSharingLinks']
+    $AnonymousLinks = @($Links | Where-Object { $_.classification -eq 'Anonymous' })
+    $ExternalLinks = @($Links | Where-Object { $_.classification -eq 'External' })
+    # 'write' and 'owner' both mean the recipient can change the content.
+    $CanEdit = { param($Link) @($Link.roles) -contains 'write' -or @($Link.roles) -contains 'owner' }
+    $SiteOf = { param($Link) [string]($Link.siteName ?? $Link.siteUrl) }
+    # Who the tenant is sharing with, counted from named external recipients only: anonymous links
+    # have no recipient and internal ones are not sprawl.
+    $ExternalRecipients = @($ExternalLinks | ForEach-Object { @($_.sharedWith) } | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | ForEach-Object { [string]$_ })
+    $TopRecipients = @(Get-RankedCount $ExternalRecipients { $_ } 'recipient' 'links')
+
+    $Body = [PSCustomObject]@{
+        summary       = [PSCustomObject]@{
+            sharePointSites         = $SharePointSiteRows.Count
+            sharePointFiles         = [int64](Get-Total $SharePointSiteRows 'fileCount')
+            sharePointStorageUsedGB = [math]::Round((Get-Total $SharePointSiteRows 'storageUsedInBytes') / 1GB, 2)
+            teamsSites              = $TeamsSiteRows.Count
+            teamsFiles              = [int64](Get-Total $TeamsSiteRows 'fileCount')
+            teamsStorageUsedGB      = [math]::Round((Get-Total $TeamsSiteRows 'storageUsedInBytes') / 1GB, 2)
+            oneDriveAccounts        = $OneDriveRows.Count
+            oneDriveFiles           = [int64](Get-Total $OneDriveRows 'fileCount')
+            oneDriveStorageUsedGB   = [math]::Round((Get-Total $OneDriveRows 'storageUsedInBytes') / 1GB, 2)
+            totalLinks              = $Links.Count
+            anonymousLinks          = $AnonymousLinks.Count
+            externalLinks           = $ExternalLinks.Count
+            internalLinks           = $Links.Count - $AnonymousLinks.Count - $ExternalLinks.Count
+            itemsShared             = @($Links | Where-Object { $_.driveId -and $_.itemId } | ForEach-Object { "$($_.driveId)|$($_.itemId)" } | Sort-Object -Unique).Count
+            anonymousEditLinks      = @($AnonymousLinks | Where-Object { & $CanEdit $_ }).Count
+            neverExpiringAnonymous  = @($AnonymousLinks | Where-Object { -not $_.expirationDateTime }).Count
+            # A share on a folder exposes everything below it, so it counts differently to a file share.
+            folderShares            = @($Links | Where-Object { $_.itemType -eq 'Folder' -and $_.classification -in @('Anonymous', 'External') }).Count
+            passwordProtectedLinks  = @($Links | Where-Object { $_.hasPassword -eq $true }).Count
+            externalRecipients      = $TopRecipients.Count
+            linksSynced             = $CacheSynced['SharePointSharingLinks']
+            usageSynced             = ($CacheSynced['SharePointSiteUsage'] -or $CacheSynced['OneDriveUsage'])
+            lastDataRefresh         = $LastDataRefresh
+        }
+        byScope       = @(Get-RankedCount $Links { [string]($_.classification ?? 'Internal') } 'scope' 'links')
+        byLinkType    = @(Get-RankedCount $Links { [string]($_.linkType ?? 'link') } 'type' 'links')
+        topSites      = @(Get-RankedCount $Links { & $SiteOf $_ } 'site' 'links' 10)
+        topLibraries  = @(Get-RankedCount @($Links | Where-Object { $_.driveName }) { $Site = & $SiteOf $_; if ($Site) { "$Site / $($_.driveName)" } else { [string]$_.driveName } } 'library' 'links' 10)
+        topRecipients = @($TopRecipients | Select-Object -First 10)
+        links         = @($Links)
+    }
+    return $Body
+}
diff --git a/Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageRows.ps1 b/Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageRows.ps1
index 7a8e7fcb6ed9f..22882ab0917e4 100644
--- a/Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageRows.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageRows.ps1
@@ -63,6 +63,25 @@ function Get-CIPPSharePointSiteUsageRows {
         }
     }
 
+    $RequestId = 0
+    $MissingSiteRequests = foreach ($Row in $AdminRows) {
+        $RowUrl = ([string]$Row.SiteUrl).TrimEnd('/')
+        $RowSiteId = ([string]$Row.SiteId).Trim('{}')
+        if ([string]::IsNullOrWhiteSpace($RowUrl) -or $GraphByWebUrl.ContainsKey($RowUrl) -or ($RowSiteId -and $GraphBySiteId.ContainsKey($RowSiteId))) { continue }
+        $SiteUri = [System.Uri]$RowUrl
+        @{
+            id     = [string]$RequestId++
+            method = 'GET'
+            url    = "sites/$($SiteUri.Host):$($SiteUri.AbsolutePath)?`$select=id,createdDateTime,description,name,displayName,webUrl,sharepointIds"
+        }
+    }
+    if (@($MissingSiteRequests).Count -gt 0) {
+        foreach ($Response in @(New-GraphBulkRequest -tenantid $TenantFilter -Requests @($MissingSiteRequests) -asapp $true | Where-Object { $_.status -eq 200 })) {
+            $GraphBySiteId[([string]$Response.body.sharepointIds.siteId).Trim('{}').ToLowerInvariant()] = $Response.body
+            $GraphByWebUrl[$Response.body.webUrl.TrimEnd('/').ToLowerInvariant()] = $Response.body
+        }
+    }
+
     $ArchiveByUrl = [System.Collections.Generic.Dictionary[string, object]]::new([System.StringComparer]::OrdinalIgnoreCase)
     if ($IncludeArchive) {
         try {
diff --git a/Modules/CIPPCore/Public/Get-CIPPTestResultsTenants.ps1 b/Modules/CIPPCore/Public/Get-CIPPTestResultsTenants.ps1
index 9ad2092151408..a59fd0bc88d7b 100644
--- a/Modules/CIPPCore/Public/Get-CIPPTestResultsTenants.ps1
+++ b/Modules/CIPPCore/Public/Get-CIPPTestResultsTenants.ps1
@@ -20,7 +20,7 @@ function Get-CIPPTestResultsTenants {
         One or more test IDs (the row's RowKey), e.g. 'CustomScript-<guid>'.
 
     .PARAMETER Status
-        One or more statuses to filter on (Passed / Failed / Investigate / Skipped / Informational).
+        One or more statuses to filter on (Passed / Failed / Investigate / Skipped / Informational / Unlicensed).
 
     .PARAMETER TestType
         Restrict to a single test type (Identity / Devices / Custom).
@@ -302,6 +302,7 @@ function Get-CIPPTestResultsTenants {
             'Investigate' { $Counts['Investigate']++ }
             'Skipped' { $Counts['Skipped']++ }
             'Informational' { $Counts['Informational']++ }
+            'Unlicensed' { $Counts['Informational']++ }
         }
 
         if ($RowStatusSet -and -not $RowStatusSet.Contains($StatusValue)) { continue }
diff --git a/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1 b/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1
index 76b010f8bb364..75be0a5612ab6 100644
--- a/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1
+++ b/Modules/CIPPCore/Public/Get-CippTestDataFieldManifest.ps1
@@ -106,7 +106,8 @@ function Get-CippTestDataFieldManifest {
             'ExoHostedOutboundSpamFilterPolicy'  = @('Identity', 'IsDefault', 'RecipientLimitExternalPerHour', 'RecipientLimitInternalPerHour', 'RecipientLimitPerDay', 'ActionWhenThresholdReached', 'NotifyOutboundSpam', 'NotifyOutboundSpamRecipients', 'BccSuspiciousOutboundMail', 'BccSuspiciousOutboundAdditionalRecipients', 'AutoForwardingMode')
             'ExoInboundConnector'                = @('Identity', 'Enabled', 'SenderDomains', 'EFSkipLastIP', 'EFSkipIPs', 'EFTestMode', 'EFUsers')
             'ExoMalwareFilterPolicies'           = @('Name', 'Identity', 'IsDefault', 'EnableFileFilter', 'FileTypes', 'EnableInternalSenderAdminNotifications', 'InternalSenderAdminAddress', 'ZapEnabled', 'Action', 'RecipientDomainIs')
-            'ExoOrganizationConfig'              = @('CustomerLockBoxEnabled', 'BookingsEnabled', 'AuditDisabled', 'ExternalInOutlookEnabled', 'ExternalInOutlook', 'OAuth2ClientProfileEnabled', 'MailTipsAllTipsEnabled', 'MailTipsExternalRecipientsTipsEnabled', 'MailTipsGroupMetricsEnabled', 'MailTipsLargeAudienceThreshold', 'RejectDirectSend')
+            'ExoExternalInOutlook'               = @('Identity', 'Enabled', 'AllowList')
+            'ExoOrganizationConfig'              = @('CustomerLockBoxEnabled', 'BookingsEnabled', 'AuditDisabled', 'OAuth2ClientProfileEnabled', 'MailTipsAllTipsEnabled', 'MailTipsExternalRecipientsTipsEnabled', 'MailTipsGroupMetricsEnabled', 'MailTipsLargeAudienceThreshold', 'RejectDirectSend')
             'ExoPresetSecurityPolicy'            = @('Identity', 'State', 'ImpersonationProtectionState', 'EnableMailboxIntelligence', 'EnableMailboxIntelligenceProtection', 'EnableSimilarUsersSafetyTips', 'EnableSimilarDomainsSafetyTips', 'EnableUnusualCharactersSafetyTips')
             'ExoProtectionAlert'                 = @('Name', 'Disabled')
             'ExoRemoteDomain'                    = @('Name', 'DomainName', 'AutoForwardEnabled')
diff --git a/Modules/CIPPCore/Public/Get-CippTestSuitePatterns.ps1 b/Modules/CIPPCore/Public/Get-CippTestSuitePatterns.ps1
index a96ca716460f6..107183429cac4 100644
--- a/Modules/CIPPCore/Public/Get-CippTestSuitePatterns.ps1
+++ b/Modules/CIPPCore/Public/Get-CippTestSuitePatterns.ps1
@@ -30,5 +30,6 @@ function Get-CippTestSuitePatterns {
         CopilotReadiness = 'Invoke-CippTestCopilotReady*'
         GenericTests     = 'Invoke-CippTestGenericTest*'
         E8               = 'Invoke-CippTestE8_*'
+        SecuritySimulations = 'Invoke-CippTestSecuritySimulation_*'
     }
 }
diff --git a/Modules/CIPPCore/Public/Get-DefenderTvmExportUrls.ps1 b/Modules/CIPPCore/Public/Get-DefenderTvmExportUrls.ps1
new file mode 100644
index 0000000000000..cc16dbb0762b4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Get-DefenderTvmExportUrls.ps1
@@ -0,0 +1,38 @@
+function Get-DefenderTvmExportUrls {
+    <#
+    .SYNOPSIS
+        Returns the Defender TVM software-vulnerabilities export file URLs for a tenant, cached.
+    .DESCRIPTION
+        Calls SoftwareVulnerabilitiesExport (rate-limited to 20/hour) and caches the returned SAS blob
+        URLs so any consumer in the app can reuse them until they near expiry. sasValidHours=6, so a
+        cached set is reused for MaxAgeHours (default 5) before a fresh call is made.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$TenantId,
+        [int]$MaxAgeHours = 5,
+        [switch]$Force
+    )
+
+    $Table = Get-CIPPTable -TableName 'CacheDefenderTvmExport'
+
+    if (-not $Force) {
+        $Row = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'TvmExport' and RowKey eq '$TenantId'"
+        if ($Row -and $Row.Cached -and ([datetime]$Row.Cached) -gt (Get-Date).ToUniversalTime().AddHours(-$MaxAgeHours)) {
+            return @($Row.ExportFiles | ConvertFrom-Json)
+        }
+    }
+
+    $Export = New-GraphGetRequest -tenantid $TenantId -uri 'https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilitiesExport?sasValidHours=6' -scope 'https://api.securitycenter.microsoft.com/.default'
+    $Files = @($Export.exportFiles)
+
+    Add-CIPPAzDataTableEntity @Table -Entity @{
+        PartitionKey  = 'TvmExport'
+        RowKey        = $TenantId
+        ExportFiles   = "$($Files | ConvertTo-Json -Compress)"
+        GeneratedTime = "$($Export.generatedTime)"
+        Cached        = (Get-Date).ToUniversalTime().ToString('o')
+    } -Force
+
+    return $Files
+}
diff --git a/Modules/CIPPCore/Public/Get-DefenderTvmRaw.ps1 b/Modules/CIPPCore/Public/Get-DefenderTvmRaw.ps1
index c09e88666c22a..1f9d0ee40dddc 100644
--- a/Modules/CIPPCore/Public/Get-DefenderTvmRaw.ps1
+++ b/Modules/CIPPCore/Public/Get-DefenderTvmRaw.ps1
@@ -1,86 +1,52 @@
 function Get-DefenderTvmRaw {
     <#
     .SYNOPSIS
-        Fetch Defender TVM SoftwareVulnerabilitiesByMachine with paging.
-    .PARAMETER TenantId
-        Microsoft Entra tenant id to query.
-    .PARAMETER MaxPages
-        Optional page cap (0 = no cap).
-    .PARAMETER Stream
-        Emit records straight to the pipeline instead of buffering the whole tenant
-        dataset into a list. Peak memory becomes one page rather than every record,
-        so use this when the consumer folds records as they arrive rather than
-        indexing the result (see Set-CIPPDBCacheDefenderCVEs). The buffered default
-        is unchanged. Trade-off: on a mid-pagination failure, records already emitted
-        have flowed downstream before the throw.
+        Stream Defender TVM software-vulnerabilities-per-device via the export (gzip files) API.
+    .DESCRIPTION
+        Uses the "via files" export only: cached SAS URLs (Get-DefenderTvmExportUrls) to GZIP
+        multiline-JSON files, stream-decompressed one record at a time. Peak memory is ~one record
+        plus the consumer's aggregate, independent of tenant size. Pass -Stream to emit to the
+        pipeline (the fold consumers do); without it, records are buffered into a list.
     #>
     [CmdletBinding()]
     param(
         [Parameter(Mandatory)][string]$TenantId,
-        [int]$MaxPages = 0,
         [switch]$Stream
     )
 
-    $scope = 'https://api.securitycenter.microsoft.com/.default'
-    $uri   = 'https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilitiesByMachine'
-    $all   = New-Object System.Collections.Generic.List[object]
-    $page  = 0
-
     try {
-        if ($Stream) {
-            Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message 'Streaming Defender TVM fetch' -Sev 'Debug'
-            New-GraphGetRequest -tenantid $TenantId -uri $uri -scope $scope -Stream
+        $Files = Get-DefenderTvmExportUrls -TenantId $TenantId
+        if (-not $Files -or $Files.Count -eq 0) {
+            Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message 'No export files returned from Defender TVM' -Sev 'Warning'
             return
         }
 
-        # New-GraphGetRequest already follows @odata.nextLink internally and returns the
-        # flattened .value rows for every page, so this loop only ever runs once and
-        # $MaxPages never takes effect. Both in-repo callers (get-DefenderCVEs and
-        # Set-CIPPDBCacheDefenderCVEs) now pass -Stream, so this buffered path is kept only
-        # for ad-hoc use - it holds the whole tenant dataset, so don't put it back on a hot
-        # path.
-        do {
-            Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message "Fetching page $($page + 1)" -Sev 'Debug'
-
-            $resp = New-GraphGetRequest -tenantid $TenantId -uri $uri -scope $scope
-
-            if ($resp -is [System.Collections.IDictionary]) {
-                if ($resp.ContainsKey('value')) {
-                    $rows     = $resp.value
-                    $nextLink = $resp.'@odata.nextLink'
-                    if ($rows) { $all.AddRange($rows) }
-                    $uri = $nextLink
-                    Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message "Page $($page + 1): $($rows.Count) records" -Sev 'Debug'
+        $Buffer = if ($Stream) { $null } else { [System.Collections.Generic.List[object]]::new() }
+        $Client = [System.Net.Http.HttpClient]::new()
+        $Client.Timeout = [TimeSpan]::FromMinutes(30)
+        try {
+            foreach ($Url in $Files) {
+                $NetStream = $Client.GetStreamAsync($Url).GetAwaiter().GetResult()
+                $Gzip = [System.IO.Compression.GZipStream]::new($NetStream, [System.IO.Compression.CompressionMode]::Decompress)
+                $Reader = [System.IO.StreamReader]::new($Gzip)
+                try {
+                    while ($null -ne ($Line = $Reader.ReadLine())) {
+                        if (-not $Line) { continue }
+                        $Record = $Line | ConvertFrom-Json
+                        if ($Stream) { $Record } else { $Buffer.Add($Record) }
+                    }
+                } finally {
+                    $Reader.Dispose(); $Gzip.Dispose(); $NetStream.Dispose()
                 }
-                else {
-                    $all.Add($resp)
-                    $uri = $null
-                }
-            }
-            elseif ($resp -is [System.Collections.IEnumerable] -and $resp -isnot [string]) {
-                $all.AddRange($resp)
-                $uri = $null
-            }
-            else {
-                $all.Add($resp)
-                $uri = $null
             }
+        } finally {
+            $Client.Dispose()
+        }
 
-            $page++
-
-            if ($page -gt 100) {
-                Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message "Reached 100 page safety limit — stopping" -Sev 'Warning'
-                break
-            }
-
-        } while ($uri -and ($MaxPages -eq 0 -or $page -lt $MaxPages))
-
-        Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message "Defender TVM fetch complete: $($all.Count) records across $page page(s)" -Sev 'Info'
-        return $all
-    }
-    catch {
+        if (-not $Stream) { return $Buffer }
+    } catch {
         $Sev = if (Test-CIPPCacheCapabilityError -Message $_.Exception.Message) { 'Debug' } else { 'Error' }
-        Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message "Error on page $page`: $($_.Exception.Message)" -Sev $Sev
+        Write-LogMessage -API 'DefenderTVM' -tenant $TenantId -message "Error: $($_.Exception.Message)" -Sev $Sev
         throw
     }
 }
diff --git a/Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1 b/Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1
new file mode 100644
index 0000000000000..e35dec649e447
--- /dev/null
+++ b/Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1
@@ -0,0 +1,56 @@
+function Get-CIPPTemplateContentHash {
+    <#
+    .SYNOPSIS
+        Computes a deterministic content hash for a template JSON blob.
+    .DESCRIPTION
+        Drops the fields that change without a real content edit (tenantFilter,
+        excludedTenants, updatedAt/updatedBy, createdAt), then canonicalises the
+        remaining object (object keys sorted ordinal, arrays kept in order) before
+        hashing, so the same content hashes equal regardless of key order.
+    .OUTPUTS
+        Lowercase SHA256 hex string, or $null for empty/unparsable input.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [string]$JSON
+    )
+
+    if ([string]::IsNullOrWhiteSpace($JSON)) { return $null }
+
+    try {
+        $Data = $JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+    } catch {
+        return $null
+    }
+
+    function Get-CIPPCanonicalValue {
+        param($Value)
+
+        if ($null -eq $Value) { return $null }
+
+        if ($Value -is [System.Collections.IEnumerable] -and $Value -isnot [string]) {
+            return @($Value | ForEach-Object { Get-CIPPCanonicalValue -Value $_ })
+        }
+
+        if ($Value -is [PSCustomObject] -or $Value -is [System.Collections.IDictionary]) {
+            $Ordered = [ordered]@{}
+            $Keys = @(if ($Value -is [System.Collections.IDictionary]) { $Value.Keys } else { $Value.PSObject.Properties.Name })
+            [array]::Sort($Keys, [System.StringComparer]::Ordinal)
+            foreach ($Key in $Keys) {
+                if ($Key -in @('tenantFilter', 'excludedTenants', 'updatedAt', 'updatedBy', 'createdAt')) { continue }
+                $Ordered[$Key] = Get-CIPPCanonicalValue -Value $Value.$Key
+            }
+            return $Ordered
+        }
+
+        return $Value
+    }
+
+    $Canonical = Get-CIPPCanonicalValue -Value $Data
+    $CompactJSON = $Canonical | ConvertTo-Json -Depth 100 -Compress
+    $Bytes = [System.Text.Encoding]::UTF8.GetBytes($CompactJSON)
+    $HashBytes = [System.Security.Cryptography.SHA256]::HashData($Bytes)
+    -join ($HashBytes | ForEach-Object { $_.ToString('x2') })
+}
diff --git a/Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateSourceUrl.ps1 b/Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateSourceUrl.ps1
new file mode 100644
index 0000000000000..da2f2950d76e9
--- /dev/null
+++ b/Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateSourceUrl.ps1
@@ -0,0 +1,36 @@
+function Get-CIPPTemplateSourceUrl {
+    <#
+    .SYNOPSIS
+        Builds the GitHub URL for a synced template's source file.
+    .DESCRIPTION
+        The frontend cannot guess a template's repo path: the scheduled sync matches
+        files by sanitised filename anywhere in the tree, so the path is only known at
+        import/push time and stored as SourcePath. This resolves the branch to link
+        against from the CommunityRepos row (UploadBranch, falling back to
+        DefaultBranch, then 'main').
+    .OUTPUTS
+        string or $null
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [string]$Source,
+        [string]$SourcePath,
+        [array]$Repos
+    )
+
+    if ([string]::IsNullOrEmpty($Source)) { return $null }
+
+    if (-not $Repos) {
+        $RepoTable = Get-CIPPTable -TableName CommunityRepos
+        $Repos = @(Get-CIPPAzDataTableEntity @RepoTable -Filter "PartitionKey eq 'CommunityRepos'")
+    }
+    $RepoEntity = $Repos | Where-Object { $_.FullName -eq $Source } | Select-Object -First 1
+    $Branch = $RepoEntity.UploadBranch ?? $RepoEntity.DefaultBranch ?? 'main'
+
+    if ([string]::IsNullOrEmpty($SourcePath)) {
+        return "https://github.com/$Source"
+    }
+    "https://github.com/$Source/blob/$Branch/$SourcePath"
+}
diff --git a/Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1 b/Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1
new file mode 100644
index 0000000000000..a935cf4f46b75
--- /dev/null
+++ b/Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1
@@ -0,0 +1,90 @@
+function Push-CIPPBaselineToRepo {
+    <#
+    .SYNOPSIS
+        Pushes a baseline and its related templates to a community repository.
+    .DESCRIPTION
+        The body behind the UploadBaseline action of Invoke-ExecCommunityRepo, extracted so
+        the save endpoints can push right after a save. A baseline is not a templates-table
+        row: Export-CIPPBaselineTemplate assembles the portable set - the BaselineTemplate
+        file plus one standard template file per referenced CA/Intune template. Every pushed
+        file is stamped with its returned blob SHA and the repo FullName: related templates
+        on their templates row, the baseline itself on its rollout row.
+    .OUTPUTS
+        @{ resultText = <string>; state = 'success' | 'error' }
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$GUID,
+        [Parameter(Mandatory)][string]$FullName,
+        [string]$Message,
+        [string]$Branch
+    )
+
+    if (-not $Branch) {
+        $RepoTable = Get-CIPPTable -TableName CommunityRepos
+        $RepoEntity = Get-CIPPAzDataTableEntity @RepoTable -Filter "PartitionKey eq 'CommunityRepos' and FullName eq '$($FullName)'"
+        $Branch = $RepoEntity.UploadBranch ?? $RepoEntity.DefaultBranch
+    }
+
+    $Export = Export-CIPPBaselineTemplate -GUID $GUID
+    if (-not $Export) {
+        return @{
+            resultText = "Baseline '$($GUID)' not found"
+            state      = 'error'
+        }
+    }
+
+    $TemplateTable = Get-CIPPTable -TableName templates
+    foreach ($TemplateEntity in $Export.Templates) {
+        $TemplateJson = $(try { $TemplateEntity.JSON | ConvertFrom-Json -Depth 100 } catch { $null })
+        $DisplayName = "$($TemplateJson.Displayname ?? $TemplateJson.displayName ?? $TemplateJson.name ?? $TemplateEntity.RowKey)"
+        $Basename = $DisplayName -replace '\s', '_' -replace '[^\w\d_]', ''
+        $Path = '{0}/{1}.json' -f $TemplateEntity.PartitionKey, $Basename
+        $PushResult = Push-GitHubContent -FullName $FullName -Path $Path -Content ($TemplateEntity | ConvertTo-Json -Depth 100) -Message $Message -Branch $Branch
+        # A push that returns no blob sha did not land (integration disabled, or no write access).
+        if (-not $PushResult.content.sha) {
+            return @{
+                resultText = "Template '$DisplayName' was not pushed to $FullName. Check the GitHub integration and that the repository is writable."
+                state      = 'error'
+            }
+        }
+        $TemplateStamp = @{
+            PartitionKey = $TemplateEntity.PartitionKey
+            RowKey       = $TemplateEntity.RowKey
+            SHA          = [string]$PushResult.content.sha
+            Source       = $FullName
+            SourcePath   = $Path
+        }
+        # ContentHash powers hasLocalChanges, which is only exposed for standards templates.
+        if ($TemplateEntity.PartitionKey -eq 'StandardsTemplateV2') {
+            $TemplateStamp.ContentHash = Get-CIPPTemplateContentHash -JSON $TemplateEntity.JSON
+        }
+        Add-CIPPAzDataTableEntity @TemplateTable -Entity $TemplateStamp -OperationType UpsertMerge
+    }
+
+    $BaselineBasename = "$($Export.Baseline.templateName)" -replace '\s', '_' -replace '[^\w\d_]', ''
+    $BaselinePath = 'BaselineTemplate/{0}.json' -f $BaselineBasename
+    $BaselinePushResult = Push-GitHubContent -FullName $FullName -Path $BaselinePath -Content ($Export.Baseline | ConvertTo-Json -Depth 100) -Message $Message -Branch $Branch
+    if (-not $BaselinePushResult.content.sha) {
+        return @{
+            resultText = "Baseline '$($Export.Baseline.templateName)' was not pushed to $FullName. Check the GitHub integration and that the repository is writable."
+            state      = 'error'
+        }
+    }
+    $RolloutTable = Get-CIPPTable -TableName BaselineRollouts
+    Add-CIPPAzDataTableEntity @RolloutTable -Entity @{
+        PartitionKey = 'rollout'
+        RowKey       = "$GUID"
+        SHA          = [string]$BaselinePushResult.content.sha
+        Source       = $FullName
+        SourcePath   = $BaselinePath
+        LocalChanges = $false
+    } -OperationType UpsertMerge
+
+    @{
+        resultText = "Baseline '$($Export.Baseline.templateName)' uploaded with $(@($Export.Templates).Count) related template$(if (@($Export.Templates).Count -eq 1) { '' } else { 's' })"
+        state      = 'success'
+    }
+}
diff --git a/Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1 b/Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1
new file mode 100644
index 0000000000000..58c88d9940004
--- /dev/null
+++ b/Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1
@@ -0,0 +1,74 @@
+function Push-CIPPTemplateToRepo {
+    <#
+    .SYNOPSIS
+        Pushes a standards template to a community repository.
+    .DESCRIPTION
+        The body behind the UploadTemplate action of Invoke-ExecCommunityRepo, extracted so
+        the save endpoints can push right after a save. On a successful push, stamps the
+        templates row with the returned blob SHA and the repo FullName so the scheduled sync
+        recognises this as the current copy instead of re-importing it as new.
+    .OUTPUTS
+        @{ resultText = <string>; state = 'success' | 'error' }
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)]$GUID,
+        [Parameter(Mandatory)][string]$FullName,
+        [string]$Message,
+        [string]$Branch
+    )
+
+    $TemplateTable = Get-CIPPTable -TableName templates
+    $TemplateEntity = Get-CIPPAzDataTableEntity @TemplateTable -Filter "RowKey eq '$($GUID)' or OriginalEntityId eq '$($GUID)'" | Select-Object -ExcludeProperty ETag, Timestamp
+    if (-not $TemplateEntity) {
+        return @{
+            resultText = "Template '$($GUID)' not found"
+            state      = 'error'
+        }
+    }
+
+    if (-not $Branch) {
+        $RepoTable = Get-CIPPTable -TableName CommunityRepos
+        $RepoEntity = Get-CIPPAzDataTableEntity @RepoTable -Filter "PartitionKey eq 'CommunityRepos' and FullName eq '$($FullName)'"
+        $Branch = $RepoEntity.UploadBranch ?? $RepoEntity.DefaultBranch
+    }
+
+    $Template = $TemplateEntity.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+    $DisplayName = $Template.Displayname ?? $Template.templateName ?? $Template.name
+    if ($Template.tenantFilter) {
+        $Template.tenantFilter = @(@{ label = 'Template Tenant'; value = 'Template Tenant' })
+    }
+    if ($Template.excludedTenants) {
+        $Template.excludedTenants = @()
+    }
+    $TemplateEntity.JSON = $Template | ConvertTo-Json -Compress -Depth 100
+    $ContentHash = Get-CIPPTemplateContentHash -JSON $TemplateEntity.JSON
+
+    $Basename = $DisplayName -replace '\s', '_' -replace '[^\w\d_]', ''
+    $Path = '{0}/{1}.json' -f $TemplateEntity.PartitionKey, $Basename
+    # Pretty-printed, not compressed: repo files are hand-edited on GitHub.
+    $PushResult = Push-GitHubContent -FullName $FullName -Path $Path -Content ($TemplateEntity | ConvertTo-Json -Depth 100) -Message $Message -Branch $Branch
+
+    # A push that returns no blob sha did not land (integration disabled, or no write access).
+    if (-not $PushResult.content.sha) {
+        return @{
+            resultText = "Template '$($DisplayName)' was not pushed to $FullName. Check the GitHub integration and that the repository is writable."
+            state      = 'error'
+        }
+    }
+    Add-CIPPAzDataTableEntity @TemplateTable -Entity @{
+        PartitionKey = $TemplateEntity.PartitionKey
+        RowKey       = $TemplateEntity.RowKey
+        SHA          = [string]$PushResult.content.sha
+        Source       = $FullName
+        SourcePath   = $Path
+        ContentHash  = $ContentHash
+    } -OperationType UpsertMerge
+
+    @{
+        resultText = "Template '$($DisplayName)' uploaded"
+        state      = 'success'
+    }
+}
diff --git a/Modules/CIPPCore/Public/GitHub/Test-CIPPRepoSource.ps1 b/Modules/CIPPCore/Public/GitHub/Test-CIPPRepoSource.ps1
new file mode 100644
index 0000000000000..22b38b81a4a8d
--- /dev/null
+++ b/Modules/CIPPCore/Public/GitHub/Test-CIPPRepoSource.ps1
@@ -0,0 +1,17 @@
+function Test-CIPPRepoSource {
+    <#
+    .SYNOPSIS
+        True when a template's Source column names a GitHub repository (owner/repo).
+    .DESCRIPTION
+        The Source column is also used for other provenance markers, such as the baseline
+        migration's 'StandardsTemplateV2:<guid>' and tenant-sourced templates, which must not
+        read as repository syncs.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param([string]$Source)
+
+    return ($Source -match '^[\w.-]+/[\w.-]+$')
+}
diff --git a/Modules/CIPPCore/Public/GraphHelper/Add-CippQueueMessage.ps1 b/Modules/CIPPCore/Public/GraphHelper/Add-CippQueueMessage.ps1
index abb87f07468f0..6915fdd1b753b 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Add-CippQueueMessage.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Add-CippQueueMessage.ps1
@@ -15,7 +15,7 @@ function Add-CippQueueMessage {
         Defaults to P2 when called from an HTTP request (user-initiated work skips the queue) and
         P5 otherwise.
     .EXAMPLE
-        Add-CippQueueMessage -Cmdlet 'Start-BPAOrchestrator' -Parameters @{ TenantFilter = 'AllTenants'; Force = $true }
+        Add-CippQueueMessage -Cmdlet 'Start-UserTasksOrchestrator' -Parameters @{ TaskId = $RowKey }
     .FUNCTIONALITY
         Internal
     #>
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-CIPPActiveAlertSnoozes.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-CIPPActiveAlertSnoozes.ps1
new file mode 100644
index 0000000000000..418b5e060d737
--- /dev/null
+++ b/Modules/CIPPCore/Public/GraphHelper/Get-CIPPActiveAlertSnoozes.ps1
@@ -0,0 +1,73 @@
+function Get-CIPPActiveAlertSnoozes {
+    <#
+    .SYNOPSIS
+        Return the active snooze records for one alert cmdlet in one tenant, keyed by content hash.
+    .DESCRIPTION
+        Reads the AlertSnooze table for the cmdlet and tenant, keeps the snoozes that are still in
+        effect (timed ones that have not expired, and "until resolved" ones) and returns them as a
+        hashtable of ContentHash to snooze record. Timed snoozes that expired more than 30 days ago
+        are removed while we are here, so the table does not grow without bound.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$CmdletName,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    $Active = @{}
+    $SnoozeTable = Get-CIPPTable -tablename 'AlertSnooze'
+
+    try {
+        $SafeCmdlet = ConvertTo-CIPPODataFilterValue -Value $CmdletName -Type String
+        $SnoozeRecords = Get-CIPPAzDataTableEntity @SnoozeTable -Filter "PartitionKey eq '$SafeCmdlet'" | Where-Object {
+            $_.Tenant -eq $TenantFilter
+        }
+    } catch {
+        Write-Information "Failed to query AlertSnooze table: $($_.Exception.Message). Treating nothing as snoozed."
+        return $Active
+    }
+
+    if (-not $SnoozeRecords) { return $Active }
+
+    $CurrentUnixTime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
+    $ThirtyDaysAgo = $CurrentUnixTime - (30 * 86400)
+    $RecordsToCleanup = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Record in @($SnoozeRecords)) {
+        if ([string]$Record.UntilResolved -eq 'True') {
+            $Active[[string]$Record.ContentHash] = $Record
+            continue
+        }
+        $SnoozeUntil = ([string]$Record.SnoozeUntil) -as [int64]
+        if ($null -eq $SnoozeUntil -or $SnoozeUntil -le 0) {
+            # Legacy or malformed row with no usable expiry: treat as lapsed rather than silently muting forever.
+            $RecordsToCleanup.Add($Record)
+        } elseif ($SnoozeUntil -gt $CurrentUnixTime) {
+            $Active[[string]$Record.ContentHash] = $Record
+        } elseif ($SnoozeUntil -lt $ThirtyDaysAgo) {
+            $RecordsToCleanup.Add($Record)
+        }
+    }
+
+    if ($RecordsToCleanup.Count -gt 0) {
+        try {
+            foreach ($Stale in $RecordsToCleanup) {
+                Remove-CIPPAzDataTableEntity @SnoozeTable -Entity @{
+                    PartitionKey = $Stale.PartitionKey
+                    RowKey       = $Stale.RowKey
+                    ETag         = '*'
+                } | Out-Null
+            }
+            Write-Information "Cleaned up $($RecordsToCleanup.Count) expired snooze records for $CmdletName / $TenantFilter"
+        } catch {
+            Write-Information "Failed to clean up expired snooze records: $($_.Exception.Message)"
+        }
+    }
+
+    return $Active
+}
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-CIPPAlertLifecycleKey.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-CIPPAlertLifecycleKey.ps1
new file mode 100644
index 0000000000000..ba61241bfe1f2
Binary files /dev/null and b/Modules/CIPPCore/Public/GraphHelper/Get-CIPPAlertLifecycleKey.ps1 differ
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-CIPPOmaSettingDecryptedValue.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-CIPPOmaSettingDecryptedValue.ps1
index 206f37feffcd4..4d77df20a00d0 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Get-CIPPOmaSettingDecryptedValue.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Get-CIPPOmaSettingDecryptedValue.ps1
@@ -97,6 +97,7 @@ function Get-CIPPOmaSettingDecryptedValue {
                     }
                 } catch {
                     Write-Warning "Error decrypting OMA setting '$($omaSetting.displayName)': $($_.Exception.Message)"
+                    Write-LogMessage -API 'IntunePolicy' -tenant $TenantFilter -message "Could not decrypt OMA-URI setting '$($omaSetting.displayName)' in '$($DeviceConfiguration.displayName)': $(Get-NormalizedError -Message $_.Exception.Message)" -sev Warning
                     # Continue with other settings even if one fails
                 }
             }
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-CippSamPermissions.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-CippSamPermissions.ps1
index 8391eaa00b980..313019b8bf290 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Get-CippSamPermissions.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Get-CippSamPermissions.ps1
@@ -12,11 +12,12 @@ function Get-CippSamPermissions {
     The effective set returned in .Permissions is therefore always manifest ∪ extras. Each permission
     is annotated with a 'required' boolean so the UI can lock the manifest-defined defaults.
 
-    Unless -NoDiff is used, the function also reads what is actually granted on the CIPP-SAM enterprise
-    application (service principal) in the partner tenant - appRoleAssignments (application/Role) and
-    oauth2PermissionGrants (delegated/Scope) - and diffs those grants against the effective set,
+    Unless -NoDiff is used, the function reads what is actually granted on the CIPP-SAM enterprise
+    application (service principal) in the partner tenant: appRoleAssignments (application/Role) and
+    oauth2PermissionGrants (delegated/Scope). It diffs those grants against the effective set,
     surfacing permissions that need to be granted (MissingPermissions) and grants that are present but
     not in the effective set (PartnerAppDiff). The app registration's requiredResourceAccess is not used.
+    If the grant lookup fails, GrantCheckFailed is set to $true and GrantCheckError contains the error message.
 
     .EXAMPLE
     Get-CippSamPermissions
@@ -197,44 +198,92 @@ function Get-CippSamPermissions {
         }
     }
 
-    # Diff the manifest-required base against the saved AppPermissions table. The table records what has
-    # been applied to the CIPP-SAM app - the repair/update flow persists it as manifest ∪ extras - so it
-    # stands in for the "current" permission set and no partner-tenant Graph call is needed here.
-    # MissingPermissions = manifest-required perms not yet present in the table (a Permissions repair is needed).
-    # PartnerAppDiff mirrors MissingPermissions in the shape the SAM permissions page expects.
+    # Diff the effective set against what is actually GRANTED on the partner CIPP-SAM enterprise
+    # application (service principal): appRoleAssignments for application (Role) permissions and
+    # oauth2PermissionGrants for delegated (Scope) permissions. The app registration's
+    # requiredResourceAccess is intentionally NOT used - permissions are applied as SP grants, so the
+    # grants are the real source of truth for what the app can do.
+    # MissingPermissions = effective perms not yet granted on the SP (need to be added).
+    # PartnerAppDiff also surfaces extra grants on the SP that are not in the effective set.
     $MissingPermissions = @{}
     $PartnerAppDiff = @{}
+    $GrantCheckFailed = $false
+    $GrantCheckError = ''
     if (!$NoDiff.IsPresent) {
-        foreach ($AppId in $AllAppIds) {
-            $ManifestApp = $ManifestPermissions.$AppId
-            $SavedApp = $SavedPermissions.$AppId
+        try {
+            $PartnerSP = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals(appId='$($env:ApplicationID)')?`$select=id" -tenantid $env:TenantID -NoAuthCheck $true
+            $AppRoleAssignments = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals/$($PartnerSP.id)/appRoleAssignments?`$top=999" -tenantid $env:TenantID -NoAuthCheck $true
+            $OAuthGrants = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/servicePrincipals/$($PartnerSP.id)/oauth2PermissionGrants?`$top=999" -tenantid $env:TenantID -NoAuthCheck $true
+
+            # Grants reference the resource SP's object id; map it back to the resource appId the
+            # effective set is keyed on. Use $UsedServicePrincipals - it carries both id and appId
+            # ($ServicePrincipals is selected without id, so its .id is null).
+            $ResourceIdToAppId = @{}
+            foreach ($SP in $UsedServicePrincipals) { if ($SP.id) { $ResourceIdToAppId[$SP.id] = $SP.appId } }
+
+            # Granted application roles (GUIDs) per resource appId.
+            $GrantedRoleIdsByApp = @{}
+            foreach ($Assignment in $AppRoleAssignments) {
+                $ResAppId = $ResourceIdToAppId[$Assignment.resourceId]
+                if (!$ResAppId -or !$Assignment.appRoleId) { continue }
+                if (-not $GrantedRoleIdsByApp.ContainsKey($ResAppId)) { $GrantedRoleIdsByApp[$ResAppId] = [System.Collections.Generic.List[string]]::new() }
+                $GrantedRoleIdsByApp[$ResAppId].Add([string]$Assignment.appRoleId)
+            }
 
-            $SavedAppIds = @($SavedApp.applicationPermissions.id)
-            $SavedDelIds = @($SavedApp.delegatedPermissions.id)
+            # Granted delegated scope NAMES per resource appId (oauth2 grants store space-delimited names).
+            $GrantedScopesByApp = @{}
+            foreach ($Grant in $OAuthGrants) {
+                $ResAppId = $ResourceIdToAppId[$Grant.resourceId]
+                if (!$ResAppId) { continue }
+                if (-not $GrantedScopesByApp.ContainsKey($ResAppId)) { $GrantedScopesByApp[$ResAppId] = [System.Collections.Generic.List[string]]::new() }
+                foreach ($ScopeName in @(($Grant.scope -split ' ') | Where-Object { $_ })) { $GrantedScopesByApp[$ResAppId].Add($ScopeName) }
+            }
 
-            $MissingApp = @(foreach ($Permission in $ManifestApp.applicationPermissions) {
-                    if ($Permission.id -and $SavedAppIds -notcontains $Permission.id) {
-                        [PSCustomObject]@{ id = $Permission.id; value = $Permission.value }
-                    }
-                })
-            $MissingDel = @(foreach ($Permission in $ManifestApp.delegatedPermissions) {
-                    if ($Permission.id -and $SavedDelIds -notcontains $Permission.id) {
-                        [PSCustomObject]@{ id = $Permission.id; value = $Permission.value }
+            foreach ($AppId in $AllAppIds) {
+                $ServicePrincipal = $ServicePrincipals | Where-Object -Property appId -EQ $AppId
+                $GrantedRoleIds = @($GrantedRoleIdsByApp[$AppId] | Where-Object { $_ })
+                $GrantedScopeNames = @($GrantedScopesByApp[$AppId] | Where-Object { $_ })
+
+                # Application (Role) permissions compare by GUID against appRoleAssignments.
+                $EffApp = @($EffectivePermissions.$AppId.applicationPermissions | Where-Object { $_.id -match $GuidRegex })
+                # Delegated (Scope) permissions compare by NAME (value) against oauth2 grant scopes -
+                # this covers both GUID-resolved scopes and the string-named AdditionalPermissions.
+                $EffDel = @($EffectivePermissions.$AppId.delegatedPermissions)
+                $EffAppIds = @($EffApp.id)
+                $EffDelNames = @($EffDel.value)
+
+                $MissingApp = @(foreach ($Permission in $EffApp) { if ($GrantedRoleIds -notcontains $Permission.id) { $Permission } })
+                $MissingDel = @(foreach ($Permission in $EffDel) { if ($Permission.value -and $GrantedScopeNames -notcontains $Permission.value) { $Permission } })
+                $ExtraApp = @(foreach ($Id in ($GrantedRoleIds | Sort-Object -Unique)) {
+                        if ($EffAppIds -notcontains $Id) {
+                            [PSCustomObject]@{ id = $Id; value = (($ServicePrincipal.appRoles | Where-Object -Property id -EQ $Id).value) ?? $Id }
+                        }
+                    })
+                $ExtraDel = @(foreach ($Name in ($GrantedScopeNames | Sort-Object -Unique)) {
+                        if ($EffDelNames -notcontains $Name) {
+                            [PSCustomObject]@{ id = $Name; value = $Name }
+                        }
+                    })
+
+                if ($MissingApp.Count -gt 0 -or $MissingDel.Count -gt 0) {
+                    $MissingPermissions.$AppId = @{
+                        applicationPermissions = $MissingApp
+                        delegatedPermissions   = $MissingDel
                     }
-                })
-
-            if ($MissingApp.Count -gt 0 -or $MissingDel.Count -gt 0) {
-                $MissingPermissions.$AppId = @{
-                    applicationPermissions = $MissingApp
-                    delegatedPermissions   = $MissingDel
                 }
-                $PartnerAppDiff.$AppId = @{
-                    missingApplicationPermissions = $MissingApp
-                    missingDelegatedPermissions   = $MissingDel
-                    extraApplicationPermissions   = @()
-                    extraDelegatedPermissions     = @()
+                if ($MissingApp.Count -gt 0 -or $MissingDel.Count -gt 0 -or $ExtraApp.Count -gt 0 -or $ExtraDel.Count -gt 0) {
+                    $PartnerAppDiff.$AppId = @{
+                        missingApplicationPermissions = $MissingApp
+                        missingDelegatedPermissions   = $MissingDel
+                        extraApplicationPermissions   = $ExtraApp
+                        extraDelegatedPermissions     = $ExtraDel
+                    }
                 }
             }
+        } catch {
+            Write-Information "Failed to retrieve partner enterprise app grants for permission diff: $($_.Exception.Message)"
+            $GrantCheckFailed = $true
+            $GrantCheckError = $_.Exception.Message
         }
     }
 
@@ -282,6 +331,8 @@ function Get-CippSamPermissions {
         Type                  = if ($HasSaved) { 'Table' } else { 'Manifest' }
         UpdatedBy             = $SavedRow.UpdatedBy ?? 'CIPP'
         Timestamp             = $Timestamp.ToString('yyyy-MM-ddTHH:mm:ssZ')
+        GrantCheckFailed      = $GrantCheckFailed
+        GrantCheckError       = $GrantCheckError
     }
 
     $SamAppPermissions = $SamAppPermissions | ConvertTo-Json -Depth 10 -Compress | ConvertFrom-Json
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-ClassicAPIToken.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-ClassicAPIToken.ps1
index f3375364c5b46..253e6ea98d4c7 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Get-ClassicAPIToken.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Get-ClassicAPIToken.ps1
@@ -37,7 +37,6 @@ function Get-ClassicAPIToken($tenantID, $Resource) {
             $Tenant = Get-CIPPAzDataTableEntity @TenantsTable -Filter $Filter
             if (!$Tenant) {
                 $Tenant = @{
-                    GraphErrorCount     = $null
                     LastGraphTokenError = $null
                     LastGraphError      = $null
                     PartitionKey        = 'TenantFailed'
@@ -45,7 +44,6 @@ function Get-ClassicAPIToken($tenantID, $Resource) {
                 }
             }
             $Tenant.LastGraphError = $_.Exception.Message
-            $Tenant.GraphErrorCount++
 
             Update-AzDataTableEntity -Force @TenantsTable -Entity $Tenant
             Throw "Failed to obtain Classic API Token for $TenantID - $_"
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-GraphToken.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-GraphToken.ps1
index 3e549741a2ab5..60250577fdf59 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Get-GraphToken.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Get-GraphToken.ps1
@@ -209,7 +209,6 @@ function Get-GraphToken {
             if (!$Tenant.RowKey) {
                 $donotset = $true
                 $Tenant = [pscustomobject]@{
-                    GraphErrorCount     = 0
                     LastGraphTokenError = ''
                     LastGraphError      = ''
                     PartitionKey        = 'TenantFailed'
@@ -226,7 +225,6 @@ function Get-GraphToken {
             } else {
                 $_.Exception.Message
             }
-            $Tenant.GraphErrorCount++
 
             if (!$donotset) { Update-AzDataTableEntity -Force @TenantsTable -Entity $Tenant }
             throw "Could not get token: $($Tenant.LastGraphError)"
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1
index 0b9c687bc2b42..fe2b344ef7702 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1
@@ -73,7 +73,7 @@ function Get-NormalizedError {
         '*AADSTS9002313*' { 'The credentials used to connect to the Graph API are not available, please retry. If this issue persists you may need to execute the SAM wizard.' }
         '*One or more platform(s) is/are not configured for the customer. Please configure the platform before trying to purchase a SKU.*' { 'One or more platform(s) is/are not configured for the customer. Please configure the platform before trying to purchase a SKU.' }
         "One or more added object references already exist for the following modified properties: 'members'." { 'This user is already a member of the selected group.' }
-        '*is not present in the role definition of the current user*' { 'We do not have permissions to access this resource, try performing a CPV refresh in Application Settings -> Permissions. ' }
+        '*is not present in the role definition of the current user*' { 'We do not have permissions to access this resource, try performing a CPV refresh in Application Settings -> Permissions or Try with AsApp: true' }
         default { $message }
 
     }
diff --git a/Modules/CIPPCore/Public/GraphHelper/Get-Tenants.ps1 b/Modules/CIPPCore/Public/GraphHelper/Get-Tenants.ps1
index 8c8680f7d43be..fb26c0d2b43eb 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Get-Tenants.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Get-Tenants.ps1
@@ -30,7 +30,7 @@ function Get-Tenants {
     } elseif ($IncludeErrors.IsPresent) {
         $Filter = "PartitionKey eq 'Tenants' and Excluded eq false"
     } else {
-        $Filter = "PartitionKey eq 'Tenants' and Excluded eq false and GraphErrorCount lt 50"
+        $Filter = "PartitionKey eq 'Tenants' and Excluded eq false"
     }
 
     if ($TenantFilter) {
@@ -60,30 +60,33 @@ function Get-Tenants {
     }
 
     if ($CleanOld.IsPresent) {
-        try {
-            $GDAPRelationships = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships?`$filter=status eq 'active'&`$select=customer,autoExtendDuration,endDateTime" -NoAuthCheck:$true
-            # Filter out MLT relationships locally
-            $GDAPRelationships = $GDAPRelationships | Where-Object { $_.displayName -notlike 'MLT_*' }
-            if (!$GDAPRelationships) {
-                Write-LogMessage -API 'Get-Tenants' -message 'Tried cleaning old tenants but failed to get GDAP relationships - No relationships returned' -Sev 'Critical'
-                throw 'Failed to get GDAP relationships for cleaning old tenants.'
+        # Only check GDAP relationships if there are GDAP-managed tenants to reconcile against - direct-tenant deployments have none.
+        $CurrentTenants = Get-CIPPAzDataTableEntity @TenantsTable -Filter "PartitionKey eq 'Tenants' and Excluded eq false and delegatedPrivilegeStatus ne 'directTenant'"
+        if (($CurrentTenants | Measure-Object).Count -gt 0) {
+            try {
+                $GDAPRelationships = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/tenantRelationships/delegatedAdminRelationships?`$filter=status eq 'active'&`$select=customer,autoExtendDuration,endDateTime" -NoAuthCheck:$true
+                # Filter out MLT relationships locally
+                $GDAPRelationships = $GDAPRelationships | Where-Object { $_.displayName -notlike 'MLT_*' }
+                if (!$GDAPRelationships) {
+                    Write-LogMessage -API 'Get-Tenants' -message 'Tried cleaning old tenants but failed to get GDAP relationships - No relationships returned' -Sev 'Critical'
+                    throw 'Failed to get GDAP relationships for cleaning old tenants.'
+                }
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-LogMessage -API 'Get-Tenants' -message "Tried cleaning old tenants but failed to get GDAP relationships - $($_.Exception.Message)" -Sev 'Critical' -LogData $ErrorMessage
+                throw $_
             }
-        } catch {
-            $ErrorMessage = Get-CippException -Exception $_
-            Write-LogMessage -API 'Get-Tenants' -message "Tried cleaning old tenants but failed to get GDAP relationships - $($_.Exception.Message)" -Sev 'Critical' -LogData $ErrorMessage
-            throw $_
-        }
-        $GDAPList = foreach ($Relationship in $GDAPRelationships) {
-            [PSCustomObject]@{
-                customerId      = $Relationship.customer.tenantId
-                displayName     = $Relationship.customer.displayName
-                autoExtend      = ($Relationship.autoExtendDuration -ne 'PT0S')
-                relationshipEnd = $Relationship.endDateTime
+            $GDAPList = foreach ($Relationship in $GDAPRelationships) {
+                [PSCustomObject]@{
+                    customerId      = $Relationship.customer.tenantId
+                    displayName     = $Relationship.customer.displayName
+                    autoExtend      = ($Relationship.autoExtendDuration -ne 'PT0S')
+                    relationshipEnd = $Relationship.endDateTime
+                }
+            }
+            $CurrentTenants | Where-Object { $_.customerId -notin $GDAPList.customerId -and $_.customerId -ne $env:TenantID } | ForEach-Object {
+                Remove-CIPPAzDataTableEntity -Force @TenantsTable -Entity $_
             }
-        }
-        $CurrentTenants = Get-CIPPAzDataTableEntity @TenantsTable -Filter "PartitionKey eq 'Tenants' and Excluded eq false and delegatedPrivilegeStatus ne 'directTenant'"
-        $CurrentTenants | Where-Object { $_.customerId -notin $GDAPList.customerId -and $_.customerId -ne $env:TenantID } | ForEach-Object {
-            Remove-CIPPAzDataTableEntity -Force @TenantsTable -Entity $_
         }
     }
     $PartnerModeTable = Get-CippTable -tablename 'tenantMode'
@@ -138,13 +141,6 @@ function Get-Tenants {
                 Write-Host "Alias found for $($_.Name) - $Alias."
             }
 
-            if ($TriggerRefresh.IsPresent -and $ExistingTenantInfo.customerId) {
-                # Reset error count
-                Write-Host "Resetting error count for $($_.Name)"
-                $ExistingTenantInfo.GraphErrorCount = 0
-                Add-CIPPAzDataTableEntity @TenantsTable -Entity $ExistingTenantInfo -Force | Out-Null
-            }
-
             # Re-read domains for a row last derived over 7 days ago even when it looks healthy: a custom
             # domain can be made default in M365 after onboarding with nothing here to signal it, and the
             # cache-hit branch below never re-reads domains. LastRefresh is stamped only on a real fetch.
@@ -229,7 +225,6 @@ function Get-Tenants {
                     Excluded                 = $false
                     ExcludeUser              = ''
                     ExcludeDate              = ''
-                    GraphErrorCount          = 0
                     LastGraphError           = ''
                     RequiresRefresh          = [bool]$RequiresRefresh
                     LastRefresh              = (Get-Date).ToUniversalTime()
@@ -259,7 +254,6 @@ function Get-Tenants {
                 Excluded          = $false
                 ExcludeUser       = ''
                 ExcludeDate       = ''
-                GraphErrorCount   = 0
                 LastGraphError    = ''
                 RequiresRefresh   = [bool]$RequiresRefresh
                 LastRefresh       = (Get-Date).ToUniversalTime()
@@ -290,7 +284,6 @@ function Get-Tenants {
                 Excluded          = $false
                 ExcludeUser       = ''
                 ExcludeDate       = ''
-                GraphErrorCount   = 0
                 LastGraphError    = ''
                 RequiresRefresh   = [bool]$RequiresRefresh
                 LastRefresh       = (Get-Date).ToUniversalTime()
diff --git a/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1 b/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1
index 8fbc6c7635c4c..f7e959130460a 100644
--- a/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1
@@ -12,6 +12,8 @@ function New-ExoBulkRequest {
         $NoAuthCheck,
         $Select,
         $ReturnWithCommand,
+        [int]$MaxConcurrency = 1,
+        [int]$TimeoutSec = 100,
         [switch]$Compliance,
         [switch]$AsApp
     )
@@ -53,6 +55,7 @@ function New-ExoBulkRequest {
             }
 
             $ReturnedData = [System.Collections.Generic.List[object]]::new()
+            $BatchPayloads = [System.Collections.Generic.List[object]]::new()
             foreach ($batch in $batches) {
                 $BatchBodyObj = @{
                     requests = @()
@@ -101,12 +104,85 @@ function New-ExoBulkRequest {
                 }
                 $BatchBodyJson = ConvertTo-Json -InputObject $BatchBodyObj -Depth 10
                 $BatchBodyJson = Get-CIPPTextReplacement -TenantFilter $tenantid -Text $BatchBodyJson
-                $Results = Invoke-CIPPRestMethod $BatchURL -ResponseHeadersVariable responseHeaders -Method POST -Body $BatchBodyJson -Headers $Headers -ContentType 'application/json; charset=utf-8'
-                foreach ($Response in $Results.responses) {
-                    $ReturnedData.Add($Response)
+                # Clone the headers as they stood for this batch's POST (X-AnchorMailbox/X-CmdletName are
+                # mutated per sub-request above); the $batch envelope also carries per-request headers.
+                $BatchPayloads.Add(@{ Json = $BatchBodyJson; Headers = $Headers.Clone() })
+            }
+
+            # Dispatch a set of batch payloads and return the flattened sub-responses. -MaxConcurrency 1
+            # (default) keeps the sequential Invoke-CIPPRestMethod loop; >1 fans out via
+            # CIPP.CIPPRestClient.SendConcurrent, which bounds concurrency and retries a fully-429'd/5xx
+            # POST honouring Retry-After (its backoff is separate from the per-request -TimeoutSec, so a
+            # rate-limit wait never trips the timeout). EXO caps each $batch at 10 sub-requests.
+            function Send-BatchPayloadSet {
+                param($Payloads, $DispatchUrl, $Concurrency, $Timeout)
+                $Out = [System.Collections.Generic.List[object]]::new()
+                if ($Concurrency -gt 1 -and @($Payloads).Count -gt 1) {
+                    $ConcRequests = [System.Collections.Generic.List[CIPP.CIPPConcurrentRequest]]::new()
+                    foreach ($Payload in $Payloads) {
+                        $ConcRequest = [CIPP.CIPPConcurrentRequest]::new()
+                        $ConcRequest.Uri = $DispatchUrl
+                        $ConcRequest.Method = 'POST'
+                        $ConcRequest.Body = $Payload.Json
+                        $ConcRequest.ContentType = 'application/json; charset=utf-8'
+                        $ConcRequest.TimeoutSec = $Timeout
+                        $ConcHeaders = [System.Collections.Generic.Dictionary[string, string]]::new()
+                        foreach ($HeaderKey in $Payload.Headers.Keys) { $ConcHeaders[$HeaderKey] = [string]$Payload.Headers[$HeaderKey] }
+                        $ConcRequest.Headers = $ConcHeaders
+                        $ConcRequests.Add($ConcRequest)
+                    }
+                    foreach ($ConcResult in [CIPP.CIPPRestClient]::SendConcurrent($ConcRequests, $Concurrency, 3)) {
+                        if ($ConcResult.Error) {
+                            Write-Host "EXO bulk batch failed after $($ConcResult.Attempts) attempt(s): $($ConcResult.Error)"
+                            continue
+                        }
+                        try {
+                            $Parsed = $ConcResult.Result.Content | ConvertFrom-Json
+                        } catch {
+                            Write-Host "EXO bulk batch: could not parse response (HTTP $($ConcResult.StatusCode))"
+                            continue
+                        }
+                        foreach ($Response in $Parsed.responses) { $Out.Add($Response) }
+                    }
+                } else {
+                    foreach ($Payload in $Payloads) {
+                        $Results = Invoke-CIPPRestMethod $DispatchUrl -ResponseHeadersVariable responseHeaders -Method POST -Body $Payload.Json -Headers $Payload.Headers -ContentType 'application/json; charset=utf-8' -TimeoutSec $Timeout
+                        foreach ($Response in $Results.responses) { $Out.Add($Response) }
+                    }
                 }
+                return $Out
+            }
+
+            foreach ($Response in (Send-BatchPayloadSet $BatchPayloads $BatchURL $MaxConcurrency $TimeoutSec)) { $ReturnedData.Add($Response) }
+
+            # EXO can throttle individual sub-requests inside a 200 batch envelope (status 429 per response,
+            # emitted under Prefer: odata.continue-on-error). SendConcurrent only sees the outer 200, so
+            # retry those here: rebuild the throttled sub-requests into fresh batches, honour Retry-After
+            # (else a capped exponential backoff), and swap the successful results back in by id.
+            $RateLimitRetry = 0
+            while ($RateLimitRetry -lt 3) {
+                $Throttled = @($ReturnedData | Where-Object { $_.status -eq 429 -and $_.id -and $IdToBatchRequest.ContainsKey($_.id) })
+                if ($Throttled.Count -eq 0) { break }
+                $RateLimitRetry++
+                $RetryAfter = 0
+                foreach ($ThrottledResponse in $Throttled) { $Ra = $ThrottledResponse.headers.'Retry-After' -as [int]; if ($Ra -gt $RetryAfter) { $RetryAfter = $Ra } }
+                if ($RetryAfter -le 0) { $RetryAfter = [int][math]::Pow(2, $RateLimitRetry) }  # 2s, 4s, 8s
+                Start-Sleep -Seconds $RetryAfter
 
-                Write-Host "Batch #$($batches.IndexOf($batch) + 1) of $($batches.Count) processed"
+                $ThrottledRequests = @($Throttled | ForEach-Object { $IdToBatchRequest[$_.id] })
+                $RetryPayloads = [System.Collections.Generic.List[object]]::new()
+                for ($i = 0; $i -lt $ThrottledRequests.Count; $i += 10) {
+                    $Slice = $ThrottledRequests[$i..[math]::Min($i + 9, $ThrottledRequests.Count - 1)]
+                    $RetryJson = ConvertTo-Json -InputObject @{ requests = @($Slice) } -Depth 10
+                    $RetryJson = Get-CIPPTextReplacement -TenantFilter $tenantid -Text $RetryJson
+                    $RetryPayloads.Add(@{ Json = $RetryJson; Headers = $Headers.Clone() })
+                }
+
+                $Replacements = @{}
+                foreach ($Response in (Send-BatchPayloadSet $RetryPayloads $BatchURL $MaxConcurrency $TimeoutSec)) { if ($Response.id) { $Replacements[$Response.id] = $Response } }
+                for ($i = 0; $i -lt $ReturnedData.Count; $i++) {
+                    if ($ReturnedData[$i].id -and $Replacements.ContainsKey($ReturnedData[$i].id)) { $ReturnedData[$i] = $Replacements[$ReturnedData[$i].id] }
+                }
             }
 
             # Follow @odata.nextLink continuations so results are not capped at one page (mirrors New-GraphBulkRequest).
diff --git a/Modules/CIPPCore/Public/GraphHelper/New-GraphBulkRequest.ps1 b/Modules/CIPPCore/Public/GraphHelper/New-GraphBulkRequest.ps1
index d89b5e8734202..9dc3a717da292 100644
--- a/Modules/CIPPCore/Public/GraphHelper/New-GraphBulkRequest.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/New-GraphBulkRequest.ps1
@@ -35,7 +35,6 @@ function New-GraphBulkRequest {
         $Tenant = Get-CIPPAzDataTableEntity @TenantsTable -Filter $Filter
         if (!$Tenant) {
             $Tenant = @{
-                GraphErrorCount = 0
                 LastGraphError  = ''
                 PartitionKey    = 'TenantFailed'
                 RowKey          = 'Failed'
@@ -55,6 +54,33 @@ function New-GraphBulkRequest {
                 }
                 $Return
             }
+            # A throttled or briefly unavailable FIRST page used to come straight back as the item's failure
+            # (continuation pages below are retried). Send those items again - twice, waiting the longest
+            # Retry-After they asked for, up to 30 s - before a caller sees a failure.
+            $TransientStatus = @(429, 503, 504)
+            for ($Attempt = 1; $Attempt -le 2; $Attempt++) {
+                $Transient = @($ReturnedData.responses | Where-Object { ($_.status -as [int]) -in $TransientStatus })
+                if ($Transient.Count -eq 0) { break }
+                $Wait = 1
+                foreach ($Throttled in $Transient) {
+                    $Asked = $Throttled.headers.'Retry-After' -as [int]
+                    if ($Asked -gt $Wait) { $Wait = $Asked }
+                }
+                Start-Sleep -Seconds ([Math]::Min($Wait, 30))
+                $TransientIds = @($Transient | ForEach-Object { [string]$_.id })
+                $RetryRequests = @($Requests | Where-Object { [string]$_.id -in $TransientIds })
+                for ($j = 0; $j -lt $RetryRequests.Count; $j += 20) {
+                    $RetryBody = ConvertTo-Json -InputObject @{ requests = @($RetryRequests[$j..($j + 19)]) } -Compress -Depth 100
+                    $RetryReturn = Invoke-CIPPRestMethod -Uri $URL -Method POST -Headers $headers -ContentType 'application/json; charset=utf-8' -Body $RetryBody
+                    foreach ($Fresh in @($RetryReturn.responses)) {
+                        foreach ($Batch in @($ReturnedData)) {
+                            for ($k = 0; $k -lt @($Batch.responses).Count; $k++) {
+                                if ([string]$Batch.responses[$k].id -eq [string]$Fresh.id) { $Batch.responses[$k] = $Fresh }
+                            }
+                        }
+                    }
+                }
+            }
             foreach ($MoreData in $ReturnedData.Responses | Where-Object { $_.body.'@odata.nextLink' }) {
                 if ($NoPaginateIds -contains $MoreData.id) {
                     continue
@@ -167,7 +193,6 @@ function New-GraphBulkRequest {
 
             if ($Message -ne 'Request not applicable to target tenant.') {
                 $Tenant.LastGraphError = $Message ?? ''
-                $Tenant.GraphErrorCount++
                 Update-AzDataTableEntity -Force @TenantsTable -Entity $Tenant
             }
             throw $Message
diff --git a/Modules/CIPPCore/Public/GraphHelper/Remove-SnoozedAlerts.ps1 b/Modules/CIPPCore/Public/GraphHelper/Remove-SnoozedAlerts.ps1
deleted file mode 100644
index 8f22ca37d3257..0000000000000
--- a/Modules/CIPPCore/Public/GraphHelper/Remove-SnoozedAlerts.ps1
+++ /dev/null
@@ -1,94 +0,0 @@
-function Remove-SnoozedAlerts {
-    <#
-    .SYNOPSIS
-        Filter out snoozed alert items from an alert data array.
-    .DESCRIPTION
-        Queries the AlertSnooze table for active snooze records matching the given
-        cmdlet and tenant, then removes matching items from the data array.
-        Also performs lazy cleanup of snoozes expired more than 30 days ago.
-    .FUNCTIONALITY
-        Internal
-    #>
-    [CmdletBinding()]
-    param(
-        [Parameter(Mandatory = $true)]
-        $Data,
-
-        [Parameter(Mandatory = $true)]
-        [string]$CmdletName,
-
-        [Parameter(Mandatory = $true)]
-        [string]$TenantFilter
-    )
-
-    $SnoozeTable = Get-CIPPTable -tablename 'AlertSnooze'
-
-    # Query all snooze records for this cmdlet + tenant
-    try {
-        $SnoozeRecords = Get-CIPPAzDataTableEntity @SnoozeTable -Filter "PartitionKey eq '$($CmdletName)'" | Where-Object {
-            $_.Tenant -eq $TenantFilter
-        }
-    } catch {
-        Write-Information "Failed to query AlertSnooze table: $($_.Exception.Message). Returning all data."
-        return $Data
-    }
-
-    if (-not $SnoozeRecords -or @($SnoozeRecords).Count -eq 0) {
-        return $Data
-    }
-
-    $CurrentUnixTime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
-    $ThirtyDaysAgo = $CurrentUnixTime - (30 * 86400)
-
-    # Separate active snoozes from expired ones
-    $ActiveHashes = [System.Collections.Generic.HashSet[string]]::new()
-    $RecordsToCleanup = [System.Collections.Generic.List[object]]::new()
-
-    foreach ($record in @($SnoozeRecords)) {
-        $SnoozeUntil = [int64]$record.SnoozeUntil
-
-        if ($SnoozeUntil -eq -1) {
-            # Forever snooze - always active
-            $null = $ActiveHashes.Add($record.ContentHash)
-        } elseif ($SnoozeUntil -gt $CurrentUnixTime) {
-            # Not yet expired
-            $null = $ActiveHashes.Add($record.ContentHash)
-        } elseif ($SnoozeUntil -lt $ThirtyDaysAgo) {
-            # Expired more than 30 days ago - schedule for cleanup
-            $RecordsToCleanup.Add($record)
-        }
-        # Expired but within 30 days - just skip (don't filter, don't cleanup yet)
-    }
-
-    # Lazy cleanup of old expired snoozes
-    if ($RecordsToCleanup.Count -gt 0) {
-        try {
-            foreach ($staleRecord in $RecordsToCleanup) {
-                Remove-CIPPAzDataTableEntity @SnoozeTable -Entity @{
-                    PartitionKey = $staleRecord.PartitionKey
-                    RowKey       = $staleRecord.RowKey
-                    ETag         = '*'
-                } | Out-Null
-            }
-            Write-Information "Cleaned up $($RecordsToCleanup.Count) expired snooze records for $CmdletName / $TenantFilter"
-        } catch {
-            Write-Information "Failed to cleanup expired snooze records: $($_.Exception.Message)"
-        }
-    }
-
-    if ($ActiveHashes.Count -eq 0) {
-        return $Data
-    }
-
-    # Filter out snoozed items
-    $FilteredData = foreach ($item in @($Data)) {
-        $HashResult = Get-AlertContentHash -AlertItem $item
-        if (-not $ActiveHashes.Contains($HashResult.ContentHash)) {
-            $item
-        } else {
-            Write-Information "Snoozing alert item: $($HashResult.ContentPreview) for $CmdletName / $TenantFilter"
-        }
-    }
-
-    return $FilteredData
-}
diff --git a/Modules/CIPPCore/Public/GraphHelper/Test-CIPPGraphEndpointBlocked.ps1 b/Modules/CIPPCore/Public/GraphHelper/Test-CIPPGraphEndpointBlocked.ps1
new file mode 100644
index 0000000000000..6e5f6cdba8e5c
--- /dev/null
+++ b/Modules/CIPPCore/Public/GraphHelper/Test-CIPPGraphEndpointBlocked.ps1
@@ -0,0 +1,149 @@
+function Test-CIPPGraphEndpointBlocked {
+    <#
+    .SYNOPSIS
+        Returns true when a Graph path is on the customer-content blocklist.
+    .DESCRIPTION
+        Used wherever an arbitrary Graph path is accepted (Get-GraphRequestList, which backs
+        ListGraphRequest and scheduled tasks, and ListGraphBulkRequest) so operators and MCP cannot
+        pull mailbox, chat, drive, or other customer content through Graph Explorer-style proxies.
+
+        The path and any $expand/expand values (from the query string or -Expand) are
+        percent-decoded before matching, because Graph decodes them server-side.
+    .PARAMETER Uri
+        Full Graph URI or relative endpoint (host/version stripped before match).
+    .PARAMETER Expand
+        $expand / expand values passed separately from the Uri.
+    .PARAMETER Throw
+        If set, throw when blocked and emit nothing when allowed, so callers can use it as a bare
+        guard statement without leaking $false into their own output.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    [OutputType([bool])]
+    param(
+        [Parameter(Mandatory, Position = 0)]
+        [AllowEmptyString()]
+        [string]$Uri,
+
+        [string[]]$Expand,
+
+        [switch]$Throw
+    )
+
+    # Decode until stable (every pass shortens the string, so it terminates), including IIS-style %uXXXX.
+    # Whitespace, control and format characters (NUL, zero-width space) are then dropped: Graph either
+    # ignores them or 404s, so removing them before matching can only fail closed.
+    function ConvertFrom-CippEncodedGraphText([string]$Text) {
+        do {
+            $Previous = $Text
+            $Text = [regex]::Replace([System.Uri]::UnescapeDataString($Text), '%u([0-9a-f]{4})', {
+                    [string][char][Convert]::ToInt32($args[0].Groups[1].Value, 16)
+                }, 'IgnoreCase')
+        } while ($Text -ne $Previous)
+        return $Text -replace '[\s\p{C}]+', ''
+    }
+
+    # \ ? and # become separators (a front end or a second decode may honour them), and trailing dots on
+    # a segment are dropped, since some front ends strip them.
+    function ConvertTo-CippGraphMatchPath([string]$Text) {
+        return $Text -replace '[\\?#]', '/' -replace '\.+(?=[/(;]|$)', '' -replace '^/+', ''
+    }
+
+    # An $expand expression like "fields,driveItem($select=id)" is matched as path segments under the
+    # resource it expands, so patterns that need a parent (planner/.../tasks, lists/.../items) still apply.
+    # Anything that is not part of a property name is a separator, so "fields, driveItem" and
+    # "fields,+driveItem" (+ is a space in a query string) cannot hide the segment boundary.
+    function ConvertTo-CippExpandPath([string]$Text) {
+        return ConvertTo-CippGraphMatchPath ($ExpandPrefix + ((ConvertFrom-CippEncodedGraphText $Text) -replace '[^\w.$@-]', '/'))
+    }
+
+    $Candidates = [System.Collections.Generic.List[string]]::new()
+    $ExpandPrefix = '$expand/'
+
+    if (-not [string]::IsNullOrWhiteSpace($Uri)) {
+        # Parse the way the HTTP client will send it: fragment dropped, \ becomes /, dot segments resolved.
+        $Text = $Uri.Trim()
+        if ($Text -notmatch '^https?://') {
+            $Text = 'https://graph.microsoft.com/v1.0/' + ($Text -replace '^[/\\]+', '')
+        }
+        $Parsed = $null
+        if ([System.Uri]::TryCreate($Text, [System.UriKind]::Absolute, [ref]$Parsed)) {
+            $Raw = $Parsed.AbsolutePath -replace '^/(v1\.0|beta)(?=/|$)', ''
+            $Query = $Parsed.Query -replace '^\?', ''
+        } else {
+            $Raw, $Query = ($Text -replace '^https?://[^/]+/(v1\.0|beta)/?', '' -replace '#.*$', '') -split '\?', 2
+        }
+        $Path = ConvertTo-CippGraphMatchPath (ConvertFrom-CippEncodedGraphText $Raw)
+        if ($Path) {
+            $Candidates.Add($Path)
+            $ExpandPrefix = '{0}/$expand/' -f $Path.TrimEnd('/')
+        }
+
+        foreach ($Pair in ($Query -split '&')) {
+            $Key, $Value = $Pair -split '=', 2
+            # Loose on purpose (catches "?$expand", "$Expand ", "%2524expand"): a false hit only means the
+            # value is checked too.
+            if ((ConvertFrom-CippEncodedGraphText $Key) -match 'expand' -and $Value) {
+                $Candidates.Add((ConvertTo-CippExpandPath $Value))
+            }
+        }
+    }
+
+    foreach ($Value in @($Expand)) {
+        if (-not [string]::IsNullOrWhiteSpace($Value)) {
+            $Candidates.Add((ConvertTo-CippExpandPath $Value))
+        }
+    }
+
+    if ($Candidates.Count -eq 0) {
+        if ($Throw) { return }
+        return $false
+    }
+
+    if ($null -eq $script:CippGraphEndpointBlocklist) {
+        $BlocklistPath = Join-Path -Path $env:CIPPRootPath -ChildPath 'Config\GraphEndpointBlocklist.json'
+        $Blocklist = [System.IO.File]::ReadAllText($BlocklistPath) | ConvertFrom-Json
+        $RegexOptions = [System.Text.RegularExpressions.RegexOptions]'IgnoreCase, CultureInvariant'
+        # Patterns like lists(?=[/(]).*/items backtrack quadratically on crafted input; cap each match.
+        $MatchTimeout = [timespan]::FromMilliseconds(250)
+        $Entries = @(
+            foreach ($Entry in @($Blocklist.blockedEndpoints)) {
+                if (-not $Entry.pattern) { continue }
+                [pscustomobject]@{
+                    id     = $Entry.id
+                    reason = $Entry.reason
+                    Regex  = [regex]::new($Entry.pattern, $RegexOptions, $MatchTimeout)
+                }
+            }
+        )
+        if ($Entries.Count -eq 0) {
+            throw "Graph endpoint blocklist at $BlocklistPath has no patterns"
+        }
+        $script:CippGraphEndpointBlocklist = $Entries
+    }
+
+    foreach ($Candidate in $Candidates) {
+        foreach ($Entry in $script:CippGraphEndpointBlocklist) {
+            $Reason = $Entry.reason
+            try {
+                $IsBlocked = $Entry.Regex.IsMatch($Candidate)
+            } catch {
+                # Match timeout on pathological input: fail closed.
+                $IsBlocked = $true
+                $Reason = 'path could not be checked in time'
+            }
+            if ($IsBlocked) {
+                $Message = 'Graph endpoint blocked ({0}): {1}' -f $Entry.id, $Reason
+                Write-Information $Message
+                if ($Throw) {
+                    throw $Message
+                }
+                return $true
+            }
+        }
+    }
+
+    if ($Throw) { return }
+    return $false
+}
diff --git a/Modules/CIPPCore/Public/GraphHelper/Write-AlertTrace.ps1 b/Modules/CIPPCore/Public/GraphHelper/Write-AlertTrace.ps1
index a152cbd84bd79..f9d1ea3382f62 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Write-AlertTrace.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Write-AlertTrace.ps1
@@ -1,56 +1,257 @@
 function Write-AlertTrace {
     <#
+    .SYNOPSIS
+        Reconcile one alert run against the AlertLifecycle table and return the items worth notifying about.
+    .DESCRIPTION
+        Every scripted alert (Get-CIPPAlert*) calls this once per tenant with everything it found,
+        including an empty result when it found nothing. Each item is hashed with
+        Get-AlertContentHash and compared with the rows already stored for this cmdlet and tenant:
+
+          - not stored yet                 -> New       (Open, or Snoozed when a snooze covers it)
+          - stored and Resolved            -> Reopened  (ReopenCount + 1)
+          - stored and still present       -> Continuing (LastSeen refreshed, no notification)
+          - stored but absent this run     -> Resolved
+          - stored as Snoozed, snooze gone -> back to Open and notified again
+
+        Only New and Reopened items that are not snoozed are returned, so the scheduled-task
+        post-execution step notifies once per state change instead of once per run. A run that
+        finds nothing returns nothing and resolves whatever was still open.
+
+        A snooze set "until resolved" is deleted when its item resolves, so the item notifies
+        again if it ever comes back. Timed snoozes outlive a resolution and keep suppressing
+        the item until they expire.
+
+        Alerts that fail part-way must not call this, since "could not check" is not "clear".
+
+        With -Append the run is treated as a stream of events rather than a full picture: items
+        are added or refreshed but nothing is resolved by absence. Open rows that have not been
+        seen for 30 days are resolved as stale instead.
     .FUNCTIONALITY
-    Internal function. Pleases most of Write-AlertTrace for alerting purposes
+        Internal
     #>
+    [CmdletBinding()]
     param(
+        [Parameter(Mandatory = $true)]
         $cmdletName,
         $data,
+        [Parameter(Mandatory = $true)]
         $tenantFilter,
-        [string]$PartitionKey = (Get-Date -UFormat '%Y%m%d').ToString(),
-        [string]$AlertComment = $null
+        [string]$AlertComment = $null,
+        [switch]$Append
     )
-    # Filter out snoozed alert items before comparison and storage
-    $data = @(Remove-SnoozedAlerts -Data $data -CmdletName $cmdletName -TenantFilter $tenantFilter)
-    if (-not $data -or $data.Count -eq 0) {
-        Write-Host "All alert items are snoozed for cmdlet '$cmdletName' and tenant '$tenantFilter'. Skipping alert trace." -ForegroundColor Yellow
-        return $null
-    }
-
-    $Table = Get-CIPPTable -tablename AlertLastRun
-    #Get current row and compare the $logData object. If it's the same, don't write it.
-    $Row = Get-CIPPAzDataTableEntity @table -Filter "RowKey eq '$($tenantFilter)-$($cmdletName)' and PartitionKey eq '$PartitionKey'"
-    try {
-        $RowData = $Row.LogData
-        $Compare = Compare-Object $RowData (ConvertTo-Json -InputObject $data -Compress -Depth 10 | Out-String)
-        Write-Host "Comparing new alert data with existing data for cmdlet '$cmdletName' and tenant '$tenantFilter'. Differences: $Compare"
-        if ($Compare) {
-            $LogData = ConvertTo-Json -InputObject $data -Compress -Depth 10 | Out-String
-            $TableRow = @{
-                'PartitionKey' = $PartitionKey
-                'RowKey'       = "$($tenantFilter)-$($cmdletName)"
-                'CmdletName'   = "$cmdletName"
-                'Tenant'       = "$tenantFilter"
-                'LogData'      = [string]$LogData
-                'AlertComment' = [string]$AlertComment
+
+    $CmdletName = [string]$cmdletName
+    $TenantFilter = [string]$tenantFilter
+    $Now = [datetime]::UtcNow
+    $NowIso = $Now.ToString('o')
+    $StaleCutoff = $Now.AddDays(-30)
+    $RetentionCutoff = $Now.AddDays(-90)
+
+    $Table = Get-CIPPTable -tablename 'AlertLifecycle'
+    $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String
+    $SafeCmdlet = ConvertTo-CIPPODataFilterValue -Value $CmdletName -Type String
+    $Existing = @(Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$SafeTenant' and CmdletName eq '$SafeCmdlet'")
+
+    $ByHash = @{}
+    foreach ($Row in $Existing) {
+        if ($Row.ContentHash) { $ByHash[[string]$Row.ContentHash] = $Row }
+    }
+
+    # One-time seed: the first reconcile for a cmdlet/tenant pair after the upgrade treats the
+    # items of its last AlertLastRun row as already open, so nothing that was already known
+    # is announced as new.
+    if ($Existing.Count -eq 0) {
+        try {
+            $LastRunTable = Get-CIPPTable -tablename 'AlertLastRun'
+            $SafeLastRunKey = ConvertTo-CIPPODataFilterValue -Value "$($TenantFilter)-$($CmdletName)" -Type String
+            $LastRunRows = @(Get-CIPPAzDataTableEntity @LastRunTable -Filter "RowKey eq '$SafeLastRunKey'")
+            $LastRun = $LastRunRows | Where-Object { $_.PartitionKey -match '^\d{8}$' } | Sort-Object -Property PartitionKey -Descending | Select-Object -First 1
+            if ($LastRun -and -not [string]::IsNullOrWhiteSpace($LastRun.LogData)) {
+                $SeedSeen = [datetime]::ParseExact([string]$LastRun.PartitionKey, 'yyyyMMdd', [cultureinfo]::InvariantCulture).ToString('o')
+                foreach ($SeedItem in @($LastRun.LogData | ConvertFrom-Json -ErrorAction Stop)) {
+                    if ($null -eq $SeedItem) { continue }
+                    $SeedHash = Get-AlertContentHash -AlertItem $SeedItem
+                    if ($ByHash.ContainsKey($SeedHash.ContentHash)) { continue }
+                    $SeedKeys = Get-CIPPAlertLifecycleKey -CmdletName $CmdletName -TenantFilter $TenantFilter -ContentHash $SeedHash.ContentHash
+                    $ByHash[$SeedHash.ContentHash] = [PSCustomObject]@{
+                        PartitionKey        = $SeedKeys.PartitionKey
+                        RowKey              = $SeedKeys.RowKey
+                        CmdletName          = $CmdletName
+                        Tenant              = $TenantFilter
+                        ContentHash         = $SeedHash.ContentHash
+                        ContentPreview      = $SeedHash.ContentPreview
+                        AlertItem           = [string](ConvertTo-Json -InputObject $SeedItem -Compress -Depth 10)
+                        AlertComment        = [string]$LastRun.AlertComment
+                        Status              = 'Open'
+                        FirstSeen           = $SeedSeen
+                        LastSeen            = $SeedSeen
+                        LastChecked         = $SeedSeen
+                        ResolvedAt          = ''
+                        ReopenCount         = '0'
+                        SnoozeUntil         = ''
+                        SnoozedBy           = ''
+                        SnoozeRowKey        = ''
+                        SnoozeReason        = ''
+                        SnoozeVisible       = ''
+                        SnoozeUntilResolved = ''
+                    }
+                }
+                Write-Information "Seeded $($ByHash.Count) open alert items for $CmdletName / $TenantFilter from AlertLastRun"
             }
-            $Table.Entity = $TableRow
-            Add-CIPPAzDataTableEntity @Table -Force | Out-Null
-            return $data
+        } catch {
+            Write-Information "Could not seed AlertLifecycle from AlertLastRun for $CmdletName / $TenantFilter : $($_.Exception.Message)"
         }
-    } catch {
-        $LogData = ConvertTo-Json -InputObject $data -Compress -Depth 10 | Out-String
-        $TableRow = @{
-            'PartitionKey' = $PartitionKey
-            'RowKey'       = "$($tenantFilter)-$($cmdletName)"
-            'CmdletName'   = "$cmdletName"
-            'Tenant'       = "$tenantFilter"
-            'LogData'      = [string]$LogData
-            'AlertComment' = [string]$AlertComment
+    }
+
+    $Snoozes = Get-CIPPActiveAlertSnoozes -CmdletName $CmdletName -TenantFilter $TenantFilter
+
+    $Seen = [System.Collections.Generic.HashSet[string]]::new()
+    $Writes = [System.Collections.Generic.List[object]]::new()
+    $Notify = [System.Collections.Generic.List[object]]::new()
+    $Counts = @{ New = 0; Reopened = 0; Continuing = 0; Resolved = 0; Snoozed = 0 }
+
+    foreach ($Item in @($data)) {
+        if ($null -eq $Item) { continue }
+        $Hash = Get-AlertContentHash -AlertItem $Item
+        if (-not $Seen.Add($Hash.ContentHash)) { continue }
+
+        $Snooze = $Snoozes[$Hash.ContentHash]
+        $Keys = Get-CIPPAlertLifecycleKey -CmdletName $CmdletName -TenantFilter $TenantFilter -ContentHash $Hash.ContentHash
+        $ItemJson = [string](ConvertTo-Json -InputObject $Item -Compress -Depth 10)
+        $Row = $ByHash[$Hash.ContentHash]
+
+        $Entity = @{
+            PartitionKey        = $Keys.PartitionKey
+            RowKey              = $Keys.RowKey
+            CmdletName          = $CmdletName
+            Tenant              = $TenantFilter
+            ContentHash         = [string]$Hash.ContentHash
+            ContentPreview      = [string]$Hash.ContentPreview
+            AlertItem           = $ItemJson
+            AlertComment        = [string]$AlertComment
+            LastSeen            = $NowIso
+            LastChecked         = $NowIso
+            ResolvedAt          = ''
+            SnoozeUntil         = if ($Snooze) { [string]$Snooze.SnoozeUntil } else { '' }
+            SnoozedBy           = if ($Snooze) { [string]$Snooze.SnoozedBy } else { '' }
+            SnoozeRowKey        = if ($Snooze) { [string]$Snooze.RowKey } else { '' }
+            SnoozeReason        = if ($Snooze) { [string]$Snooze.SnoozeReason } else { '' }
+            SnoozeVisible       = if ($Snooze) { [string]([string]$Snooze.KeepVisible -eq 'True') } else { '' }
+            SnoozeUntilResolved = if ($Snooze) { [string]([string]$Snooze.UntilResolved -eq 'True') } else { '' }
         }
-        $Table.Entity = $TableRow
-        Add-CIPPAzDataTableEntity @Table -Force | Out-Null
-        return $data
+
+        if (-not $Row) {
+            $Entity.Status = if ($Snooze) { 'Snoozed' } else { 'Open' }
+            $Entity.FirstSeen = $NowIso
+            $Entity.ReopenCount = '0'
+            if ($Snooze) { $Counts.Snoozed++ } else { $Counts.New++; $Notify.Add($Item) }
+        } else {
+            $PriorStatus = [string]$Row.Status
+            $Entity.FirstSeen = [string]$Row.FirstSeen
+            $Entity.ReopenCount = [string]([int]($Row.ReopenCount ?? 0))
+
+            if ($PriorStatus -eq 'Resolved') {
+                $Entity.Status = if ($Snooze) { 'Snoozed' } else { 'Open' }
+                $Entity.FirstSeen = $NowIso
+                $Entity.ReopenCount = [string]([int]($Row.ReopenCount ?? 0) + 1)
+                if ($Snooze) { $Counts.Snoozed++ } else { $Counts.Reopened++; $Notify.Add($Item) }
+            } elseif ($Snooze) {
+                $Entity.Status = 'Snoozed'
+                $Counts.Snoozed++
+            } elseif ($PriorStatus -eq 'Snoozed') {
+                # The snooze lapsed or was removed while the condition persisted: it fires again.
+                $Entity.Status = 'Open'
+                $Counts.New++
+                $Notify.Add($Item)
+            } else {
+                $Entity.Status = 'Open'
+                $Counts.Continuing++
+            }
+        }
+
+        $Writes.Add($Entity)
     }
 
+    $Removals = [System.Collections.Generic.List[object]]::new()
+    $SnoozesToDrop = [System.Collections.Generic.List[object]]::new()
+    foreach ($Row in $Existing) {
+        if ($Seen.Contains([string]$Row.ContentHash)) { continue }
+        $Status = [string]$Row.Status
+
+        if ($Status -eq 'Resolved') {
+            [datetime]$ResolvedAt = [datetime]::MinValue
+            if ([datetime]::TryParse([string]$Row.ResolvedAt, [cultureinfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::RoundtripKind, [ref]$ResolvedAt) -and $ResolvedAt -lt $RetentionCutoff) {
+                $Removals.Add($Row)
+            }
+            continue
+        }
+
+        $ResolveIt = $true
+        if ($Append) {
+            [datetime]$LastSeen = [datetime]::MinValue
+            $ResolveIt = [datetime]::TryParse([string]$Row.LastSeen, [cultureinfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::RoundtripKind, [ref]$LastSeen) -and $LastSeen -lt $StaleCutoff
+        }
+        if (-not $ResolveIt) { continue }
+
+        # Rewrite the whole row: the upsert replaces rather than merges.
+        $Resolved = @{}
+        foreach ($Prop in $Row.PSObject.Properties) {
+            if ($Prop.Name -in @('ETag', 'Timestamp')) { continue }
+            $Resolved[$Prop.Name] = $Prop.Value
+        }
+        $Resolved.Status = 'Resolved'
+        $Resolved.ResolvedAt = $NowIso
+        $Resolved.LastChecked = $NowIso
+        if ($Status -eq 'Snoozed' -and [string]$Row.SnoozeUntilResolved -eq 'True') {
+            # An "until resolved" snooze has done its job; drop it so a comeback notifies again.
+            $SnoozesToDrop.Add([string]$Row.SnoozeRowKey)
+            $Resolved.SnoozeUntil = ''
+            $Resolved.SnoozedBy = ''
+            $Resolved.SnoozeRowKey = ''
+            $Resolved.SnoozeReason = ''
+            $Resolved.SnoozeVisible = ''
+            $Resolved.SnoozeUntilResolved = ''
+        }
+        $Writes.Add($Resolved)
+        $Counts.Resolved++
+    }
+
+    if ($Writes.Count -gt 0) {
+        Add-CIPPAzDataTableEntity @Table -Entity @($Writes) -Force | Out-Null
+    }
+    if ($Removals.Count -gt 0) {
+        try {
+            foreach ($Old in $Removals) {
+                Remove-CIPPAzDataTableEntity @Table -Entity @{
+                    PartitionKey = [string]$Old.PartitionKey
+                    RowKey       = [string]$Old.RowKey
+                    ETag         = '*'
+                } | Out-Null
+            }
+        } catch {
+            Write-Information "Could not purge resolved alert rows for $CmdletName / $TenantFilter : $($_.Exception.Message)"
+        }
+    }
+    if ($SnoozesToDrop.Count -gt 0) {
+        try {
+            $SnoozeTable = Get-CIPPTable -tablename 'AlertSnooze'
+            foreach ($SnoozeKey in $SnoozesToDrop) {
+                if ([string]::IsNullOrWhiteSpace($SnoozeKey)) { continue }
+                Remove-CIPPAzDataTableEntity @SnoozeTable -Entity @{
+                    PartitionKey = $CmdletName
+                    RowKey       = $SnoozeKey
+                    ETag         = '*'
+                } | Out-Null
+            }
+        } catch {
+            Write-Information "Could not drop until-resolved snoozes for $CmdletName / $TenantFilter : $($_.Exception.Message)"
+        }
+    }
+
+    Write-Information ("Alert reconcile for {0} / {1}: {2} new, {3} reopened, {4} continuing, {5} resolved, {6} snoozed" -f $CmdletName, $TenantFilter, $Counts.New, $Counts.Reopened, $Counts.Continuing, $Counts.Resolved, $Counts.Snoozed)
+
+    if ($Notify.Count -gt 0) {
+        return @($Notify)
+    }
+    return $null
 }
diff --git a/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1 b/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1
index 975238e16573c..55c9e3a369df1 100644
--- a/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1
+++ b/Modules/CIPPCore/Public/GraphHelper/Write-LogMessage.ps1
@@ -91,6 +91,11 @@ function Write-LogMessage {
     if ($script:CippBaselineRunIdStorage.Value) {
         $TableRow.BaselineRunId = [string]$script:CippBaselineRunIdStorage.Value
     }
+    # Set by Set-CippBecCaseContext while a BEC check, containment, content search or evidence
+    # export runs, so the evidence package can bundle every log line of a case.
+    if ($script:CippBecCaseIdStorage.Value) {
+        $TableRow.BecCaseId = [string]$script:CippBecCaseIdStorage.Value
+    }
 
     $Table.Entity = $TableRow
     Add-CIPPAzDataTableEntity @Table | Out-Null
diff --git a/Modules/CIPPCore/Public/GraphRequests/Get-GraphRequestList.ps1 b/Modules/CIPPCore/Public/GraphRequests/Get-GraphRequestList.ps1
index c7e0a9188d03f..53a5f2933239b 100644
--- a/Modules/CIPPCore/Public/GraphRequests/Get-GraphRequestList.ps1
+++ b/Modules/CIPPCore/Public/GraphRequests/Get-GraphRequestList.ps1
@@ -144,6 +144,10 @@ function Get-GraphRequestList {
         }
     }
     $GraphQuery.Query = $ParamCollection.ToString()
+    Test-CIPPGraphEndpointBlocked -Uri $GraphQuery.ToString() -Expand $BatchExpandQuery -Throw
+    if ($nextLink -match '^https://') {
+        Test-CIPPGraphEndpointBlocked -Uri $nextLink -Throw
+    }
     $PartitionKey = Get-StringHash -String (@($Endpoint, $ParamCollection.ToString(), 'v2') -join '-')
 
     # Perform $count check before caching
@@ -187,6 +191,7 @@ function Get-GraphRequestList {
             }
             $GraphQuery.Query = $ParamCollection.ToString()
             $GraphRequest.uri = $GraphQuery.ToString()
+            Test-CIPPGraphEndpointBlocked -Uri $GraphRequest.uri -Throw
         }
 
         if ($Parameters.'$count' -and -not $ManualPagination.IsPresent) {
diff --git a/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 b/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1
index a81a95e7c0fb2..c69b70d5cf2ed 100644
--- a/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1
+++ b/Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1
@@ -71,6 +71,7 @@ function Invoke-CIPPDBCacheCollection {
             'AppRoleAssignments'
             'LicenseOverview'
             'ActiveUserDetail'
+            'M365AppUserDetail'
             'BitlockerKeys'
             'AdminReportSettings'
             'PeopleInsights'
@@ -126,6 +127,7 @@ function Invoke-CIPPDBCacheCollection {
         ExchangeData       = @(
             'CASMailboxes'
             'MailboxUsage'
+            'MailTrafficSummary'
             'OfficeActivations'
             'HVEAccounts'
         )
@@ -183,6 +185,7 @@ function Invoke-CIPPDBCacheCollection {
             'SPOTenantSyncClientRestriction'
             'SharePointAdminSettings'
             'SharePointSiteUsage'
+            'SharePointUsageReport'
             'SiteActivity'
             'OneDriveUsage'
         )
diff --git a/Modules/CIPPCore/Public/Invoke-CIPPSharePointTemplateDeploy.ps1 b/Modules/CIPPCore/Public/Invoke-CIPPSharePointTemplateDeploy.ps1
index 706a758569bf6..0d95bb657f215 100644
--- a/Modules/CIPPCore/Public/Invoke-CIPPSharePointTemplateDeploy.ps1
+++ b/Modules/CIPPCore/Public/Invoke-CIPPSharePointTemplateDeploy.ps1
@@ -8,9 +8,10 @@ function Invoke-CIPPSharePointTemplateDeploy {
     Each site has a siteType (sharePoint or teams). When overrideSiteType is set, the template
     siteType is used for every site; otherwise each site's own siteType applies. Teams sites
     are created via the Teams API so channels and Teams functionality stay intact, then
-    document libraries are added to the backing SharePoint site. SharePoint sites use the
-    plain site-creation path. Root-level and per-library permissions are applied by group
-    display name, optionally creating missing groups as security groups.
+    optional extra channels, document libraries, and Documents-root folders (siblings of
+    General) are added. SharePoint sites use the plain site-creation path (libraries only).
+    Root-level and per-library permissions are applied by group display name, optionally
+    creating missing groups as security groups.
 
     .PARAMETER TemplateData
     The deserialized template object (templateName, siteType, overrideSiteType, createMissingGroups, siteTemplates)
@@ -67,13 +68,20 @@ function Invoke-CIPPSharePointTemplateDeploy {
         if ($SiteType -notin @('sharePoint', 'teams')) { $SiteType = 'sharePoint' }
         $IsTeams = $SiteType -eq 'teams'
 
+        # Channels/folders only apply to Teams; missing arrays (old templates) count as empty.
+        # Avoid @($null) which is a one-element array and would invent a blank item step.
+        $Channels = if ($IsTeams -and $null -ne $SiteTemplate.channels) { @($SiteTemplate.channels) } else { @() }
+        $Folders = if ($IsTeams -and $null -ne $SiteTemplate.folders) { @($SiteTemplate.folders) } else { @() }
+        $Libraries = if ($null -ne $SiteTemplate.libraries) { @($SiteTemplate.libraries) } else { @() }
+
         # Step counter for this site: prerequisites, create, site permissions, then one step
-        # per library. Shown as 'Step x of y' in the live progress messages.
-        $TotalSteps = 3 + @($SiteTemplate.libraries).Count
+        # per channel / library / folder. Shown as 'Step x of y' in the live progress messages.
+        $TotalSteps = 3 + $Channels.Count + $Libraries.Count + $Folders.Count
         try {
             Update-DeployStep -Index $SiteIndex -Status 'running' -Message "Step 1 of ${TotalSteps}: Checking prerequisites"
             # Skip if exists: leave pre-existing sites/teams completely untouched — no
-            # libraries or permission changes are applied to anything this run didn't create.
+            # channels, libraries, folders, or permission changes are applied to anything
+            # this run didn't create.
             if ($SkipIfExists) {
                 $AlreadyExists = $false
                 if ($IsTeams) {
@@ -100,10 +108,12 @@ function Invoke-CIPPSharePointTemplateDeploy {
             }
             # Create the container first: a full Team (Teams API) so all Teams functionality
             # stays intact, or a plain SharePoint site otherwise.
+            $GroupId = $null
             if ($IsTeams) {
                 Update-DeployStep -Index $SiteIndex -Status 'running' -Message "Step 2 of ${TotalSteps}: Creating Team and waiting for its SharePoint site"
                 $Team = New-CIPPTeam -DisplayName $SiteTemplate.displayName -Description ($SiteTemplate.description ?? '') -Owner $SiteOwner -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName
                 $SiteUrl = $Team.SiteUrl
+                $GroupId = $Team.GroupId
                 $Results.Add("[$TenantFilter] Created Team '$($SiteTemplate.displayName)' with site $SiteUrl")
                 $RawLanguage = [string](($SiteTemplate.language.value ?? $SiteTemplate.language))
                 if ($RawLanguage -and $RawLanguage -ne 'default') {
@@ -145,7 +155,7 @@ function Invoke-CIPPSharePointTemplateDeploy {
                 $Results.Add("[$TenantFilter] Created site '$($SiteTemplate.displayName)' at $SiteUrl")
             }
 
-            # Track template-defined sub-steps (site perms, libraries, library perms). A failure
+            # Track template-defined sub-steps (site perms, channels, libraries, folders). A failure
             # here must mark this site step failed — do not report succeeded after swallowing errors.
             $StepFailures = [System.Collections.Generic.List[string]]::new()
 
@@ -173,12 +183,38 @@ function Invoke-CIPPSharePointTemplateDeploy {
                 }
             }
 
-            # Then the document libraries via the SharePoint module.
-            $LibraryStep = 3
-            foreach ($Library in $SiteTemplate.libraries) {
-                $LibraryStep++
+            # Item steps start after prerequisites + create + site permissions.
+            $ItemStep = 3
+
+            # Teams: channels first (extra public/private channels; Site Owner owns private ones).
+            foreach ($Channel in $Channels) {
+                $ItemStep++
+                $ChannelName = [string]($Channel.name ?? '')
+                $RawMembership = [string](($Channel.membershipType.value ?? $Channel.membershipType))
+                $MembershipType = switch ($RawMembership) {
+                    'private' { 'private' }
+                    'shared' { 'shared' }
+                    default { 'standard' }
+                }
+                $RawLayout = [string](($Channel.layoutType.value ?? $Channel.layoutType))
+                $LayoutType = if ($RawLayout -eq 'chat') { 'chat' } else { 'post' }
                 try {
-                    Update-DeployStep -Index $SiteIndex -Status 'running' -Message "Step $LibraryStep of ${TotalSteps}: Creating library '$($Library.name)'"
+                    Update-DeployStep -Index $SiteIndex -Status 'running' -Message "Step $ItemStep of ${TotalSteps}: Creating channel '$ChannelName'"
+                    $NewChannel = New-CIPPTeamChannel -GroupId $GroupId -ChannelName $ChannelName -MembershipType $MembershipType -LayoutType $LayoutType -Owner $SiteOwner -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName
+                    $Results.Add("[$TenantFilter] $($SiteTemplate.displayName): channel '$ChannelName' ($MembershipType, $LayoutType) $($NewChannel.Created ? 'created' : 'already existed')")
+                } catch {
+                    $FailMsg = "Channel '$ChannelName' failed: $($_.Exception.Message)"
+                    $StepFailures.Add($FailMsg)
+                    $Results.Add("[$TenantFilter] $($SiteTemplate.displayName): $FailMsg")
+                    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "SharePoint template site '$($SiteTemplate.displayName)': $FailMsg" -sev Error
+                }
+            }
+
+            # Document libraries via the SharePoint module.
+            foreach ($Library in $Libraries) {
+                $ItemStep++
+                try {
+                    Update-DeployStep -Index $SiteIndex -Status 'running' -Message "Step $ItemStep of ${TotalSteps}: Creating library '$($Library.name)'"
                     $NewLibrary = New-CIPPSharePointLibrary -SiteUrl $SiteUrl -LibraryName $Library.name -Description ($Library.description ?? '') -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName
                     $Results.Add("[$TenantFilter] $($SiteTemplate.displayName): library '$($Library.name)' $($NewLibrary.Created ? 'created' : 'already existed')")
 
@@ -208,6 +244,22 @@ function Invoke-CIPPSharePointTemplateDeploy {
                 }
             }
 
+            # Teams: folders at Documents root (siblings of General).
+            foreach ($Folder in $Folders) {
+                $ItemStep++
+                $FolderName = [string]($Folder.name ?? '')
+                try {
+                    Update-DeployStep -Index $SiteIndex -Status 'running' -Message "Step $ItemStep of ${TotalSteps}: Creating folder '$FolderName'"
+                    $NewFolder = New-CIPPSharePointFolder -GroupId $GroupId -FolderName $FolderName -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName
+                    $Results.Add("[$TenantFilter] $($SiteTemplate.displayName): folder '$FolderName' $($NewFolder.Created ? 'created' : 'already existed')")
+                } catch {
+                    $FailMsg = "Folder '$FolderName' failed: $($_.Exception.Message)"
+                    $StepFailures.Add($FailMsg)
+                    $Results.Add("[$TenantFilter] $($SiteTemplate.displayName): $FailMsg")
+                    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "SharePoint template site '$($SiteTemplate.displayName)': $FailMsg" -sev Error
+                }
+            }
+
             if ($StepFailures.Count -gt 0) {
                 $FailureSummary = $StepFailures -join '; '
                 $Results.Add("[$TenantFilter] Site '$($SiteTemplate.displayName)' completed with failures at $SiteUrl")
diff --git a/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 b/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1
index 64cae16fa4f13..3631a6a513071 100644
--- a/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1
+++ b/Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1
@@ -27,7 +27,7 @@ function Invoke-CIPPTestCollection {
     [CmdletBinding()]
     param(
         [Parameter(Mandatory = $true)]
-        [ValidateSet('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'SMB1001', 'CopilotReadiness', 'GenericTests', 'E8', 'Custom')]
+        [ValidateSet('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'SMB1001', 'CopilotReadiness', 'GenericTests', 'E8', 'SecuritySimulations', 'Custom')]
         [string]$SuiteName,
 
         [Parameter(Mandatory = $true)]
diff --git a/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1 b/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1
index 116d4764adf9e..c836ec345d625 100644
--- a/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1
@@ -13,7 +13,7 @@ function New-CIPPAlertTemplate {
         $AlertComment,
         $CustomSubject
     )
-    $Appname = '[{"Application Name":"ACOM Azure Website","Application IDs":"23523755-3a2b-41ca-9315-f81f3f566a95"},{"Application Name":"AEM-DualAuth","Application IDs":"69893ee3-dd10-4b1c-832d-4870354be3d8"},{"Application Name":"ASM Campaign Servicing","Application IDs":"0cb7b9ec-5336-483b-bc31-b15b5788de71"},{"Application Name":"Azure Advanced Threat Protection","Application IDs":"7b7531ad-5926-4f2d-8a1d-38495ad33e17"},{"Application Name":"Azure Data Lake","Application IDs":"e9f49c6b-5ce5-44c8-925d-015017e9f7ad"},{"Application Name":"Azure Lab Services Portal","Application IDs":"835b2a73-6e10-4aa5-a979-21dfda45231c"},{"Application Name":"Azure Portal","Application IDs":"c44b4083-3bb0-49c1-b47d-974e53cbdf3c"},{"Application Name":"AzureSupportCenter","Application IDs":"37182072-3c9c-4f6a-a4b3-b3f91cacffce"},{"Application Name":"Bing","Application IDs":"9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7"},{"Application Name":"CPIM Service","Application IDs":"bb2a2e3a-c5e7-4f0a-88e0-8e01fd3fc1f4"},{"Application Name":"CRM Power BI Integration","Application IDs":"e64aa8bc-8eb4-40e2-898b-cf261a25954f"},{"Application Name":"Dataverse","Application IDs":"00000007-0000-0000-c000-000000000000"},{"Application Name":"Enterprise Roaming and Backup","Application IDs":"60c8bde5-3167-4f92-8fdb-059f6176dc0f"},{"Application Name":"IAM Supportability","Application IDs":"a57aca87-cbc0-4f3c-8b9e-dc095fdc8978"},{"Application Name":"IrisSelectionFrontDoor","Application IDs":"16aeb910-ce68-41d1-9ac3-9e1673ac9575"},{"Application Name":"MCAPI Authorization Prod","Application IDs":"d73f4b35-55c9-48c7-8b10-651f6f2acb2e"},{"Application Name":"Media Analysis and Transformation Service","Application IDs":"944f0bd1-117b-4b1c-af26-804ed95e767e<br>0cd196ee-71bf-4fd6-a57c-b491ffd4fb1e"},{"Application Name":"Microsoft 365 Support Service","Application IDs":"ee272b19-4411-433f-8f28-5c13cb6fd407"},{"Application Name":"Microsoft App Access Panel","Application IDs":"0000000c-0000-0000-c000-000000000000"},{"Application Name":"Microsoft Approval Management","Application IDs":"65d91a3d-ab74-42e6-8a2f-0add61688c74<br>38049638-cc2c-4cde-abe4-4479d721ed44"},{"Application Name":"Microsoft Authentication Broker","Application IDs":"29d9ed98-a469-4536-ade2-f981bc1d605e"},{"Application Name":"Microsoft Azure CLI","Application IDs":"04b07795-8ddb-461a-bbee-02f9e1bf7b46"},{"Application Name":"Microsoft Azure PowerShell","Application IDs":"1950a258-227b-4e31-a9cf-717495945fc2"},{"Application Name":"Microsoft Bing Search","Application IDs":"cf36b471-5b44-428c-9ce7-313bf84528de"},{"Application Name":"Microsoft Bing Search for Microsoft Edge","Application IDs":"2d7f3606-b07d-41d1-b9d2-0d0c9296a6e8"},{"Application Name":"Microsoft Bing Default Search Engine","Application IDs":"1786c5ed-9644-47b2-8aa0-7201292175b6"},{"Application Name":"Microsoft Defender for Cloud Apps","Application IDs":"3090ab82-f1c1-4cdf-af2c-5d7a6f3e2cc7"},{"Application Name":"Microsoft Docs","Application IDs":"18fbca16-2224-45f6-85b0-f7bf2b39b3f3"},{"Application Name":"Microsoft Dynamics ERP","Application IDs":"00000015-0000-0000-c000-000000000000"},{"Application Name":"Microsoft Edge Insider Addons Prod","Application IDs":"6253bca8-faf2-4587-8f2f-b056d80998a7"},{"Application Name":"Microsoft Exchange Online Protection","Application IDs":"00000007-0000-0ff1-ce00-000000000000"},{"Application Name":"Microsoft Forms","Application IDs":"c9a559d2-7aab-4f13-a6ed-e7e9c52aec87"},{"Application Name":"Microsoft Graph","Application IDs":"00000003-0000-0000-c000-000000000000"},{"Application Name":"Microsoft Intune Web Company Portal","Application IDs":"74bcdadc-2fdc-4bb3-8459-76d06952a0e9"},{"Application Name":"Microsoft Intune Windows Agent","Application IDs":"fc0f3af4-6835-4174-b806-f7db311fd2f3"},{"Application Name":"Microsoft Learn","Application IDs":"18fbca16-2224-45f6-85b0-f7bf2b39b3f3"},{"Application Name":"Microsoft Office","Application IDs":"d3590ed6-52b3-4102-aeff-aad2292ab01c"},{"Application Name":"Microsoft Office 365 Portal","Application IDs":"00000006-0000-0ff1-ce00-000000000000"},{"Application Name":"Microsoft Office Web Apps Service","Application IDs":"67e3df25-268a-4324-a550-0de1c7f97287"},{"Application Name":"Microsoft Online Syndication Partner Portal","Application IDs":"d176f6e7-38e5-40c9-8a78-3998aab820e7"},{"Application Name":"Microsoft password reset service","Application IDs":"93625bc8-bfe2-437a-97e0-3d0060024faa"},{"Application Name":"Microsoft Power BI","Application IDs":"871c010f-5e61-4fb1-83ac-98610a7e9110"},{"Application Name":"Microsoft Storefronts","Application IDs":"28b567f6-162c-4f54-99a0-6887f387bbcc"},{"Application Name":"Microsoft Stream Portal","Application IDs":"cf53fce8-def6-4aeb-8d30-b158e7b1cf83"},{"Application Name":"Microsoft Substrate Management","Application IDs":"98db8bd6-0cc0-4e67-9de5-f187f1cd1b41"},{"Application Name":"Microsoft Support","Application IDs":"fdf9885b-dd37-42bf-82e5-c3129ef5a302"},{"Application Name":"Microsoft Teams","Application IDs":"1fec8e78-bce4-4aaf-ab1b-5451cc387264"},{"Application Name":"Microsoft Teams Services","Application IDs":"cc15fd57-2c6c-4117-a88c-83b1d56b4bbe"},{"Application Name":"Microsoft Teams Web Client","Application IDs":"5e3ce6c0-2b1f-4285-8d4b-75ee78787346"},{"Application Name":"Microsoft Whiteboard Services","Application IDs":"95de633a-083e-42f5-b444-a4295d8e9314"},{"Application Name":"O365 Suite UX","Application IDs":"4345a7b9-9a63-4910-a426-35363201d503"},{"Application Name":"Office 365 Exchange Online","Application IDs":"00000002-0000-0ff1-ce00-000000000000"},{"Application Name":"Office 365 Management","Application IDs":"00b41c95-dab0-4487-9791-b9d2c32c80f2"},{"Application Name":"Office 365 Search Service","Application IDs":"66a88757-258c-4c72-893c-3e8bed4d6899"},{"Application Name":"Office 365 SharePoint Online","Application IDs":"00000003-0000-0ff1-ce00-000000000000"},{"Application Name":"Office Delve","Application IDs":"94c63fef-13a3-47bc-8074-75af8c65887a"},{"Application Name":"Office Online Add-in SSO","Application IDs":"93d53678-613d-4013-afc1-62e9e444a0a5"},{"Application Name":"Office Online Client AAD- Augmentation Loop","Application IDs":"2abdc806-e091-4495-9b10-b04d93c3f040"},{"Application Name":"Office Online Client AAD- Loki","Application IDs":"b23dd4db-9142-4734-867f-3577f640ad0c"},{"Application Name":"Office Online Client AAD- Maker","Application IDs":"17d5e35f-655b-4fb0-8ae6-86356e9a49f5"},{"Application Name":"Office Online Client MSA- Loki","Application IDs":"b6e69c34-5f1f-4c34-8cdf-7fea120b8670"},{"Application Name":"Office Online Core SSO","Application IDs":"243c63a3-247d-41c5-9d83-7788c43f1c43"},{"Application Name":"Office Online Search","Application IDs":"a9b49b65-0a12-430b-9540-c80b3332c127"},{"Application Name":"Office.com","Application IDs":"4b233688-031c-404b-9a80-a4f3f2351f90"},{"Application Name":"Office365 Shell WCSS-Client","Application IDs":"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7"},{"Application Name":"OfficeClientService","Application IDs":"0f698dd4-f011-4d23-a33e-b36416dcb1e6"},{"Application Name":"OfficeHome","Application IDs":"4765445b-32c6-49b0-83e6-1d93765276ca"},{"Application Name":"OfficeShredderWacClient","Application IDs":"4d5c2d63-cf83-4365-853c-925fd1a64357"},{"Application Name":"OMSOctopiPROD","Application IDs":"62256cef-54c0-4cb4-bcac-4c67989bdc40"},{"Application Name":"OneDrive SyncEngine","Application IDs":"ab9b8c07-8f02-4f72-87fa-80105867a763"},{"Application Name":"OneNote","Application IDs":"2d4d3d8e-2be3-4bef-9f87-7875a61c29de"},{"Application Name":"Outlook Mobile","Application IDs":"27922004-5251-4030-b22d-91ecd9a37ea4"},{"Application Name":"Partner Customer Delegated Admin Offline Processor","Application IDs":"a3475900-ccec-4a69-98f5-a65cd5dc5306"},{"Application Name":"Password Breach Authenticator","Application IDs":"bdd48c81-3a58-4ea9-849c-ebea7f6b6360"},{"Application Name":"Power BI Service","Application IDs":"00000009-0000-0000-c000-000000000000"},{"Application Name":"SharedWithMe","Application IDs":"ffcb16e8-f789-467c-8ce9-f826a080d987"},{"Application Name":"SharePoint Online Web Client Extensibility","Application IDs":"08e18876-6177-487e-b8b5-cf950c1e598c"},{"Application Name":"Signup","Application IDs":"b4bddae8-ab25-483e-8670-df09b9f1d0ea"},{"Application Name":"Skype for Business Online","Application IDs":"00000004-0000-0ff1-ce00-000000000000"},{"Application Name":"Sway","Application IDs":"905fcf26-4eb7-48a0-9ff0-8dcc7194b5ba"},{"Application Name":"Universal Store Native Client","Application IDs":"268761a2-03f3-40df-8a8b-c3db24145b6b"},{"Application Name":"Vortex [wsfed enabled]","Application IDs":"5572c4c0-d078-44ce-b81c-6cbf8d3ed39e"},{"Application Name":"Windows Azure Active Directory","Application IDs":"00000002-0000-0000-c000-000000000000"},{"Application Name":"Windows Azure Service Management API","Application IDs":"797f4846-ba00-4fd7-ba43-dac1f8f63013"},{"Application Name":"WindowsDefenderATP Portal","Application IDs":"a3b79187-70b2-4139-83f9-6016c58cd27b"},{"Application Name":"Windows Search","Application IDs":"26a7ee05-5602-4d76-a7ba-eae8b7b67941"},{"Application Name":"Windows Spotlight","Application IDs":"1b3c667f-cde3-4090-b60b-3d2abd0117f0"},{"Application Name":"Windows Store for Business","Application IDs":"45a330b1-b1ec-4cc1-9161-9f03992aa49f"},{"Application Name":"Yammer","Application IDs":"00000005-0000-0ff1-ce00-000000000000"},{"Application Name":"Yammer Web","Application IDs":"c1c74fed-04c9-4704-80dc-9f79a2e515cb"},{"Application Name":"Yammer Web Embed","Application IDs":"e1ef36fd-b883-4dbf-97f0-9ece4b576fc6"}]' | ConvertFrom-Json | Where-Object -Property 'Application IDs' -EQ $data.applicationId
+    $AppName = Get-CIPPMicrosoftFirstPartyApp -AppId "$($data.applicationId)"
     $TemplatePath = Join-Path $env:CIPPRootPath 'Config\TemplateEmail.html'
     $HTMLTemplate = Get-Content $TemplatePath -Raw | Out-String
     $Title = ''
@@ -39,6 +39,97 @@ function New-CIPPAlertTemplate {
         $AfterButtonText = 'Click the button above to go to the logbook and investigate the deviations. You can also use the standards page to remediate the deviations.'
     }
 
+    if ($InputObject -eq 'baseline') {
+        $Alerts = @($Data)
+        $DriftAlerts = @($Alerts | Where-Object { $_.Event -eq 'Drift' })
+        $RemediatedAlerts = @($Alerts | Where-Object { $_.Event -eq 'Remediated' })
+        $ConflictAlerts = @($Alerts | Where-Object { $_.Event -eq 'Conflict' })
+
+        $Title = if ($Alerts.Count -eq 1) {
+            switch ($Alerts[0].Event) {
+                'Remediated' { "$($Tenant) - Baseline: fixed automatically - $($Alerts[0].Label)" }
+                'Conflict' { "$($Tenant) - Baseline conflict: $($Alerts[0].Label)" }
+                default { "$($Tenant) - Baseline change detected: $($Alerts[0].Label)" }
+            }
+        } else {
+            $TitleParts = [System.Collections.Generic.List[string]]::new()
+            if ($DriftAlerts.Count -gt 0) { $TitleParts.Add("$($DriftAlerts.Count) need$(if ($DriftAlerts.Count -eq 1) { 's' }) review") }
+            if ($RemediatedAlerts.Count -gt 0) { $TitleParts.Add("$($RemediatedAlerts.Count) fixed automatically") }
+            if ($ConflictAlerts.Count -gt 0) { $TitleParts.Add("$($ConflictAlerts.Count) in conflict") }
+            "$($Tenant) - Baseline: $($TitleParts -join ', ')"
+        }
+
+        $Encode = { param($Value) [System.Net.WebUtility]::HtmlEncode("$Value") }
+        $MutedStyle = 'color:#6b7280;font-size:13px'
+
+        # Status is the one thing every reader scans for, so it carries color: red needs a
+        # decision, green is already handled, amber cannot run.
+        $StatusCell = @{
+            'Drift'      = '<strong style="color:#b42318">Needs review</strong>'
+            'Remediated' = '<strong style="color:#067647">Fixed automatically</strong>'
+            'Conflict'   = '<strong style="color:#b54708">Conflict</strong>'
+        }
+        $SummaryHTML = '<table class="table-modern"><tr><th>Standard</th><th>Status</th></tr>'
+        foreach ($Alert in $Alerts) {
+            $BaselineNote = "$($Alert.Baseline)$(if ($Alert.Stage) { " · stage $($Alert.Stage)" })"
+            $SummaryHTML += ('<tr><td><strong>{0}</strong><br /><span style="{1}">{2}</span></td><td>{3}</td></tr>' -f `
+                (& $Encode $Alert.Label), $MutedStyle, (& $Encode $BaselineNote), ($StatusCell[[string]$Alert.Event] ?? (& $Encode $Alert.Event)))
+        }
+        $SummaryHTML += '</table>'
+        $IntroText = "<p>You've set your baseline to alert when a tenant moves away from it. Here is what changed on <strong>$(& $Encode $Tenant)</strong>:</p>$SummaryHTML"
+
+        if ($RemediatedAlerts.Count -gt 0) {
+            $IntroText += "<p>CIPP has already put the automatically fixed standard$(if ($RemediatedAlerts.Count -ne 1) { 's' }) back to the agreed value - those need no action.</p>"
+        }
+        $FormatDiffValue = {
+            param($Value)
+            if ($null -eq $Value -or "$Value" -eq '') { return '(not set)' }
+            if ($Value -is [bool]) { return $(if ($Value) { 'On' } else { 'Off' }) }
+            $Text = "$Value"
+            if ($Text.Length -gt 120) { $Text = "$($Text.Substring(0, 117))..." }
+            & $Encode $Text
+        }
+        $DetailAlerts = @($DriftAlerts + $ConflictAlerts)
+        $DetailShown = 0
+        foreach ($Alert in $DetailAlerts) {
+            if ($DetailShown -eq 0) {
+                $IntroText += '<h2 style="margin-bottom:0">What needs your attention</h2>'
+            }
+            if ($DetailShown -ge 6) {
+                $IntroText += "<p>...and $($DetailAlerts.Count - $DetailShown) more - the alignment page shows every difference.</p>"
+                break
+            }
+            $IntroText += "<h3 style=`"margin-bottom:2px`">$(& $Encode $Alert.Label)</h3>"
+            if (![string]::IsNullOrWhiteSpace($Alert.Description)) {
+                $IntroText += "<p style=`"$MutedStyle;margin:2px 0 8px 0`">$(& $Encode $Alert.Description)</p>"
+            }
+            if ($Alert.Event -eq 'Conflict') {
+                $IntroText += "<p>Two baselines configure this standard with different settings ($(& $Encode (@($Alert.ConflictWith) -join ' and '))). CIPP cannot pick a side, so nothing runs for it until one of them changes.</p>"
+                $DetailShown++
+                continue
+            }
+            $Differences = @($Alert.Differences)
+            if ($Differences.Count -gt 0) {
+                $DiffHTML = '<table class="table-modern"><tr><th>Setting</th><th>Should be</th><th>Is now</th></tr>'
+                foreach ($Difference in ($Differences | Select-Object -First 8)) {
+                    $DiffHTML += ('<tr><td>{0}</td><td><strong>{1}</strong></td><td>{2}</td></tr>' -f `
+                        (& $Encode $Difference.Property), (& $FormatDiffValue $Difference.ExpectedValue), (& $FormatDiffValue $Difference.ReceivedValue))
+                }
+                $DiffHTML += '</table>'
+                $IntroText += $DiffHTML
+                if ($Differences.Count -gt 8) {
+                    $IntroText += "<p>...and $($Differences.Count - 8) more difference$(if (($Differences.Count - 8) -ne 1) { 's' }) on this standard.</p>"
+                }
+            } else {
+                $IntroText += '<p>This standard no longer matches its agreed configuration.</p>'
+            }
+            $DetailShown++
+        }
+
+        $ButtonUrl = "$CIPPURL/tenant/baselines/alignment?tenantFilter=$($Tenant)"
+        $ButtonText = 'Review baseline alignment'
+        $AfterButtonText = '<p>From the alignment page you can remediate a deviation, accept it as an agreed exception with a reason, or inspect every value that differs.</p>'
+    }
     if ($InputObject -eq 'sherwebmig') {
         $DataHTML = ($Data | ConvertTo-Html -Fragment | Out-String).Replace('<table>', ' <table class="table-modern">')
         $IntroText = "<p>The following licenses have not yet been found at Sherweb, and are expiring within 7 days:</p>$dataHTML"
@@ -125,7 +216,7 @@ function New-CIPPAlertTemplate {
         $ButtonText = 'View custom test results'
     }
     if ($InputObject -eq 'auditlog') {
-        $ButtonUrl = "$CIPPURL/identity/administration/users/user/bec?userId=$($data.ObjectId)&tenantFilter=$Tenant"
+        $ButtonUrl = "$CIPPURL/identity/administration/bec/case?userId=$($data.ObjectId)&tenantFilter=$Tenant"
         $ButtonText = 'User Management'
         $AfterButtonText = '<p>If this is incorrect, use the user management screen to block the user and revoke the sessions</p>'
         switch ($Data.Operation) {
@@ -150,7 +241,7 @@ function New-CIPPAlertTemplate {
                     $LocationTable = ($LocationInfo | ConvertTo-Html -Fragment -As List | Out-String).Replace('<table>', ' <table class="table-modern">')
                     $IntroText = $IntroText + "<p>The (potential) location information for this IP is as follows:</p>$LocationTable"
                 }
-                $ButtonUrl = "$CIPPURL/identity/administration/users/user/bec?userId=$($data.UserId)&tenantFilter=$Tenant"
+                $ButtonUrl = "$CIPPURL/identity/administration/bec/case?userId=$($data.UserId)&tenantFilter=$Tenant"
                 $ButtonText = 'Start BEC Investigation'
                 $AfterButtonText = '<p>If you believe this is a suspect rule, you can click the button above to start the investigation.</p>'
             }
@@ -163,7 +254,7 @@ function New-CIPPAlertTemplate {
                     $LocationTable = ($LocationInfo | ConvertTo-Html -Fragment -As List | Out-String).Replace('<table>', ' <table class="table-modern">')
                     $IntroText = $IntroText + "<p>The (potential) location information for this IP is as follows:</p>$LocationTable"
                 }
-                $ButtonUrl = "$CIPPURL/identity/administration/users/user/bec?userId=$($data.UserId)&tenantFilter=$Tenant"
+                $ButtonUrl = "$CIPPURL/identity/administration/bec/case?userId=$($data.UserId)&tenantFilter=$Tenant"
                 $ButtonText = 'Start BEC Investigation'
                 $AfterButtonText = '<p>If you believe this is a suspect rule, you can click the button above to start the investigation.</p>'
             }
@@ -258,7 +349,7 @@ function New-CIPPAlertTemplate {
 
             }
             'Add service principal.' {
-                if ($Appname) { $AppName = $AppName.'Application Name' } else { $appName = $data.ApplicationId }
+                if (-not $AppName) { $AppName = $data.ApplicationId }
                 $Title = "$($Tenant) - Service Principal $($data.ObjectId) has been added."
                 $Table = ($data.ModifiedProperties | ConvertTo-Html -Fragment | Out-String).Replace('<table>', ' <table class="table-modern">')
                 if ($ActionResults) { $IntroText = $IntroText + "<p>Based on the rule, the following actions have been taken: $($ActionResults -join '<br/>' )</p>" }
@@ -271,7 +362,7 @@ function New-CIPPAlertTemplate {
                 $ButtonText = 'Enterprise Apps'
             }
             'Remove service principal.' {
-                if ($Appname) { $AppName = $AppName.'Application Name' } else { $appName = $data.ApplicationId }
+                if (-not $AppName) { $AppName = $data.ApplicationId }
                 $Title = "$($Tenant) - Service Principal $($data.ObjectId) has been removed."
                 $Table = ($data.CIPPModifiedProperties | ConvertFrom-Json | ConvertTo-Html -Fragment | Out-String).Replace('<table>', ' <table class="table-modern">')
                 if ($ActionResults) { $IntroText = $IntroText + "<p>Based on the rule, the following actions have been taken: $($ActionResults -join '<br/>' )</p>" }
@@ -285,7 +376,7 @@ function New-CIPPAlertTemplate {
             }
             'UserLoggedIn' {
                 $Table = ($data | ConvertTo-Html -Fragment -As List | Out-String).Replace('<table>', ' <table class="table-modern">')
-                if ($Appname) { $AppName = $AppName.'Application Name' } else { $appName = $data.ApplicationId }
+                if (-not $AppName) { $AppName = $data.ApplicationId }
                 $Title = "$($Tenant) - a user has logged on from a location you've set up to receive alerts for."
                 $IntroText = "$($data.UserId) ($($data.Userkey)) has logged on from IP $($data.ClientIP) to the application $($Appname). According to our database this is located in $($LocationInfo.CountryOrRegion) - $($LocationInfo.City). <br/><br> You have set up alerts to be notified when this happens. See the table below for more info.$Table"
                 if ($ActionResults) { $IntroText = $IntroText + "<p>Based on the rule, the following actions have been taken: $($ActionResults -join '<br/>' )</p>" }
@@ -293,7 +384,7 @@ function New-CIPPAlertTemplate {
                     $LocationTable = ($LocationInfo | ConvertTo-Html -Fragment -As List | Out-String).Replace('<table>', ' <table class="table-modern">')
                     $IntroText = $IntroText + "<p>The (potential) location information for this IP is as follows:</p>$LocationTable"
                 }
-                $ButtonUrl = "$CIPPURL/identity/administration/users/user/bec?userId=$($data.Userkey)&tenantFilter=$Tenant"
+                $ButtonUrl = "$CIPPURL/identity/administration/bec/case?userId=$($data.Userkey)&tenantFilter=$Tenant"
                 $ButtonText = 'User Management'
                 $AfterButtonText = '<p>If this is incorrect, use the user management screen to block the user and revoke the sessions</p>'
             }
diff --git a/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1 b/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1
index 96e7b2c4ad42c..619043307b2ac 100644
--- a/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPBackupTask.ps1
@@ -144,6 +144,16 @@ function New-CIPPBackupTask {
             }
         }
 
+        'teamsvoice' {
+            Measure-CippTask -TaskName 'TeamsVoice' -EventName 'CIPP.BackupCompleted' -Script {
+                # Keep only what assignNumber can recreate: numbers held by a user or resource account.
+                # Unassigned numbers carry nothing to restore; policyAssigned targets a shared-calling policy.
+                New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/admin/teams/telephoneNumberManagement/numberAssignments' -tenantid $TenantFilter |
+                    Where-Object { $_.assignmentStatus -in @('userAssigned', 'voiceApplicationAssigned') -and $_.assignmentTargetId } |
+                    Select-Object telephoneNumber, assignmentTargetId, assignmentStatus, assignmentCategory, numberType, locationId
+            }
+        }
+
         'CippWebhookAlerts' {
             Measure-CippTask -TaskName 'WebhookAlerts' -EventName 'CIPP.BackupCompleted' -Script {
                 $WebhookTable = Get-CIPPTable -TableName 'WebhookRules'
diff --git a/Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1 b/Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1
index 0ce44860f248d..7c421215dfe45 100644
--- a/Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1
@@ -248,6 +248,11 @@ function New-CIPPIntuneAppDeployment {
                 APIName       = $APIName
             }
             if ($AppTypeForAssignment) { $AssignParams.AppType = $AppTypeForAssignment }
+            # Group ids queued by the deploy drawer's single-tenant picker; they win over the
+            # name resolution of assignTo/excludeGroup inside Set-CIPPAssignedApplication.
+            # '@($null).Count' is 1, so test the value before counting it.
+            if ($AppConfig.GroupIds -and @($AppConfig.GroupIds).Count -gt 0) { $AssignParams.GroupIds = @($AppConfig.GroupIds) }
+            if ($AppConfig.ExcludeGroupIds -and @($AppConfig.ExcludeGroupIds).Count -gt 0) { $AssignParams.ExcludeGroupIds = @($AppConfig.ExcludeGroupIds) }
             Set-CIPPAssignedApplication @AssignParams
         }
     }
diff --git a/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1 b/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1
index 2f50b17a2ffc4..4a4e710ad1799 100644
--- a/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1
@@ -7,6 +7,18 @@ function New-CIPPIntuneTemplate {
         $CIPPURL,
         $ODataType
     )
+    # App Protection and MAM App Configuration list rows (Invoke-ListAppProtectionPolicies) carry the
+    # concrete @odata.type as their URLName. Map it into the managedAppPolicies bucket and derive
+    # $ODataType so that branch fetches from the correct concrete collection - the generic
+    # managedAppPolicies collection rejects a fetch-by-id for an app configuration policy ("Invalid Id").
+    $ManagedAppPolicyTypes = @(
+        'androidManagedAppProtection', 'iosManagedAppProtection', 'windowsManagedAppProtection',
+        'mdmWindowsInformationProtectionPolicy', 'targetedManagedAppConfiguration', 'defaultManagedAppProtection'
+    )
+    if ($URLName -in $ManagedAppPolicyTypes) {
+        if (-not $ODataType) { $ODataType = "#microsoft.graph.$URLName" }
+        $URLName = 'managedAppPolicies'
+    }
     if ($ODataType) {
         switch -wildcard ($ODataType) {
             '*CompliancePolicy' {
@@ -115,6 +127,12 @@ function New-CIPPIntuneTemplate {
             if ($Template.omaSettings) {
                 Write-Information "Checking for encrypted OMA settings in policy: $($Template.displayName)"
                 $Template = Get-CIPPOmaSettingDecryptedValue -DeviceConfiguration $Template -DeviceConfigurationId $ID -TenantFilter $TenantFilter
+                # The decrypt helper is best-effort and leaves Intune's placeholder behind on failure. No
+                # tenant accepts that on create, so refuse to store a template that can never deploy.
+                $EncryptedOma = @($Template.omaSettings | Where-Object { $_.secretReferenceValueId -or $_.isEncrypted -eq $true -or $_.value -eq 'PGEvPg==' })
+                if ($EncryptedOma.Count -gt 0) {
+                    throw "Could not decrypt OMA-URI setting(s) '$($EncryptedOma.displayName -join "', '")', template not saved. Check the logbook, and that CIPP has DeviceManagementConfiguration.Read.All on the tenant."
+                }
             }
 
             $DisplayName = $Template.displayName
@@ -124,35 +142,10 @@ function New-CIPPIntuneTemplate {
             $Type = 'Admin'
             $Template = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)('$($ID)')" -tenantid $TenantFilter
             $DisplayName = $Template.displayName
-            $TemplateJsonItems = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)('$($ID)')/definitionValues?`$expand=definition" -tenantid $TenantFilter
-            $TemplateJsonSource = foreach ($TemplateJsonItem in $TemplateJsonItems) {
-                $presentationValues = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/$($urlname)('$($ID)')/definitionValues('$($TemplateJsonItem.id)')/presentationValues?`$expand=presentation" -tenantid $TenantFilter | ForEach-Object {
-                    $obj = $_
-                    if ($obj.id) {
-                        $PresObj = @{
-                            id                        = $obj.id
-                            'presentation@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($TemplateJsonItem.definition.id)')/presentations('$($obj.presentation.id)')"
-                        }
-                        if ($obj.values) { $PresObj['values'] = $obj.values }
-                        if ($obj.value) { $PresObj['value'] = $obj.value }
-                        if ($obj.'@odata.type') { $PresObj['@odata.type'] = $obj.'@odata.type' }
-                        [pscustomobject]$PresObj
-                    }
-                }
-                [PSCustomObject]@{
-                    'definition@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($TemplateJsonItem.definition.id)')"
-                    enabled                 = $TemplateJsonItem.enabled
-                    presentationValues      = @($presentationValues)
-                }
-            }
-            $inputvar = [pscustomobject]@{
-                added      = @($TemplateJsonSource)
-                updated    = @()
-                deletedIds = @()
-
-            }
-
-
+            # Each setting's identity (name, category, class, presentation position) is recorded next
+            # to its bind: a definition from an imported ADMX file has a different id in every tenant,
+            # and the identity is what Resolve-CIPPIntuneAdminTemplateBinding matches on at deployment.
+            $inputvar = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $ID -TenantFilter $TenantFilter -IncludeIdentity
             $TemplateJson = (ConvertTo-Json -InputObject $inputvar -Depth 100 -Compress)
         }
         'windowsFeatureUpdateProfiles' {
diff --git a/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1 b/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1
index 28bbbb2be7a65..a0e1edec7ba1a 100644
--- a/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPRestoreTask.ps1
@@ -32,6 +32,7 @@ function New-CIPPRestoreTask {
         'IntuneProtection'  = @{ success = 0; failed = 0 }
         'AntiSpam'          = @{ success = 0; failed = 0 }
         'AntiPhishing'      = @{ success = 0; failed = 0 }
+        'TeamsPhoneNumbers' = @{ success = 0; failed = 0 }
         'WebhookAlerts'     = @{ success = 0; failed = 0 }
         'ScriptedAlerts'    = @{ success = 0; failed = 0 }
     }
@@ -676,6 +677,78 @@ function New-CIPPRestoreTask {
                 }
             }
         }
+        'teamsvoice' {
+            Write-Host "Restore Teams phone number assignments for $TenantFilter"
+            $Backup = if ($BackupData.teamsvoice -is [string]) { $BackupData.teamsvoice | ConvertFrom-Json } else { $BackupData.teamsvoice }
+            $BaseUri = 'https://graph.microsoft.com/v1.0/admin/teams/telephoneNumberManagement/numberAssignments'
+            try {
+                $LiveNumbers = New-GraphGetRequest -uri $BaseUri -tenantid $TenantFilter
+                # One POST per number: $batch fails with an IIS 'Request Too Long' page (see Remove-CIPPUserTeamsPhoneDIDs).
+                foreach ($Number in $Backup) {
+                    $PhoneNumber = $Number.telephoneNumber
+                    try {
+                        $Live = $LiveNumbers | Where-Object { $_.telephoneNumber -eq $PhoneNumber } | Select-Object -First 1
+                        # assignmentCategory can only change through unassign + assign (updateNumber does not take it),
+                        # so a same-holder category change falls through to the overwrite move path below.
+                        $CategoryChanged = $Number.assignmentCategory -and $Live.assignmentCategory -and $Live.assignmentCategory -ne $Number.assignmentCategory
+                        if ($Live.assignmentTargetId -eq $Number.assignmentTargetId -and -not ($overwrite -and $CategoryChanged)) {
+                            if ($overwrite -and $Number.locationId -and $Live.locationId -ne $Number.locationId) {
+                                # Same holder, different emergency location: updateNumber is synchronous and only touches the optional attributes.
+                                $UpdateBody = @{ telephoneNumber = $PhoneNumber; locationId = $Number.locationId }
+                                $null = New-GraphPOSTRequest -uri "$BaseUri/updateNumber" -tenantid $TenantFilter -body ($UpdateBody | ConvertTo-Json -Compress) -type POST
+                                $restorationStats['TeamsPhoneNumbers'].success++
+                                Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message "Restored emergency location of Teams phone number $PhoneNumber from backup" -Sev 'Info'
+                                $RestoreData.Add("Restored emergency location of Teams phone number $PhoneNumber")
+                            } else {
+                                $RestoreData.Add("Teams phone number $PhoneNumber is already assigned to $($Number.assignmentTargetId)")
+                            }
+                            continue
+                        }
+                        $NumberType = Get-CippTeamsNumberType -NumberType $Number.numberType
+                        if ($Live.assignmentStatus -ne 'unassigned' -and $Live.assignmentTargetId) {
+                            if (-not $overwrite) {
+                                $RestoreData.Add("Teams phone number $PhoneNumber is assigned to $($Live.assignmentTargetId) and overwrite is disabled")
+                                continue
+                            }
+                            $UnassignBody = @{ telephoneNumber = $PhoneNumber; numberType = $NumberType }
+                            $null = New-GraphPOSTRequest -uri "$BaseUri/unassignNumber" -tenantid $TenantFilter -body ($UnassignBody | ConvertTo-Json -Compress) -type POST
+                            # unassignNumber is async (202); assigning before it lands fails because the number is still held.
+                            # ponytail: fixed 30s poll of the full list, follow the 202 Location operation URL once New-GraphPOSTRequest exposes response headers.
+                            $Attempts = 0
+                            do {
+                                Start-Sleep -Seconds 3
+                                $Attempts++
+                                $Current = New-GraphGetRequest -uri $BaseUri -tenantid $TenantFilter | Where-Object { $_.telephoneNumber -eq $PhoneNumber } | Select-Object -First 1
+                            } while ($Current.assignmentStatus -ne 'unassigned' -and $Attempts -lt 10)
+                            if ($Current.assignmentStatus -ne 'unassigned') {
+                                throw "Unassignment of $PhoneNumber from $($Live.assignmentTargetId) did not complete in time, run the restore again"
+                            }
+                        }
+                        $AssignBody = @{
+                            telephoneNumber    = $PhoneNumber
+                            assignmentTargetId = $Number.assignmentTargetId
+                            numberType         = $NumberType
+                        }
+                        if ($Number.assignmentCategory) { $AssignBody.assignmentCategory = $Number.assignmentCategory }
+                        if ($Number.locationId) { $AssignBody.locationId = $Number.locationId }
+                        # assignNumber is asynchronous: 202 Accepted, Enterprise Voice is enabled on the target as a side effect.
+                        $null = New-GraphPOSTRequest -uri "$BaseUri/assignNumber" -tenantid $TenantFilter -body ($AssignBody | ConvertTo-Json -Compress) -type POST
+                        $restorationStats['TeamsPhoneNumbers'].success++
+                        Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message "Submitted assignment of Teams phone number $PhoneNumber to $($Number.assignmentTargetId) from backup" -Sev 'Info'
+                        $RestoreData.Add("Submitted assignment of Teams phone number $PhoneNumber to $($Number.assignmentTargetId)")
+                    } catch {
+                        $restorationStats['TeamsPhoneNumbers'].failed++
+                        $ErrorMessage = Get-CippException -Exception $_
+                        Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message "Could not restore Teams phone number $PhoneNumber : $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+                        $RestoreData.Add("Could not restore Teams phone number $PhoneNumber : $($ErrorMessage.NormalizedError)")
+                    }
+                }
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-LogMessage -Headers $Headers -API $APINAME -tenant $TenantFilter -message "Could not restore Teams phone numbers: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+                $RestoreData.Add("Could not restore Teams phone numbers: $($ErrorMessage.NormalizedError)")
+            }
+        }
         'CippWebhookAlerts' {
             Write-Host "Restore Webhook Alerts for $TenantFilter"
             $WebhookTable = Get-CIPPTable -TableName 'WebhookRules'
diff --git a/Modules/CIPPCore/Public/New-CIPPSPOAdminListViewXml.ps1 b/Modules/CIPPCore/Public/New-CIPPSPOAdminListViewXml.ps1
index d74f7c882045c..6dcbc551a1a94 100644
--- a/Modules/CIPPCore/Public/New-CIPPSPOAdminListViewXml.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPSPOAdminListViewXml.ps1
@@ -23,6 +23,7 @@ function New-CIPPSPOAdminListViewXml {
 
     .PARAMETER ExcludeTemplates
     TemplateName values to exclude via Neq. Mutually exclusive with IncludeTemplates.
+    Teams channel sites (TEAMCHANNEL#0/#1) are included by default, unlike the admin UI.
 
     .PARAMETER IncludeTemplates
     TemplateName values to include via In. Mutually exclusive with ExcludeTemplates.
@@ -68,7 +69,7 @@ function New-CIPPSPOAdminListViewXml {
         [AllowNull()]
         [object]$ExcludeState = 0,
 
-        [string[]]$ExcludeTemplates = @('TEAMCHANNEL#0', 'TEAMCHANNEL#1'),
+        [string[]]$ExcludeTemplates = @(),
 
         [string[]]$IncludeTemplates = @(),
 
diff --git a/Modules/CIPPCore/Public/New-CIPPSharePointFolder.ps1 b/Modules/CIPPCore/Public/New-CIPPSharePointFolder.ps1
new file mode 100644
index 0000000000000..14168f10da032
--- /dev/null
+++ b/Modules/CIPPCore/Public/New-CIPPSharePointFolder.ps1
@@ -0,0 +1,114 @@
+function New-CIPPSharePointFolder {
+    <#
+    .SYNOPSIS
+    Create a folder at the root of a Team's default Documents library
+
+    .DESCRIPTION
+    Creates a folder as a sibling of the General channel folder under the team's Documents
+    drive root via Microsoft Graph. If a folder (or item) with the same name already exists
+    it is returned instead. The reserved name "General" is refused.
+
+    .PARAMETER GroupId
+    The Team / M365 group id whose default drive (Documents) hosts the folder
+
+    .PARAMETER FolderName
+    Name of the folder to create at the drive root
+
+    .PARAMETER TenantFilter
+    The tenant the Team belongs to
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$GroupId,
+
+        [Parameter(Mandatory = $true)]
+        [string]$FolderName,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        $APIName = 'Create SharePoint Folder',
+        $Headers
+    )
+
+    $TrimmedName = $FolderName.Trim()
+    if (-not $TrimmedName) {
+        throw 'Folder name is required.'
+    }
+    if ($TrimmedName -ieq 'General') {
+        throw 'Folder name "General" is reserved for the default channel folder.'
+    }
+
+    $DriveRootChildrenUri = "https://graph.microsoft.com/v1.0/groups/$GroupId/drive/root/children"
+    $EscapedPathName = [uri]::EscapeDataString($TrimmedName)
+    $ExistingItemUri = "https://graph.microsoft.com/v1.0/groups/$GroupId/drive/root:/${EscapedPathName}"
+
+    # Wait briefly for the Documents drive after Team provision.
+    $DriveReady = $false
+    $Attempts = 0
+    do {
+        $Attempts++
+        try {
+            $null = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/drive?`$select=id" -tenantid $TenantFilter -AsApp $true
+            $DriveReady = $true
+        } catch {
+            if ($Attempts -lt 8) { Start-Sleep -Seconds 5 }
+        }
+    } while (-not $DriveReady -and $Attempts -lt 8)
+
+    if (-not $DriveReady) {
+        throw "Documents drive for team $GroupId was not available yet. Folder '$TrimmedName' was not created."
+    }
+
+    # Idempotency: reuse an existing root item with this name.
+    try {
+        $Existing = New-GraphGetRequest -uri "$ExistingItemUri`?`$select=id,name,folder" -tenantid $TenantFilter -AsApp $true
+        if ($Existing.id) {
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Folder $TrimmedName already exists on team $GroupId Documents root, reusing it." -sev Info
+            return [PSCustomObject]@{
+                ItemId  = $Existing.id
+                Name    = $Existing.name
+                Created = $false
+            }
+        }
+    } catch {
+        # 404 means the folder does not exist yet, which is the normal path.
+    }
+
+    if (-not $PSCmdlet.ShouldProcess($TrimmedName, "Create folder on team $GroupId Documents root")) { return }
+
+    try {
+        $Body = ConvertTo-Json -Compress -InputObject @{
+            name                                   = $TrimmedName
+            folder                                 = @{}
+            '@microsoft.graph.conflictBehavior'    = 'fail'
+        }
+        $NewFolder = New-GraphPostRequest -uri $DriveRootChildrenUri -tenantid $TenantFilter -type POST -body $Body -AsApp $true
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully created folder $TrimmedName on team $GroupId Documents root" -sev Info
+        return [PSCustomObject]@{
+            ItemId  = $NewFolder.id
+            Name    = $NewFolder.name
+            Created = $true
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        # Race / concurrent create: treat name conflict as success via re-fetch.
+        if ($ErrorMessage.NormalizedError -match 'nameAlreadyExists|conflict|409') {
+            try {
+                $Existing = New-GraphGetRequest -uri "$ExistingItemUri`?`$select=id,name,folder" -tenantid $TenantFilter -AsApp $true
+                if ($Existing.id) {
+                    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Folder $TrimmedName already exists on team $GroupId Documents root, reusing it." -sev Info
+                    return [PSCustomObject]@{
+                        ItemId  = $Existing.id
+                        Name    = $Existing.name
+                        Created = $false
+                    }
+                }
+            } catch {}
+        }
+        $Result = "Failed to create folder $TrimmedName on team $GroupId Documents root. Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage
+        throw $Result
+    }
+}
diff --git a/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1 b/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1
index d8be8d93685bd..0c2537ebb8c09 100644
--- a/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1
@@ -16,7 +16,12 @@ function New-CIPPSharepointSite {
     The username of the site owner
 
     .PARAMETER TemplateName
-    The template to use for the site. Default is Communication
+    The template to use for the site. Default is Communication.
+    Communication = SITEPAGEPUBLISHING#0, Team = STS#3 (no group), TeamGroup = GROUP#0 team site
+    backed by a new Microsoft 365 group (created app-only via Graph; SiteDesign and Lcid are ignored).
+
+    .PARAMETER IsPublic
+    TeamGroup only: create the Microsoft 365 group as public. Default is private.
 
     .PARAMETER SiteDesign
     The design to use for the site. Default is Topic
@@ -50,9 +55,11 @@ function New-CIPPSharepointSite {
         [string]$SiteOwner,
 
         [Parameter(Mandatory = $false)]
-        [ValidateSet('Communication', 'Team')]
+        [ValidateSet('Communication', 'Team', 'TeamGroup')]
         [string]$TemplateName = 'Communication',
 
+        [switch]$IsPublic,
+
         [Parameter(Mandatory = $false)]
         [ValidateSet('Topic', 'Showcase', 'Blank', 'Custom')]
         [string]$SiteDesign = 'Showcase',
@@ -128,6 +135,58 @@ function New-CIPPSharepointSite {
         $ResolvedLcid = 1033
     }
 
+    # Group-connected team site (GROUP#0): SPSiteManager cannot create these, and SharePoint's
+    # GroupSiteManager/CreateGroupEx rejects the GDAP/SAM caller with UnauthorizedAccessException.
+    # Create the M365 group app-only via Graph (like New-CIPPTeam) and let SharePoint provision
+    # the site. Site designs and Lcid do not apply here; the site uses the tenant default language.
+    if ($TemplateName -eq 'TeamGroup') {
+        $GroupBody = @{
+            displayName        = $SiteName
+            description        = $SiteDescription
+            mailNickname       = $SitePath
+            mailEnabled        = $true
+            securityEnabled    = $false
+            groupTypes         = @('Unified')
+            visibility         = if ($IsPublic) { 'Public' } else { 'Private' }
+            'owners@odata.bind' = @("https://graph.microsoft.com/v1.0/users/$SiteOwner")
+        }
+        if ($SensitivityLabel) { $GroupBody.assignedLabels = @(@{ labelId = $SensitivityLabel }) }
+        if ($Classification) { $GroupBody.classification = $Classification }
+        Write-Verbose (ConvertTo-Json -InputObject $GroupBody -Compress -Depth 10)
+
+        if (-not $PSCmdlet.ShouldProcess($SiteName, 'Create new group-connected SharePoint site')) { return }
+
+        try {
+            $Group = New-GraphPOSTRequest -AsApp $true -uri 'https://graph.microsoft.com/v1.0/groups' -tenantid $TenantFilter -body (ConvertTo-Json -Depth 10 -InputObject $GroupBody)
+        } catch {
+            $ErrorMessage = Get-CippException -Exception $_
+            $Result = "Failed to create new SharePoint site $SiteName with URL $SiteUrl. Error: $($ErrorMessage.NormalizedError)"
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage
+            throw $Result
+        }
+
+        # Site provisioning is asynchronous; poll briefly like New-CIPPTeam does.
+        $CreatedUrl = $null
+        $Attempts = 0
+        do {
+            $Attempts++
+            try {
+                $Site = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups/$($Group.id)/sites/root?`$select=webUrl" -tenantid $TenantFilter -AsApp $true
+                $CreatedUrl = $Site.webUrl
+            } catch {
+                if ($Attempts -lt 10) { Start-Sleep -Seconds 6 }
+            }
+        } while (-not $CreatedUrl -and $Attempts -lt 10)
+
+        $Result = if ($CreatedUrl) {
+            "Successfully created new SharePoint site $SiteName with URL $CreatedUrl"
+        } else {
+            "Successfully created Microsoft 365 group $SiteName ($($Group.id)). Its SharePoint site is still being provisioned. Please wait for it to finish."
+        }
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Info
+        return $Result
+    }
+
     switch ($TemplateName) {
         'Communication' {
             $WebTemplate = 'SITEPAGEPUBLISHING#0'
diff --git a/Modules/CIPPCore/Public/New-CIPPTAP.ps1 b/Modules/CIPPCore/Public/New-CIPPTAP.ps1
index e84584171d846..494e2e8a6ae9d 100644
--- a/Modules/CIPPCore/Public/New-CIPPTAP.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPTAP.ps1
@@ -7,7 +7,8 @@ function New-CIPPTAP {
         $Headers,
         $LifetimeInMinutes,
         [bool]$IsUsableOnce,
-        $StartDateTime
+        $StartDateTime,
+        [bool]$GeneratePwPushLink
     )
 
     try {
@@ -51,16 +52,35 @@ function New-CIPPTAP {
 
         Write-LogMessage -headers $Headers -API $APIName -message "Created Temporary Access Pass (TAP) for $UserID$paramString" -Sev 'Info' -tenant $TenantFilter
 
+        # Opt-in PwPush link so the TAP can be handed to the end user securely. Mirrors the
+        # password reset flow: if the integration is disabled or the push fails, fall back
+        # to the plain TAP rather than failing a pass that Graph has already created.
+        $TapValue = $GraphRequest.temporaryAccessPass
+        $UsedPwPush = $false
+        if ($GeneratePwPushLink) {
+            try {
+                $PwPushLink = New-PwPushLink -Payload $TapValue
+                if ($PwPushLink -and $PwPushLink -ne $false) {
+                    $TapValue = $PwPushLink
+                    $UsedPwPush = $true
+                } else {
+                    Write-LogMessage -headers $Headers -API $APIName -message "PwPush link was requested for the TAP of $UserID but the PwPush integration is not enabled or returned no link. Returning the plain TAP." -Sev 'Warning' -tenant $TenantFilter
+                }
+            } catch {
+                Write-LogMessage -headers $Headers -API $APIName -message "Failed to create PwPush link for the TAP of $UserID, returning the plain TAP. Error: $($_.Exception.Message)" -Sev 'Warning' -tenant $TenantFilter
+            }
+        }
+
         # Build result text with parameters
-        $resultText = "The TAP for $UserID is $($GraphRequest.temporaryAccessPass) - This TAP is usable for the next $($GraphRequest.LifetimeInMinutes) minutes"
+        $resultText = $UsedPwPush ? "The PwPush link for the TAP of $UserID is $TapValue - This TAP is usable for the next $($GraphRequest.LifetimeInMinutes) minutes" : "The TAP for $UserID is $TapValue - This TAP is usable for the next $($GraphRequest.LifetimeInMinutes) minutes"
         $resultText += $GraphRequest.isUsableOnce ? ' (one-time use only)' : ''
         $resultText += $StartDateTime ? " starting at $(Get-Date $GraphRequest.startDateTime -Format 'yyyy-MM-dd HH:mm:ss') UTC" : ''
 
         return @{
             resultText          = $resultText
             userId              = $UserID
-            copyField           = $GraphRequest.temporaryAccessPass
-            temporaryAccessPass = $GraphRequest.temporaryAccessPass
+            copyField           = $TapValue
+            temporaryAccessPass = $TapValue
             lifetimeInMinutes   = $GraphRequest.LifetimeInMinutes
             startDateTime       = $GraphRequest.startDateTime
             isUsableOnce        = $GraphRequest.isUsableOnce
diff --git a/Modules/CIPPCore/Public/New-CIPPTeamChannel.ps1 b/Modules/CIPPCore/Public/New-CIPPTeamChannel.ps1
new file mode 100644
index 0000000000000..e149281a00b69
--- /dev/null
+++ b/Modules/CIPPCore/Public/New-CIPPTeamChannel.ps1
@@ -0,0 +1,182 @@
+function New-CIPPTeamChannel {
+    <#
+    .SYNOPSIS
+    Create a channel on a Microsoft Team
+
+    .DESCRIPTION
+    Creates a public (standard), private, or shared channel via the Graph Teams API, with an
+    optional layoutType (post or chat). Private and shared channels include the Site Owner as
+    the sole owner member. Shared channel creates are async (202); this helper polls the
+    operation then resolves the channel by name. If a channel with the same display name
+    already exists it is returned instead. The reserved name "General" is refused.
+
+    .PARAMETER GroupId
+    The Team / M365 group id
+
+    .PARAMETER ChannelName
+    Display name of the channel
+
+    .PARAMETER MembershipType
+    standard (public), private, or shared
+
+    .PARAMETER LayoutType
+    post (default) or chat
+
+    .PARAMETER Owner
+    UPN of the channel owner. Required for private and shared channels under application permissions.
+
+    .PARAMETER TenantFilter
+    The tenant the Team belongs to
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$GroupId,
+
+        [Parameter(Mandatory = $true)]
+        [string]$ChannelName,
+
+        [ValidateSet('standard', 'private', 'shared')]
+        [string]$MembershipType = 'standard',
+
+        [ValidateSet('post', 'chat')]
+        [string]$LayoutType = 'post',
+
+        [Parameter(Mandatory = $true)]
+        [string]$Owner,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+
+        $APIName = 'Create Team Channel',
+        $Headers
+    )
+
+    $TrimmedName = $ChannelName.Trim()
+    if (-not $TrimmedName) {
+        throw 'Channel name is required.'
+    }
+    if ($TrimmedName -ieq 'General') {
+        throw 'Channel name "General" is reserved and cannot be created by the template.'
+    }
+
+    $PreferShared = @{ Prefer = 'include-unknown-enum-members' }
+
+    # Idempotency: reuse an existing channel with the same display name.
+    try {
+        $ExistingChannels = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/teams/$GroupId/channels?`$select=id,displayName,membershipType,layoutType" -tenantid $TenantFilter -AsApp $true -extraHeaders $PreferShared
+        $Match = @($ExistingChannels) | Where-Object { $_.displayName -ieq $TrimmedName } | Select-Object -First 1
+        if ($Match.id) {
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Channel $TrimmedName already exists on team $GroupId, reusing it." -sev Info
+            return [PSCustomObject]@{
+                ChannelId      = $Match.id
+                DisplayName    = $Match.displayName
+                MembershipType = $Match.membershipType
+                LayoutType     = $Match.layoutType
+                Created        = $false
+            }
+        }
+    } catch {
+        # Listing can fail transiently right after Team create; fall through to create.
+    }
+
+    if (-not $PSCmdlet.ShouldProcess($TrimmedName, "Create $MembershipType ($LayoutType) channel on team $GroupId")) { return }
+
+    $ChannelBody = @{
+        displayName    = $TrimmedName
+        membershipType = $MembershipType
+        layoutType     = $LayoutType
+    }
+    if ($MembershipType -in @('private', 'shared')) {
+        $ChannelBody.members = @(
+            @{
+                '@odata.type'     = '#microsoft.graph.aadUserConversationMember'
+                'roles'           = @('owner')
+                'user@odata.bind' = "https://graph.microsoft.com/v1.0/users('$Owner')"
+            }
+        )
+    }
+    # Host team can see the shared channel immediately (same pattern as Graph example 7).
+    if ($MembershipType -eq 'shared') {
+        $ChannelBody.sharedWithTeams = @(
+            @{ id = $GroupId }
+        )
+    }
+
+    try {
+        $Body = ConvertTo-Json -Depth 10 -Compress -InputObject $ChannelBody
+
+        if ($MembershipType -eq 'shared') {
+            # Shared channel create returns 202 + Content-Location to a teamsAsyncOperation.
+            $ResponseHeaders = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/teams/$GroupId/channels" -tenantid $TenantFilter -type POST -body $Body -AsApp $true -returnHeaders $true -AddedHeaders $PreferShared
+            $ContentLocation = [string](($ResponseHeaders.'Content-Location' | Select-Object -First 1) ?? ($ResponseHeaders.'Location' | Select-Object -First 1))
+            if ($ContentLocation) {
+                $OperationUri = if ($ContentLocation -match '^https?://') {
+                    $ContentLocation
+                } else {
+                    "https://graph.microsoft.com/v1.0$ContentLocation"
+                }
+                $Attempts = 0
+                $OperationStatus = $null
+                do {
+                    $Attempts++
+                    try {
+                        $Operation = New-GraphGetRequest -uri $OperationUri -tenantid $TenantFilter -AsApp $true
+                        $OperationStatus = [string]$Operation.status
+                        if ($OperationStatus -in @('succeeded', 'failed', 'failedWithError')) { break }
+                    } catch {
+                        # Keep polling while the operation resource appears.
+                    }
+                    if ($Attempts -lt 20) { Start-Sleep -Seconds 3 }
+                } while ($Attempts -lt 20)
+
+                if ($OperationStatus -notin @('succeeded', $null, '')) {
+                    if ($OperationStatus -in @('failed', 'failedWithError')) {
+                        throw "Shared channel '$TrimmedName' async create failed (status: $OperationStatus)."
+                    }
+                    Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Shared channel $TrimmedName operation still '$OperationStatus' after polling; resolving by name." -sev Warning
+                }
+            }
+
+            # Resolve the created channel by display name (202 path does not return the channel body).
+            $Resolved = $null
+            $ResolveAttempts = 0
+            do {
+                $ResolveAttempts++
+                try {
+                    $Listed = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/teams/$GroupId/channels?`$select=id,displayName,membershipType,layoutType" -tenantid $TenantFilter -AsApp $true -extraHeaders $PreferShared
+                    $Resolved = @($Listed) | Where-Object { $_.displayName -ieq $TrimmedName } | Select-Object -First 1
+                } catch {}
+                if (-not $Resolved.id -and $ResolveAttempts -lt 10) { Start-Sleep -Seconds 3 }
+            } while (-not $Resolved.id -and $ResolveAttempts -lt 10)
+
+            if (-not $Resolved.id) {
+                throw "Shared channel '$TrimmedName' was accepted but could not be resolved on team $GroupId yet."
+            }
+
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully created shared ($LayoutType) channel $TrimmedName on team $GroupId" -sev Info
+            return [PSCustomObject]@{
+                ChannelId      = $Resolved.id
+                DisplayName    = $Resolved.displayName
+                MembershipType = $Resolved.membershipType
+                LayoutType     = ($Resolved.layoutType ?? $LayoutType)
+                Created        = $true
+            }
+        }
+
+        $NewChannel = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/teams/$GroupId/channels" -tenantid $TenantFilter -type POST -body $Body -AsApp $true -AddedHeaders $PreferShared
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Successfully created $MembershipType ($LayoutType) channel $TrimmedName on team $GroupId" -sev Info
+        return [PSCustomObject]@{
+            ChannelId      = $NewChannel.id
+            DisplayName    = $NewChannel.displayName
+            MembershipType = $NewChannel.membershipType
+            LayoutType     = ($NewChannel.layoutType ?? $LayoutType)
+            Created        = $true
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Result = "Failed to create channel $TrimmedName on team $GroupId. Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Result -sev Error -LogData $ErrorMessage
+        throw $Result
+    }
+}
diff --git a/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1 b/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1
index 08fcdec56df1e..fc6de8113abc8 100644
--- a/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPTemplateRun.ps1
@@ -78,7 +78,7 @@ function New-CIPPTemplateRun {
 
                 if (!$ExistingTemplate -or $UpdateNeeded) {
                     $Template = (Get-GitHubFileContents -FullName $TemplateSettings.templateRepo.value -Branch $TemplateSettings.templateRepoBranch.value -Path $File.path).content | ConvertFrom-Json
-                    $ImportResult = Import-CommunityTemplate -Template $Template -SHA $File.sha -MigrationTable $MigrationTable -LocationData $LocationData -Source $TemplateSettings.templateRepo.value
+                    $ImportResult = Import-CommunityTemplate -Template $Template -SHA $File.sha -MigrationTable $MigrationTable -LocationData $LocationData -Source $TemplateSettings.templateRepo.value -Path $File.path
                     if ($ImportResult) {
                         Write-Information $ImportResult
                         $ImportResult
diff --git a/Modules/CIPPCore/Public/New-CIPPUserTask.ps1 b/Modules/CIPPCore/Public/New-CIPPUserTask.ps1
index b47c28f8111b6..f8de472b606bc 100644
--- a/Modules/CIPPCore/Public/New-CIPPUserTask.ps1
+++ b/Modules/CIPPCore/Public/New-CIPPUserTask.ps1
@@ -230,6 +230,42 @@ function New-CIPPUserTask {
         }
     }
 
+    # SharePoint site membership is scheduled instead of run inline: a freshly created account cannot
+    # be resolved on a site (ensureuser) until it has replicated to SharePoint.
+    if ($UserObj.sharePointSites) {
+        $SiteRole = $UserObj.sharePointSiteRole.value ?? $UserObj.sharePointSiteRole ?? 'Members'
+        $SiteAccessTime = [int64](([datetime]::UtcNow).AddMinutes(15) - (Get-Date '1/1/1970')).TotalSeconds
+        foreach ($Site in @($UserObj.sharePointSites)) {
+            $SiteLabel = $Site.label ?? $Site.value
+            try {
+                $TaskBody = [PSCustomObject]@{
+                    TenantFilter  = $UserObj.tenantFilter
+                    Name          = "Add SharePoint Site Member: $($CreationResults.Username) -> $($Site.value) ($SiteRole)"
+                    Command       = @{ value = 'Set-CIPPSharePointSiteMember' }
+                    Parameters    = [PSCustomObject]@{
+                        TenantFilter      = $UserObj.tenantFilter
+                        UserPrincipalName = $CreationResults.Username
+                        Role              = $SiteRole
+                        SharePointType    = $Site.addedFields.rootWebTemplate
+                        GroupId           = $Site.addedFields.ownerPrincipalName
+                        SiteUrl           = $Site.value
+                        APIName           = 'SharePoint Site Onboarding'
+                    }
+                    ScheduledTime = $SiteAccessTime
+                    PostExecution = @{ Webhook = $false; Email = $false; PSA = $false }
+                }
+                $ScheduleResult = Add-CIPPScheduledTask -Task $TaskBody -hidden $false -Headers $Headers -DisallowDuplicateName $true
+                if ($ScheduleResult -like 'Successfully added task:*') {
+                    $Results.Add("Scheduled $SiteRole access to the SharePoint site $SiteLabel in 15 minutes.")
+                } else {
+                    $Results.Add("Failed to schedule SharePoint access to $($SiteLabel): $ScheduleResult")
+                }
+            } catch {
+                $Results.Add("Failed to schedule SharePoint access to $($SiteLabel): $($_.Exception.Message)")
+            }
+        }
+    }
+
     if ($UserObj.setManager) {
         $ManagerResults = Set-CIPPManager -Users $CreationResults.Username -Manager $UserObj.setManager.value -TenantFilter $UserObj.tenantFilter -Headers $Headers
         $Results.Add($ManagerResults.Result)
diff --git a/Modules/CIPPCore/Public/PIM/Get-CIPPPrivilegedRoleTemplateIds.ps1 b/Modules/CIPPCore/Public/PIM/Get-CIPPPrivilegedRoleTemplateIds.ps1
index cd745f8540df5..12bd205e8ca4a 100644
--- a/Modules/CIPPCore/Public/PIM/Get-CIPPPrivilegedRoleTemplateIds.ps1
+++ b/Modules/CIPPCore/Public/PIM/Get-CIPPPrivilegedRoleTemplateIds.ps1
@@ -14,6 +14,8 @@ function Get-CIPPPrivilegedRoleTemplateIds {
     .PARAMETER Set
         Privileged          - CIPP's privileged set (18 roles). Default.
         CisaHighlyPrivileged - the six roles CISA SCuBA calls highly privileged.
+        Critical            - the four roles that decide who else is privileged: Global, Privileged Role,
+                              Privileged Authentication and Conditional Access Administrator.
         GlobalAdministrator - only Global Administrator.
 
     .PARAMETER WithNames
@@ -25,7 +27,7 @@ function Get-CIPPPrivilegedRoleTemplateIds {
     #>
     [CmdletBinding()]
     param(
-        [ValidateSet('Privileged', 'CisaHighlyPrivileged', 'GlobalAdministrator')]
+        [ValidateSet('Privileged', 'CisaHighlyPrivileged', 'GlobalAdministrator', 'Critical')]
         [string]$Set = 'Privileged',
 
         [switch]$WithNames
@@ -54,6 +56,14 @@ function Get-CIPPPrivilegedRoleTemplateIds {
 
     $Ids = switch ($Set) {
         'GlobalAdministrator' { @('62e90394-69f5-4237-9190-012177145e10') }
+        'Critical' {
+            @(
+                '62e90394-69f5-4237-9190-012177145e10',
+                'e8611ab8-c189-46e8-94e1-60213ab1f814',
+                '7be44c8a-adaf-4e2a-84d6-ab2649e08a13',
+                'b1be1c3e-b65d-4f19-8427-f6fa0d97feb9'
+            )
+        }
         'CisaHighlyPrivileged' {
             @(
                 '62e90394-69f5-4237-9190-012177145e10',
diff --git a/Modules/CIPPCore/Public/Remove-CIPPEnrollmentTimeDeviceMembershipMarker.ps1 b/Modules/CIPPCore/Public/Remove-CIPPEnrollmentTimeDeviceMembershipMarker.ps1
new file mode 100644
index 0000000000000..25e35b951e6c4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Remove-CIPPEnrollmentTimeDeviceMembershipMarker.ps1
@@ -0,0 +1,35 @@
+function Remove-CIPPEnrollmentTimeDeviceMembershipMarker {
+    <#
+    .SYNOPSIS
+        Forgets the enrollment-time device group recorded against a Device Preparation policy.
+    .DESCRIPTION
+        Called when a policy is deleted for recreation: the recreated profile gets a new id, so a
+        marker left behind under the old one would answer for a policy that no longer exists.
+        A marker that cannot be removed does not fail the recreation, and a row that was never
+        written is not an error - the 404 is non-terminating, so it only reaches the catch with
+        -ErrorAction Stop.
+    .PARAMETER PolicyId
+        The configuration policy id being deleted.
+    .PARAMETER TenantFilter
+        The tenant the policy belongs to.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding(SupportsShouldProcess)]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$PolicyId,
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    try {
+        $Table = Get-CIPPTable -TableName 'EnrollmentTimeMembershipTargets'
+        $Entity = @{ PartitionKey = [string]$TenantFilter; RowKey = [string]$PolicyId }
+        if ($PSCmdlet.ShouldProcess($PolicyId, 'Remove enrollment time device membership marker')) {
+            Remove-AzDataTableEntity @Table -Entity ([pscustomobject]$Entity) -Force -ErrorAction Stop
+        }
+    } catch {
+        Write-Information "Could not remove the enrollment time device membership marker for policy $PolicyId : $($_.Exception.Message)"
+    }
+}
diff --git a/Modules/CIPPCore/Public/Remove-CIPPImage.ps1 b/Modules/CIPPCore/Public/Remove-CIPPImage.ps1
index fed55f8957c0f..0e2dbac54ef05 100644
--- a/Modules/CIPPCore/Public/Remove-CIPPImage.ps1
+++ b/Modules/CIPPCore/Public/Remove-CIPPImage.ps1
@@ -36,5 +36,7 @@ function Remove-CIPPImage {
         } catch {
             Write-Warning "Failed to remove image '$ImageId' in partition '$PartitionKey': $($_.Exception.Message)"
         }
+        # Its name row (see Set-CIPPImageName) goes with it; there may not be one.
+        try { Remove-CIPPAzDataTableEntity @Table -Entity @{ PartitionKey = 'imageMeta'; RowKey = $ImageId } -Force | Out-Null } catch { Write-Verbose "No name row for image '$ImageId'." }
     }
 }
diff --git a/Modules/CIPPCore/Public/Request-CIPPSPOPersonalSite.ps1 b/Modules/CIPPCore/Public/Request-CIPPSPOPersonalSite.ps1
index 13816a670d220..902da7363f776 100644
--- a/Modules/CIPPCore/Public/Request-CIPPSPOPersonalSite.ps1
+++ b/Modules/CIPPCore/Public/Request-CIPPSPOPersonalSite.ps1
@@ -8,59 +8,55 @@ function Request-CIPPSPOPersonalSite {
         [string]$Headers = 'CIPP',
         [string]$APIName = 'Request-CIPPSPOPersonalSite'
     )
-    $UserList = [System.Collections.Generic.List[string]]::new()
-    foreach ($User in $UserEmails) {
-        $UserList.Add("<Object Type='String'>$User</Object>")
-    }
 
-    $XML = @"
-<Request xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009" AddExpandoFieldTypeSuffix="true" SchemaVersion="15.0.0.0" LibraryVersion="16.0.0.0" ApplicationName=".NET Library">
-    <Actions>
-        <ObjectPath Id="4" ObjectPathId="3" />
-        <ObjectPath Id="6" ObjectPathId="5" />
-        <Query Id="7" ObjectPathId="5">
-            <Query SelectAllProperties="true">
-                <Properties />
-            </Query>
-        </Query>
-    </Actions>
-    <ObjectPaths>
-        <Constructor Id="3" TypeId="{268004ae-ef6b-4e9b-8425-127220d84719}" />
-        <Method Id="5" ParentId="3" Name="RequestPersonalSites">
-            <Parameters>
-                <Parameter Type="Array">
-                    $($UserList -join '')
-                </Parameter>
-            </Parameters>
-        </Method>
-    </ObjectPaths>
-</Request>
-"@
+    # CreatePersonalSiteEnqueueBulk accepts at most 200 users per call.
+    $BatchSize = 200
+    $Routes = [ordered]@{
+        'ProfileLoader.CreatePersonalSiteEnqueueBulk' = '<Request xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009" AddExpandoFieldTypeSuffix="true" SchemaVersion="15.0.0.0" LibraryVersion="16.0.0.0" ApplicationName=".NET Library"><Actions><ObjectPath Id="5" ObjectPathId="4" /><Method Name="CreatePersonalSiteEnqueueBulk" Id="6" ObjectPathId="4"><Parameters><Parameter Type="Array">{0}</Parameter></Parameters></Method></Actions><ObjectPaths><StaticMethod Id="4" Name="GetProfileLoader" TypeId="{{9c42543a-91b3-4902-b2fe-14ccdefb6e2b}}" /></ObjectPaths></Request>'
+        'Tenant.RequestPersonalSites'                 = '<Request xmlns="http://schemas.microsoft.com/sharepoint/clientquery/2009" AddExpandoFieldTypeSuffix="true" SchemaVersion="15.0.0.0" LibraryVersion="16.0.0.0" ApplicationName=".NET Library"><Actions><ObjectPath Id="4" ObjectPathId="3" /><ObjectPath Id="6" ObjectPathId="5" /><Query Id="7" ObjectPathId="5"><Query SelectAllProperties="true"><Properties /></Query></Query></Actions><ObjectPaths><Constructor Id="3" TypeId="{{268004ae-ef6b-4e9b-8425-127220d84719}}" /><Method Id="5" ParentId="3" Name="RequestPersonalSites"><Parameters><Parameter Type="Array">{0}</Parameter></Parameters></Method></ObjectPaths></Request>'
+    }
 
     $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter
+    $Uri = "$($SharePointInfo.AdminUrl)/_vti_bin/client.svc/ProcessQuery"
+    $Scope = "$($SharePointInfo.AdminUrl)/.default"
+
     try {
-        # OneDrive pre-provisioning (ProfileLoader.RequestPersonalSites) is a User Profile Service
-        # operation, so it must run app-only with the SAM certificate: a GDAP delegated token has no
-        # licensed user object in the customer tenant and SharePoint refuses it with a bare 401. App-only
-        # here needs the SharePoint 'User.ReadWrite.All' application permission (declared in
-        # SAMManifest.json, applied on CPV consent) on top of Sites.FullControl.All.
-        $Request = New-GraphPostRequest -scope "$($SharePointInfo.AdminUrl)/.default" -tenantid $TenantFilter -Uri "$($SharePointInfo.AdminUrl)/_vti_bin/client.svc/ProcessQuery" -Type POST -Body $XML -ContentType 'text/xml' -AsApp $true -UseCertificate
+        for ($Offset = 0; $Offset -lt $UserEmails.Count; $Offset += $BatchSize) {
+            $Batch = $UserEmails[$Offset..([Math]::Min($Offset + $BatchSize, $UserEmails.Count) - 1)]
+            $UserList = [System.Collections.Generic.List[string]]::new()
+            foreach ($User in $Batch) {
+                $UserList.Add("<Object Type='String'>$([System.Security.SecurityElement]::Escape($User))</Object>")
+            }
+            $UserArray = $UserList -join ''
 
-        # ProcessQuery answers HTTP 200 even when the request was refused - the reason rides in the CSOM
-        # ErrorInfo node (e.g. an "access to profile information" denial when the permission above is not
-        # yet consented). Surface it so a refusal is not reported back as success.
-        $CsomError = ($Request | Where-Object { $_.ErrorInfo } | Select-Object -First 1).ErrorInfo.ErrorMessage
-        if ($CsomError) { throw $CsomError }
-        if (!$Request.IsComplete) { throw 'SharePoint did not confirm the personal site request.' }
+            $Failures = [System.Collections.Generic.List[string]]::new()
+            $Accepted = $false
+            foreach ($RouteName in $Routes.Keys) {
+                try {
+                    $Request = New-GraphPostRequest -scope $Scope -tenantid $TenantFilter -Uri $Uri -Type POST -Body ($Routes[$RouteName] -f $UserArray) -ContentType 'text/xml'
+                    # ProcessQuery answers HTTP 200 even when the request was refused - the reason rides in
+                    # the CSOM ErrorInfo node. Surface it so a refusal is not reported back as success.
+                    $CsomError = ($Request | Where-Object { $_.ErrorInfo } | Select-Object -First 1).ErrorInfo
+                    if ($CsomError) { throw "$($CsomError.ErrorMessage) [$($CsomError.ErrorTypeName)]" }
+                    if (!$Request.IsComplete) { throw 'SharePoint did not confirm the personal site request.' }
+                    $Accepted = $true
+                    break
+                } catch {
+                    $Failures.Add("$RouteName - $($_.Exception.Message)")
+                    Write-LogMessage -headers $Headers -API $APIName -message "$RouteName refused the personal site request for $($Batch -join ', '): $($_.Exception.Message)" -Sev 'Warning' -tenant $TenantFilter
+                }
+            }
+            if (-not $Accepted) { throw ($Failures -join ' | ') }
+        }
         Write-LogMessage -headers $Headers -API $APIName -message "Requested personal site for $($UserEmails -join ', ')" -Sev 'Info' -tenant $TenantFilter
         return "Successfully requested personal site for $($UserEmails -join ', ')"
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         $Detail = $ErrorMessage.NormalizedError
-        # A "profile information" denial means the SAM app has not been granted the SharePoint
-        # User.ReadWrite.All application permission in this tenant yet - refreshing CPV consent fixes it.
-        if ($Detail -match 'profile information') {
-            $Detail = "$Detail - CIPP is missing the SharePoint 'User.ReadWrite.All' application permission in $TenantFilter. Refresh the tenant's CPV permissions and try again."
+        # Delegated SharePoint admin calls need the CIPP user to hold SharePoint Administrator in the
+        # tenant (via the GDAP relationship); a bare 401 or an unauthorized-operation refusal is that.
+        if ($Detail -match '\b401\b|unauthorized') {
+            $Detail = "$Detail - The CIPP user needs the SharePoint Administrator role in $TenantFilter (through the GDAP relationship) to request personal sites."
         }
         $Result = "Failed to request personal site for $($UserEmails -join ', '). Error: $Detail"
         Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Error' -tenant $TenantFilter -LogData $ErrorMessage
diff --git a/Modules/CIPPCore/Public/Resolve-CIPPIntuneAdminTemplateBinding.ps1 b/Modules/CIPPCore/Public/Resolve-CIPPIntuneAdminTemplateBinding.ps1
new file mode 100644
index 0000000000000..6d0e5a501cca3
--- /dev/null
+++ b/Modules/CIPPCore/Public/Resolve-CIPPIntuneAdminTemplateBinding.ps1
@@ -0,0 +1,193 @@
+function Resolve-CIPPIntuneAdminTemplateBinding {
+    <#
+    .SYNOPSIS
+        Rewrites an administrative template's definition binds to the ids of the tenant it is deployed to.
+    .DESCRIPTION
+        An administrative template (deviceManagement/groupPolicyConfigurations) stores each setting as a
+        groupPolicyDefinitions('<id>') bind plus presentations('<id>') binds for its values. Built-in
+        definitions have one id in every tenant, but a definition from an imported ADMX file is minted
+        with a new id in every tenant, and again on every re-import. A template captured in one tenant
+        therefore binds to ids that do not exist in the next, and Graph rejects updateDefinitionValues
+        with a generic error.
+
+        Get-CIPPIntuneAdminTemplateDefinitionValue records each setting's identity next to its bind
+        (definition: displayName, categoryPath, classType; presentation: label, type, position). This
+        function checks which bound ids exist in the target tenant and, for those that do not, finds the
+        same setting there by that identity and rewrites the binds. The identity metadata is removed from
+        the result, because Graph does not accept it on a definition value.
+
+        A setting whose ADMX has not been imported into the target tenant is reported by name with what
+        to do about it. A template captured before the identity was recorded carries only ids, which are
+        kept when the tenant has them (the same tenant, or a re-deploy) and rejected with an explanation
+        otherwise.
+    .PARAMETER RawJSON
+        The template payload: {added, updated, deletedIds} as stored in the template's RAWJson, after
+        text replacement.
+    .PARAMETER TenantFilter
+        The tenant the policy is being deployed to.
+    .PARAMETER DisplayName
+        The policy name, used in messages only.
+    .OUTPUTS
+        The payload as a JSON string, ready to post to updateDefinitionValues.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$RawJSON,
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [string]$DisplayName,
+        $Headers,
+        $APIName = 'Resolve-CIPPIntuneAdminTemplateBinding'
+    )
+
+    $BindPattern = "groupPolicyDefinitions\('([0-9a-fA-F-]{36})'\)"
+    $Policy = $RawJSON | ConvertFrom-Json -Depth 100
+    $Added = @($Policy.added | Where-Object { $_ })
+    $PolicyLabel = if ($DisplayName) { "'$DisplayName'" } else { 'template' }
+
+    $Strip = {
+        foreach ($Item in $Added) {
+            if ($Item.PSObject.Properties['definition']) { $Item.PSObject.Properties.Remove('definition') }
+            foreach ($PresentationValue in @($Item.presentationValues | Where-Object { $_ })) {
+                if ($PresentationValue.PSObject.Properties['presentation']) { $PresentationValue.PSObject.Properties.Remove('presentation') }
+            }
+        }
+    }
+
+    if ($Added.Count -eq 0) {
+        & $Strip
+        return (ConvertTo-Json -InputObject $Policy -Depth 100 -Compress)
+    }
+
+    # Which of the bound definitions does this tenant have? One batch, one GET per distinct id.
+    $BoundIds = [System.Collections.Generic.List[string]]::new()
+    foreach ($Item in $Added) {
+        $Match = [regex]::Match([string]$Item.'definition@odata.bind', $BindPattern)
+        if ($Match.Success) {
+            $Id = $Match.Groups[1].Value.ToLowerInvariant()
+            if (-not $BoundIds.Contains($Id)) { $BoundIds.Add($Id) }
+        }
+    }
+    $ExistenceRequests = [System.Collections.Generic.List[object]]::new()
+    foreach ($Id in $BoundIds) {
+        $ExistenceRequests.Add([PSCustomObject]@{
+                id     = $Id
+                method = 'GET'
+                url    = "/deviceManagement/groupPolicyDefinitions('$Id')?`$select=id"
+            })
+    }
+    $Present = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    if ($ExistenceRequests.Count -gt 0) {
+        foreach ($Reply in @(New-GraphBulkRequest -Requests @($ExistenceRequests) -tenantid $TenantFilter)) {
+            if ($Reply.status -eq 200 -and $Reply.body.id) { [void]$Present.Add([string]$Reply.body.id) }
+        }
+    }
+
+    $DefinitionCache = @{}
+    $PresentationCache = @{}
+    $NotImported = [System.Collections.Generic.List[string]]::new()
+    $NoIdentity = [System.Collections.Generic.List[string]]::new()
+
+    # The tenant's definitions in one category and class, fetched once per category.
+    $GetCandidates = {
+        param($Identity)
+        $Class = [string]$Identity.classType
+        $Category = [string]$Identity.categoryPath
+        $Filter = if ($Category) {
+            "classType eq '$(ConvertTo-CIPPODataFilterValue -Value $Class -Type String)' and categoryPath eq '$(ConvertTo-CIPPODataFilterValue -Value $Category -Type String)'"
+        } else {
+            "classType eq '$(ConvertTo-CIPPODataFilterValue -Value $Class -Type String)' and displayName eq '$(ConvertTo-CIPPODataFilterValue -Value ([string]$Identity.displayName) -Type String)'"
+        }
+        if (-not $DefinitionCache.ContainsKey($Filter)) {
+            $DefinitionCache[$Filter] = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions?`$filter=$Filter&`$select=id,displayName,categoryPath,classType" -tenantid $TenantFilter | Where-Object { $_.id })
+        }
+        $DefinitionCache[$Filter]
+    }
+
+    foreach ($Item in $Added) {
+        $Match = [regex]::Match([string]$Item.'definition@odata.bind', $BindPattern)
+        if (-not $Match.Success) { continue }
+        $SourceId = $Match.Groups[1].Value
+        if ($Present.Contains($SourceId)) { continue }
+
+        $Identity = $Item.definition
+        if (-not $Identity -or [string]::IsNullOrWhiteSpace([string]$Identity.displayName)) {
+            $NoIdentity.Add($SourceId)
+            continue
+        }
+
+        $Candidates = @(& $GetCandidates $Identity | Where-Object { [string]$_.displayName -eq [string]$Identity.displayName })
+        if ($Identity.categoryPath -and $Candidates.Count -gt 1) {
+            $Exact = @($Candidates | Where-Object { [string]$_.categoryPath -eq [string]$Identity.categoryPath })
+            if ($Exact.Count -gt 0) { $Candidates = $Exact }
+        }
+        if ($Candidates.Count -eq 0) {
+            $NotImported.Add("'$($Identity.displayName)' ($($Identity.categoryPath), $($Identity.classType))")
+            continue
+        }
+        if ($Candidates.Count -gt 1) {
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Administrative template $PolicyLabel : $($Candidates.Count) definitions in $TenantFilter match '$($Identity.displayName)' ($($Identity.categoryPath), $($Identity.classType)); using the first." -Sev Warning
+        }
+        $Target = $Candidates[0]
+        $Item.'definition@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($Target.id)')"
+
+        $PresentationValues = @($Item.presentationValues | Where-Object { $_ })
+        if ($PresentationValues.Count -eq 0) { continue }
+        if (-not $PresentationCache.ContainsKey([string]$Target.id)) {
+            $PresentationCache[[string]$Target.id] = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($Target.id)')/presentations" -tenantid $TenantFilter | Where-Object { $_.id })
+        }
+        $TargetPresentations = $PresentationCache[[string]$Target.id]
+
+        for ($Index = 0; $Index -lt $PresentationValues.Count; $Index++) {
+            $PresentationValue = $PresentationValues[$Index]
+            $PresentationIdentity = $PresentationValue.presentation
+            $Type = [string]$PresentationIdentity.'@odata.type'
+            $SameType = @($TargetPresentations | Where-Object { -not $Type -or [string]$_.'@odata.type' -eq $Type })
+
+            # The label names the field when the ADMX gave it one; otherwise the position in the
+            # definition's presentation list (its order in the ADMX) is what identifies it, checked
+            # against the type so a re-ordered ADMX cannot bind a list value to a text box.
+            $Chosen = $null
+            $Label = [string]$PresentationIdentity.label
+            if ($Label) {
+                $Chosen = $SameType | Where-Object { [string]$_.label -eq $Label } | Select-Object -First 1
+            }
+            if (-not $Chosen -and $null -ne $PresentationIdentity.index) {
+                $Position = [int]$PresentationIdentity.index
+                if ($Position -ge 0 -and $Position -lt $TargetPresentations.Count -and $TargetPresentations[$Position] -in $SameType) {
+                    $Chosen = $TargetPresentations[$Position]
+                }
+            }
+            if (-not $Chosen -and -not $PresentationIdentity -and $PresentationValues.Count -eq $TargetPresentations.Count) {
+                # Captured before the presentation identity was recorded: the values were stored in
+                # the order the presentations came back, which is the ADMX order on both sides.
+                $Chosen = $TargetPresentations[$Index]
+            }
+            if (-not $Chosen -and $SameType.Count -eq 1) {
+                $Chosen = $SameType[0]
+            }
+            if (-not $Chosen) {
+                $NotImported.Add("value $($Index + 1) of '$($Identity.displayName)' ($($Identity.categoryPath), $($Identity.classType)) has no matching field in this tenant's copy of the setting")
+                continue
+            }
+            $PresentationValue.'presentation@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($Target.id)')/presentations('$($Chosen.id)')"
+        }
+    }
+
+    if ($NoIdentity.Count -gt 0) {
+        $Message = "Administrative template $PolicyLabel references definition ids that do not exist in $TenantFilter ($($NoIdentity -join ', ')). Settings from an imported ADMX file have a different id in every tenant, and this template was captured before CIPP recorded which settings those ids belong to, so they cannot be matched in this tenant. Re-create the template from the source tenant and deploy it again."
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error
+        throw $Message
+    }
+    if ($NotImported.Count -gt 0) {
+        $Message = "Administrative template $PolicyLabel uses settings that are not available in $TenantFilter : $($NotImported -join '; '). These settings come from an imported ADMX file. Import the same ADMX and ADML files into $TenantFilter (Intune admin center > Devices > Configuration > Import ADMX), wait until the file shows as Available, then deploy again."
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message $Message -Sev Error
+        throw $Message
+    }
+
+    & $Strip
+    return (ConvertTo-Json -InputObject $Policy -Depth 100 -Compress)
+}
diff --git a/Modules/CIPPCore/Public/SAMManifest/Update-CippSamPermissions.ps1 b/Modules/CIPPCore/Public/SAMManifest/Update-CippSamPermissions.ps1
index bad4157e0f263..0c04760a9c258 100644
--- a/Modules/CIPPCore/Public/SAMManifest/Update-CippSamPermissions.ps1
+++ b/Modules/CIPPCore/Public/SAMManifest/Update-CippSamPermissions.ps1
@@ -5,9 +5,9 @@ function Update-CippSamPermissions {
     .DESCRIPTION
         Writes the full applied permission set - the SAM manifest base PLUS any admin-configured extra
         permissions - into the AppPermissions table, so the table always reflects everything the
-        CIPP-SAM app is expected to have. Get-CippSamPermissions diffs the manifest against this table
-        to decide when a Permissions repair is needed, so persisting the manifest here is what lets that
-        check clear after a repair.
+        CIPP-SAM app is expected to have. The grant flow below reads this table, so persisting the
+        manifest here is what lets the permission check clear after a repair - that check compares the
+        effective set against the grants on the service principal, not against this table.
 
         It deliberately does NOT write the partner CIPP-SAM app registration's requiredResourceAccess.
         Permissions reach the CIPP-SAM service principal(s) - partner and clients - through the grant
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/ConvertTo-CIPPCANormalizedPolicy.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/ConvertTo-CIPPCANormalizedPolicy.ps1
new file mode 100644
index 0000000000000..ada890e84624b
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/ConvertTo-CIPPCANormalizedPolicy.ps1
@@ -0,0 +1,95 @@
+function ConvertTo-CIPPCANormalizedPolicy {
+    <#
+    .SYNOPSIS
+        Normalizes a cached conditionalAccessPolicy so every collection the gap analysis reads is present.
+    .DESCRIPTION
+        The beta Graph shape leaves many collections null.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Policy
+    )
+
+    $AsStrings = {
+        param($Value)
+        , [string[]]@(@($Value) | Where-Object { $null -ne $_ } | ForEach-Object { "$_" })
+    }
+
+    $Conditions = $Policy.conditions
+    $Users = $Conditions.users
+    $Apps = $Conditions.applications
+
+    $Platforms = $null
+    if ($null -ne $Conditions.platforms) {
+        $Platforms = [PSCustomObject]@{
+            includePlatforms = & $AsStrings $Conditions.platforms.includePlatforms
+            excludePlatforms = & $AsStrings $Conditions.platforms.excludePlatforms
+        }
+    }
+
+    $Locations = $null
+    if ($null -ne $Conditions.locations) {
+        $Locations = [PSCustomObject]@{
+            includeLocations = & $AsStrings $Conditions.locations.includeLocations
+            excludeLocations = & $AsStrings $Conditions.locations.excludeLocations
+        }
+    }
+
+    $Grant = $Policy.grantControls
+    $Operator = $null
+    if ($null -ne $Grant) {
+        $Operator = if ($Grant.operator) { "$($Grant.operator)" } else { 'OR' }
+    }
+    $GrantControls = [PSCustomObject]@{
+        present                     = ($null -ne $Grant)
+        operator                    = $Operator
+        builtInControls             = & $AsStrings $Grant.builtInControls
+        customAuthenticationFactors = & $AsStrings $Grant.customAuthenticationFactors
+        termsOfUse                  = & $AsStrings $Grant.termsOfUse
+        authenticationStrength      = $Grant.authenticationStrength
+    }
+
+    [PSCustomObject]@{
+        id               = "$($Policy.id)"
+        displayName      = if ($Policy.displayName) { "$($Policy.displayName)" } else { "$($Policy.id)" }
+        state            = if ($Policy.state) { "$($Policy.state)" } else { 'disabled' }
+        templateId       = $Policy.templateId
+        createdDateTime  = $Policy.createdDateTime
+        modifiedDateTime = $Policy.modifiedDateTime
+        conditions       = [PSCustomObject]@{
+            users                      = [PSCustomObject]@{
+                includeUsers                 = & $AsStrings $Users.includeUsers
+                excludeUsers                 = & $AsStrings $Users.excludeUsers
+                includeGroups                = & $AsStrings $Users.includeGroups
+                excludeGroups                = & $AsStrings $Users.excludeGroups
+                includeRoles                 = & $AsStrings $Users.includeRoles
+                excludeRoles                 = & $AsStrings $Users.excludeRoles
+                includeGuestsOrExternalUsers = $Users.includeGuestsOrExternalUsers
+                excludeGuestsOrExternalUsers = $Users.excludeGuestsOrExternalUsers
+            }
+            applications               = [PSCustomObject]@{
+                includeApplications                         = & $AsStrings $Apps.includeApplications
+                excludeApplications                         = & $AsStrings $Apps.excludeApplications
+                includeUserActions                          = & $AsStrings $Apps.includeUserActions
+                includeAuthenticationContextClassReferences = & $AsStrings $Apps.includeAuthenticationContextClassReferences
+                applicationFilter                           = $Apps.applicationFilter
+            }
+            clientAppTypes             = & $AsStrings $Conditions.clientAppTypes
+            platforms                  = $Platforms
+            locations                  = $Locations
+            userRiskLevels             = & $AsStrings $Conditions.userRiskLevels
+            signInRiskLevels           = & $AsStrings $Conditions.signInRiskLevels
+            servicePrincipalRiskLevels = & $AsStrings $Conditions.servicePrincipalRiskLevels
+            devices                    = $Conditions.devices
+            clientApplications         = $Conditions.clientApplications
+            agentIdRiskLevels          = $Conditions.agentIdRiskLevels
+            insiderRiskLevels          = $Conditions.insiderRiskLevels
+            authenticationFlows        = $Conditions.authenticationFlows
+        }
+        grantControls    = $GrantControls
+        sessionControls  = $Policy.sessionControls
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAnalysisContext.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAnalysisContext.ps1
new file mode 100644
index 0000000000000..91e09a58fbfe1
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAnalysisContext.ps1
@@ -0,0 +1,168 @@
+function Get-CIPPCAAnalysisContext {
+    <#
+    .SYNOPSIS
+        Builds the shared context every Conditional Access gap check reads from.
+    .DESCRIPTION
+        Reads the tenant's cached ConditionalAccessPolicies, NamedLocations, AuthenticationStrengths,
+        ServicePrincipals, Roles and LicenseOverview rows once (cache only, no Graph calls), normalizes
+        every policy, loads the static reference datasets and returns one hashtable: TenantFilter, Policies
+        (normalized), Enabled, ReportOnly, Disabled, NamedLocations, NamedLocationById, AuthStrengths (id ->
+        strength), ServicePrincipals (lower-case appId -> service principal), Roles (lower-case
+        roleTemplateId -> display name), Licenses (HasEntraIdP1/P2, HasIntunePlan1, HasWorkloadIdPremium,
+        Source), BreakGlass (candidate from Get-CIPPCABreakGlassCandidate with a display name resolved from
+        the Users/Groups cache when available) and Data (reference datasets plus lower-cased lookup tables).
+        Privileged role ids come from Get-CIPPPrivilegedRoleTemplateIds and first-party application names
+        from Get-CIPPMicrosoftFirstPartyApp, so the analysis shares those lists with the rest of CIPP.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    $ReadCache = {
+        param($Type, $Fields)
+        try {
+            if ($Fields) {
+                New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type -Fields $Fields | Where-Object { $_ }
+            } else {
+                New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type | Where-Object { $_ }
+            }
+        } catch {
+            Write-Information "Get-CIPPCAAnalysisContext: could not read cached '$Type' for $TenantFilter - $($_.Exception.Message)"
+        }
+    }
+
+    $RawPolicies = @(Get-CIPPSimulationCache -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies')
+    $Policies = [System.Collections.Generic.List[object]]::new()
+    foreach ($Raw in $RawPolicies) {
+        if (-not $Raw.id) { continue }
+        $Policies.Add((ConvertTo-CIPPCANormalizedPolicy -Policy $Raw))
+    }
+    $Policies = @($Policies)
+    $Enabled = @($Policies | Where-Object { $_.state -eq 'enabled' })
+    $ReportOnly = @($Policies | Where-Object { $_.state -eq 'enabledForReportingButNotEnforced' })
+    $Disabled = @($Policies | Where-Object { $_.state -eq 'disabled' })
+
+    $NamedLocations = @(& $ReadCache 'NamedLocations' | Where-Object { $_.id })
+    $NamedLocationById = @{}
+    foreach ($Location in $NamedLocations) { $NamedLocationById["$($Location.id)"] = $Location }
+
+    $AuthStrengths = @{}
+    foreach ($Strength in @(& $ReadCache 'AuthenticationStrengths')) {
+        if ($Strength.id) { $AuthStrengths["$($Strength.id)"] = $Strength }
+    }
+
+    $ServicePrincipals = @{}
+    foreach ($ServicePrincipal in @(& $ReadCache 'ServicePrincipals' @('id', 'appId', 'displayName', 'servicePrincipalType', 'appOwnerOrganizationId'))) {
+        if ($ServicePrincipal.appId) { $ServicePrincipals["$($ServicePrincipal.appId)".ToLowerInvariant()] = $ServicePrincipal }
+    }
+
+    $Roles = @{}
+    foreach ($Role in @(& $ReadCache 'Roles' @('id', 'roleTemplateId', 'displayName'))) {
+        $RoleKey = if ($Role.roleTemplateId) { "$($Role.roleTemplateId)" } else { "$($Role.id)" }
+        if ($RoleKey -and $Role.displayName) { $Roles[$RoleKey.ToLowerInvariant()] = "$($Role.displayName)" }
+    }
+
+    $Data = @{}
+    foreach ($Name in @('Reference', 'CoverageControls', 'MicrosoftGuidance', 'FociFamilies', 'BypassApps', 'AppDescriptions')) {
+        $Data[$Name] = Get-CIPPCAAnalysisData -Name $Name
+    }
+    $Data['MicrosoftGuidance'] = @($Data['MicrosoftGuidance'])
+    #foci contributed by Shebin and Michael Bargury
+    $Data['FociApps'] = @($Data['FociFamilies'])
+    $Data['FociById'] = @{}
+    foreach ($App in $Data['FociApps']) { if ($App.appId) { $Data['FociById']["$($App.appId)".ToLowerInvariant()] = $App } }
+
+    $Data['BypassAppById'] = @{}
+    foreach ($App in @($Data['BypassApps'].bypassApps)) { if ($App.appId) { $Data['BypassAppById']["$($App.appId)".ToLowerInvariant()] = $App } }
+    $Data['ImmuneResources'] = @($Data['BypassApps'].immuneResources)
+    $Data['ImmuneById'] = @{}
+    foreach ($Resource in $Data['ImmuneResources']) { if ($Resource.resourceId) { $Data['ImmuneById']["$($Resource.resourceId)".ToLowerInvariant()] = $Resource } }
+    $Data['DeviceRegistrationResource'] = $Data['BypassApps'].deviceRegistrationResource
+    $Data['WellKnownById'] = @{}
+    foreach ($App in @($Data['BypassApps'].wellKnownApps)) { if ($App.appId) { $Data['WellKnownById']["$($App.appId)".ToLowerInvariant()] = $App } }
+    $Data['HighValueApps'] = @($Data['BypassApps'].highValueApps)
+    $Data['AppGroupAliases'] = @{}
+    foreach ($Property in @($Data['BypassApps'].appGroupAliases.PSObject.Properties)) { $Data['AppGroupAliases'][$Property.Name.ToLowerInvariant()] = $Property.Value }
+
+    $Data['FirstPartyNames'] = Get-CIPPMicrosoftFirstPartyApp
+
+    $Data['AppDescriptionById'] = @{}
+    foreach ($App in @($Data['AppDescriptions'])) { if ($App.appId) { $Data['AppDescriptionById']["$($App.appId)".ToLowerInvariant()] = $App } }
+
+    $Data['HighPrivilegeRoleNames'] = @{}
+    foreach ($Role in @(Get-CIPPPrivilegedRoleTemplateIds -WithNames)) { $Data['HighPrivilegeRoleNames']["$($Role.Id)".ToLowerInvariant()] = "$($Role.DisplayName)" }
+    $Data['CriticalRoleIds'] = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($RoleId in @(Get-CIPPPrivilegedRoleTemplateIds -Set Critical)) { $null = $Data['CriticalRoleIds'].Add("$RoleId") }
+
+    $PlanReference = $Data['Reference'].servicePlanIds
+    $PlanIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    $LicenseRows = @(& $ReadCache 'LicenseOverview' @('skuId', 'ServicePlans'))
+    foreach ($Row in $LicenseRows) {
+        foreach ($Plan in @($Row.ServicePlans)) {
+            if ($Plan.servicePlanId) { $null = $PlanIds.Add("$($Plan.servicePlanId)") }
+        }
+    }
+    $Capabilities = $(try { Get-CIPPTenantCapabilities -TenantFilter $TenantFilter } catch { $null })
+    $CapabilityNames = @(($Capabilities ?? [PSCustomObject]@{}).PSObject.Properties | Where-Object { $_.Value -eq $true } | ForEach-Object { "$($_.Name)" })
+    if ($CapabilityNames.Count -gt 0) {
+        $Licenses = @{
+            Source               = 'TenantCapabilities'
+            HasEntraIdP1         = ($CapabilityNames -contains 'AAD_PREMIUM') -or ($CapabilityNames -contains 'AAD_PREMIUM_P2')
+            HasEntraIdP2         = $CapabilityNames -contains 'AAD_PREMIUM_P2'
+            HasIntunePlan1       = @($CapabilityNames | Where-Object { $_ -like 'INTUNE_A*' -or $_ -eq 'INTUNE_EDU' }).Count -gt 0
+            HasWorkloadIdPremium = @($CapabilityNames | Where-Object { $_ -like '*WORKLOAD*' }).Count -gt 0 -or
+            $PlanIds.Contains("$($PlanReference.workloadIdPremiumP1)") -or $PlanIds.Contains("$($PlanReference.workloadIdPremiumP2)")
+        }
+    } elseif ($LicenseRows.Count -gt 0) {
+        $Licenses = @{
+            Source               = 'LicenseOverview'
+            HasEntraIdP1         = $PlanIds.Contains("$($PlanReference.entraIdP1)") -or $PlanIds.Contains("$($PlanReference.entraIdP2)")
+            HasEntraIdP2         = $PlanIds.Contains("$($PlanReference.entraIdP2)")
+            HasIntunePlan1       = $PlanIds.Contains("$($PlanReference.intunePlan1)")
+            HasWorkloadIdPremium = $PlanIds.Contains("$($PlanReference.workloadIdPremiumP1)") -or $PlanIds.Contains("$($PlanReference.workloadIdPremiumP2)")
+        }
+    } else {
+        $ActivePolicies = @($Policies | Where-Object { $_.state -in @('enabled', 'enabledForReportingButNotEnforced') })
+        $InferredP2 = @($ActivePolicies | Where-Object { @($_.conditions.signInRiskLevels).Count -gt 0 -or @($_.conditions.userRiskLevels).Count -gt 0 }).Count -gt 0
+        $InferredIntune = @($ActivePolicies | Where-Object { @($_.grantControls.builtInControls) -contains 'compliantDevice' }).Count -gt 0
+        $InferredWorkload = @($ActivePolicies | Where-Object { @($_.conditions.clientApplications.includeServicePrincipals).Count -gt 0 }).Count -gt 0
+        $Licenses = @{
+            Source               = 'InferredFromPolicies'
+            HasEntraIdP1         = $true
+            HasEntraIdP2         = $InferredP2
+            HasIntunePlan1       = $InferredIntune
+            HasWorkloadIdPremium = $InferredWorkload
+        }
+    }
+
+    $BreakGlass = Get-CIPPCABreakGlassCandidate -Policies $Policies
+    if ($BreakGlass) {
+        $DirectoryType = if ($BreakGlass.type -eq 'user') { 'Users' } else { 'Groups' }
+        $Match = $null
+        foreach ($Entry in @(& $ReadCache $DirectoryType @('id', 'displayName'))) {
+            if ("$($Entry.id)" -eq $BreakGlass.id) { $Match = $Entry; break }
+        }
+        $ShortId = $BreakGlass.id.Substring(0, [math]::Min(8, $BreakGlass.id.Length))
+        $BreakGlass.displayName = if ($Match.displayName) { "$($Match.displayName)" } else { "ID: $ShortId..." }
+    }
+
+    @{
+        TenantFilter      = $TenantFilter
+        Policies          = $Policies
+        Enabled           = $Enabled
+        ReportOnly        = $ReportOnly
+        Disabled          = $Disabled
+        NamedLocations    = $NamedLocations
+        NamedLocationById = $NamedLocationById
+        AuthStrengths     = $AuthStrengths
+        ServicePrincipals = $ServicePrincipals
+        Roles             = $Roles
+        Licenses          = $Licenses
+        BreakGlass        = $BreakGlass
+        Data              = $Data
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAnalysisData.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAnalysisData.ps1
new file mode 100644
index 0000000000000..f39de927dedb7
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAnalysisData.ps1
@@ -0,0 +1,29 @@
+function Get-CIPPCAAnalysisData {
+    <#
+    .SYNOPSIS
+        Loads one static reference dataset used by the Conditional Access gap analysis.
+    .DESCRIPTION
+        Reads Config/SecuritySimulations/CAAnalysis/<Name>.json under the CIPP root and returns the parsed
+        object.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Name
+    )
+
+    $Path = Join-Path $env:CIPPRootPath "Config/SecuritySimulations/CAAnalysis/$Name.json"
+    if (-not (Test-Path -LiteralPath $Path)) {
+        Write-Information "Get-CIPPCAAnalysisData: dataset '$Name' was not found at $Path"
+        return $null
+    }
+
+    try {
+        [System.IO.File]::ReadAllText($Path) | ConvertFrom-Json -Depth 20 -ErrorAction Stop
+    } catch {
+        Write-Information "Get-CIPPCAAnalysisData: failed to parse $Name.json: $($_.Exception.Message)"
+        $null
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAppDisplayName.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAppDisplayName.ps1
new file mode 100644
index 0000000000000..50b9fcc519042
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAAppDisplayName.ps1
@@ -0,0 +1,45 @@
+function Get-CIPPCAAppDisplayName {
+    <#
+    .SYNOPSIS
+        Resolves an application ID referenced by a Conditional Access policy to a readable name.
+    .DESCRIPTION
+        Looks the ID up, in order, in the curated app descriptions, the tenant's cached service principals,
+        the known bypass-app list, the FOCI family list, the well-known app list, the Microsoft first-party
+        name table and the built-in application-group aliases (Office365, MicrosoftAdminPortals).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$AppId,
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Key = $AppId.ToLowerInvariant()
+    $Data = $Context.Data
+
+    $Description = $Data.AppDescriptionById[$Key]
+    if ($Description.displayName) { return "$($Description.displayName)" }
+
+    $ServicePrincipal = $Context.ServicePrincipals[$Key]
+    if ($ServicePrincipal.displayName) { return "$($ServicePrincipal.displayName)" }
+
+    $Bypass = $Data.BypassAppById[$Key]
+    if ($Bypass.displayName) { return "$($Bypass.displayName)" }
+
+    $Foci = $Data.FociById[$Key]
+    if ($Foci.displayName) { return "$($Foci.displayName)" }
+
+    $WellKnown = $Data.WellKnownById[$Key]
+    if ($WellKnown.displayName) { return "$($WellKnown.displayName)" }
+
+    $FirstParty = $Data.FirstPartyNames[$Key]
+    if ($FirstParty) { return "$FirstParty" }
+
+    $Alias = $Data.AppGroupAliases[$Key]
+    if ($Alias.displayName) { return "$($Alias.displayName)" }
+
+    return $AppId
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCABreakGlassCandidate.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCABreakGlassCandidate.ps1
new file mode 100644
index 0000000000000..39ad14687816a
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCABreakGlassCandidate.ps1
@@ -0,0 +1,56 @@
+function Get-CIPPCABreakGlassCandidate {
+    <#
+    .SYNOPSIS
+        Identifies the most likely break-glass (emergency access) account or group from policy exclusion
+        patterns.
+    .DESCRIPTION
+        Walks every enabled or report-only policy that targets All users and counts how often each excluded
+        user or group appears.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]]$Policies
+    )
+
+    $Candidates = [ordered]@{}
+    $ActivePolicies = @($Policies | Where-Object { $_.state -in @('enabled', 'enabledForReportingButNotEnforced') })
+
+    foreach ($Policy in $ActivePolicies) {
+        if (-not (@($Policy.conditions.users.includeUsers) -contains 'All')) { continue }
+
+        foreach ($UserId in @($Policy.conditions.users.excludeUsers)) {
+            if ($UserId -eq 'GuestsOrExternalUsers') { continue }
+            if (-not $Candidates.Contains($UserId)) {
+                $Candidates[$UserId] = [PSCustomObject]@{ Id = $UserId; Hits = 0; Policies = [System.Collections.Generic.List[string]]::new(); Type = 'user' }
+            }
+            $Candidates[$UserId].Hits++
+            $Candidates[$UserId].Policies.Add("$($Policy.displayName)")
+        }
+
+        foreach ($GroupId in @($Policy.conditions.users.excludeGroups)) {
+            if (-not $Candidates.Contains($GroupId)) {
+                $Candidates[$GroupId] = [PSCustomObject]@{ Id = $GroupId; Hits = 0; Policies = [System.Collections.Generic.List[string]]::new(); Type = 'group' }
+            }
+            $Candidates[$GroupId].Hits++
+            $Candidates[$GroupId].Policies.Add("$($Policy.displayName)")
+        }
+    }
+
+    $Primary = $null
+    foreach ($Entry in $Candidates.Values) {
+        if ($null -eq $Primary -or $Entry.Hits -gt $Primary.Hits) { $Primary = $Entry }
+    }
+    if ($null -eq $Primary) { return $null }
+
+    [PSCustomObject]@{
+        id          = "$($Primary.Id)"
+        count       = [int]$Primary.Hits
+        policies    = [string[]]@($Primary.Policies)
+        type        = $Primary.Type
+        displayName = $null
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAGapAnalysis.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAGapAnalysis.ps1
new file mode 100644
index 0000000000000..cfde3c7f7587c
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAGapAnalysis.ps1
@@ -0,0 +1,97 @@
+function Get-CIPPCAGapAnalysis {
+    <#
+    .SYNOPSIS
+        Runs the Conditional Access gap analysis for one tenant from CIPP's cache.
+    .DESCRIPTION
+        Builds the shared context (Get-CIPPCAAnalysisContext, cache only - no Graph calls), runs every
+        Test-CIPPCAGap* check, adds the persona-coverage findings, builds the persona x control matrix and
+        returns one object: policyCount, enabledCount, reportOnlyCount, disabledCount, findings      = @( id
+        (F-0001...), title, severity (Critical|High|Medium|Low|Info), category, description,
+        affectedPolicies (display names), remediation, fix ($null or @{ caTemplate }), relatedIds ),
+        personaMatrix = @{ personas; controls; cells = @( persona, control, state
+        (Enforced|ReportOnly|Missing|NotApplicable), policies ) }, score         = @{ score (1-10), scoreMax
+        = 10, enforcedControls, applicableControls, criticalFindings, highFindings }, licenses, breakGlass.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    $Context = Get-CIPPCAAnalysisContext -TenantFilter $TenantFilter
+
+    $Checks = @(
+        'Test-CIPPCAGapFociExclusion'
+        'Test-CIPPCAGapSwissCheeseGrant'
+        'Test-CIPPCAGapDeviceRegistrationBypass'
+        'Test-CIPPCAGapKnownBypassApps'
+        'Test-CIPPCAGapMissingMfa'
+        'Test-CIPPCAGapReportOnlyState'
+        'Test-CIPPCAGapResilienceDefaults'
+        'Test-CIPPCAGapLocationConditions'
+        'Test-CIPPCAGapLegacyAuth'
+        'Test-CIPPCAGapUserAgentBypass'
+        'Test-CIPPCAGapMicrosoftManagedPolicy'
+        'Test-CIPPCAGapPrivilegedRoleExclusion'
+        'Test-CIPPCAGapGuestExclusion'
+        'Test-CIPPCAGapCredentialRegistration'
+        'Test-CIPPCAGapGuestAuthStrength'
+        'Test-CIPPCAGapProtectedActions'
+        'Test-CIPPCAGapBreakGlass'
+        'Test-CIPPCAGapMfaCoverage'
+        'Test-CIPPCAGapIdentityProtection'
+        'Test-CIPPCAGapHighValueApps'
+        'Test-CIPPCAGapCaImmuneResources'
+        'Test-CIPPCAGapResourceExclusionBypass'
+        'Test-CIPPCAGapUncoveredAppExclusions'
+        'Test-CIPPCAGapMicrosoftGuidance'
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    foreach ($Check in $Checks) {
+        try {
+            foreach ($Finding in @(& $Check -Context $Context -ErrorAction Stop)) {
+                if ($null -ne $Finding) { $Findings.Add($Finding) }
+            }
+        } catch {
+            Write-Information "Get-CIPPCAGapAnalysis: $Check failed for $TenantFilter - $($_.Exception.Message)"
+        }
+    }
+
+    $Persona = Get-CIPPCAPersonaMatrix -Context $Context
+    foreach ($Finding in @($Persona.findings)) { $Findings.Add($Finding) }
+
+    $Findings = [System.Collections.Generic.List[object]]@($Findings | Where-Object { "$($_.severity)" -notin @('Info', 'Low') })
+    $Sequence = 0
+    foreach ($Finding in $Findings) {
+        $Sequence++
+        $Finding.id = 'F-{0:d4}' -f $Sequence
+    }
+
+    $PersonaMatrix = [PSCustomObject]@{
+        personas = $Persona.personas
+        controls = $Persona.controls
+        cells    = @($Persona.cells)
+    }
+    $Score = Get-CIPPCAPostureScore -Findings @($Findings) -PersonaMatrix $PersonaMatrix
+
+    [PSCustomObject]@{
+        policyCount     = @($Context.Policies).Count
+        enabledCount    = @($Context.Enabled).Count
+        reportOnlyCount = @($Context.ReportOnly).Count
+        disabledCount   = @($Context.Disabled).Count
+        findings        = @($Findings)
+        personaMatrix   = $PersonaMatrix
+        score           = $Score
+        licenses        = [PSCustomObject]@{
+            source               = "$($Context.Licenses.Source)"
+            hasEntraIdP1         = [bool]$Context.Licenses.HasEntraIdP1
+            hasEntraIdP2         = [bool]$Context.Licenses.HasEntraIdP2
+            hasIntunePlan1       = [bool]$Context.Licenses.HasIntunePlan1
+            hasWorkloadIdPremium = [bool]$Context.Licenses.HasWorkloadIdPremium
+        }
+        breakGlass      = $Context.BreakGlass
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAPersonaMatrix.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAPersonaMatrix.ps1
new file mode 100644
index 0000000000000..b4495ce76db95
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAPersonaMatrix.ps1
@@ -0,0 +1,155 @@
+function Get-CIPPCAPersonaMatrix {
+    <#
+    .SYNOPSIS
+        Builds the "who is protected by what" matrix: four personas by eight controls.
+    .DESCRIPTION
+        Personas come from how policies TARGET identities, never from policy names, so the matrix is
+        truthful for tenants that follow no naming convention: Admins              - policies that include
+        privileged roles, or All users without excluding roles Users               - policies that include
+        All users (group-scoped policies never prove everyone is covered) Guests              - policies
+        that include guests/external users, or All users without excluding them Workload identities -
+        policies that include service principals A cell is Enforced when an enabled policy in the persona's
+        bucket implements the control, ReportOnly when only a report-only policy does, Missing otherwise,
+        NotApplicable when the persona does not need that control, and Unlicensed when the tenant cannot
+        implement it: risk-based controls need Entra ID P2, compliant-device controls need Intune,
+        workload-identity risk needs Workload Identities Premium - a tenant is never marked as missing a
+        control it cannot buy into.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $ControlMeta = $Context.Data.CoverageControls
+    $ControlOrder = @('RequireMfa', 'PhishingResistantMfa', 'RequireCompliantDevice', 'BlockLegacyAuth', 'SignInRisk', 'UserRisk', 'SessionControls', 'BlockCountries')
+    $Personas = @(
+        [PSCustomObject]@{ id = 'admins'; label = 'Admins'; expected = $ControlOrder }
+        [PSCustomObject]@{ id = 'users'; label = 'Users'; expected = @($ControlOrder | Where-Object { $_ -ne 'PhishingResistantMfa' }) }
+        [PSCustomObject]@{ id = 'guests'; label = 'Guests'; expected = @('RequireMfa', 'BlockLegacyAuth', 'SignInRisk', 'SessionControls', 'BlockCountries') }
+        [PSCustomObject]@{ id = 'workloadIdentities'; label = 'Workload identities'; expected = @('SignInRisk', 'BlockCountries') }
+    )
+
+    $Licenses = $Context.Licenses
+    $Unavailable = [System.Collections.Generic.List[string]]::new()
+    if ($Licenses.HasEntraIdP2 -ne $true) { $Unavailable.Add('SignInRisk'); $Unavailable.Add('UserRisk') }
+    if ($Licenses.HasIntunePlan1 -ne $true) { $Unavailable.Add('RequireCompliantDevice') }
+    $WorkloadRiskAvailable = $Licenses.HasWorkloadIdPremium -eq $true
+
+    $PolicyPersonas = {
+        param($P)
+        $Out = [System.Collections.Generic.List[string]]::new()
+        $U = $P.conditions.users
+        $All = @($U.includeUsers) -contains 'All'
+        $ExcludesGuests = ($null -ne $U.excludeGuestsOrExternalUsers -and "$($U.excludeGuestsOrExternalUsers.guestOrExternalUserTypes)") -or (@($U.excludeUsers) -contains 'GuestsOrExternalUsers')
+        $IncludesGuests = ($null -ne $U.includeGuestsOrExternalUsers -and "$($U.includeGuestsOrExternalUsers.guestOrExternalUserTypes)") -or (@($U.includeUsers) -contains 'GuestsOrExternalUsers')
+        if (@($U.includeRoles).Count -gt 0 -or ($All -and @($U.excludeRoles).Count -eq 0)) { $Out.Add('admins') }
+        if ($All) { $Out.Add('users') }
+        if ($IncludesGuests -or ($All -and -not $ExcludesGuests)) { $Out.Add('guests') }
+        if (@($P.conditions.clientApplications.includeServicePrincipals).Count -gt 0) { $Out.Add('workloadIdentities') }
+        $Out.ToArray()
+    }
+
+    $Detectors = @{
+        'BlockLegacyAuth'        = {
+            param($P)
+            $Types = @($P.conditions.clientAppTypes)
+            (($Types -contains 'exchangeActiveSync') -or ($Types -contains 'other')) -and (@($P.grantControls.builtInControls) -contains 'block')
+        }
+        'RequireMfa'              = {
+            param($P)
+            (@($P.grantControls.builtInControls) -contains 'mfa') -or (-not [string]::IsNullOrWhiteSpace("$($P.grantControls.authenticationStrength.id)"))
+        }
+        'RequireCompliantDevice' = {
+            param($P)
+            $C = @($P.grantControls.builtInControls)
+            ($C -contains 'compliantDevice') -or ($C -contains 'domainJoinedDevice')
+        }
+        'SignInRisk'             = {
+            param($P)
+            (@($P.conditions.signInRiskLevels).Count -gt 0) -or (@($P.conditions.servicePrincipalRiskLevels).Count -gt 0)
+        }
+        'UserRisk'                = { param($P) @($P.conditions.userRiskLevels).Count -gt 0 }
+        'SessionControls'              = {
+            param($P)
+            ($P.sessionControls.signInFrequency.isEnabled -eq $true) -or ($P.sessionControls.persistentBrowser.isEnabled -eq $true)
+        }
+        'BlockCountries'          = {
+            param($P)
+            $L = $P.conditions.locations
+            ($null -ne $L) -and ((@($L.includeLocations).Count -gt 0) -or (@($L.excludeLocations).Count -gt 0)) -and (@($P.grantControls.builtInControls) -contains 'block')
+        }
+        'PhishingResistantMfa'   = { param($P) Test-CIPPCAPolicyPhishingResistant -Policy $P -Context $Context }
+    }
+
+    $SeverityForGap = {
+        param($PersonaId, $Control)
+        switch ($PersonaId) {
+            'admins' { if ($Control -in @('RequireMfa', 'PhishingResistantMfa')) { 'Critical' } else { 'High' } }
+            'users' { if ($Control -eq 'RequireMfa') { 'Critical' } elseif ($Control -eq 'BlockLegacyAuth') { 'High' } else { 'Medium' } }
+            'guests' { if ($Control -eq 'RequireMfa') { 'High' } else { 'Medium' } }
+            default { 'Low' }
+        }
+    }
+
+    $Buckets = @{}
+    foreach ($Persona in $Personas) { $Buckets[$Persona.id] = [System.Collections.Generic.List[object]]::new() }
+    foreach ($Policy in @($Context.Policies)) {
+        foreach ($PersonaId in @(& $PolicyPersonas $Policy)) {
+            $Buckets[$PersonaId].Add($Policy)
+        }
+    }
+
+    $Cells = [System.Collections.Generic.List[object]]::new()
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Persona in $Personas) {
+        $Assigned = @($Buckets[$Persona.id])
+        foreach ($Control in $ControlOrder) {
+            $ControlLabel = "$($ControlMeta.$Control.label)"
+            if ($Persona.expected -notcontains $Control) {
+                $Cells.Add([PSCustomObject]@{ persona = $Persona.label; control = $ControlLabel; state = 'NotApplicable'; policies = [string[]]@() })
+                continue
+            }
+            $Unlicensed = ($Unavailable -contains $Control) -or ($Persona.id -eq 'workloadIdentities' -and $Control -eq 'SignInRisk' -and -not $WorkloadRiskAvailable)
+            if ($Unlicensed) {
+                $Cells.Add([PSCustomObject]@{ persona = $Persona.label; control = $ControlLabel; state = 'Unlicensed'; policies = [string[]]@() })
+                continue
+            }
+            $Detector = $Detectors[$Control]
+            $EnabledHits = [string[]]@($Assigned | Where-Object { $_.state -eq 'enabled' -and (& $Detector $_) } | ForEach-Object { "$($_.displayName)" })
+            $ReportOnlyHits = [string[]]@($Assigned | Where-Object { $_.state -eq 'enabledForReportingButNotEnforced' -and (& $Detector $_) } | ForEach-Object { "$($_.displayName)" })
+
+            if ($EnabledHits.Count -gt 0) {
+                $State = 'Enforced'; $Names = $EnabledHits
+            } elseif ($ReportOnlyHits.Count -gt 0) {
+                $State = 'ReportOnly'; $Names = $ReportOnlyHits
+            } else {
+                $State = 'Missing'; $Names = [string[]]@()
+            }
+            $Cells.Add([PSCustomObject]@{ persona = $Persona.label; control = $ControlLabel; state = $State; policies = $Names })
+
+            if ($State -eq 'Missing' -and $Persona.id -ne 'workloadIdentities') {
+                $Params = @{
+                    Severity         = & $SeverityForGap $Persona.id $Control
+                    Category         = 'Persona coverage'
+                    Title            = "$($Persona.label) have no enforced policy for ""$ControlLabel"""
+                    Description      = "None of the enforced policies that apply to $($Persona.label) provides this control. $($ControlMeta.$Control.description)"
+                    Remediation      = "Extend a policy that already applies to $($Persona.label) with this control, or add a dedicated one."
+                    CaTemplate       = "$ControlLabel for $($Persona.label)"
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-policy-common'
+                }
+                $Findings.Add((New-CIPPCAGapFinding @Params))
+            }
+        }
+    }
+
+    [PSCustomObject]@{
+        personas     = [string[]]@($Personas | ForEach-Object { $_.label })
+        controls     = [string[]]@($ControlOrder | ForEach-Object { "$($ControlMeta.$_.label)" })
+        cells        = @($Cells)
+        findings     = @($Findings)
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAPostureScore.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAPostureScore.ps1
new file mode 100644
index 0000000000000..af17098fe74b9
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Get-CIPPCAPostureScore.ps1
@@ -0,0 +1,46 @@
+function Get-CIPPCAPostureScore {
+    <#
+    .SYNOPSIS
+        Computes the Conditional Access score on a 1-10 scale.
+    .DESCRIPTION
+        The score is the share of applicable persona-matrix controls that an enforced policy covers
+        (report-only counting half), on a 10-point scale, nudged down by the serious policy findings: half a
+        point per Critical and a quarter per High, capped at two points in total.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]]$Findings,
+        [Parameter(Mandatory = $true)]
+        $PersonaMatrix
+    )
+
+    $Round = { param($Value) [int][math]::Round([double]$Value, [System.MidpointRounding]::AwayFromZero) }
+
+    $Applicable = @($PersonaMatrix.cells | Where-Object { $_.state -notin @('NotApplicable', 'Unlicensed') })
+    $Covered = 0.0
+    foreach ($Cell in $Applicable) {
+        if ($Cell.state -eq 'Enforced') { $Covered += 1 }
+        elseif ($Cell.state -eq 'ReportOnly') { $Covered += 0.5 }
+    }
+    $Coverage = if ($Applicable.Count -gt 0) { ($Covered / $Applicable.Count) * 10 } else { 10 }
+
+    $Serious = @($Findings | Where-Object { "$($_.category)" -ne 'Persona coverage' })
+    $Critical = @($Serious | Where-Object { "$($_.severity)" -eq 'Critical' }).Count
+    $High = @($Serious | Where-Object { "$($_.severity)" -eq 'High' }).Count
+    $Penalty = [math]::Min(2, ($Critical * 0.5) + ($High * 0.25))
+
+    $Score = [math]::Max(1, [math]::Min(10, (& $Round ($Coverage - $Penalty))))
+
+    [PSCustomObject]@{
+        score            = [int]$Score
+        scoreMax         = 10
+        enforcedControls = [int](& $Round $Covered)
+        applicableControls = $Applicable.Count
+        criticalFindings = $Critical
+        highFindings     = $High
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/New-CIPPCAGapFinding.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/New-CIPPCAGapFinding.ps1
new file mode 100644
index 0000000000000..1636bcfb308c5
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/New-CIPPCAGapFinding.ps1
@@ -0,0 +1,52 @@
+function New-CIPPCAGapFinding {
+    <#
+    .SYNOPSIS
+        Builds one Conditional Access gap finding in the shape every Test-CIPPCAGap* check returns.
+    .DESCRIPTION
+        Returns a PSCustomObject with id (stamped later by Get-CIPPCAGapAnalysis), title, severity,
+        category, description, affectedPolicies (display names), remediation, fix ($null or @{ caTemplate =
+        '<template name>' }), documentationUrl (the Microsoft Learn page behind the finding - shown as a
+        button, never inside the text) and relatedIds (app/role/location IDs the finding refers to).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Title,
+        [Parameter(Mandatory = $true)]
+        [ValidateSet('Critical', 'High', 'Medium', 'Low', 'Info')]
+        [string]$Severity,
+        [Parameter(Mandatory = $true)]
+        [string]$Category,
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyString()]
+        [string]$Description,
+        [AllowEmptyString()]
+        [string]$Remediation = '',
+        [AllowEmptyCollection()]
+        [string[]]$AffectedPolicies = @(),
+        [string]$CaTemplate,
+        [string]$DocumentationUrl,
+        [AllowEmptyCollection()]
+        [string[]]$RelatedIds = @()
+    )
+
+    $Fix = $null
+    if (-not [string]::IsNullOrWhiteSpace($CaTemplate)) {
+        $Fix = @{ caTemplate = $CaTemplate }
+    }
+
+    [PSCustomObject]@{
+        id               = $null
+        title            = $Title
+        severity         = $Severity
+        category         = $Category
+        description      = $Description
+        affectedPolicies = [string[]]@($AffectedPolicies | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+        remediation      = $Remediation
+        fix              = $Fix
+        documentationUrl = $(if ([string]::IsNullOrWhiteSpace($DocumentationUrl)) { $null } else { $DocumentationUrl })
+        relatedIds       = [string[]]@($RelatedIds | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapBreakGlass.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapBreakGlass.ps1
new file mode 100644
index 0000000000000..5cdda5687193f
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapBreakGlass.ps1
@@ -0,0 +1,180 @@
+function Test-CIPPCAGapBreakGlass {
+    <#
+    .SYNOPSIS
+        Checks that the detected break-glass account or group is excluded from every user-targeting policy.
+    .DESCRIPTION
+        Uses the break-glass candidate on the context (the user or group excluded most often across enabled
+        and report-only All-users policies).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $BreakGlass = $Context.BreakGlass
+
+    $TargetsUsers = {
+        param($P)
+        $U = $P.conditions.users
+        (@($U.includeUsers | Where-Object { $_ -ne 'None' }).Count -gt 0) -or (@($U.includeGroups).Count -gt 0) -or (@($U.includeRoles).Count -gt 0)
+    }
+    $IsExcluded = {
+        param($P)
+        if ($BreakGlass.type -eq 'user') { @($P.conditions.users.excludeUsers) -contains $BreakGlass.id }
+        else { @($P.conditions.users.excludeGroups) -contains $BreakGlass.id }
+    }
+
+    $AllPolicies = @($Context.Policies)
+    $UserTargetingPolicies = @($AllPolicies | Where-Object { & $TargetsUsers $_ })
+
+    if ($BreakGlass) {
+        $Label = if ($BreakGlass.type -eq 'user') { 'emergency-access account' } else { 'emergency-access group' }
+        $DisplayName = "$($BreakGlass.displayName)"
+        $ExcludeTarget = if ($BreakGlass.type -eq 'user') { 'excluded users' } else { 'excluded groups' }
+
+        foreach ($Policy in $UserTargetingPolicies) {
+            $Excluded = & $IsExcluded $Policy
+
+            if ($Excluded) {
+                $Params = @{
+                    Severity         = 'Info'
+                    Category         = 'Emergency access'
+                    Title            = "The emergency-access $($BreakGlass.type) is excluded from this policy"
+                    Description      = "The $Label $DisplayName keeps working even if this policy locks everyone else out."
+                    Remediation      = "No change needed. Keep monitoring any sign-in by the $Label and confirm periodically that it still works."
+                    AffectedPolicies = @($Policy.displayName)
+                    RelatedIds       = @($BreakGlass.id)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+                }
+                $Findings.Add((New-CIPPCAGapFinding @Params))
+                continue
+            }
+
+            $Controls = @($Policy.grantControls.builtInControls)
+            $Blocks = $Controls -contains 'block'
+            $RequiresMfa = ($Controls -contains 'mfa') -or ($null -ne $Policy.grantControls.authenticationStrength)
+            $RequiresCompliance = ($Controls -contains 'compliantDevice') -or ($Controls -contains 'domainJoinedDevice')
+            $TargetsAllUsers = @($Policy.conditions.users.includeUsers) -contains 'All'
+            $TargetsAllApps = @($Policy.conditions.applications.includeApplications) -contains 'All'
+
+            $Severity = 'Low'
+            if ($Blocks -and $TargetsAllUsers -and $TargetsAllApps) { $Severity = 'High' }
+            elseif (($RequiresMfa -or $RequiresCompliance) -and $TargetsAllUsers) { $Severity = 'Medium' }
+            elseif ($Blocks -and $TargetsAllUsers) { $Severity = 'Medium' }
+
+            $IsMicrosoftManaged = "$($Policy.displayName)".ToLowerInvariant().Contains('microsoft managed') -or ($null -ne $Policy.templateId)
+            if ($IsMicrosoftManaged -and $Policy.state -eq 'disabled') {
+                $Params = @{
+                    Severity         = 'Info'
+                    Category         = 'Emergency access'
+                    Title            = "Disabled Microsoft-managed policy does not exclude the emergency-access $($BreakGlass.type)"
+                    Description      = "The $Label $DisplayName is not on the exclusion list of this Microsoft-managed policy. Because the policy is switched off, there is no exposure today."
+                    Remediation      = "Exclude the $Label $DisplayName before this policy is ever enabled, so emergency access is preserved."
+                    AffectedPolicies = @($Policy.displayName)
+                    RelatedIds       = @($BreakGlass.id)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+                }
+            } elseif ($Policy.state -eq 'enabledForReportingButNotEnforced') {
+                $Params = @{
+                    Severity         = 'Medium'
+                    Category         = 'Emergency access'
+                    Title            = "Report-only policy does not exclude the emergency-access $($BreakGlass.type)"
+                    Description      = "The $Label $DisplayName is not on the exclusion list. The policy is in report-only mode, so nothing is enforced yet, but enabling it as it stands could lock out emergency access."
+                    Remediation      = "Exclude the $Label $DisplayName before this policy is switched to enforced."
+                    AffectedPolicies = @($Policy.displayName)
+                    RelatedIds       = @($BreakGlass.id)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+                }
+            } elseif ($Policy.state -eq 'disabled') {
+                $Params = @{
+                    Severity         = 'Low'
+                    Category         = 'Emergency access'
+                    Title            = "Disabled policy does not exclude the emergency-access $($BreakGlass.type)"
+                    Description      = "The $Label $DisplayName is not on the exclusion list. The policy is switched off, so there is no exposure today, but enabling it as it stands could lock out emergency access."
+                    Remediation      = "Exclude the $Label $DisplayName before this policy is enabled."
+                    AffectedPolicies = @($Policy.displayName)
+                    RelatedIds       = @($BreakGlass.id)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+                }
+            } else {
+                $Params = @{
+                    Severity         = $Severity
+                    Category         = 'Emergency access'
+                    Title            = "Enforced policy does not exclude the emergency-access $($BreakGlass.type)"
+                    Description      = "The $Label $DisplayName is subject to this enforced policy. If the policy misfires, for example through a faulty multifactor, device or block rule, the $Label is locked out with everyone else and cannot be used to recover."
+                    Remediation      = "Add $DisplayName to the $ExcludeTarget of this policy so emergency access survives a lockout."
+                    AffectedPolicies = @($Policy.displayName)
+                    RelatedIds       = @($BreakGlass.id)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+                }
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+
+        $WithNames = [System.Collections.Generic.List[string]]::new()
+        $WithoutNames = [System.Collections.Generic.List[string]]::new()
+        $EnabledWithoutCount = 0
+        foreach ($Policy in $UserTargetingPolicies) {
+            if (& $IsExcluded $Policy) { $WithNames.Add($Policy.displayName) }
+            else {
+                $WithoutNames.Add($Policy.displayName)
+                if ($Policy.state -eq 'enabled') { $EnabledWithoutCount++ }
+            }
+        }
+        $BreakGlassLabel = if ($BreakGlass.type -eq 'user') { 'Emergency-access account' } else { 'Emergency-access group' }
+        $TotalPolicyCount = $AllPolicies.Count
+        $Overview = "$BreakGlassLabel`: $DisplayName. The tenant has $TotalPolicyCount policies, of which $($UserTargetingPolicies.Count) apply to users; $($WithNames.Count) exclude the $Label and $($WithoutNames.Count) do not."
+
+        if ($WithoutNames.Count -gt 0) {
+            $Listed = @($WithoutNames | Select-Object -First 10) -join ', '
+            $Overflow = if ($WithoutNames.Count -gt 10) { " and $($WithoutNames.Count - 10) more" } else { '' }
+            $Params = @{
+                Severity         = if ($EnabledWithoutCount -gt 0) { 'High' } else { 'Medium' }
+                Category         = 'Emergency access'
+                Title            = "$BreakGlassLabel excluded from only $($WithNames.Count) of $($UserTargetingPolicies.Count) policies that could lock it out"
+                Description      = "$Overview $DisplayName was identified as the $($BreakGlassLabel.ToLowerInvariant()) because it is the identity excluded most often across your policies. A single misconfigured policy among the $($WithoutNames.Count) that do not exclude it could lock out every administrator, with no account left to recover access. Policies that do not exclude it: $Listed$Overflow"
+                Remediation      = "Exclude $DisplayName from all $($WithoutNames.Count) policies listed and from every future policy, and alert on any sign-in by it."
+                AffectedPolicies = @($WithoutNames)
+                RelatedIds       = @($BreakGlass.id)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+            }
+        } else {
+            $Params = @{
+                Severity         = 'Info'
+                Category         = 'Emergency access'
+                Title            = "$BreakGlassLabel is excluded from all $($UserTargetingPolicies.Count) policies that apply to users"
+                Description      = "$Overview Emergency access is preserved across the tenant: whatever a policy does, $DisplayName can still sign in to recover from a lockout."
+                Remediation      = "Confirm $DisplayName is the intended emergency-access $($BreakGlass.type), keep a second one for redundancy, alert on any sign-in by them and test them regularly."
+                AffectedPolicies = @($WithNames)
+                RelatedIds       = @($BreakGlass.id)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+            }
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    } else {
+        $CriticalPolicies = @($Context.Enabled | Where-Object {
+                if (-not (@($_.conditions.users.includeUsers) -contains 'All')) { return $false }
+                $C = @($_.grantControls.builtInControls)
+                ($C -contains 'mfa') -or ($null -ne $_.grantControls.authenticationStrength) -or ($C -contains 'block') -or ($C -contains 'compliantDevice')
+            })
+        $CriticalList = @($CriticalPolicies | Select-Object -First 10 | ForEach-Object { "- $($_.displayName)" }) -join "`n"
+        $CriticalOverflow = if ($CriticalPolicies.Count -gt 10) { "`nand $($CriticalPolicies.Count - 10) more" } else { '' }
+        $TotalPolicyCount = $AllPolicies.Count
+        $Params = @{
+            Severity         = 'Critical'
+            Category         = 'Emergency access'
+            Title            = "No emergency-access account could be identified across $TotalPolicyCount policies"
+            Description      = "None of the $TotalPolicyCount policies share a consistently excluded user or group, which is how an emergency-access account normally shows up; $($UserTargetingPolicies.Count) of them apply to users. Without such an account, one faulty policy can lock out every administrator, and recovery then depends on Microsoft support and can take days. Policies that most need an exclusion:`n$CriticalList$CriticalOverflow"
+            Remediation      = 'Create two dedicated emergency-access accounts, exclude them from every policy and alert on any sign-in by them.'
+            AffectedPolicies = @($CriticalPolicies | ForEach-Object { $_.displayName })
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapCaImmuneResources.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapCaImmuneResources.ps1
new file mode 100644
index 0000000000000..9219b6e2a3243
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapCaImmuneResources.ps1
@@ -0,0 +1,37 @@
+function Test-CIPPCAGapCaImmuneResources {
+    <#
+    .SYNOPSIS
+        Tenant-wide awareness finding about Microsoft resources that Conditional Access never evaluates.
+    .DESCRIPTION
+        When at least one enabled or report-only policy targets All cloud apps, emits a single Info finding
+        listing the resources that always show notApplied in sign-in logs (Intune Checkin, Windows
+        Notification Service, Mobile Application Management, Azure MFA Connector, OCaaS Client Interaction
+        Service, Authenticator App).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $AllAppsPolicies = @($Context.Policies | Where-Object { $_.state -ne 'disabled' -and (@($_.conditions.applications.includeApplications) -contains 'All') })
+    if ($AllAppsPolicies.Count -eq 0) { return @($Findings) }
+
+    $Resources = @($Context.Data.ImmuneResources)
+    $Names = @($Resources | ForEach-Object { "$($_.displayName)" }) -join ', '
+    $Params = @{
+        Severity         = 'Info'
+        Category         = 'Always-exempt services'
+        Title            = "$($Resources.Count) Microsoft services are never subject to Conditional Access"
+        Description      = "Although $($AllAppsPolicies.Count) of your policies cover every application, Microsoft exempts these services by design: $Names. Sign-ins to them are recorded as not evaluated, and they can be used to test whether a password is valid without triggering any policy."
+        Remediation      = 'Nothing can change this. Watch sign-in activity against these services for signs of password testing.'
+        AffectedPolicies = @($AllAppsPolicies | ForEach-Object { $_.displayName })
+        RelatedIds       = @($Resources | ForEach-Object { "$($_.resourceId)" })
+    }
+    $Findings.Add((New-CIPPCAGapFinding @Params))
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapCredentialRegistration.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapCredentialRegistration.ps1
new file mode 100644
index 0000000000000..0044f70915124
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapCredentialRegistration.ps1
@@ -0,0 +1,112 @@
+function Test-CIPPCAGapCredentialRegistration {
+    <#
+    .SYNOPSIS
+        Reviews policies that target "Register security info" for constraints that block new-device
+        credential setup.
+    .DESCRIPTION
+        Since July 2026 (MC1326253) policies scoped to the register-security-info user action are evaluated
+        during Windows Hello for Business and macOS Platform SSO registration.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Reference = $Context.Data.Reference
+    $RegisterSecurityInfo = "$($Reference.registerSecurityInfoAction)"
+    $LegacyTrustedIps = "$($Reference.legacyMfaTrustedIpsLocation)"
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($Policy.state -eq 'disabled') { continue }
+        if (-not (@($Policy.conditions.applications.includeUserActions) -contains $RegisterSecurityInfo)) { continue }
+
+        $Grant = $Policy.grantControls
+        $Controls = @($Grant.builtInControls)
+        $Conditions = $Policy.conditions
+        $Locations = $Conditions.locations
+
+        $RequiresCompliance = ($Controls -contains 'compliantDevice') -or ($Controls -contains 'domainJoinedDevice')
+        $RequiresApprovedApp = $Controls -contains 'approvedApplication'
+        $RequiresAppProtection = $Controls -contains 'compliantApplication'
+        $IncludedLocations = if ($null -ne $Locations) { @($Locations.includeLocations) } else { @() }
+        $ExcludedLocations = if ($null -ne $Locations) { @($Locations.excludeLocations) } else { @() }
+        $HasLocationConditions = ($IncludedLocations.Count -gt 0) -or ($ExcludedLocations.Count -gt 0)
+        $HasDeviceFilter = $null -ne $Conditions.devices.deviceFilter.rule
+        $HasMfaAlternative = ($Grant.operator -eq 'OR') -and (($Controls -contains 'mfa') -or ($null -ne $Grant.authenticationStrength))
+
+        $Issues = [System.Collections.Generic.List[string]]::new()
+        if ($RequiresCompliance -and -not $HasMfaAlternative) {
+            $Issues.Add('A managed-device requirement, which a device cannot meet while it is still being set up')
+        }
+        if (($RequiresApprovedApp -or $RequiresAppProtection) -and -not $HasMfaAlternative) {
+            $Issues.Add('An approved or protected app requirement, which may not be met before those apps are installed')
+        }
+        if ($HasLocationConditions) {
+            if ($IncludedLocations.Count -gt 0 -and -not ($IncludedLocations -contains 'All') -and -not ($IncludedLocations -contains 'AllTrusted')) {
+                $LocationNames = @($IncludedLocations | ForEach-Object {
+                        if ($_ -eq $LegacyTrustedIps) { 'MFA Trusted IPs (legacy)' }
+                        else {
+                            $Named = $Context.NamedLocationById["$_"]
+                            if ($Named.displayName) { "$($Named.displayName)" } else { "$_" }
+                        }
+                    }) -join ', '
+                $Issues.Add("A network requirement limiting setup to $LocationNames, which blocks people setting up a device from home or on the road")
+            }
+            if (($ExcludedLocations -contains 'AllTrusted') -and -not ($IncludedLocations -contains 'AllTrusted')) {
+                $Issues.Add('A block on untrusted networks, which affects people setting up a device from home or a public network')
+            }
+        }
+        if ($HasDeviceFilter) {
+            $Issues.Add('A device filter, which may not evaluate reliably before the device is fully registered')
+        }
+
+        if ($Issues.Count -eq 0) {
+            $StateNote = if ($Policy.state -eq 'enabledForReportingButNotEnforced') {
+                'The policy is in report-only mode, so it will only apply during registration once it is enforced.'
+            } else {
+                'The policy is enforced, so it already applies during registration.'
+            }
+            $Params = @{
+                Severity         = 'Info'
+                Category         = 'Sign-in method registration'
+                Title            = 'Sign-in method registration policy is compatible with new-device setup'
+                Description      = "Policies that protect the registration of sign-in methods now also apply when people set up Windows Hello or macOS Platform SSO on a new device. This one asks only for multifactor authentication and has no device, network or app conditions, so it should not get in the way of setting up a new device. $StateNote"
+                Remediation      = 'No change needed. Make sure people can meet the multifactor requirement on a brand-new device, for example with a Temporary Access Pass, and let the helpdesk know an extra prompt can appear during setup.'
+                AffectedPolicies = @($Policy.displayName)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-security-info-registration'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+            continue
+        }
+
+        $Severity = 'Medium'
+        if (($RequiresCompliance -and -not $HasMfaAlternative) -or ($HasLocationConditions -and -not ($IncludedLocations -contains 'All'))) {
+            $Severity = 'High'
+        }
+
+        $Remediation = if ($RequiresCompliance -and -not $HasMfaAlternative) {
+            'Keep the managed-device requirement for ordinary sign-in but not for registering sign-in methods, and let new devices be set up with multifactor authentication or a Temporary Access Pass.'
+        } elseif ($HasLocationConditions) {
+            'Allow registration from any network, or at least from the networks people actually set up devices on, and keep the stricter network rules for ordinary sign-in.'
+        } else {
+            'Confirm that people can meet the device and app conditions of this policy while setting up a new device, and relax them for the registration step if they cannot.'
+        }
+
+        $Params = @{
+            Severity         = $Severity
+            Category         = 'Sign-in method registration'
+            Title            = 'Policy may stop people from setting up a new device'
+            Description      = "Policies that protect the registration of sign-in methods also apply when people set up Windows Hello or macOS Platform SSO on a new device. This one has conditions a brand-new device may not be able to meet:`n$(@($Issues | ForEach-Object { "- $_" }) -join "`n")`n`nPeople setting up a new laptop or Mac could be unable to finish, and the helpdesk would see failed enrollments."
+            Remediation      = $Remediation
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-security-info-registration'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapDeviceRegistrationBypass.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapDeviceRegistrationBypass.ps1
new file mode 100644
index 0000000000000..c7a084fe9e9a1
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapDeviceRegistrationBypass.ps1
@@ -0,0 +1,79 @@
+function Test-CIPPCAGapDeviceRegistrationBypass {
+    <#
+    .SYNOPSIS
+        Finds policies that try to protect device registration with controls the Device Registration Service
+        ignores.
+    .DESCRIPTION
+        The Device Registration Service only honors MFA / authentication strength grant controls (MSRC
+        VULN-153600, by design).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $DrsId = "$($Context.Data.DeviceRegistrationResource.resourceId)"
+    $RegisterAction = "$($Context.Data.Reference.registerDeviceAction)"
+
+    $RequiresMfa = {
+        param($P)
+        (@($P.grantControls.builtInControls) -contains 'mfa') -or ($null -ne $P.grantControls.authenticationStrength)
+    }
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($Policy.state -eq 'disabled') { continue }
+
+        $Apps = $Policy.conditions.applications
+        $Controls = @($Policy.grantControls.builtInControls)
+        $Locations = $Policy.conditions.locations
+
+        $ExplicitlyTargetsRegistration = (@($Apps.includeApplications) -contains $DrsId) -or (@($Apps.includeUserActions) -contains $RegisterAction)
+        $TargetsAllApps = @($Apps.includeApplications) -contains 'All'
+        if (-not $ExplicitlyTargetsRegistration -and -not $TargetsAllApps) { continue }
+
+        $UsesLocationCondition = ($null -ne $Locations) -and ((@($Locations.includeLocations).Count -gt 0) -or (@($Locations.excludeLocations).Count -gt 0))
+        $RequiresCompliantDevice = ($Controls -contains 'compliantDevice') -or ($Controls -contains 'domainJoinedDevice')
+        if (-not $UsesLocationCondition -and -not $RequiresCompliantDevice) { continue }
+        if (& $RequiresMfa $Policy) { continue }
+
+        $HasRegistrationMfaPolicy = $false
+        foreach ($Other in @($Context.Policies)) {
+            if ($Other.id -eq $Policy.id -or $Other.state -eq 'disabled') { continue }
+            $OtherApps = $Other.conditions.applications
+            $CoversRegistration = (@($OtherApps.includeUserActions) -contains $RegisterAction) -or (@($OtherApps.includeApplications) -contains $DrsId)
+            if ($CoversRegistration -and (& $RequiresMfa $Other)) { $HasRegistrationMfaPolicy = $true; break }
+        }
+        if ($HasRegistrationMfaPolicy) { continue }
+
+        $Blocks = $Controls -contains 'block'
+        $Issues = [System.Collections.Generic.List[string]]::new()
+        if ($UsesLocationCondition) { $Issues.Add('network location conditions') }
+        if ($RequiresCompliantDevice) { $Issues.Add('a managed-device requirement') }
+        $IssueText = $Issues -join ' and '
+
+        $Framing = if ($Blocks) {
+            "This policy blocks access based on $IssueText, but the device registration service ignores those conditions. New devices can therefore still be registered, for example from an untrusted network."
+        } else {
+            "This policy relies on $IssueText, but the device registration service ignores those conditions and only responds to a multifactor requirement."
+        }
+
+        $Params = @{
+            Severity         = if ($ExplicitlyTargetsRegistration) { 'High' } else { 'Medium' }
+            Category         = 'Device registration'
+            Title            = if ($ExplicitlyTargetsRegistration) { 'Device registration is protected only by conditions the service ignores' } else { 'Device registration is not covered by the conditions of this policy' }
+            Description      = "$Framing No other enforced policy requires multifactor authentication when a device is registered, so anyone with a valid password can register a device that may then count as trusted."
+            Remediation      = 'Require multifactor authentication for registering or joining devices through a dedicated policy, since network and device conditions do not protect this step.'
+            AffectedPolicies = @($Policy.displayName)
+            RelatedIds       = @($DrsId)
+            CaTemplate       = "$($Context.Data.Reference.templates.registerSecurityInfo)"
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-registration'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapFociExclusion.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapFociExclusion.ps1
new file mode 100644
index 0000000000000..333480056dc93
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapFociExclusion.ps1
@@ -0,0 +1,46 @@
+function Test-CIPPCAGapFociExclusion {
+    <#
+    .SYNOPSIS
+        Flags policies that exclude an app from the FOCI (Family of Client IDs) token-sharing family.
+    .DESCRIPTION
+        FOCI apps share refresh tokens, so excluding one Microsoft client (Teams, Office, Outlook Mobile,
+        ...) from a policy effectively excludes every other family member.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $FociApps = @($Context.Data.FociApps)
+
+    foreach ($Policy in @($Context.Policies)) {
+        foreach ($AppId in @($Policy.conditions.applications.excludeApplications)) {
+            $Key = "$AppId".ToLowerInvariant()
+            $App = $Context.Data.FociById[$Key]
+            if ($null -eq $App) { continue }
+
+            $Family = @($FociApps | Where-Object { "$($_.appId)".ToLowerInvariant() -ne $Key })
+            $FamilyNames = @($Family | Select-Object -First 8 | ForEach-Object { "$($_.displayName)" })
+            $Overflow = if ($Family.Count -gt 8) { ' and others' } else { '' }
+
+            $Params = @{
+                Severity         = 'Critical'
+                Category         = 'Shared app tokens'
+                Title            = "Exempting $($App.displayName) also exempts $($Family.Count) related Microsoft apps"
+                Description      = "$($App.displayName) belongs to a family of Microsoft applications that share sign-in tokens, so a token obtained through one member works for the others. " +
+                "Exempting it from this policy therefore exempts the whole family, including $($FamilyNames -join ', ')$Overflow."
+                Remediation      = 'Remove the exemption and, if this application needs different treatment, give it a dedicated policy instead of exempting it from a broad one.'
+                AffectedPolicies = @($Policy.displayName)
+                RelatedIds       = @($Family | ForEach-Object { "$($_.appId)" })
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-cloud-apps'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapGuestAuthStrength.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapGuestAuthStrength.ps1
new file mode 100644
index 0000000000000..b4effdf4579ce
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapGuestAuthStrength.ps1
@@ -0,0 +1,64 @@
+function Test-CIPPCAGapGuestAuthStrength {
+    <#
+    .SYNOPSIS
+        Advises on Cross-Tenant Access Settings when guests are required to satisfy MFA or an authentication
+        strength.
+    .DESCRIPTION
+        Requiring MFA for guests is best practice, not a weakness, so this is an Info-level operational
+        advisory: guest users authenticate in their home tenant and are blocked unless inbound MFA trust is
+        configured.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($Policy.state -eq 'disabled') { continue }
+        $Users = $Policy.conditions.users
+        $Grant = $Policy.grantControls
+        $TargetsGuests = (@($Users.includeUsers) -contains 'GuestsOrExternalUsers') -or ($null -ne $Users.includeGuestsOrExternalUsers)
+        $RequiresAuthStrength = $null -ne $Grant.authenticationStrength
+        $RequiresMfa = @($Grant.builtInControls) -contains 'mfa'
+        if (-not $TargetsGuests -or (-not $RequiresAuthStrength -and -not $RequiresMfa)) { continue }
+
+        $StrengthType = 'MFA'
+        if ($RequiresAuthStrength) {
+            $StrengthName = if ($Grant.authenticationStrength.displayName) { "$($Grant.authenticationStrength.displayName)" } else { 'Unknown' }
+            $StrengthType = if (Test-CIPPCAPolicyPhishingResistant -Policy $Policy -Context $Context) { 'Phishing-resistant MFA' } else { "the ""$StrengthName"" authentication strength" }
+        }
+
+        $GuestTypes = [System.Collections.Generic.List[string]]::new()
+        if ($null -ne $Users.includeGuestsOrExternalUsers) {
+            $TypeString = "$($Users.includeGuestsOrExternalUsers.guestOrExternalUserTypes)"
+            if ($TypeString.Contains('b2bCollaborationGuest')) { $GuestTypes.Add('B2B Collaboration guests') }
+            if ($TypeString.Contains('b2bCollaborationMember')) { $GuestTypes.Add('B2B Collaboration members') }
+            if ($TypeString.Contains('b2bDirectConnectUser')) { $GuestTypes.Add('B2B Direct Connect users') }
+            if ($TypeString.Contains('internalGuest')) { $GuestTypes.Add('Internal guests') }
+            if ($TypeString.Contains('serviceProvider')) { $GuestTypes.Add('Service provider users') }
+        }
+        $GuestTypeText = if ($GuestTypes.Count -gt 0) { $GuestTypes -join ', ' } else { 'all guest and external users' }
+
+        $PhishingNote = if ($RequiresAuthStrength -and $StrengthType -eq 'Phishing-resistant MFA') {
+            ' Few organizations have phishing-resistant methods rolled out, so guests can only meet this requirement if their home organization supports such methods and this tenant trusts the result.'
+        } else { '' }
+
+        $Params = @{
+            Severity         = 'Info'
+            Category         = 'Guest coverage'
+            Title            = 'Guest multifactor requirement depends on trusting their home organization'
+            Description      = "This policy requires $StrengthType from $GuestTypeText. Guests prove their identity in their home organization rather than here, so they can only meet this requirement if this tenant is set to trust the multifactor authentication their home organization performed. Until that trust is in place, guests are blocked even after completing multifactor authentication at home.$PhishingNote"
+            Remediation      = 'Trust the multifactor authentication performed by the home organizations of your guests in the cross-tenant access settings, for all external organizations or per partner, and verify with a guest sign-in before enforcing.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/external-id/authentication-conditional-access'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapGuestExclusion.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapGuestExclusion.ps1
new file mode 100644
index 0000000000000..b38fc6f1906e9
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapGuestExclusion.ps1
@@ -0,0 +1,171 @@
+function Test-CIPPCAGapGuestExclusion {
+    <#
+    .SYNOPSIS
+        Flags All-users policies that exclude guest or external users, and tenants with no guest coverage at
+        all.
+    .DESCRIPTION
+        Per policy (any state): a policy targeting All users that excludes GuestsOrExternalUsers, either the
+        simple sentinel or the structured excludeGuestsOrExternalUsers object, produces a finding whose
+        severity depends on what the policy enforces (security-info registration, block, MFA on all apps, or
+        other) and on whether another non-disabled policy covers guests.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Reference = $Context.Data.Reference
+    $TypeLabels = $Reference.guestTypeLabels
+    $AllKnownTypes = @($Reference.guestTypeOrder | ForEach-Object { "$_" })
+    $RegisterSecurityInfo = "$($Reference.registerSecurityInfoAction)"
+
+    $LabelOf = {
+        param($TypeName)
+        $Label = $TypeLabels.$TypeName
+        if ($Label) { "$Label" } else { "$TypeName" }
+    }
+
+    foreach ($Policy in @($Context.Policies)) {
+        $Users = $Policy.conditions.users
+        if (-not (@($Users.includeUsers) -contains 'All')) { continue }
+
+        $ExcludesGuestsSimple = @($Users.excludeUsers) -contains 'GuestsOrExternalUsers'
+        $ExcludeObject = $Users.excludeGuestsOrExternalUsers
+        $HasStructuredExclusion = ($null -ne $ExcludeObject) -and ($null -ne $ExcludeObject.guestOrExternalUserTypes)
+        if (-not $ExcludesGuestsSimple -and -not $HasStructuredExclusion) { continue }
+
+        $ExcludedGuestTypes = @()
+        $ExternalTenantScope = ''
+        if ($HasStructuredExclusion) {
+            $ExcludedGuestTypes = @("$($ExcludeObject.guestOrExternalUserTypes)" -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
+            $Tenants = $ExcludeObject.externalTenants
+            if ("$($Tenants.'@odata.type')".Contains('AllExternalTenants') -or "$($Tenants.membershipKind)" -eq 'all') {
+                $ExternalTenantScope = 'all external organizations'
+            } elseif ("$($Tenants.membershipKind)" -eq 'enumerated') {
+                $ExternalTenantScope = 'specific external organizations'
+            }
+        }
+
+        $ExcludesAllTypes = $ExcludesGuestsSimple -or (@($AllKnownTypes | Where-Object { $ExcludedGuestTypes -notcontains $_ }).Count -eq 0)
+
+        $Controls = @($Policy.grantControls.builtInControls)
+        $RequiresMfa = ($Controls -contains 'mfa') -or ($null -ne $Policy.grantControls.authenticationStrength)
+        $Blocks = $Controls -contains 'block'
+        $TargetsSecurityRegistration = @($Policy.conditions.applications.includeUserActions) -contains $RegisterSecurityInfo
+        $TargetsAllApps = @($Policy.conditions.applications.includeApplications) -contains 'All'
+
+        $HasGuestCoveragePolicy = $false
+        foreach ($Other in @($Context.Policies)) {
+            if ($Other.id -eq $Policy.id -or $Other.state -eq 'disabled') { continue }
+            $OtherUsers = $Other.conditions.users
+            $IncludesGuests = (@($OtherUsers.includeUsers) -contains 'GuestsOrExternalUsers') -or ($null -ne $OtherUsers.includeGuestsOrExternalUsers)
+            $AllWithoutGuestExclusion = (@($OtherUsers.includeUsers) -contains 'All') -and -not (@($OtherUsers.excludeUsers) -contains 'GuestsOrExternalUsers') -and ($null -eq $OtherUsers.excludeGuestsOrExternalUsers)
+            if ($IncludesGuests -or $AllWithoutGuestExclusion) { $HasGuestCoveragePolicy = $true; break }
+        }
+
+        if ($ExcludesGuestsSimple) {
+            $GuestDescription = 'all guest and external users'
+            $ExcludedTypesList = $AllKnownTypes
+        } else {
+            $GuestDescription = (@($ExcludedGuestTypes | ForEach-Object { & $LabelOf $_ }) -join ', ')
+            if ($ExternalTenantScope) { $GuestDescription += " from $ExternalTenantScope" }
+            $ExcludedTypesList = $ExcludedGuestTypes
+        }
+
+        $ResourceTenantEnforceable = @($ExcludedTypesList | Where-Object { $_ -in @('b2bCollaborationGuest', 'b2bCollaborationMember', 'internalGuest', 'serviceProvider') })
+        $HomeTenantOnly = @($ExcludedTypesList | Where-Object { $_ -eq 'b2bDirectConnectUser' })
+        $OtherTypes = @($ExcludedTypesList | Where-Object { $_ -eq 'otherExternalUser' })
+
+        $EnforcementDetail = ''
+        if ($ResourceTenantEnforceable.Count -gt 0) {
+            $EnforcementDetail += "`n`nGuest types this tenant can hold to its own requirements: $(@($ResourceTenantEnforceable | ForEach-Object { & $LabelOf $_ }) -join ', '). They complete multifactor authentication in their home organization, and this tenant can be set to trust that result."
+        }
+        if ($HomeTenantOnly.Count -gt 0) {
+            $EnforcementDetail += "`n`nGuest types that sign in only through their home organization: $(& $LabelOf 'b2bDirectConnectUser'). This tenant cannot enforce its own requirements on them and can only ask that their home organization applies equivalent ones."
+        }
+        if ($OtherTypes.Count -gt 0) {
+            $EnforcementDetail += "`n`nOther external identities exempt here: $(& $LabelOf 'otherExternalUser'). These are external accounts that fall outside the standard guest and partner categories."
+        }
+
+        if ($TargetsSecurityRegistration) {
+            $Severity = if ($HasGuestCoveragePolicy) { 'Medium' } else { 'High' }
+            $ContextDetail = "This policy protects the registration of sign-in methods, yet $GuestDescription are exempt from it. A compromised guest account could add its own sign-in methods unchallenged."
+        } elseif ($Blocks -and $TargetsAllApps) {
+            $Severity = if ($HasGuestCoveragePolicy) { 'Medium' } else { 'High' }
+            $ContextDetail = "This policy blocks access to every application, yet $GuestDescription are exempt from it and pass where everyone else is stopped."
+        } elseif ($RequiresMfa -and $TargetsAllApps) {
+            $Severity = if ($HasGuestCoveragePolicy) { 'Medium' } else { 'High' }
+            $ContextDetail = "This policy requires multifactor authentication for every application, yet $GuestDescription are exempt from it and can sign in with a password alone."
+        } else {
+            $Severity = if ($HasGuestCoveragePolicy) { 'Low' } else { 'Medium' }
+            $ContextDetail = "This policy applies to all users, yet $GuestDescription are exempt from it and its requirements do not reach them."
+        }
+        if (-not $HasGuestCoveragePolicy) {
+            $ContextDetail += ' No other policy applies comparable requirements to guests, so they are left without this protection.'
+        }
+
+        $TypesText = if ($ExcludesGuestsSimple) {
+            ' Exempt guest types: every type of guest and external user.'
+        } elseif ($ExcludedGuestTypes.Count -gt 0) {
+            " Exempt guest types: $(@($ExcludedGuestTypes | ForEach-Object { & $LabelOf $_ }) -join ', ')."
+        } else { '' }
+        $ScopeText = if ($ExternalTenantScope) { " This applies to guests from $ExternalTenantScope." } else { '' }
+
+        $Remediation = if ($HasGuestCoveragePolicy) {
+            'Confirm that the policy covering guests applies the same requirements to the same applications, and trust the multifactor authentication guests complete in their home organization so they can meet it.'
+        } else {
+            "Require multifactor authentication from guests through a dedicated policy such as ""$($Reference.templates.mfaB2BGuest)"" or ""$($Reference.templates.mfaMixedGuests)"", or remove the exemption from this policy, and trust the multifactor authentication guests complete in their home organization."
+        }
+
+        $TitleCount = if ($ExcludesAllTypes) { 'All' } else { "$($ExcludedGuestTypes.Count)" }
+        $TitleSuffix = if ($HasGuestCoveragePolicy) { '' } else { ' with no other policy covering them' }
+
+        $Params = @{
+            Severity         = $Severity
+            Category         = 'Guest coverage'
+            Title            = "$TitleCount external user type(s) exempt from this policy$TitleSuffix"
+            Description      = $ContextDetail + $TypesText + $ScopeText + $EnforcementDetail
+            Remediation      = $Remediation
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-old-require-mfa-guest'
+        }
+        if (-not $HasGuestCoveragePolicy) { $Params['CaTemplate'] = "$($Reference.templates.mfaB2BGuest)" }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    $GuestExcludingPolicies = @($Context.Enabled | Where-Object {
+            $U = $_.conditions.users
+            if (-not (@($U.includeUsers) -contains 'All')) { return $false }
+            (@($U.excludeUsers) -contains 'GuestsOrExternalUsers') -or ($null -ne $U.excludeGuestsOrExternalUsers -and $null -ne $U.excludeGuestsOrExternalUsers.guestOrExternalUserTypes)
+        })
+    $HasGuestSpecificMfa = @($Context.Enabled | Where-Object {
+            $U = $_.conditions.users
+            $IncludesGuests = (@($U.includeUsers) -contains 'GuestsOrExternalUsers') -or ($null -ne $U.includeGuestsOrExternalUsers)
+            $RequiresMfa = (@($_.grantControls.builtInControls) -contains 'mfa') -or ($null -ne $_.grantControls.authenticationStrength)
+            $IncludesGuests -and $RequiresMfa
+        }).Count -gt 0
+    $HasMfaForAll = @($Context.Enabled | Where-Object {
+            (@($_.conditions.users.includeUsers) -contains 'All') -and ((@($_.grantControls.builtInControls) -contains 'mfa') -or ($null -ne $_.grantControls.authenticationStrength))
+        }).Count -gt 0
+
+    if ($GuestExcludingPolicies.Count -gt 0 -and -not $HasGuestSpecificMfa -and -not $HasMfaForAll) {
+        $Names = @($GuestExcludingPolicies | ForEach-Object { $_.displayName })
+        $Params = @{
+            Severity         = 'High'
+            Category         = 'Guest coverage'
+            Title            = "Guests are exempt from $($GuestExcludingPolicies.Count) policy(ies) and face no multifactor requirement"
+            Description      = "External accounts are a common way into a tenant, and here they can sign in with a password alone. The enforced policies that exempt them: $($Names -join ', ')."
+            Remediation      = 'Require multifactor authentication from all guest and external users for every application, and consider a shorter session lifetime for them.'
+            AffectedPolicies = $Names
+            CaTemplate       = "$($Reference.templates.mfaGuests)"
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-old-require-mfa-guest'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapHighValueApps.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapHighValueApps.ps1
new file mode 100644
index 0000000000000..38b8c359efd51
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapHighValueApps.ps1
@@ -0,0 +1,53 @@
+function Test-CIPPCAGapHighValueApps {
+    <#
+    .SYNOPSIS
+        Tenant-wide check that high-value Microsoft applications are covered by an MFA or block policy.
+    .DESCRIPTION
+        For Azure Management, Azure Portal, Microsoft Graph, Exchange Online and SharePoint Online: covered
+        when an enabled policy includes the app (directly or via All apps) without excluding it and requires
+        MFA, an authentication strength, or blocks.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Unprotected = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($App in @($Context.Data.HighValueApps)) {
+        $AppId = "$($App.appId)"
+        $IsCovered = @($Context.Enabled | Where-Object {
+                $Apps = $_.conditions.applications
+                $IncludesAll = @($Apps.includeApplications) -contains 'All'
+                $IncludesSpecific = @($Apps.includeApplications) -contains $AppId
+                $IsExcluded = @($Apps.excludeApplications) -contains $AppId
+                $C = @($_.grantControls.builtInControls)
+                $HasMfaOrBlock = ($C -contains 'mfa') -or ($C -contains 'block') -or ($null -ne $_.grantControls.authenticationStrength)
+                ($IncludesAll -or $IncludesSpecific) -and -not $IsExcluded -and $HasMfaOrBlock
+            }).Count -gt 0
+        if (-not $IsCovered) { $Unprotected.Add($App) }
+    }
+
+    if ($Unprotected.Count -gt 0) {
+        $CriticalApps = @($Unprotected | Where-Object { $_.risk -eq 'critical' })
+        $AppLines = @($Unprotected | ForEach-Object { "- $($_.name) ($($_.description)), $($_.risk) risk" }) -join "`n"
+        $CriticalSuffix = if ($CriticalApps.Count -gt 0) { ", $($CriticalApps.Count) of them critical" } else { '' }
+        $Params = @{
+            Severity         = if ($CriticalApps.Count -gt 0) { 'Critical' } else { 'High' }
+            Category         = 'Application coverage'
+            Title            = "$($Unprotected.Count) high-value Microsoft service(s) can be reached with a password alone$CriticalSuffix"
+            Description      = "No enforced policy requires multifactor authentication or blocks access for these services, which hold the tenant's most sensitive data and controls:`n$AppLines`n`nA stolen password is enough to manage Azure resources, read mail and files through the API, or open mailboxes and documents directly."
+            Remediation      = 'Require multifactor authentication from all users for all applications as the baseline, and add stricter requirements such as phishing-resistant methods for Azure management.'
+            RelatedIds       = @($Unprotected | ForEach-Object { "$($_.appId)" })
+            CaTemplate       = "$($Context.Data.Reference.templates.mfaAllUsers)"
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapIdentityProtection.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapIdentityProtection.ps1
new file mode 100644
index 0000000000000..7e0f1827613d6
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapIdentityProtection.ps1
@@ -0,0 +1,52 @@
+function Test-CIPPCAGapIdentityProtection {
+    <#
+    .SYNOPSIS
+        Tenant-wide check for risk-based Conditional Access (user risk and sign-in risk conditions).
+    .DESCRIPTION
+        Raises one High finding when no enabled policy uses user risk levels as a condition and another High
+        finding when no enabled policy uses sign-in risk levels.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    if ($Context.Licenses.HasEntraIdP2 -ne $true) { return @() }
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Templates = $Context.Data.Reference.templates
+
+    $HasUserRiskPolicy = @($Context.Enabled | Where-Object { @($_.conditions.userRiskLevels).Count -gt 0 }).Count -gt 0
+    $HasSignInRiskPolicy = @($Context.Enabled | Where-Object { @($_.conditions.signInRiskLevels).Count -gt 0 }).Count -gt 0
+
+    if (-not $HasUserRiskPolicy) {
+        $Params = @{
+            Severity         = 'High'
+            Category         = 'Risk-based access'
+            Title            = 'No policy responds when Microsoft flags an account as likely compromised'
+            Description      = 'Microsoft continuously rates each account for signs of compromise, such as credentials found in leaks or unusual behavior. Without a policy acting on that rating, a compromised account keeps working until someone notices by hand.'
+            Remediation      = 'Require high-risk users to re-verify and reset their credentials, or block them, with the emergency-access accounts excluded.'
+            CaTemplate       = "$($Templates.userRisk)"
+            DocumentationUrl = 'https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-risk-policies#user-risk-policy'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    if (-not $HasSignInRiskPolicy) {
+        $Params = @{
+            Severity         = 'High'
+            Category         = 'Risk-based access'
+            Title            = 'No policy responds when Microsoft rates a sign-in as suspicious'
+            Description      = 'Microsoft scores every sign-in in real time on signals such as anonymous networks, impossible travel and password-spray patterns. Without a policy acting on that score, someone with a valid password can sign in from anywhere without any extra check.'
+            Remediation      = 'Require multifactor authentication for medium- and high-risk sign-ins and consider blocking high-risk sign-ins outright, with the emergency-access accounts excluded.'
+            CaTemplate       = "$($Templates.signInRisk)"
+            DocumentationUrl = 'https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-risk-policies#sign-in-risk-policy'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapKnownBypassApps.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapKnownBypassApps.ps1
new file mode 100644
index 0000000000000..8a2ad5ce36f1a
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapKnownBypassApps.ps1
@@ -0,0 +1,77 @@
+function Test-CIPPCAGapKnownBypassApps {
+    <#
+    .SYNOPSIS
+        Reviews every non-FOCI app excluded from a policy and cross-references it with the known bypass-app
+        catalog.
+    .DESCRIPTION
+        One consolidated "App Exclusion" finding per policy that excludes apps (FOCI apps are covered by
+        Test-CIPPCAGapFociExclusion).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Data = $Context.Data
+
+    foreach ($Policy in @($Context.Policies)) {
+        $Details = [System.Collections.Generic.List[object]]::new()
+        $HasHighRisk = $false
+
+        foreach ($AppId in @($Policy.conditions.applications.excludeApplications)) {
+            $Key = "$AppId".ToLowerInvariant()
+            if ($null -ne $Data.FociById[$Key]) { continue }
+
+            $ServicePrincipal = $Context.ServicePrincipals[$Key]
+            $BypassApp = $Data.BypassAppById[$Key]
+            $Description = $Data.AppDescriptionById[$Key]
+            $Alias = $Data.AppGroupAliases[$Key]
+
+            $Name = $Description.displayName ?? $ServicePrincipal.displayName ?? $BypassApp.displayName ?? $Alias.displayName ?? "$AppId"
+            $ServicePrincipalPurpose = if ($ServicePrincipal) { "An application registered in this tenant (type: $($ServicePrincipal.servicePrincipalType ?? 'Application'))." } else { 'An application that is neither registered in this tenant nor listed in the known catalog.' }
+            $Purpose = $Description.purpose ?? $BypassApp.description ?? $Alias.purpose ?? $ServicePrincipalPurpose
+            $Reason = $Description.commonExclusionReason ?? 'No common reason for exempting this application is known.'
+            $Risk = $Description.exclusionRisk ?? $(if ($BypassApp) { 'high' } else { 'medium' })
+
+            if ($Risk -in @('critical', 'high') -or $null -ne $BypassApp) { $HasHighRisk = $true }
+
+            $Details.Add([PSCustomObject]@{
+                    appId           = "$AppId"
+                    displayName     = "$Name"
+                    purpose         = "$Purpose"
+                    exclusionReason = "$Reason"
+                    risk            = "$Risk"
+                })
+        }
+
+        if ($Details.Count -eq 0) { continue }
+
+        $HighRiskApps = @($Details | Where-Object { $_.risk -in @('critical', 'high') })
+        $AppNames = @($Details | ForEach-Object { $_.displayName }) -join ', '
+        $RiskSummary = if ($HighRiskApps.Count -gt 0) {
+            "The higher-risk exemptions are $(@($HighRiskApps | ForEach-Object { $_.displayName }) -join ', ')."
+        } else {
+            'None of these exemptions is considered high risk.'
+        }
+        $PerApp = @($Details | ForEach-Object { "- $($_.displayName) ($($_.risk) risk): $($_.purpose) $($_.exclusionReason)" }) -join "`n"
+        $HighRiskSuffix = if ($HighRiskApps.Count -gt 0) { ", $($HighRiskApps.Count) of them high risk" } else { '' }
+
+        $Params = @{
+            Severity         = if ($HasHighRisk) { 'High' } else { 'Medium' }
+            Category         = 'Application exemptions'
+            Title            = "$($Details.Count) application(s) exempt from this policy$HighRiskSuffix"
+            Description      = "Sign-ins through $AppNames are not subject to the requirements of this policy. $RiskSummary`n`n$PerApp"
+            Remediation      = 'Keep only the exemptions with a documented business reason, and give applications that need lighter requirements a policy of their own instead.'
+            AffectedPolicies = @($Policy.displayName)
+            RelatedIds       = @($Details | ForEach-Object { $_.appId })
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-cloud-apps'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapLegacyAuth.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapLegacyAuth.ps1
new file mode 100644
index 0000000000000..5ad8dcbab1309
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapLegacyAuth.ps1
@@ -0,0 +1,56 @@
+function Test-CIPPCAGapLegacyAuth {
+    <#
+    .SYNOPSIS
+        Checks that legacy authentication (Exchange ActiveSync / Other clients) is blocked.
+    .DESCRIPTION
+        Tenant-wide: when no enabled policy blocks the legacy client types, a Critical finding is raised
+        with the block-legacy-authentication template as the fix.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    $TargetsLegacy = {
+        param($P)
+        $Types = @($P.conditions.clientAppTypes)
+        ($Types -contains 'exchangeActiveSync') -or ($Types -contains 'other')
+    }
+
+    $BlocksLegacy = @($Context.Enabled | Where-Object { (& $TargetsLegacy $_) -and (@($_.grantControls.builtInControls) -contains 'block') }).Count -gt 0
+    if ($BlocksLegacy) { return @() }
+
+    $Params = @{
+        Severity         = 'Critical'
+        Category         = 'Older sign-in methods'
+        Title            = 'Older sign-in methods that cannot use multifactor authentication are still allowed'
+        Description      = 'No enforced policy stops the older mail and client protocols that cannot perform multifactor authentication. A stolen password is enough to sign in through them, which is why they are the usual route for password-spray attacks.'
+        Remediation      = 'Block the older sign-in methods (Exchange ActiveSync and other legacy clients) for every user.'
+        CaTemplate       = "$($Context.Data.Reference.templates.blockLegacyAuth)"
+        DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication'
+    }
+    $Findings.Add((New-CIPPCAGapFinding @Params))
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($Policy.state -eq 'disabled') { continue }
+        if (-not (& $TargetsLegacy $Policy)) { continue }
+        if (@($Policy.grantControls.builtInControls) -contains 'block') { continue }
+        $Params = @{
+            Severity         = 'Medium'
+            Category         = 'Older sign-in methods'
+            Title            = 'A policy covers older sign-in methods without blocking them'
+            Description      = 'This policy applies to older sign-in methods but grants access instead of blocking it. Those methods cannot complete multifactor authentication, so the requirement this policy sets can never be met and the policy adds no protection.'
+            Remediation      = 'Change this policy to block the older sign-in methods, or rely on a dedicated policy that blocks them for every user.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-block-legacy-authentication'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapLocationConditions.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapLocationConditions.ps1
new file mode 100644
index 0000000000000..d2ae0438a38e3
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapLocationConditions.ps1
@@ -0,0 +1,109 @@
+function Test-CIPPCAGapLocationConditions {
+    <#
+    .SYNOPSIS
+        Reviews the named locations each non-disabled policy references.
+    .DESCRIPTION
+        Four checks per policy with a location condition: (1) a referenced named location explicitly marked
+        not trusted (Medium); (2) the policy uses "All trusted locations" while IP-range named locations in
+        the tenant are not trusted, so they silently fall outside the trusted set (High; country locations
+        cannot be trusted and are ignored); (3) a referenced location ID that no longer exists (Medium); (4)
+        a referenced country location with no countries configured, which never matches (High).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $CountryType = '#microsoft.graph.countryNamedLocation'
+
+    foreach ($Policy in @($Context.Policies)) {
+        $Locations = $Policy.conditions.locations
+        if ($null -eq $Locations -or $Policy.state -eq 'disabled') { continue }
+
+        $Include = @($Locations.includeLocations)
+        $Exclude = @($Locations.excludeLocations)
+        $UsesAllTrusted = ($Include -contains 'AllTrusted') -or ($Exclude -contains 'AllTrusted')
+
+        $AllRefs = [System.Collections.Generic.List[string]]::new()
+        foreach ($Id in $Include) { $AllRefs.Add("$Id") }
+        foreach ($Id in $Exclude) { $AllRefs.Add("$Id") }
+        $Sentinels = @('AllTrusted', 'All')
+
+        foreach ($LocationId in $AllRefs) {
+            if ($LocationId -in $Sentinels) { continue }
+            $Location = $Context.NamedLocationById[$LocationId]
+            if ($null -ne $Location -and $Location.isTrusted -eq $false) {
+                $Params = @{
+                    Severity         = 'Medium'
+                    Category         = 'Locations'
+                    Title            = "Named location ""$($Location.displayName)"" is not marked as trusted"
+                    Description      = 'This policy refers to a network location that is not flagged as trusted. Where the policy also relies on the set of trusted locations, this one falls outside it, and people connecting from there may be blocked or challenged unexpectedly.'
+                    Remediation      = "Mark ""$($Location.displayName)"" as trusted if it is a known corporate network, or confirm the policy is meant to treat it as untrusted."
+                    AffectedPolicies = @($Policy.displayName)
+                    RelatedIds       = @($LocationId)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-assignment-network'
+                }
+                $Findings.Add((New-CIPPCAGapFinding @Params))
+            }
+        }
+
+        if ($UsesAllTrusted) {
+            $Untrusted = @($Context.NamedLocations | Where-Object { -not $_.isTrusted -and "$($_.'@odata.type')" -ne $CountryType })
+            if ($Untrusted.Count -gt 0) {
+                $Names = @($Untrusted | ForEach-Object { "$($_.displayName)" }) -join ', '
+                $Params = @{
+                    Severity         = 'High'
+                    Category         = 'Locations'
+                    Title            = "Policy relies on trusted locations while $($Untrusted.Count) defined location(s) are not trusted"
+                    Description      = "The following defined network locations are not flagged as trusted and therefore fall outside what this policy treats as trusted: $Names. People connecting from them may be locked out or prompted unexpectedly."
+                    Remediation      = 'Flag the locations that represent corporate offices or VPNs as trusted, and confirm the policy behaves as intended for the remaining ones.'
+                    AffectedPolicies = @($Policy.displayName)
+                    RelatedIds       = @($Untrusted | ForEach-Object { "$($_.id)" })
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-assignment-network'
+                }
+                $Findings.Add((New-CIPPCAGapFinding @Params))
+            }
+        }
+
+        foreach ($LocationId in $AllRefs) {
+            if ($LocationId -in $Sentinels) { continue }
+            if ($Context.NamedLocationById.ContainsKey($LocationId)) { continue }
+            $Params = @{
+                Severity         = 'Medium'
+                Category         = 'Locations'
+                Title            = 'Policy refers to a network location that no longer exists'
+                Description      = 'One of the locations this policy depends on has been deleted. The condition can never match, which silently changes what the policy allows or blocks.'
+                Remediation      = 'Remove the stale reference and, if the condition is still needed, point the policy at a current location.'
+                AffectedPolicies = @($Policy.displayName)
+                RelatedIds       = @($LocationId)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-assignment-network'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+
+        foreach ($LocationId in $AllRefs) {
+            if ($LocationId -in $Sentinels) { continue }
+            $Location = $Context.NamedLocationById[$LocationId]
+            if ($null -eq $Location) { continue }
+            if ("$($Location.'@odata.type')" -ne $CountryType) { continue }
+            if (@($Location.countriesAndRegions | Where-Object { $_ }).Count -gt 0) { continue }
+            $Params = @{
+                Severity         = 'High'
+                Category         = 'Locations'
+                Title            = "Country location ""$($Location.displayName)"" has no countries defined"
+                Description      = 'The country list behind this location is empty, so the condition never matches. Depending on how it is used, the policy either never applies or its exclusion has no effect.'
+                Remediation      = 'Add the intended countries to this location, or remove it from the policy.'
+                AffectedPolicies = @($Policy.displayName)
+                RelatedIds       = @($LocationId)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-assignment-network'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMfaCoverage.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMfaCoverage.ps1
new file mode 100644
index 0000000000000..21745b67ae110
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMfaCoverage.ps1
@@ -0,0 +1,54 @@
+function Test-CIPPCAGapMfaCoverage {
+    <#
+    .SYNOPSIS
+        Tenant-wide check that some enabled policy requires MFA for All users.
+    .DESCRIPTION
+        A policy covers MFA for all users when it includes "All" users and requires MFA or an authentication
+        strength.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    $IsMfaForAll = {
+        param($P)
+        (@($P.conditions.users.includeUsers) -contains 'All') -and ((@($P.grantControls.builtInControls) -contains 'mfa') -or ($null -ne $P.grantControls.authenticationStrength))
+    }
+
+    $HasMfaForAll = @($Context.Enabled | Where-Object { & $IsMfaForAll $_ }).Count -gt 0
+    if ($HasMfaForAll) { return @($Findings) }
+
+    $ReportOnlyMfaForAll = @($Context.ReportOnly | Where-Object { & $IsMfaForAll $_ } | Select-Object -First 1)
+    if ($ReportOnlyMfaForAll.Count -gt 0) {
+        $Policy = $ReportOnlyMfaForAll[0]
+        $Params = @{
+            Severity         = 'Medium'
+            Category         = 'Multifactor coverage'
+            Title            = 'The multifactor policy for all users is in report-only mode'
+            Description      = "$($Policy.displayName) would require multifactor authentication from everyone, but it only records what would happen. Until it is enforced, users can still sign in with a password alone."
+            Remediation      = 'Enforce the policy once the report-only results show no unexpected impact and the emergency-access accounts are excluded.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    } else {
+        $Params = @{
+            Severity         = 'Critical'
+            Category         = 'Multifactor coverage'
+            Title            = 'No policy requires multifactor authentication from all users'
+            Description      = 'Nothing in the tenant ensures that every user proves their identity with a second factor. Any account whose password is stolen or guessed can be signed in to directly.'
+            Remediation      = 'Require multifactor authentication from all users for all applications as the baseline policy, with only the emergency-access accounts excluded.'
+            CaTemplate       = "$($Context.Data.Reference.templates.mfaAllUsers)"
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMicrosoftGuidance.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMicrosoftGuidance.ps1
new file mode 100644
index 0000000000000..4f40ec1f3f641
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMicrosoftGuidance.ps1
@@ -0,0 +1,274 @@
+function Test-CIPPCAGapMicrosoftGuidance {
+    <#
+    .SYNOPSIS
+        Checks every policy against Microsoft's published guidance on Conditional Access side effects.
+    .DESCRIPTION
+        Each entry in Config/SecuritySimulations/CAAnalysis/MicrosoftGuidance.json describes a policy shape
+        that Microsoft documents as breaking something (meeting-room devices, token protection scope,
+        emergency access, retired grant controls and so on). A policy that matches produces one finding
+        with the guidance text, its severity and the Microsoft documentation link.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context,
+        [switch]$IncludeAdvisory
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Reference = $Context.Data.Reference
+    $Apps = $Reference.guidanceAppIds
+    $GuidanceById = @{}
+    foreach ($Guidance in @($Context.Data.MicrosoftGuidance)) { $GuidanceById["$($Guidance.id)"] = $Guidance }
+
+    $ExchangeOnline = "$($Apps.exchangeOnline)".ToLowerInvariant()
+    $SharePointOnline = "$($Apps.sharePointOnline)".ToLowerInvariant()
+    $TeamsService = "$($Apps.teamsService)".ToLowerInvariant()
+    $Office365Group = "$($Apps.office365Group)".ToLowerInvariant()
+    $DefenderAtp = "$($Apps.defenderAtpXplat)".ToLowerInvariant()
+    $DefenderTvm = "$($Apps.defenderTvm)".ToLowerInvariant()
+    $WindowsCloudLogin = "$($Apps.windowsCloudLogin)".ToLowerInvariant()
+    $TokenProtectionSupported = @($ExchangeOnline, $SharePointOnline, $TeamsService, "$($Apps.azureVirtualDesktop)".ToLowerInvariant(), "$($Apps.windows365)".ToLowerInvariant(), $WindowsCloudLogin)
+    $DirSyncRoleId = "$($Reference.directorySyncRoleTemplateId)"
+
+    $IsActive = { param($P) $P.state -in @('enabled', 'enabledForReportingButNotEnforced') }
+    $TargetsAllUsers = { param($P) @($P.conditions.users.includeUsers) -contains 'All' }
+    $TargetsAllApps = { param($P) @($P.conditions.applications.includeApplications) -contains 'All' }
+    $HasMfaGrant = { param($P) (@($P.grantControls.builtInControls) -contains 'mfa') -or ($null -ne $P.grantControls.authenticationStrength) }
+    $HasBlockGrant = { param($P) @($P.grantControls.builtInControls) -contains 'block' }
+    $HasComplianceGrant = { param($P) @($P.grantControls.builtInControls) -contains 'compliantDevice' }
+    $HasAdminRoles = { param($P) @($P.conditions.users.includeRoles).Count -gt 0 }
+    $HasNoUserExclusions = { param($P) $U = $P.conditions.users; (@($U.excludeUsers).Count -eq 0) -and (@($U.excludeGroups).Count -eq 0) -and (@($U.excludeRoles).Count -eq 0) }
+    $HasTokenProtection = {
+        param($P)
+        $Session = $P.sessionControls
+        if ($null -eq $Session) { return $false }
+        if ($Session.secureSignInSession.isEnabled -eq $true) { return $true }
+        if ($Session.tokenProtection.signInSessionTokenProtection.isEnabled -eq $true) { return $true }
+        $false
+    }
+    $LowerApps = { param($Values) , [string[]]@(@($Values) | ForEach-Object { "$_".ToLowerInvariant() }) }
+
+    $Results = [System.Collections.Generic.List[object]]::new()
+    $AddResult = {
+        param($GuidanceId, $Policy, $Detail, $Impacted)
+        $Guidance = $GuidanceById[$GuidanceId]
+        if ($null -eq $Guidance) { return }
+        $Results.Add([PSCustomObject]@{
+                guidanceId        = $GuidanceId
+                policyId          = $Policy.id
+                policyName        = $Policy.displayName
+                severity          = "$($Guidance.severity)"
+                title             = "$($Guidance.title)"
+                detail            = $Detail
+                impactedResources = [string[]]@($Impacted | Where-Object { $_ })
+                remediation       = "$($Guidance.remediation)"
+                docUrl            = "$($Guidance.docUrl)"
+            })
+    }
+
+    foreach ($Policy in @($Context.Policies)) {
+        $Active = & $IsActive $Policy
+        $AllUsers = & $TargetsAllUsers $Policy
+        $AllApps = & $TargetsAllApps $Policy
+        $Grant = $Policy.grantControls
+        $Controls = @($Grant.builtInControls)
+        $IncludeApps = & $LowerApps $Policy.conditions.applications.includeApplications
+        $ExcludeApps = & $LowerApps $Policy.conditions.applications.excludeApplications
+        $Session = $Policy.sessionControls
+        $SignInFrequency = $Session.signInFrequency
+        $TokenProtection = & $HasTokenProtection $Policy
+
+        if ($Active -and $TokenProtection) {
+            if ($IncludeApps -contains 'all') {
+                & $AddResult 'TokenProtectionApps' $Policy 'This token-protection policy applies to every application, although only a few Microsoft services support the feature. People using unsupported tools such as Power Query, developer extensions and older Office installations will be blocked.' @('PowerShell modules accessing SharePoint', 'PowerQuery extension for Excel', 'VS Code extensions accessing Exchange/SharePoint', 'Office perpetual clients')
+            } elseif ($IncludeApps -contains $Office365Group) {
+                & $AddResult 'TokenProtectionApps' $Policy 'This token-protection policy applies to the Office 365 application group as a whole, which Microsoft warns can cause unexpected failures because not every service in the group supports the feature.' @('Office 365 application group members')
+            } else {
+                $Unsupported = @($IncludeApps | Where-Object { $TokenProtectionSupported -notcontains $_ })
+                if ($Unsupported.Count -gt 0) {
+                    & $AddResult 'TokenProtectionApps' $Policy "This token-protection policy applies to $($Unsupported.Count) application(s) that may not support the feature; only Exchange Online, SharePoint Online, Teams, Azure Virtual Desktop, Windows 365 and Windows Cloud Login do." $Unsupported
+                }
+            }
+        }
+
+        if ($Active -and $TokenProtection) {
+            $Issues = [System.Collections.Generic.List[string]]::new()
+            $Platforms = $Policy.conditions.platforms
+            if ($null -eq $Platforms -or -not (@($Platforms.includePlatforms) -contains 'windows')) {
+                $Issues.Add('The policy is not limited to Windows devices, although token protection only works there.')
+            }
+            $ClientTypes = @($Policy.conditions.clientAppTypes)
+            if ($ClientTypes.Count -eq 0 -or ($ClientTypes -contains 'browser')) {
+                $Issues.Add('The policy also applies to web browsers, which do not support token protection, so browser-based tools such as Teams on the web will be blocked.')
+            }
+            if ($Issues.Count -gt 0) {
+                & $AddResult 'TokenProtectionPlatforms' $Policy ($Issues -join ' ') @('macOS / iOS / Android / Linux users', 'Teams Web (MSAL.js)', 'Browser-based applications')
+            }
+        }
+
+        if ($Active -and $TokenProtection) {
+            $DeviceFilter = $Policy.conditions.devices.deviceFilter
+            if ($null -eq $DeviceFilter) {
+                & $AddResult 'TokenProtectionDevices' $Policy 'This token-protection policy does not exempt the device types that cannot support it. Meeting-room devices, Cloud PCs, virtual desktop hosts, self-deploying and bulk-enrolled devices and Azure virtual machines will be blocked with unclear error messages.' @('Surface Hub', 'Teams Rooms (MTR) on Windows', 'Cloud PCs (Microsoft Entra joined)', 'Azure Virtual Desktop session hosts (Microsoft Entra joined)', 'Windows Autopilot self-deploying devices', 'Bulk-enrolled Windows devices', 'Azure VMs with Entra ID auth')
+            } else {
+                $Rule = "$($DeviceFilter.rule)".ToLowerInvariant()
+                $Missing = @($Reference.tokenProtectionDeviceFilterPatterns | Where-Object { -not $Rule.Contains("$($_.pattern)") })
+                if ($Missing.Count -gt 0 -and "$($DeviceFilter.mode)" -eq 'exclude') {
+                    $MissingLabels = @($Missing | ForEach-Object { "$($_.label)" })
+                    & $AddResult 'TokenProtectionDevices' $Policy "The device filter on this token-protection policy may not exempt every device type that cannot support it; possibly missing: $($MissingLabels -join ', ')." $MissingLabels
+                }
+            }
+        }
+
+        if ($Active -and $AllUsers -and ((& $HasMfaGrant $Policy) -or (& $HasBlockGrant $Policy) -or (& $HasComplianceGrant $Policy)) -and (& $HasNoUserExclusions $Policy)) {
+            & $AddResult 'BreakGlassMissing' $Policy "$($Policy.displayName) applies to every user and exempts nobody. A mistake in the policy or a service outage would lock out everyone, administrators included, with no account left to recover access." @('All administrators', 'Emergency access accounts')
+        }
+
+        if ($Active -and $AllUsers -and $AllApps -and $Grant.present) {
+            $UnsupportedControls = @($Controls | Where-Object { $_ -in @('mfa', 'compliantDevice', 'domainJoinedDevice', 'approvedApplication', 'compliantApplication', 'passwordChange') })
+            $HasStrength = $null -ne $Grant.authenticationStrength
+            if ($UnsupportedControls.Count -gt 0 -or $HasStrength) {
+                $ControlList = [System.Collections.Generic.List[string]]::new()
+                foreach ($ControlName in $UnsupportedControls) { $ControlList.Add($ControlName) }
+                if ($HasStrength) { $ControlList.Add('authentication strength') }
+                & $AddResult 'SurfaceHubMfa' $Policy "This policy requires $($ControlList -join ', ') from every user. Surface Hub meeting-room accounts cannot meet such requirements and will fail to sign in, which breaks room calendars and meetings." @('Surface Hub calendar sync', 'Surface Hub Teams meetings', 'Surface Hub collaborative whiteboard')
+            }
+        }
+
+        if ($Active -and $AllUsers -and $Grant.present -and (($Controls -contains 'mfa') -or ($null -ne $Grant.authenticationStrength)) -and $AllApps) {
+            & $AddResult 'TeamsRoomsMfa' $Policy 'This policy requires multifactor authentication from every user for every application. Teams Rooms devices on Windows cannot perform it, and Android room devices cannot meet an authentication strength, so meeting-room accounts will be unable to sign in.' @('Teams Rooms on Windows', 'Teams Rooms on Android (auth strength only)', 'Teams Panels')
+        }
+
+        if ($Active -and (& $HasBlockGrant $Policy) -and -not [string]::IsNullOrWhiteSpace("$($Policy.conditions.authenticationFlows.transferMethods)")) {
+            & $AddResult 'DeviceCodeTeamsDevices' $Policy 'This policy blocks the device-code sign-in flow for everyone. Teams phones, panels and Android room devices rely on that flow for their initial setup and can no longer be signed in remotely.' @('Teams Rooms on Android', 'Teams phones', 'Teams panels', 'Remote device sign-in scenarios')
+        }
+
+        if ($Active -and $AllUsers -and $SignInFrequency.isEnabled -eq $true -and $AllApps) {
+            & $AddResult 'SignInFrequencyTeamsRooms' $Policy "This policy makes every user sign in again every $($SignInFrequency.value) $($SignInFrequency.type). Teams Rooms, phones and panels cannot handle that and will periodically sign out, disrupting scheduled meetings." @('Teams Rooms on Windows', 'Teams Rooms on Android', 'Teams phones', 'Teams panels')
+        }
+
+        if ($Active -and $AllUsers -and $AllApps) {
+            $Locations = $Policy.conditions.locations
+            $IsRestrictive = (& $HasBlockGrant $Policy) -or (($null -ne $Locations) -and (@($Locations.includeLocations).Count -gt 0) -and (& $HasBlockGrant $Policy))
+            if ($IsRestrictive -and -not (($ExcludeApps -contains $DefenderAtp) -and ($ExcludeApps -contains $DefenderTvm))) {
+                & $AddResult 'DefenderMobileApps' $Policy 'This blocking policy covers every application without exempting the Microsoft Defender mobile apps. Defender may then be unable to report device health, and devices can be marked non-compliant simply because the report never arrives.' @("MicrosoftDefenderATP XPlat ($DefenderAtp)", "Microsoft Defender for Mobile TVM ($DefenderTvm)", 'Mobile device compliance reporting')
+            }
+        }
+
+        if ($Active -and $AllUsers -and $AllApps -and ((& $HasMfaGrant $Policy) -or (& $HasComplianceGrant $Policy)) -and -not ($ExcludeApps -contains $WindowsCloudLogin)) {
+            & $AddResult 'AzureVmSignInMfa' $Policy 'This policy requires multifactor authentication or a managed device from every user for every application, without exempting sign-ins to Azure virtual machines. Remote desktop connections to those machines can only meet the requirement from a device that supports Windows Hello for Business, and Windows Server devices can never count as compliant, so administrators may be unable to connect.' @("Microsoft Azure Windows Virtual Machine Sign-In ($WindowsCloudLogin)", 'RDP connections to Azure VMs', 'RDP connections to Arc-enabled Windows Servers', 'Windows Server RDP client devices (device compliance unsupported)')
+        }
+
+        if ($Active -and "$($Session.continuousAccessEvaluation.mode)" -eq 'disabled') {
+            & $AddResult 'ContinuousAccessEvaluationDisabled' $Policy 'This policy switches off continuous access evaluation. After a security event such as an account being disabled or a password change, existing sessions stay valid for up to an hour instead of being cut off immediately.' @('Real-time user session revocation', 'Location-based policy enforcement', 'Risk-based session termination')
+        }
+
+        if ($Active -and $SignInFrequency.isEnabled -eq $true -and -not ($IncludeApps -contains 'all')) {
+            $TargetsIndividualM365 = @($IncludeApps | Where-Object { $_ -in @($ExchangeOnline, $SharePointOnline, $TeamsService) }).Count -gt 0
+            if ($TargetsIndividualM365) {
+                & $AddResult 'SignInFrequencyIndividualServices' $Policy 'This policy applies a sign-in frequency to individual Microsoft 365 services rather than to all applications. Microsoft does not support that arrangement because it can interrupt or stop the Teams device sign-in flow.' @('Teams sign-in flow', 'Teams Rooms devices', 'Teams desktop/mobile clients')
+            }
+        }
+
+        if ($Active -and $Session.disableResilienceDefaults -eq $true) {
+            $Scope = if ($AllUsers) { 'all users' } else { 'the users it targets' }
+            & $AddResult 'ResilienceDefaultsDisabled' $Policy "This policy turns off resilience defaults for $Scope. During a Microsoft sign-in service outage, anyone whose session expires loses access until the service recovers, which can stop work for hours." @('All users covered by this policy during Entra ID outages', 'Business continuity during identity service disruptions')
+        }
+
+        if ($Active -and $AllApps -and $ExcludeApps.Count -gt 0) {
+            & $AddResult 'AllResourcesAppExclusion' $Policy 'This policy covers every application but exempts some. Microsoft now enforces basic profile and directory permissions through the directory service itself, so without a policy that covers that service, applications that only ask for basic details may be challenged unexpectedly or may still slip past enforcement depending on rollout.' @('Windows Azure Active Directory (00000002-0000-0000-c000-000000000000)', 'Apps requesting User.Read, openid, profile, email, offline_access scopes', 'Native clients and SPAs with basic Azure AD Graph access')
+        }
+
+        if ($Active -and $AllUsers -and (& $HasMfaGrant $Policy) -and $DirSyncRoleId -and (@($Policy.conditions.users.excludeRoles) -contains $DirSyncRoleId)) {
+            & $AddResult 'DirectorySyncAccountMfa' $Policy 'This multifactor policy exempts the directory synchronization role. Recent versions of Entra Connect let the synchronization service authenticate as an application rather than a user account, which removes the need for this exemption and the gap it leaves.' @('Directory Synchronization Accounts role', 'Entra Connect sync service account', 'Hybrid identity sync pipeline')
+        }
+
+        if ($Active -and ($AllUsers -or (& $HasAdminRoles $Policy))) {
+            $HasCustomFactors = @($Grant.customAuthenticationFactors).Count -gt 0
+            $HasEamViaStrength = $false
+            $StrengthName = ''
+            $ExternalMethods = @()
+            $StrengthRef = $Grant.authenticationStrength
+            if ($StrengthRef.id -and $Context.AuthStrengths.ContainsKey("$($StrengthRef.id)")) {
+                $Resolved = $Context.AuthStrengths["$($StrengthRef.id)"]
+                $ExternalMethods = @($Resolved.allowedCombinations | Where-Object { "$_".ToLowerInvariant().Contains('externalauthenticationmethod') })
+                if ($ExternalMethods.Count -gt 0) {
+                    $HasEamViaStrength = $true
+                    $StrengthName = if ($Resolved.displayName) { "$($Resolved.displayName)" } elseif ($StrengthRef.displayName) { "$($StrengthRef.displayName)" } else { 'Unknown' }
+                }
+            }
+            if ($HasCustomFactors -or $HasEamViaStrength) {
+                $ExcludeGuestObject = $Policy.conditions.users.excludeGuestsOrExternalUsers
+                $ExcludesGuests = ($null -ne $ExcludeGuestObject) -and (@($ExcludeGuestObject.PSObject.Properties).Count -gt 0)
+                $EamSource = if ($HasEamViaStrength) { "the ""$StrengthName"" authentication strength, which relies on an external authentication provider" } else { 'a legacy custom control from an external authentication provider' }
+                $Detail = if ($ExcludesGuests) {
+                    "This policy relies on $EamSource. Guests appear to be exempt, but partner, service-provider and cross-tenant synchronization accounts may still be caught if the exemption does not cover every type of external identity."
+                } else {
+                    "This policy relies on $EamSource and applies to guests and external users as well. They are not enrolled with your external provider and cannot be, so they will be blocked even though Microsoft's own multifactor authentication would have been enough."
+                }
+                $Impacted = [System.Collections.Generic.List[string]]::new()
+                foreach ($Item in @('B2B guest users', 'External service providers and vendors', 'Cross-tenant collaboration partners', 'Managed service provider (MSP) accounts')) { $Impacted.Add($Item) }
+                if ($ExcludesGuests) { $Impacted.Add('Verify: B2B direct connect and cross-tenant sync accounts') }
+                if ($HasEamViaStrength) { $Impacted.Add("Auth Strength: ""$StrengthName"" - $($ExternalMethods.Count) external method combination(s)") }
+                & $AddResult 'ExternalAuthMethodGuests' $Policy $Detail @($Impacted)
+            }
+        }
+
+        if ($Controls -contains 'approvedApplication') {
+            $HasAppProtection = $Controls -contains 'compliantApplication'
+            if ($HasAppProtection -and $Grant.operator -eq 'OR') {
+            } elseif ($HasAppProtection -and $Grant.operator -eq 'AND') {
+                & $AddResult 'ApprovedClientAppRetirement' $Policy "$($Policy.displayName) requires both an approved client app and an app protection policy together. Microsoft is retiring the approved-client-app requirement, after which the app protection policy alone must be enough for this policy to keep working." @('Mobile device users on iOS and Android', 'Users accessing M365 apps from mobile devices')
+            } else {
+                & $AddResult 'ApprovedClientAppRetirement' $Policy "$($Policy.displayName) relies only on the approved-client-app requirement, which Microsoft is retiring. Once it stops being enforced, this policy no longer protects data in mobile apps." @('Mobile device users on iOS and Android', 'Users accessing M365 apps from mobile devices', 'Unmanaged BYOD devices')
+            }
+        }
+
+        if ($Active -and @($Policy.conditions.userRiskLevels).Count -gt 0 -and $Grant.present -and ($Controls -contains 'passwordChange')) {
+            $UsesRiskRemediation = $Controls -contains 'riskRemediation'
+            $Tail = if ($UsesRiskRemediation) { 'The policy already includes the newer risk-remediation requirement, so the password-change requirement can simply be removed.' } else { 'The newer risk-remediation requirement supports every sign-in method.' }
+            & $AddResult 'UserRiskPasswordChangeRetired' $Policy "$($Policy.displayName) responds to a risky user by demanding a password change, a requirement Microsoft has retired. People who sign in without a password cannot complete it and stay blocked once flagged. $Tail" @('Passwordless users (FIDO2, Windows Hello for Business)', 'External Authentication Method users (Duo, Okta, etc.)', 'High-risk users who cannot complete a password change flow')
+        }
+
+        if ($Active -and @($Policy.conditions.userRiskLevels).Count -gt 0 -and $Grant.present -and ($Controls -contains 'riskRemediation') -and ($null -ne $Grant.authenticationStrength)) {
+            $ScopeNote = 'Whether this tenant uses an external authentication provider could not be verified, so this finding is shown as a precaution and may not apply.'
+            & $AddResult 'UserRiskRemediationExternalProvider' $Policy "$($Policy.displayName) asks risky users to remediate through an authentication strength. Authentication strengths cannot accept external providers such as Duo, Okta or Ping, so people who rely on one stay blocked once flagged unless a companion policy lets them remediate with plain multifactor authentication. $ScopeNote" @('Users enrolled in External Authentication Methods (Duo, Okta Verify, Ping, etc.)', 'Any tenant using a third-party MFA provider as EAM', 'High-risk EAM users who cannot complete authentication strength challenges')
+        }
+    }
+
+    $TemplateByGuidance = @{
+        'AllResourcesAppExclusion'         = "$($Reference.templates.windowsAzureAdBaselineScopes)"
+        'UserRiskPasswordChangeRetired'   = "$($Reference.templates.riskRemediationHigh)"
+        'UserRiskRemediationExternalProvider' = "$($Reference.templates.riskRemediationEam)"
+        'ApprovedClientAppRetirement'         = "$($Reference.templates.appProtectionMobile)"
+    }
+
+    foreach ($Result in $Results) {
+        if ($Result.guidanceId -eq 'AllResourcesAppExclusion' -and -not $IncludeAdvisory.IsPresent) { continue }
+        $IsPromoted = $Result.severity -in @('critical', 'high')
+        if (-not $IsPromoted -and -not $IncludeAdvisory.IsPresent) { continue }
+        $SeverityLabel = switch ($Result.severity) {
+            'critical' { 'Critical' }
+            'high' { 'High' }
+            'medium' { 'Medium' }
+            default { 'Info' }
+        }
+        $Params = @{
+            Severity         = $SeverityLabel
+            Category         = 'Microsoft guidance'
+            Title            = $Result.title
+            Description      = "$($Result.detail)"
+            Remediation      = $Result.remediation
+            AffectedPolicies = @($Result.policyName)
+            RelatedIds       = @($Result.impactedResources)
+            DocumentationUrl = $Result.docUrl
+        }
+        if ($TemplateByGuidance.ContainsKey($Result.guidanceId)) { $Params['CaTemplate'] = $TemplateByGuidance[$Result.guidanceId] }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMicrosoftManagedPolicy.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMicrosoftManagedPolicy.ps1
new file mode 100644
index 0000000000000..18696e2faa0d0
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMicrosoftManagedPolicy.ps1
@@ -0,0 +1,64 @@
+function Test-CIPPCAGapMicrosoftManagedPolicy {
+    <#
+    .SYNOPSIS
+        Surfaces Microsoft-managed Conditional Access policies detected by their display names.
+    .DESCRIPTION
+        Per policy: a disabled policy whose name matches a Microsoft-managed policy pattern gets an Info
+        finding pointing at the MC1246002 Baseline Security Mode phantom-draft issue.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Keywords = @($Context.Data.Reference.managedPolicyPatterns | ForEach-Object { "$($_.keyword)".ToLowerInvariant() })
+
+    $IsManaged = {
+        param($P)
+        $Name = "$($P.displayName)".ToLowerInvariant()
+        foreach ($Keyword in $Keywords) { if ($Name.Contains($Keyword)) { return $true } }
+        $false
+    }
+
+    foreach ($Policy in @($Context.Policies)) {
+        if (-not (& $IsManaged $Policy) -or $Policy.state -ne 'disabled') { continue }
+        $Params = @{
+            Severity         = 'Info'
+            Category         = 'Microsoft-managed policies'
+            Title            = 'Microsoft-managed policy is switched off'
+            Description      = 'Microsoft has created disabled draft copies of its managed policies in some tenants without being asked, and removes those drafts itself. If nobody in your organization switched this policy off, that is the likely explanation and there is no exposure from it.'
+            Remediation      = 'No change needed if Microsoft created this draft. If the policy was switched off deliberately, consider running it in report-only mode to see what it would do.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/managed-policies'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    $ManagedPolicies = @($Context.Policies | Where-Object { & $IsManaged $_ })
+    if ($ManagedPolicies.Count -gt 0) {
+        $ReportOnlyCount = @($ManagedPolicies | Where-Object { $_.state -eq 'enabledForReportingButNotEnforced' }).Count
+        $DisabledCount = @($ManagedPolicies | Where-Object { $_.state -eq 'disabled' }).Count
+        $Names = @($ManagedPolicies | ForEach-Object { $_.displayName })
+        $Detail = "The managed policies are $($Names -join ', '). "
+        if ($ReportOnlyCount -gt 0) { $Detail += "$ReportOnlyCount of them are in report-only mode. " }
+        if ($DisabledCount -gt 0) { $Detail += "$DisabledCount of them are disabled. " }
+        $Detail += 'Microsoft maintains these policies and adjusts them as the tenant changes; they cannot be renamed or deleted and may overlap with your own policies. '
+
+        $Params = @{
+            Severity         = 'Info'
+            Category         = 'Microsoft-managed policies'
+            Title            = "$($ManagedPolicies.Count) Microsoft-managed policy(ies) are present in the tenant"
+            Description      = $Detail
+            Remediation      = 'Check the managed policies against your own for overlap, and consider enforcing the ones still in report-only mode.'
+            AffectedPolicies = $Names
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/managed-policies'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMissingMfa.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMissingMfa.ps1
new file mode 100644
index 0000000000000..b1094fc11c12c
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapMissingMfa.ps1
@@ -0,0 +1,55 @@
+function Test-CIPPCAGapMissingMfa {
+    <#
+    .SYNOPSIS
+        Flags grant policies that do not require MFA or an authentication strength.
+    .DESCRIPTION
+        Skips disabled policies, policies with no grant controls, block policies, workload/agent-identity
+        policies (includeUsers = None with no groups or roles) and policies whose controls are all strong
+        DeviceTrust or AppProtection controls (a legitimate standalone layer).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Groups = $Context.Data.Reference.equivalentStrengthGroups
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($Policy.state -eq 'disabled') { continue }
+        $Grant = $Policy.grantControls
+        $Controls = @($Grant.builtInControls)
+        if (-not $Grant.present -or $Controls.Count -eq 0) { continue }
+        if ($Controls -contains 'block') { continue }
+
+        $RequiresMfa = ($Controls -contains 'mfa') -or ($null -ne $Grant.authenticationStrength)
+        if ($RequiresMfa) { continue }
+
+        $Users = $Policy.conditions.users
+        $RealIncludeUsers = @($Users.includeUsers | Where-Object { $_ -ne 'None' })
+        $TargetsUsers = ($RealIncludeUsers.Count -gt 0) -or (@($Users.includeGroups).Count -gt 0) -or (@($Users.includeRoles).Count -gt 0)
+        if (-not $TargetsUsers) { continue }
+
+        $AllStrongNonMfa = @($Controls | Where-Object {
+                $ControlName = $_
+                $null -eq $Groups.$ControlName
+            }).Count -eq 0
+        if ($AllStrongNonMfa) { continue }
+
+        $Params = @{
+            Severity         = 'Medium'
+            Category         = 'Grant requirements'
+            Title            = 'Policy grants access without requiring multifactor authentication'
+            Description      = "Access is granted on the basis of $($Controls -join ', ') alone. A stolen password is enough to pass this policy, because a second factor is not part of what it asks for."
+            Remediation      = 'Make multifactor authentication part of what this policy requires, ideally through an authentication strength.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-mfa-strength'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapPrivilegedRoleExclusion.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapPrivilegedRoleExclusion.ps1
new file mode 100644
index 0000000000000..d1b993a474fc6
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapPrivilegedRoleExclusion.ps1
@@ -0,0 +1,127 @@
+function Test-CIPPCAGapPrivilegedRoleExclusion {
+    <#
+    .SYNOPSIS
+        Flags policies that exclude highly privileged directory roles.
+    .DESCRIPTION
+        Per policy (any state): every excluded role that is in the high-privilege list produces one finding
+        per policy.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $RoleNames = $Context.Data.HighPrivilegeRoleNames
+    $CriticalRoleIds = $Context.Data.CriticalRoleIds
+    $RegisterSecurityInfo = "$($Context.Data.Reference.registerSecurityInfoAction)"
+
+    foreach ($Policy in @($Context.Policies)) {
+        $ExcludedRoles = @($Policy.conditions.users.excludeRoles)
+        if ($ExcludedRoles.Count -eq 0) { continue }
+
+        $ExcludedHighPriv = [System.Collections.Generic.List[object]]::new()
+        foreach ($RoleId in $ExcludedRoles) {
+            $Name = $RoleNames["$RoleId".ToLowerInvariant()]
+            if ($Name) {
+                $ExcludedHighPriv.Add([PSCustomObject]@{ id = "$RoleId"; name = "$Name"; critical = $CriticalRoleIds.Contains("$RoleId") })
+            }
+        }
+        if ($ExcludedHighPriv.Count -eq 0) { continue }
+
+        $HasCritical = @($ExcludedHighPriv | Where-Object { $_.critical }).Count -gt 0
+        $CriticalNames = @($ExcludedHighPriv | Where-Object { $_.critical } | ForEach-Object { $_.name })
+        $AllNames = @($ExcludedHighPriv | ForEach-Object { $_.name })
+        $ExcludedLower = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+        foreach ($Entry in $ExcludedHighPriv) { $null = $ExcludedLower.Add($Entry.id) }
+
+        $CoveringPolicy = $null
+        foreach ($Other in @($Context.Policies)) {
+            if ($Other.id -eq $Policy.id -or $Other.state -eq 'disabled') { continue }
+            $OtherUsers = $Other.conditions.users
+            $EnforcesMfa = (@($Other.grantControls.builtInControls) -contains 'mfa') -or ($null -ne $Other.grantControls.authenticationStrength)
+            if (-not $EnforcesMfa) { continue }
+            $IncludeRoles = @($OtherUsers.includeRoles | ForEach-Object { "$_".ToLowerInvariant() })
+            $IncludesViaRoles = @($ExcludedLower | Where-Object { $IncludeRoles -notcontains $_.ToLowerInvariant() }).Count -eq 0
+            $OtherExcludeRoles = @($OtherUsers.excludeRoles | ForEach-Object { "$_".ToLowerInvariant() })
+            $ReExcludes = @($ExcludedLower | Where-Object { $OtherExcludeRoles -contains $_.ToLowerInvariant() }).Count -gt 0
+            $IncludesViaAllUsers = (@($OtherUsers.includeUsers) -contains 'All') -and -not $ReExcludes
+            if ($IncludesViaRoles -or $IncludesViaAllUsers) { $CoveringPolicy = $Other; break }
+        }
+
+        $Controls = @($Policy.grantControls.builtInControls)
+        $RequiresMfa = ($Controls -contains 'mfa') -or ($null -ne $Policy.grantControls.authenticationStrength)
+        $Blocks = $Controls -contains 'block'
+        $TargetsSecurityRegistration = @($Policy.conditions.applications.includeUserActions) -contains $RegisterSecurityInfo
+        $TargetsAllApps = @($Policy.conditions.applications.includeApplications) -contains 'All'
+
+        $Severity = if ($HasCritical) { 'Critical' } else { 'High' }
+        if ($TargetsSecurityRegistration) {
+            $ScenarioNames = if ($CriticalNames.Count -gt 0) { $CriticalNames -join ', ' } else { $AllNames -join ', ' }
+            $AttackScenario = "This policy protects the registration of sign-in methods, yet $ScenarioNames are exempt from it. Someone who takes over one of these administrator accounts can add their own sign-in methods unchallenged and keep access even after a password reset."
+            $Severity = 'Critical'
+        } elseif ($Blocks) {
+            $AttackScenario = "This policy blocks access, yet $($AllNames -join ', ') are exempt from it. The most powerful accounts in the tenant pass where everyone else is stopped."
+        } elseif ($RequiresMfa -and $TargetsAllApps) {
+            $AttackScenario = "This policy requires multifactor authentication for every application, yet $($AllNames -join ', ') are exempt from it. The accounts an attacker values most can sign in with a password alone."
+        } else {
+            $AttackScenario = "This policy exempts $($ExcludedHighPriv.Count) privileged role(s): $($AllNames -join ', '). Administrator accounts should face the same or stricter requirements as everyone else, not fewer."
+        }
+        if ($CoveringPolicy) { $Severity = 'Info' }
+
+        $CoveredNote = if ($CoveringPolicy) {
+            $StateLabel = if ($CoveringPolicy.state -eq 'enabledForReportingButNotEnforced') { 'report-only' } else { 'enabled' }
+            " A separate policy, $($CoveringPolicy.displayName) ($StateLabel), does appear to cover these roles."
+        } else {
+            ' No other policy requires multifactor authentication from these roles, so the exemption leaves them without that protection.'
+        }
+
+        $TitleSuffix = ''
+        if ($HasCritical) { $TitleSuffix += ', including top admin roles' }
+        if ($CoveringPolicy) { $TitleSuffix += ' (covered elsewhere)' }
+
+        $Remediation = if ($CoveringPolicy) {
+            "Confirm that $($CoveringPolicy.displayName) holds these roles to the same or stricter requirements, and exclude only named emergency-access accounts rather than whole roles."
+        } else {
+            "Remove the exemption for $($AllNames -join ', ') and exclude only the named emergency-access accounts instead."
+        }
+
+        $Affected = [System.Collections.Generic.List[string]]::new()
+        $Affected.Add($Policy.displayName)
+        if ($CoveringPolicy) { $Affected.Add($CoveringPolicy.displayName) }
+
+        $Params = @{
+            Severity         = $Severity
+            Category         = 'Administrator coverage'
+            Title            = "$($ExcludedHighPriv.Count) privileged role(s) exempt from this policy$TitleSuffix"
+            Description      = $AttackScenario + $CoveredNote
+            Remediation      = $Remediation
+            AffectedPolicies = @($Affected)
+            RelatedIds       = @($ExcludedHighPriv | ForEach-Object { $_.id })
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-old-require-mfa-admin'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    $PoliciesExcludingCritical = @($Context.Enabled | Where-Object {
+            @($_.conditions.users.excludeRoles | Where-Object { $CriticalRoleIds.Contains("$_") }).Count -gt 0
+        })
+    if ($PoliciesExcludingCritical.Count -gt 0) {
+        $AffectedNames = @($PoliciesExcludingCritical | ForEach-Object { $_.displayName })
+        $Params = @{
+            Severity         = 'Critical'
+            Category         = 'Administrator coverage'
+            Title            = "$($PoliciesExcludingCritical.Count) enforced policy(ies) exempt the top administrator roles"
+            Description      = "The following policies exempt roles such as Global Administrator or Privileged Role Administrator: $($AffectedNames -join ', '). These are the accounts attackers seek first, and here they receive less protection than a regular user."
+            Remediation      = 'Remove the role exemptions from every policy, exclude only two named emergency-access accounts, and require phishing-resistant multifactor authentication from all administrators.'
+            AffectedPolicies = $AffectedNames
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-old-require-mfa-admin'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapProtectedActions.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapProtectedActions.ps1
new file mode 100644
index 0000000000000..d15dbb9af3c84
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapProtectedActions.ps1
@@ -0,0 +1,107 @@
+function Test-CIPPCAGapProtectedActions {
+    <#
+    .SYNOPSIS
+        Reviews policies that protect Protected Actions (microsoft.directory.* user actions).
+    .DESCRIPTION
+        For every policy (any state) whose user actions start with "microsoft.directory": basic "Require
+        MFA" instead of an authentication strength is High; targeting All users instead of admin roles is
+        Medium; a non-phishing- resistant authentication strength is Info; report-only state is Info; an
+        enabled policy with no user exclusions (no break-glass path) is Medium.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Policy in @($Context.Policies)) {
+        $UserActions = @($Policy.conditions.applications.includeUserActions)
+        if ($UserActions.Count -eq 0) { continue }
+        $ProtectedActions = @($UserActions | Where-Object { "$_".StartsWith('microsoft.directory') })
+        if ($ProtectedActions.Count -eq 0) { continue }
+
+        $Grant = $Policy.grantControls
+        $Users = $Policy.conditions.users
+        $Controls = @($Grant.builtInControls)
+        $ActionList = $ProtectedActions -join ', '
+        $UsesBasicMfa = ($Controls -contains 'mfa') -and ($null -eq $Grant.authenticationStrength)
+        $UsesAuthStrength = $null -ne $Grant.authenticationStrength
+
+        if ($UsesBasicMfa) {
+            $Params = @{
+                Severity         = 'High'
+                Category         = 'Protected actions'
+                Title            = 'Protected administrative actions rely on basic multifactor authentication'
+                Description      = "This policy guards sensitive administrative operations but asks only for basic multifactor authentication rather than an authentication strength. Protected actions are designed to work with an authentication strength, so the extra check may not be applied reliably when an administrator performs them. Operations covered: $ActionList."
+                Remediation      = 'Require an authentication strength, preferably phishing-resistant, for these protected actions and confirm the administrators involved have registered a suitable method.'
+                AffectedPolicies = @($Policy.displayName)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/protected-actions-overview'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+
+        $TargetsAllUsers = @($Users.includeUsers) -contains 'All'
+        $TargetsAdminRoles = @($Users.includeRoles).Count -gt 0
+        if ($TargetsAllUsers -and -not $TargetsAdminRoles) {
+            $Params = @{
+                Severity         = 'Medium'
+                Category         = 'Protected actions'
+                Title            = 'Protected administrative actions policy applies to everyone rather than administrators'
+                Description      = "Only administrators can perform the operations this policy guards, yet it applies to every user and prompts people who could never carry them out. Operations covered: $ActionList."
+                Remediation      = 'Scope the policy to the administrator roles that actually perform these operations, keeping the emergency-access accounts excluded.'
+                AffectedPolicies = @($Policy.displayName)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/protected-actions-overview'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+
+        if ($UsesAuthStrength) {
+            $StrengthName = "$($Grant.authenticationStrength.displayName)"
+            if (-not (Test-CIPPCAPolicyPhishingResistant -Policy $Policy -Context $Context)) {
+                $Params = @{
+                    Severity         = 'Info'
+                    Category         = 'Protected actions'
+                    Title            = "Protected actions accept ""$StrengthName"" instead of phishing-resistant methods"
+                    Description      = "Common multifactor methods such as text messages, codes and push approvals can be captured by a convincing phishing page, and the operations this policy guards are exactly what an attacker with a captured administrator session would go after. Operations covered: $ActionList."
+                    Remediation      = 'Move the administrators who perform these operations to phishing-resistant sign-in methods and raise this policy to the phishing-resistant strength. The current setting meets the minimum.'
+                    AffectedPolicies = @($Policy.displayName)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/protected-actions-overview'
+                }
+                $Findings.Add((New-CIPPCAGapFinding @Params))
+            }
+        }
+
+        if ($Policy.state -eq 'enabledForReportingButNotEnforced') {
+            $Params = @{
+                Severity         = 'Info'
+                Category         = 'Protected actions'
+                Title            = 'Protected administrative actions policy is not yet enforced'
+                Description      = 'The policy is in report-only mode, so administrators can still carry out these sensitive operations without the extra verification. Report-only is a sensible starting point, but it offers no protection until the policy is enforced.'
+                Remediation      = 'Enforce the policy once the recorded results show that the administrators involved can meet the requirement.'
+                AffectedPolicies = @($Policy.displayName)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/protected-actions-overview'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+
+        $HasExclusions = @($Users.excludeUsers).Count -gt 0
+        if (-not $HasExclusions -and $Policy.state -eq 'enabled') {
+            $Params = @{
+                Severity         = 'Medium'
+                Category         = 'Protected actions'
+                Title            = 'Protected administrative actions policy has no emergency-access exclusion'
+                Description      = 'Nobody is exempt from this policy. If the required sign-in method stops working, for example during a service outage, no administrator can perform the operations needed to recover, such as disabling a faulty policy or restoring a role assignment.'
+                Remediation      = 'Exclude the emergency-access accounts from this policy and monitor any sign-in by them.'
+                AffectedPolicies = @($Policy.displayName)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/role-based-access-control/protected-actions-overview'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+        }
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapReportOnlyState.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapReportOnlyState.ps1
new file mode 100644
index 0000000000000..04090f37f7493
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapReportOnlyState.ps1
@@ -0,0 +1,33 @@
+function Test-CIPPCAGapReportOnlyState {
+    <#
+    .SYNOPSIS
+        Lists every policy that is in report-only mode.
+    .DESCRIPTION
+        A report-only policy logs what would happen but enforces nothing.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($Policy.state -ne 'enabledForReportingButNotEnforced') { continue }
+        $Params = @{
+            Severity         = 'Info'
+            Category         = 'Policy state'
+            Title            = 'Policy is in report-only mode'
+            Description      = 'The policy records the sign-ins it would have affected but does not act on them, so it provides no protection yet.'
+            Remediation      = 'Confirm from the recorded results that the policy behaves as intended, then enforce it.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-report-only'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapResilienceDefaults.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapResilienceDefaults.ps1
new file mode 100644
index 0000000000000..baade244d0bef
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapResilienceDefaults.ps1
@@ -0,0 +1,36 @@
+function Test-CIPPCAGapResilienceDefaults {
+    <#
+    .SYNOPSIS
+        Flags enabled or report-only policies that disable resilience defaults.
+    .DESCRIPTION
+        Disabling resilience defaults means users are denied access when their session expires during an
+        Entra ID outage.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($null -eq $Policy.sessionControls -or $Policy.state -eq 'disabled') { continue }
+        if ($Policy.sessionControls.disableResilienceDefaults -ne $true) { continue }
+
+        $Params = @{
+            Severity         = 'Medium'
+            Category         = 'Resilience'
+            Title            = 'Resilience defaults are disabled'
+            Description      = 'During a Microsoft sign-in service outage, people covered by this policy lose access as soon as their session expires instead of being allowed to keep working.'
+            Remediation      = 'Keep resilience defaults enabled unless a strict need for real-time evaluation outweighs losing access during an outage.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/resilience-defaults'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapResourceExclusionBypass.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapResourceExclusionBypass.ps1
new file mode 100644
index 0000000000000..e5c5d0733654b
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapResourceExclusionBypass.ps1
@@ -0,0 +1,52 @@
+function Test-CIPPCAGapResourceExclusionBypass {
+    <#
+    .SYNOPSIS
+        Tenant-wide check for "All resources" policies with app exclusions affected by Low-Privilege Scope
+        Enforcement.
+    .DESCRIPTION
+        Until 2026, excluding any app from an All-resources policy silently exempted low-privilege scopes
+        (User.Read, openid, profile, email, offline_access, People.Read) from enforcement.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $AzureAdGraph = "$($Context.Data.Reference.windowsAzureAdResource)"
+
+    $PoliciesWithExclusions = @($Context.Enabled | Where-Object {
+            $Apps = $_.conditions.applications
+            (@($Apps.includeApplications) -contains 'All') -and (@($Apps.excludeApplications).Count -gt 0)
+        })
+    if ($PoliciesWithExclusions.Count -eq 0) { return @($Findings) }
+
+    $Names = @($PoliciesWithExclusions | ForEach-Object { $_.displayName })
+    $TotalExclusions = 0
+    foreach ($Policy in $PoliciesWithExclusions) { $TotalExclusions += @($Policy.conditions.applications.excludeApplications).Count }
+    $HasAzureAdGraphPolicy = @($Context.Enabled | Where-Object { @($_.conditions.applications.includeApplications | Where-Object { "$_".ToLowerInvariant() -eq $AzureAdGraph }).Count -gt 0 }).Count -gt 0
+
+    $CoverageNote = if ($HasAzureAdGraphPolicy) {
+        ' A policy already covers the directory service through which these basic permissions are now enforced, so the change is accounted for.'
+    } else {
+        ' No policy covers the directory service through which these basic permissions are now enforced, so applications that only ask for basic profile details may be challenged unexpectedly or, depending on rollout, still slip through.'
+    }
+
+    $Params = @{
+        Severity         = if ($HasAzureAdGraphPolicy) { 'Info' } else { 'Medium' }
+        Category         = 'Exemption scope'
+        Title            = "$($PoliciesWithExclusions.Count) tenant-wide policy(ies) with exemptions are affected by a Microsoft change"
+        Description      = "The enforced policies $($Names -join ', ') cover every application but exempt $TotalExclusions application(s) between them. Until recently, any such exemption also let applications read basic profile and directory details without meeting the policy. Microsoft now enforces those basic permissions through the directory service itself, which closes that path but may change how applications that relied on it behave.$CoverageNote"
+        Remediation      = 'Aim for tenant-wide policies without application exemptions, giving applications that need lighter requirements a policy of their own, and cover the directory service explicitly where exemptions must remain.'
+        AffectedPolicies = $Names
+        RelatedIds       = @($AzureAdGraph)
+        DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-cloud-apps#new-conditional-access-behavior-when-an-all-resources-policy-has-a-resource-exclusion'
+    }
+    if (-not $HasAzureAdGraphPolicy) { $Params['CaTemplate'] = "$($Context.Data.Reference.templates.windowsAzureAdBaselineScopes)" }
+    $Findings.Add((New-CIPPCAGapFinding @Params))
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapSwissCheeseGrant.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapSwissCheeseGrant.ps1
new file mode 100644
index 0000000000000..9652c8812d6a0
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapSwissCheeseGrant.ps1
@@ -0,0 +1,78 @@
+function Test-CIPPCAGapSwissCheeseGrant {
+    <#
+    .SYNOPSIS
+        Reviews policies whose grant controls are combined with the OR operator.
+    .DESCRIPTION
+        With OR, only the weakest listed control has to be satisfied.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+    $Groups = $Context.Data.Reference.equivalentStrengthGroups
+    $Labels = $Context.Data.Reference.grantControlLabels
+
+    foreach ($Policy in @($Context.Policies)) {
+        $Grant = $Policy.grantControls
+        if (-not $Grant.present -or $Grant.operator -ne 'OR') { continue }
+
+        $Controls = @($Grant.builtInControls | Where-Object { $_ -ne 'block' })
+        if ($Controls.Count -le 1) { continue }
+
+        $DistinctGroups = @($Controls | ForEach-Object {
+                $ControlName = $_
+                $Group = $Groups.$ControlName
+                if ($Group) { "$Group" } else { "unique:$ControlName" }
+            } | Select-Object -Unique)
+        $SoleGroup = if ($DistinctGroups.Count -eq 1) { $DistinctGroups[0] } else { $null }
+        $IsManagedAccessOnly = @($DistinctGroups | Where-Object { $_ -ne 'DeviceTrust' -and $_ -ne 'AppProtection' }).Count -eq 0
+        $IsAcceptedEquivalentOr = ($null -ne $SoleGroup) -or $IsManagedAccessOnly
+
+        $LabelList = @($Controls | ForEach-Object {
+                $ControlName = $_
+                $Label = $Labels.$ControlName
+                if ($Label) { "$Label" } else { $ControlName }
+            })
+        $Joined = $LabelList -join ' or '
+
+        if ($IsAcceptedEquivalentOr) {
+            $SpansBothGroups = ($null -eq $SoleGroup) -and $IsManagedAccessOnly
+            $Explanation = if ($SpansBothGroups) {
+                'Accepting either a managed device or a protected app is the pattern Microsoft recommends for mixed corporate and personal devices; both paths prove the access is managed.'
+            } elseif ($SoleGroup -eq 'DeviceTrust') {
+                'Accepting either a compliant device or a hybrid-joined device is a recommended way to require a managed device across cloud-managed and domain-joined estates; neither path is weaker than the other.'
+            } else {
+                'Accepting either an approved client app or an app protection policy is the recommended pattern for protecting data in mobile apps; both paths provide equivalent protection.'
+            }
+            $Params = @{
+                Severity         = 'Info'
+                Category         = 'Grant requirements'
+                Title            = 'Policy accepts either of two equally strong requirements'
+                Description      = "This policy is satisfied by $Joined. Because these requirements are of equal strength, there is no weaker path for an attacker to choose. $Explanation"
+                Remediation      = 'No change needed. If multifactor authentication is meant to apply on top of these device or app requirements, make sure a separate policy enforces it.'
+                AffectedPolicies = @($Policy.displayName)
+                DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-grant'
+            }
+            $Findings.Add((New-CIPPCAGapFinding @Params))
+            continue
+        }
+
+        $Params = @{
+            Severity         = 'High'
+            Category         = 'Grant requirements'
+            Title            = 'Policy is satisfied by the weakest of several requirements'
+            Description      = "This policy accepts $Joined. Because the requirements differ in strength and any one of them is enough, an attacker only needs to meet the easiest one and the stronger ones add nothing."
+            Remediation      = 'Require all of these controls together, or split them into separate policies that each enforce a single requirement.'
+            AffectedPolicies = @($Policy.displayName)
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-grant'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapUncoveredAppExclusions.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapUncoveredAppExclusions.ps1
new file mode 100644
index 0000000000000..e052afe6ac398
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapUncoveredAppExclusions.ps1
@@ -0,0 +1,65 @@
+function Test-CIPPCAGapUncoveredAppExclusions {
+    <#
+    .SYNOPSIS
+        Tenant-wide check for apps excluded from "All resources" policies that no other policy covers.
+    .DESCRIPTION
+        Collects every app excluded from an enabled All-resources policy and checks whether any other
+        enabled policy targets it directly or via All resources without excluding it.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    $ExcludedFromAllResources = [ordered]@{}
+    foreach ($Policy in @($Context.Enabled)) {
+        $Apps = $Policy.conditions.applications
+        if (-not (@($Apps.includeApplications) -contains 'All')) { continue }
+        foreach ($AppId in @($Apps.excludeApplications)) {
+            $Key = "$AppId"
+            if (-not $ExcludedFromAllResources.Contains($Key)) { $ExcludedFromAllResources[$Key] = [System.Collections.Generic.List[string]]::new() }
+            $ExcludedFromAllResources[$Key].Add($Policy.displayName)
+        }
+    }
+
+    $Uncovered = [System.Collections.Generic.List[object]]::new()
+    foreach ($AppId in @($ExcludedFromAllResources.Keys)) {
+        $IsCovered = @($Context.Enabled | Where-Object {
+                $Apps = $_.conditions.applications
+                if (@($Apps.excludeApplications) -contains $AppId) { return $false }
+                if (@($Apps.includeApplications) -contains $AppId) { return $true }
+                if (@($Apps.includeApplications) -contains 'All') { return $true }
+                $false
+            }).Count -gt 0
+        if ($IsCovered) { continue }
+        $Uncovered.Add([PSCustomObject]@{
+                appId        = $AppId
+                displayName  = Get-CIPPCAAppDisplayName -AppId $AppId -Context $Context
+                excludedFrom = [string[]]@($ExcludedFromAllResources[$AppId])
+            })
+    }
+
+    if ($Uncovered.Count -gt 0) {
+        $AppList = @($Uncovered | ForEach-Object { "- $($_.displayName), exempt from $($_.excludedFrom -join ', ')" }) -join "`n"
+        $Affected = [System.Collections.Generic.List[string]]::new()
+        foreach ($Entry in $Uncovered) { foreach ($Name in $Entry.excludedFrom) { if (-not $Affected.Contains($Name)) { $Affected.Add($Name) } } }
+        $Params = @{
+            Severity         = 'High'
+            Category         = 'Application coverage'
+            Title            = "$($Uncovered.Count) application(s) are subject to no Conditional Access policy at all"
+            Description      = "These applications are exempt from the tenant-wide policies and no other policy covers them, so sign-ins to them face no requirements:`n$AppList`n`nSome applications cannot be selected individually in a policy, in which case a tenant-wide policy is the only way to protect them."
+            Remediation      = 'Remove each exemption from the tenant-wide policy and, where an application genuinely needs different requirements, give it a policy of its own.'
+            AffectedPolicies = @($Affected)
+            RelatedIds       = @($Uncovered | ForEach-Object { $_.appId })
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-cloud-apps'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapUserAgentBypass.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapUserAgentBypass.ps1
new file mode 100644
index 0000000000000..151f0e9638562
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAGapUserAgentBypass.ps1
@@ -0,0 +1,123 @@
+function Test-CIPPCAGapUserAgentBypass {
+    <#
+    .SYNOPSIS
+        Detects platform- and client-type-specific MFA policies that can be bypassed by spoofing the user
+        agent.
+    .DESCRIPTION
+        Per policy (non-disabled): an MFA or device-compliance policy scoped to specific device platforms
+        can be bypassed by presenting an unrecognized platform; this is High unless an enabled tenant-wide
+        policy blocks unknown platforms (then Info, naming the companion policy).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Findings = [System.Collections.Generic.List[object]]::new()
+
+    $IsBlockUnknownPlatformsPolicy = {
+        param($P)
+        $Platforms = $P.conditions.platforms
+        ($P.state -eq 'enabled') -and
+        ($null -ne $Platforms) -and
+        (@($P.grantControls.builtInControls) -contains 'block') -and
+        (@($Platforms.includePlatforms) -contains 'all') -and
+        (@($Platforms.excludePlatforms).Count -gt 0) -and
+        (@($P.conditions.users.includeUsers) -contains 'All') -and
+        (@($P.conditions.applications.includeApplications) -contains 'All')
+    }
+
+    foreach ($Policy in @($Context.Policies)) {
+        if ($Policy.state -eq 'disabled') { continue }
+
+        $Platforms = $Policy.conditions.platforms
+        $Controls = @($Policy.grantControls.builtInControls)
+        $ClientAppTypes = @($Policy.conditions.clientAppTypes)
+        $RequiresMfa = ($Controls -contains 'mfa') -or ($null -ne $Policy.grantControls.authenticationStrength)
+        $RequiresCompliance = ($Controls -contains 'compliantDevice') -or ($Controls -contains 'domainJoinedDevice')
+
+        if ($null -ne $Platforms -and @($Platforms.includePlatforms).Count -gt 0 -and -not (@($Platforms.includePlatforms) -contains 'all')) {
+            $Targeted = @($Platforms.includePlatforms) -join ', '
+            if ($RequiresMfa -or $RequiresCompliance) {
+                $Companion = $null
+                foreach ($Other in @($Context.Policies)) {
+                    if ($Other.id -ne $Policy.id -and (& $IsBlockUnknownPlatformsPolicy $Other)) { $Companion = $Other; break }
+                }
+                if ($Companion) {
+                    $Params = @{
+                        Severity         = 'Info'
+                        Category         = 'Platform coverage'
+                        Title            = "Policy applies to $Targeted only, with unknown platforms blocked elsewhere"
+                        Description      = "On its own, a policy limited to $Targeted could be sidestepped by a device that presents itself as an unrecognized platform. $($Companion.displayName) blocks such platforms across the tenant, which closes that route."
+                        Remediation      = "No change needed for unknown platforms, which $($Companion.displayName) covers. Confirm that the recognized platforms this policy leaves out are covered by another policy."
+                        AffectedPolicies = @($Policy.displayName, $Companion.displayName)
+                        DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-unknown-unsupported'
+                    }
+                } else {
+                    $Params = @{
+                        Severity         = 'High'
+                        Category         = 'Platform coverage'
+                        Title            = "Policy applies only to $Targeted and can be sidestepped from other platforms"
+                        Description      = 'A sign-in that presents itself as a platform this policy does not list, such as Linux or an unrecognized device type, is not subject to its requirements. The platform a device reports is easily changed and attackers routinely try alternatives to find one that is not covered.'
+                        Remediation      = 'Apply the policy to all platforms, or block sign-ins from unsupported and unknown platforms with a companion policy.'
+                        AffectedPolicies = @($Policy.displayName)
+                        CaTemplate       = "$($Context.Data.Reference.templates.blockUnsupportedPlatforms)"
+                        DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-unknown-unsupported'
+                    }
+                }
+                $Findings.Add((New-CIPPCAGapFinding @Params))
+            }
+        }
+
+        $HasClientFilter = ($ClientAppTypes.Count -gt 0) -and -not ($ClientAppTypes -contains 'all')
+        if ($HasClientFilter) {
+            $HasBrowser = $ClientAppTypes -contains 'browser'
+            $HasMobile = $ClientAppTypes -contains 'mobileAppsAndDesktopClients'
+            if ($RequiresMfa -and (-not $HasBrowser -or -not $HasMobile)) {
+                $Missing = [System.Collections.Generic.List[string]]::new()
+                if (-not $HasBrowser) { $Missing.Add('web browsers') }
+                if (-not $HasMobile) { $Missing.Add('desktop and mobile apps') }
+                $MissingText = $Missing -join ' and '
+                $Params = @{
+                    Severity         = 'Medium'
+                    Category         = 'Platform coverage'
+                    Title            = "Multifactor policy does not cover sign-ins from $MissingText"
+                    Description      = "The multifactor requirement in this policy applies only to some kinds of client ($($ClientAppTypes -join ', ')). Anyone can choose a client of an uncovered kind and sign in with a password alone."
+                    Remediation      = 'Apply the multifactor requirement to both web browsers and desktop and mobile apps, and block the older sign-in methods separately.'
+                    AffectedPolicies = @($Policy.displayName)
+                    DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/concept-conditional-access-conditions#client-apps'
+                }
+                $Findings.Add((New-CIPPCAGapFinding @Params))
+            }
+        }
+    }
+
+    $BlocksUnknownPlatforms = @($Context.Enabled | Where-Object {
+            $Platforms = $_.conditions.platforms
+            ($null -ne $Platforms) -and (@($Platforms.includePlatforms) -contains 'all') -and (@($Platforms.excludePlatforms).Count -gt 0) -and (@($_.grantControls.builtInControls) -contains 'block')
+        }).Count -gt 0
+    $MfaPoliciesUseSpecificPlatforms = @($Context.Enabled | Where-Object {
+            $Platforms = $_.conditions.platforms
+            if ($null -eq $Platforms -or @($Platforms.includePlatforms).Count -eq 0) { return $false }
+            $RequiresMfa = (@($_.grantControls.builtInControls) -contains 'mfa') -or ($null -ne $_.grantControls.authenticationStrength)
+            $RequiresMfa -and -not (@($Platforms.includePlatforms) -contains 'all')
+        }).Count -gt 0
+
+    if ($MfaPoliciesUseSpecificPlatforms -and -not $BlocksUnknownPlatforms) {
+        $Params = @{
+            Severity         = 'High'
+            Category         = 'Platform coverage'
+            Title            = 'Platform-limited multifactor policies leave unknown platforms open'
+            Description      = 'One or more enforced multifactor policies apply only to specific device platforms, and nothing blocks sign-ins from platforms that are unsupported or unrecognized. A device that reports itself as an unlisted platform can sign in with a password alone.'
+            Remediation      = 'Apply the multifactor policies to all platforms, or block sign-ins from unsupported and unknown platforms with a companion policy.'
+            CaTemplate       = "$($Context.Data.Reference.templates.blockUnsupportedPlatforms)"
+            DocumentationUrl = 'https://learn.microsoft.com/entra/identity/conditional-access/policy-all-users-device-unknown-unsupported'
+        }
+        $Findings.Add((New-CIPPCAGapFinding @Params))
+    }
+
+    @($Findings)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAPolicyPhishingResistant.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAPolicyPhishingResistant.ps1
new file mode 100644
index 0000000000000..e6bc93fec25a7
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/CAAnalysis/Test-CIPPCAPolicyPhishingResistant.ps1
@@ -0,0 +1,51 @@
+function Test-CIPPCAPolicyPhishingResistant {
+    <#
+    .SYNOPSIS
+        Decides whether a Conditional Access policy enforces a phishing-resistant authentication strength.
+    .DESCRIPTION
+        A policy counts as phishing-resistant when its authentication strength is the built-in Microsoft
+        "Phishing-resistant MFA" strength, when the strength's display name mentions phishing-resistant /
+        FIDO2 / Windows Hello / certificate-based, or (the authoritative signal) when the strength resolves
+        in the tenant's cached authentication-strength catalog and any allowedCombinations entry contains a
+        phishing-resistant method token (fido2, windowsHelloForBusiness, x509 certificate, device-bound
+        passkey, hardware OATH).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $Policy,
+        [Parameter(Mandatory = $true)]
+        $Context
+    )
+
+    $Reference = $Context.Data.Reference.phishingResistant
+    $PolicyNameRegex = if ($Reference.policyNameRegex) { "$($Reference.policyNameRegex)" } else { 'phishing.?resistant' }
+    $StrengthNameRegex = if ($Reference.nameRegex) { "$($Reference.nameRegex)" } else { 'phishing.?resistant|fido2|windows hello|certificate.?based' }
+    $BuiltInId = if ($Reference.builtInStrengthId) { "$($Reference.builtInStrengthId)" } else { '00000000-0000-0000-0000-000000000004' }
+    $MethodTokens = [string[]]@($Reference.methodTokens | ForEach-Object { "$_".ToLowerInvariant() })
+
+    $Strength = $Policy.grantControls.authenticationStrength
+    $DisplayName = "$($Policy.displayName)"
+
+    if ($null -eq $Strength -or [string]::IsNullOrWhiteSpace("$($Strength.id)")) {
+        return [bool]($DisplayName -match $PolicyNameRegex)
+    }
+
+    if ("$($Strength.id)" -eq $BuiltInId) { return $true }
+    if ("$($Strength.displayName)" -match $StrengthNameRegex) { return $true }
+
+    $Resolved = $null
+    if ($Context.AuthStrengths -and $Context.AuthStrengths.ContainsKey("$($Strength.id)")) {
+        $Resolved = $Context.AuthStrengths["$($Strength.id)"]
+    }
+    foreach ($Combination in @($Resolved.allowedCombinations)) {
+        $Tokens = @("$Combination".ToLowerInvariant() -split '[,\s]+' | Where-Object { $_ })
+        foreach ($Token in $Tokens) {
+            if ($MethodTokens -contains $Token) { return $true }
+        }
+    }
+
+    return [bool]($DisplayName -match $PolicyNameRegex)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPCAWhatIfVerdict.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPCAWhatIfVerdict.ps1
new file mode 100644
index 0000000000000..7ab9ac80d9fa5
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPCAWhatIfVerdict.ps1
@@ -0,0 +1,110 @@
+function Get-CIPPCAWhatIfVerdict {
+    <#
+    .SYNOPSIS
+        Turns a What If evaluation into an attacker's experience: blocked or allowed.
+    .DESCRIPTION
+        The API says which policies apply; it does not say whether the sign-in gets through.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        $Policies,
+        $AttackerCanSatisfy,
+        [string]$Expected = 'blocked'
+    )
+
+    $Satisfiable = @($AttackerCanSatisfy | Where-Object { $_ } | ForEach-Object { "$_".ToLower() })
+    $Policies = @($Policies | Where-Object { $_ })
+
+    $ControlsOf = {
+        param($Policy)
+        $List = [System.Collections.Generic.List[string]]::new()
+        foreach ($Control in @($Policy.grantControls.builtInControls | Where-Object { $_ })) { $List.Add("$Control") }
+        if ($Policy.grantControls.authenticationStrength) { $List.Add('authenticationStrength') }
+        @($List)
+    }
+
+    $BlockedBy = [System.Collections.Generic.List[string]]::new()
+    $ChallengedBy = [System.Collections.Generic.List[string]]::new()
+    $SatisfiedPolicies = [System.Collections.Generic.List[string]]::new()
+    $ReportOnlyWouldStop = [System.Collections.Generic.List[string]]::new()
+    $RequiredControls = [System.Collections.Generic.List[string]]::new()
+    $Rows = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Policy in $Policies) {
+        $Controls = & $ControlsOf $Policy
+        $Operator = $(if ("$($Policy.grantControls.operator)") { "$($Policy.grantControls.operator)".ToUpper() } else { 'OR' })
+        $Applies = $Policy.policyApplies -eq $true
+        $State = "$($Policy.state)"
+        $Met = @($Controls | Where-Object { $Satisfiable -contains $_.ToLower() })
+        $Satisfied = if ($Controls.Count -eq 0) { $true } elseif ($Operator -eq 'AND') { $Met.Count -eq $Controls.Count } else { $Met.Count -gt 0 }
+        $Blocks = $Controls -contains 'block'
+        $ControlText = $Controls -join (' {0} ' -f $Operator.ToLower())
+
+        $Result = if (-not $Applies) {
+            $(if ($State -eq 'disabled') { 'Disabled - not evaluated' } else { 'Not applicable to this sign-in' })
+        } elseif ($State -eq 'enabledForReportingButNotEnforced') {
+            $(if ($Blocks -or -not $Satisfied) { 'Report-only - would have stopped this sign-in' } else { 'Report-only - would not have stopped this sign-in' })
+        } elseif ($State -ne 'enabled') {
+            'Disabled - not evaluated'
+        } elseif ($Blocks) {
+            'Blocks the sign-in'
+        } elseif ($Controls.Count -eq 0) {
+            'Applies session controls only'
+        } elseif ($Satisfied) {
+            "Requires $ControlText - satisfied by the attacker"
+        } else {
+            "Requires $ControlText - stops the attacker"
+        }
+
+        $Rows.Add([PSCustomObject]@{
+                displayName   = "$($Policy.displayName)"
+                state         = $State
+                policyApplies = $Applies
+                controls      = @($Controls)
+                operator      = $Operator
+                result        = $Result
+            })
+
+        if (-not $Applies) { continue }
+        if ($State -eq 'enabledForReportingButNotEnforced') {
+            if ($Blocks -or -not $Satisfied) { $ReportOnlyWouldStop.Add("$($Policy.displayName)") }
+            continue
+        }
+        if ($State -ne 'enabled') { continue }
+        if ($Blocks) { $BlockedBy.Add("$($Policy.displayName)"); continue }
+        if ($Controls.Count -eq 0) { continue }
+        foreach ($Control in $Controls) {
+            if (-not $RequiredControls.Contains($Control)) { $RequiredControls.Add($Control) }
+        }
+        if ($Satisfied) { $SatisfiedPolicies.Add("$($Policy.displayName)") } else { $ChallengedBy.Add("$($Policy.displayName)") }
+    }
+
+    $Verdict = if ($BlockedBy.Count -gt 0 -or $ChallengedBy.Count -gt 0) { 'blocked' } else { 'allowed' }
+    $Detail = if ($BlockedBy.Count -gt 0) { 'blockedByPolicy' }
+    elseif ($ChallengedBy.Count -gt 0) { 'challenged' }
+    elseif ($SatisfiedPolicies.Count -gt 0) { 'grantSatisfied' }
+    else { 'noPolicy' }
+
+    $RequiresMfa = ($RequiredControls -contains 'mfa') -or ($RequiredControls -contains 'authenticationStrength')
+    $RequiresPhishingResistant = $RequiredControls -contains 'authenticationStrength'
+    $MeetsExpectation = switch ("$Expected".ToLower()) {
+        'mfa' { $Verdict -eq 'blocked' -or $RequiresMfa }
+        'phishingresistant' { $Verdict -eq 'blocked' -or $RequiresPhishingResistant }
+        default { $Verdict -eq 'blocked' }
+    }
+
+    [PSCustomObject]@{
+        verdict             = $Verdict
+        detail              = $Detail
+        meetsExpectation    = [bool]$MeetsExpectation
+        requiredControls    = @($RequiredControls)
+        blockedBy           = @($BlockedBy)
+        challengedBy        = @($ChallengedBy)
+        satisfiedPolicies   = @($SatisfiedPolicies)
+        reportOnlyWouldStop = @($ReportOnlyWouldStop)
+        policies            = @($Rows)
+        evaluatedCount      = $Policies.Count
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPSecuritySimulationSituation.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPSecuritySimulationSituation.ps1
new file mode 100644
index 0000000000000..dbe93f8d66722
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPSecuritySimulationSituation.ps1
@@ -0,0 +1,22 @@
+function Get-CIPPSecuritySimulationSituation {
+    <#
+    .SYNOPSIS
+        Returns the predefined Conditional Access sign-in situations.
+    .DESCRIPTION
+        Config/SecuritySimulations/CASituations.json holds one entry per predefined sign-in (persona,
+        sign-in conditions, expected outcome, the control that is missing when the outcome is not met).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    $Path = Join-Path $env:CIPPRootPath 'Config/SecuritySimulations/CASituations.json'
+    if (-not (Test-Path $Path)) { return @() }
+    try {
+        @([System.IO.File]::ReadAllText($Path) | ConvertFrom-Json -ErrorAction Stop | Where-Object { $_.id })
+    } catch {
+        Write-Information "Get-CIPPSecuritySimulationSituation: failed to parse CASituations.json: $($_.Exception.Message)"
+        @()
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPSimulationCache.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPSimulationCache.ps1
new file mode 100644
index 0000000000000..4d67414f8c6ed
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/Get-CIPPSimulationCache.ps1
@@ -0,0 +1,39 @@
+function Get-CIPPSimulationCache {
+    <#
+    .SYNOPSIS
+        Reads one CIPPDb cache type for a tenant, collecting it first when it is empty.
+    .DESCRIPTION
+        The same collect-on-miss rule the Baselines engine applies: a tenant whose cache for a type was
+        never collected must not read as "nothing there".
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]$TenantFilter,
+        [Parameter(Mandatory = $true)][string]$Type,
+        $Fields
+    )
+
+    $Read = {
+        if ($Fields) {
+            New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type -Fields $Fields | Where-Object { $_ }
+        } else {
+            New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type | Where-Object { $_ }
+        }
+    }
+
+    $Rows = @(& $Read)
+    if ($Rows.Count -eq 0) {
+        $Collector = Get-Command -Name "Set-CIPPDBCache$Type" -ErrorAction SilentlyContinue
+        if ($Collector) {
+            try {
+                $null = & $Collector -TenantFilter $TenantFilter
+                $Rows = @(& $Read)
+            } catch {
+                Write-Information "Get-CIPPSimulationCache: collecting '$Type' for $TenantFilter failed - $($_.Exception.Message)"
+            }
+        }
+    }
+    foreach ($Row in $Rows) { $Row }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/Invoke-CIPPCASituationBattery.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/Invoke-CIPPCASituationBattery.ps1
new file mode 100644
index 0000000000000..c23d3f5ffc54d
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/Invoke-CIPPCASituationBattery.ps1
@@ -0,0 +1,150 @@
+function Invoke-CIPPCASituationBattery {
+    <#
+    .SYNOPSIS
+        Evaluates every predefined sign-in situation against a tenant's live Conditional Access.
+    .DESCRIPTION
+        Each situation names a persona and sign-in conditions. The admin, user and guest accounts are
+        picked from the cache unless -IdentityOverrides names them (persona -> user id), and situations
+        marked countryFromSelection sign in from -Country (default RU).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]$TenantFilter,
+        [hashtable]$IdentityOverrides,
+        [string]$Country
+    )
+
+    $Country = if ([string]::IsNullOrWhiteSpace($Country)) { 'RU' } else { "$Country".Trim().ToUpperInvariant() }
+    $Capabilities = $(try { Get-CIPPTenantCapabilities -TenantFilter $TenantFilter } catch { $null })
+    $HasP2 = $Capabilities.AAD_PREMIUM_P2 -eq $true
+    $RiskConditions = @('signInRiskLevel', 'userRiskLevel', 'insiderRiskLevel')
+    $Excluded = [System.Collections.Generic.List[object]]::new()
+    $Situations = @(foreach ($Situation in @(Get-CIPPSecuritySimulationSituation)) {
+            $NeedsP2 = @(($Situation.conditions ?? [PSCustomObject]@{}).PSObject.Properties.Name | Where-Object { $RiskConditions -contains $_ }).Count -gt 0
+            if ($NeedsP2 -and -not $HasP2) {
+                $Excluded.Add([PSCustomObject]@{ id = "$($Situation.id)"; title = "$($Situation.title)"; reason = 'Requires Entra ID P2' })
+                continue
+            }
+            $Situation
+        })
+    $Users = @(Get-CIPPSimulationCache -TenantFilter $TenantFilter -Type 'Users')
+    $Roles = @(Get-CIPPSimulationCache -TenantFilter $TenantFilter -Type 'Roles')
+    $Policies = @(Get-CIPPSimulationCache -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies')
+
+    $UsersById = @{}
+    foreach ($User in $Users) { if ($User.id) { $UsersById["$($User.id)"] = $User } }
+
+    $PrivilegedTemplates = @(Get-CIPPPrivilegedRoleTemplateIds)
+    $AdminIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($Role in @($Roles | Where-Object { $PrivilegedTemplates -contains $_.roleTemplateId })) {
+        foreach ($Member in @($Role.members | Where-Object { $_.id })) { $null = $AdminIds.Add("$($Member.id)") }
+    }
+    $AdminCandidates = @($Users | Where-Object { $_.id -and $AdminIds.Contains("$($_.id)") -and $_.accountEnabled -eq $true -and "$($_.userType)" -ne 'Guest' } |
+            Sort-Object -Property displayName | ForEach-Object {
+                [PSCustomObject]@{ userId = "$($_.id)"; displayName = "$($_.displayName)"; userPrincipalName = "$($_.userPrincipalName)" }
+            })
+
+    $Identities = @{}
+    foreach ($Persona in @('admin', 'user', 'guest')) {
+        $OverrideId = $(if ($IdentityOverrides) { "$($IdentityOverrides[$Persona])" } else { '' })
+        $Selected = $(if ($OverrideId) { $UsersById[$OverrideId] } else { $null })
+        if ($Selected) {
+            $Identities[$Persona] = [PSCustomObject]@{
+                persona           = $Persona
+                kind              = 'Selected'
+                userId            = "$($Selected.id)"
+                displayName       = "$($Selected.displayName)"
+                userPrincipalName = "$($Selected.userPrincipalName)"
+            }
+        } else {
+            $Identities[$Persona] = Resolve-CIPPSimulationIdentity -TenantFilter $TenantFilter -Persona $Persona -Users $Users -Roles $Roles -Policies $Policies
+        }
+    }
+
+    $ConditionsFor = {
+        param($Situation)
+        if ($Situation.countryFromSelection -ne $true) { return $Situation.conditions }
+        $Conditions = $Situation.conditions | Select-Object -Property * -ExcludeProperty ipAddress
+        $Conditions | Add-Member -NotePropertyName country -NotePropertyValue $Country -Force
+        $Conditions
+    }
+
+    $Bodies = [System.Collections.Generic.List[object]]::new()
+    foreach ($Situation in $Situations) {
+        $Persona = $(if ("$($Situation.persona)") { "$($Situation.persona)" } else { 'user' })
+        $Identity = $Identities[$Persona]
+        if (-not $Identity) { continue }
+        $Bodies.Add((New-CIPPCAWhatIfRequest -UserId $Identity.userId -IncludeApplications $Situation.includeApplications -Conditions (& $ConditionsFor $Situation)))
+    }
+
+    $Evaluations = if ($Bodies.Count -gt 0) { @(Invoke-CIPPCAWhatIf -TenantFilter $TenantFilter -Bodies @($Bodies)) } else { @() }
+
+    $Rows = [System.Collections.Generic.List[object]]::new()
+    $EvaluableIndex = 0
+    foreach ($Situation in $Situations) {
+        $Persona = $(if ("$($Situation.persona)") { "$($Situation.persona)" } else { 'user' })
+        $Identity = $Identities[$Persona]
+        $Expected = $(if ("$($Situation.expected)") { "$($Situation.expected)" } else { 'blocked' })
+        $Row = [PSCustomObject]@{
+            id                  = "$($Situation.id)"
+            group               = "$($Situation.group)"
+            title               = "$($Situation.title)"
+            persona             = $Persona
+            identity            = $(if ($Identity) { $Identity.userPrincipalName } else { $null })
+            expected            = $Expected
+            outcome             = 'Not evaluated'
+            pass                = $null
+            requiredControls    = @()
+            blockedBy           = @()
+            reportOnlyWouldStop = @()
+            missingControl      = $(if ($Situation.missingControl) { "$($Situation.missingControl.text)" } else { '' })
+            fix                 = $Situation.missingControl.fix
+            conditions          = (& $ConditionsFor $Situation)
+            policies            = @()
+            error               = $null
+        }
+        if (-not $Identity) {
+            $Row.error = "No $Persona account is available in the cache."
+            $Rows.Add($Row)
+            continue
+        }
+        $Evaluation = $Evaluations[$EvaluableIndex]
+        $EvaluableIndex++
+        if ($Evaluation.Error) {
+            $Row.error = "$($Evaluation.Error)"
+            $Rows.Add($Row)
+            continue
+        }
+        $CanSatisfy = if ($Expected -in @('mfa', 'phishingResistant')) { @() } else { @($Situation.attackerCanSatisfy | Where-Object { $_ }) }
+        $Verdict = Get-CIPPCAWhatIfVerdict -Policies $Evaluation.Policies -AttackerCanSatisfy $CanSatisfy -Expected $Expected
+        $Row.outcome = if ($Verdict.detail -eq 'blockedByPolicy') { 'Blocked' }
+        elseif ($Verdict.detail -eq 'challenged') { 'Requires {0}' -f ($Verdict.requiredControls -join ', ') }
+        elseif ($Verdict.detail -eq 'grantSatisfied') { 'Allowed - {0} satisfied' -f ($Verdict.requiredControls -join ', ') }
+        else { 'Allowed' }
+        $Row.pass = [bool]$Verdict.meetsExpectation
+        $Row.requiredControls = @($Verdict.requiredControls)
+        $Row.blockedBy = @($Verdict.blockedBy)
+        $Row.reportOnlyWouldStop = @($Verdict.reportOnlyWouldStop)
+        $Row.policies = @($Verdict.policies | Where-Object { $_.policyApplies })
+        if ($Row.pass) { $Row.missingControl = '' }
+        $Rows.Add($Row)
+    }
+
+    [PSCustomObject]@{
+        identities = [PSCustomObject]$Identities
+        candidates = [PSCustomObject]@{ admins = @($AdminCandidates) }
+        country    = $Country
+        situations = @($Rows)
+        excluded   = @($Excluded)
+        summary    = [PSCustomObject]@{
+            total        = $Rows.Count
+            protected    = @($Rows | Where-Object { $_.pass -eq $true }).Count
+            unprotected  = @($Rows | Where-Object { $_.pass -eq $false }).Count
+            notEvaluated = @($Rows | Where-Object { $null -eq $_.pass }).Count
+            reportOnly   = @($Rows | Where-Object { $_.pass -eq $false -and @($_.reportOnlyWouldStop).Count -gt 0 }).Count
+            unlicensed   = $Excluded.Count
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/Invoke-CIPPCAWhatIf.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/Invoke-CIPPCAWhatIf.ps1
new file mode 100644
index 0000000000000..511cc4dea2f9c
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/Invoke-CIPPCAWhatIf.ps1
@@ -0,0 +1,64 @@
+function Invoke-CIPPCAWhatIf {
+    <#
+    .SYNOPSIS
+        Runs one or many Conditional Access What If evaluations, app-only, without signing in.
+    .DESCRIPTION
+        One body is a single POST to v1.0 identity/conditionalAccess/evaluate.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]$TenantFilter,
+        [Parameter(Mandatory = $true)]$Bodies
+    )
+
+    $Bodies = @($Bodies)
+    $Results = [System.Collections.Generic.List[object]]::new()
+
+    if ($Bodies.Count -eq 1) {
+        try {
+            $Json = ConvertTo-Json -Depth 20 -InputObject $Bodies[0]
+            $Response = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/evaluate' -tenantid $TenantFilter -type POST -body $Json -AsApp $true
+            $Policies = if ($null -ne $Response.value) { @($Response.value) } else { @($Response | Where-Object { $_.PSObject.Properties['policyApplies'] }) }
+            $Results.Add([PSCustomObject]@{ Index = 0; Policies = @($Policies); Error = $null })
+        } catch {
+            $Results.Add([PSCustomObject]@{ Index = 0; Policies = @(); Error = $_.Exception.Message })
+        }
+        return @($Results)
+    }
+
+    $Requests = [System.Collections.Generic.List[object]]::new()
+    for ($i = 0; $i -lt $Bodies.Count; $i++) {
+        $Requests.Add([PSCustomObject]@{
+                id      = "$i"
+                method  = 'POST'
+                url     = '/identity/conditionalAccess/evaluate'
+                headers = @{ 'Content-Type' = 'application/json' }
+                body    = $Bodies[$i]
+            })
+    }
+
+    $Responses = @()
+    $BatchError = $null
+    try {
+        $Responses = @(New-GraphBulkRequest -Requests @($Requests) -tenantid $TenantFilter -asapp $true -Version 'v1.0')
+    } catch {
+        $BatchError = $_.Exception.Message
+    }
+
+    for ($i = 0; $i -lt $Bodies.Count; $i++) {
+        $Response = $Responses | Where-Object { "$($_.id)" -eq "$i" } | Select-Object -First 1
+        if ($null -eq $Response) {
+            $Results.Add([PSCustomObject]@{ Index = $i; Policies = @(); Error = $(if ($BatchError) { $BatchError } else { 'No reply in the batch response.' }) })
+            continue
+        }
+        if ([int]$Response.status -ge 400) {
+            $Message = $Response.body.error.message
+            $Results.Add([PSCustomObject]@{ Index = $i; Policies = @(); Error = $(if ($Message) { "$Message" } else { "HTTP $($Response.status)" }) })
+            continue
+        }
+        $Results.Add([PSCustomObject]@{ Index = $i; Policies = @($Response.body.value | Where-Object { $_ }); Error = $null })
+    }
+    @($Results)
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/New-CIPPCAWhatIfRequest.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/New-CIPPCAWhatIfRequest.ps1
new file mode 100644
index 0000000000000..12f59b7e4b3a5
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/New-CIPPCAWhatIfRequest.ps1
@@ -0,0 +1,68 @@
+function New-CIPPCAWhatIfRequest {
+    <#
+    .SYNOPSIS
+        Builds the request body for the Conditional Access What If evaluation API.
+    .DESCRIPTION
+        The identity is a user (UserId) or a single-tenant service principal (ServicePrincipalId).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        $UserId,
+        $ServicePrincipalId,
+        $IncludeApplications,
+        $Conditions,
+        [switch]$AppliedPoliciesOnly
+    )
+
+    if (-not $UserId -and -not $ServicePrincipalId) {
+        throw 'A What If evaluation needs a UserId or a ServicePrincipalId.'
+    }
+
+    $Identity = if ($ServicePrincipalId) {
+        @{ '@odata.type' = '#microsoft.graph.servicePrincipalSignIn'; servicePrincipalId = "$ServicePrincipalId" }
+    } else {
+        @{ '@odata.type' = '#microsoft.graph.userSignIn'; userId = "$UserId" }
+    }
+
+    $Applications = @($IncludeApplications | Where-Object { $_ } | ForEach-Object { "$($_.value ?? $_)" })
+    if ($Applications.Count -eq 0) {
+        $Applications = @('00000002-0000-0ff1-ce00-000000000000')
+    }
+
+    if ($Conditions -is [System.Collections.IDictionary]) { $Conditions = [PSCustomObject]$Conditions }
+    $SignInConditions = @{}
+    foreach ($Property in @(($Conditions ?? [PSCustomObject]@{}).PSObject.Properties)) {
+        $Value = $Property.Value
+        if ($null -eq $Value -or "$Value" -eq '') { continue }
+        if ($Value -is [System.Management.Automation.PSCustomObject] -and $Value.PSObject.Properties['value'] -and $Value.PSObject.Properties['label']) {
+            $Value = $Value.value
+        }
+        if ($Property.Name -eq 'authenticationFlow' -and $Value -is [string]) {
+            $Value = @{ transferMethod = $Value }
+        }
+        if ($Property.Name -eq 'deviceInfo') {
+            $Allowed = @('deviceId', 'displayName', 'enrollmentProfileName', 'extensionAttributes', 'isCompliant', 'manufacturer', 'mfaRegistered', 'model', 'operatingSystem', 'operatingSystemVersion', 'ownership', 'physicalIds', 'profileType', 'systemLabels', 'trustType')
+            $Device = @{}
+            if ($Value -is [System.Collections.IDictionary]) { $Value = [PSCustomObject]$Value }
+            foreach ($DeviceProperty in @(($Value ?? [PSCustomObject]@{}).PSObject.Properties)) {
+                if ($Allowed -contains $DeviceProperty.Name -and $null -ne $DeviceProperty.Value) { $Device[$DeviceProperty.Name] = $DeviceProperty.Value }
+            }
+            if ($Device.Count -eq 0) { continue }
+            $Value = $Device
+        }
+        $SignInConditions[$Property.Name] = $Value
+    }
+
+    $Body = @{
+        signInIdentity   = $Identity
+        signInContext    = @{
+            '@odata.type'       = '#microsoft.graph.applicationContext'
+            includeApplications = $Applications
+        }
+        signInConditions = $SignInConditions
+    }
+    if ($AppliedPoliciesOnly) { $Body.appliedPoliciesOnly = $true }
+    $Body
+}
diff --git a/Modules/CIPPCore/Public/SecuritySimulations/Resolve-CIPPSimulationIdentity.ps1 b/Modules/CIPPCore/Public/SecuritySimulations/Resolve-CIPPSimulationIdentity.ps1
new file mode 100644
index 0000000000000..c926a18e1c942
--- /dev/null
+++ b/Modules/CIPPCore/Public/SecuritySimulations/Resolve-CIPPSimulationIdentity.ps1
@@ -0,0 +1,86 @@
+function Resolve-CIPPSimulationIdentity {
+    <#
+    .SYNOPSIS
+        Picks a real account in the tenant to stand in for a simulation persona.
+    .DESCRIPTION
+        The What If API evaluates a real identity, so every persona resolves to one from the CIPP cache:
+        'admin' is a member of a privileged directory role (Global Administrator first), 'user' an enabled,
+        licensed member that holds no privileged role, 'guest' an enabled guest.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]$TenantFilter,
+        [Parameter(Mandatory = $true)][ValidateSet('admin', 'user', 'guest')]$Persona,
+        $Users,
+        $Roles,
+        $Policies
+    )
+
+    if ($null -eq $Users) { $Users = @(Get-CIPPSimulationCache -TenantFilter $TenantFilter -Type 'Users') }
+    if ($null -eq $Roles) { $Roles = @(Get-CIPPSimulationCache -TenantFilter $TenantFilter -Type 'Roles') }
+    if ($null -eq $Policies) { $Policies = @(Get-CIPPSimulationCache -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies') }
+
+    $PrivilegedRoleTemplates = @(Get-CIPPPrivilegedRoleTemplateIds)
+
+    $ExcludedUserIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+    foreach ($Policy in $Policies) {
+        foreach ($Id in @($Policy.conditions.users.excludeUsers | Where-Object { $_ })) { $null = $ExcludedUserIds.Add("$Id") }
+    }
+
+    $AdminIds = [System.Collections.Generic.List[string]]::new()
+    foreach ($Template in $PrivilegedRoleTemplates) {
+        foreach ($Role in @($Roles | Where-Object { $_.roleTemplateId -eq $Template })) {
+            foreach ($Member in @($Role.members | Where-Object { $_.id })) {
+                if (-not $AdminIds.Contains("$($Member.id)")) { $AdminIds.Add("$($Member.id)") }
+            }
+        }
+    }
+
+    $UsersById = @{}
+    foreach ($User in $Users) { if ($User.id) { $UsersById["$($User.id)"] = $User } }
+
+    $Describe = {
+        param($User, $Kind)
+        [PSCustomObject]@{
+            persona           = $Persona
+            kind              = $Kind
+            userId            = "$($User.id)"
+            displayName       = "$($User.displayName)"
+            userPrincipalName = "$($User.userPrincipalName)"
+        }
+    }
+
+    switch ($Persona) {
+        'admin' {
+            $Candidates = [System.Collections.Generic.List[object]]::new()
+            foreach ($Id in $AdminIds) {
+                $User = $UsersById[$Id]
+                if ($null -eq $User -or $User.accountEnabled -ne $true -or "$($User.userType)" -eq 'Guest') { continue }
+                $Candidates.Add($User)
+            }
+            $Pick = $Candidates | Where-Object { -not $ExcludedUserIds.Contains("$($_.id)") } | Select-Object -First 1
+            if (-not $Pick) { $Pick = $Candidates | Select-Object -First 1 }
+            if ($Pick) { return (& $Describe $Pick 'Privileged role member') }
+        }
+        'user' {
+            $Pick = $Users | Where-Object {
+                $_.accountEnabled -eq $true -and
+                "$($_.userType)" -ne 'Guest' -and
+                @($_.assignedLicenses | Where-Object { $_ }).Count -gt 0 -and
+                -not $AdminIds.Contains("$($_.id)") -and
+                -not $ExcludedUserIds.Contains("$($_.id)")
+            } | Select-Object -First 1
+            if (-not $Pick) {
+                $Pick = $Users | Where-Object { $_.accountEnabled -eq $true -and "$($_.userType)" -ne 'Guest' -and -not $AdminIds.Contains("$($_.id)") } | Select-Object -First 1
+            }
+            if ($Pick) { return (& $Describe $Pick 'Licensed member') }
+        }
+        'guest' {
+            $Pick = $Users | Where-Object { $_.accountEnabled -eq $true -and "$($_.userType)" -eq 'Guest' } | Select-Object -First 1
+            if ($Pick) { return (& $Describe $Pick 'Guest') }
+        }
+    }
+    $null
+}
diff --git a/Modules/CIPPCore/Public/Send-CIPPAlert.ps1 b/Modules/CIPPCore/Public/Send-CIPPAlert.ps1
index 961cd378c84cf..c968826fbe443 100644
--- a/Modules/CIPPCore/Public/Send-CIPPAlert.ps1
+++ b/Modules/CIPPCore/Public/Send-CIPPAlert.ps1
@@ -20,6 +20,7 @@ function Send-CIPPAlert {
         $PsaTicketPriority,
         $PSAReference,
         $PSATicketId,
+        $PSAConsolidationKey,
         [switch]$UseStandardizedSchema
     )
     Write-Information 'Shipping Alert'
@@ -65,16 +66,27 @@ function Send-CIPPAlert {
                     saveToSentItems = 'true'
                 }
 
-                # Add file attachments if provided
+                # Add file attachments if provided. sendMail rejects a request body over 4MB, so attach in
+                # order (the report PDF comes first) and omit whatever no longer fits.
                 if ($Attachments -and $Attachments.Count -gt 0) {
-                    $PowerShellBody.message.attachments = @($Attachments | ForEach-Object {
-                        @{
-                            '@odata.type'  = '#microsoft.graph.fileAttachment'
-                            name           = $_.Name
-                            contentType    = $_.ContentType
-                            contentBytes   = $_.ContentBytes
+                    $Budget = 4MB - 64KB - [System.Text.Encoding]::UTF8.GetByteCount((ConvertTo-Json -Compress -Depth 10 -InputObject $PowerShellBody))
+                    $FittingAttachments = @($Attachments | ForEach-Object {
+                        $Size = ([string]$_.ContentBytes).Length + 512
+                        if ($Size -le $Budget) {
+                            $Budget = $Budget - $Size
+                            @{
+                                '@odata.type'  = '#microsoft.graph.fileAttachment'
+                                name           = $_.Name
+                                contentType    = $_.ContentType
+                                contentBytes   = $_.ContentBytes
+                            }
+                        } else {
+                            Write-Information "Omitting attachment $($_.Name) from '$Title': too large for sendMail"
                         }
                     })
+                    if ($FittingAttachments.Count -gt 0) {
+                        $PowerShellBody.message.attachments = $FittingAttachments
+                    }
                 }
 
                 $JSONBody = ConvertTo-Json -Compress -Depth 10 -InputObject $PowerShellBody
@@ -372,6 +384,12 @@ function Send-CIPPAlert {
                     $Alert.PsaTicketId = $PSATicketId
                     Write-Information "PSA alert target ticket: $PSATicketId"
                 }
+                if ($PSAConsolidationKey) {
+                    # Optional stable key for PSA extensions that support consolidation.
+                    # Extensions that do not consume this property remain unaffected.
+                    $Alert.PSAConsolidationKey = $PSAConsolidationKey
+                    Write-Information 'PSA alert consolidation key supplied'
+                }
                 if ($AffectedUser) {
                     $Alert.AffectedUser = $AffectedUser
                     $UserLabel = if ($AffectedUser.UPN) { $AffectedUser.UPN } elseif ($AffectedUser.AzureOID) { "OID:$($AffectedUser.AzureOID)" } else { 'unknown' }
diff --git a/Modules/CIPPCore/Public/Send-CIPPScheduledTaskAlert.ps1 b/Modules/CIPPCore/Public/Send-CIPPScheduledTaskAlert.ps1
index a5c29324aa3b5..bb7d4b7cca646 100644
--- a/Modules/CIPPCore/Public/Send-CIPPScheduledTaskAlert.ps1
+++ b/Modules/CIPPCore/Public/Send-CIPPScheduledTaskAlert.ps1
@@ -407,7 +407,7 @@ function Send-CIPPScheduledTaskAlert {
                             apiEndpoint = '/api/ExecSnoozeAlert'
                             cmdletName  = $TaskInfo.Command
                             tenant      = $TenantFilter
-                            durations   = @(7, 14, 30, -1)
+                            durations   = @(7, 14, 30, 90)
                             items       = @($Results | ForEach-Object {
                                     $HashResult = Get-AlertContentHash -AlertItem $_
                                     [PSCustomObject]@{
diff --git a/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1 b/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1
index f0a66378fed11..2d16894c95fc5 100644
--- a/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1
@@ -61,8 +61,10 @@ function Set-CIPPAssignedApplication {
             }
         }
 
-        # Build the assignment object
-        $MobileAppAssignment = switch ($GroupName) {
+        # Build the assignment object. Explicit ids win over the name: GroupName doubles as the display
+        # name of a picked group, and a group called 'AllDevices' must still resolve to that group.
+        $AssignmentTarget = if ($GroupIds -and @($GroupIds).Count -gt 0) { 'GroupIds' } else { $GroupName }
+        $MobileAppAssignment = switch ($AssignmentTarget) {
             'AllUsers' {
                 @(@{
                         '@odata.type' = '#microsoft.graph.mobileAppAssignment'
diff --git a/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1
index 1e97a51b2fec2..48c4197aa6fe5 100644
--- a/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPAssignedPolicy.ps1
@@ -52,7 +52,10 @@ function Set-CIPPAssignedPolicy {
         }
 
         $assignmentsList = [System.Collections.Generic.List[object]]::new()
-        switch ($GroupName) {
+        # Explicit ids win over the name. GroupName doubles as the display name of a picked group,
+        # and a group called 'AllDevices' or 'On' must still resolve to that group, not to the token.
+        $AssignmentTarget = if ($GroupIds -and @($GroupIds).Count -gt 0) { 'GroupIds' } else { $GroupName }
+        switch ($AssignmentTarget) {
             { $_ -in 'allLicensedUsers', 'AllDevices', 'AllDevicesAndUsers' } {
                 # How a broad target is expressed depends on the policy type - the MAM service
                 # behind App Protection takes only group targets. Both this and the assignment
diff --git a/Modules/CIPPCore/Public/Set-CIPPEnrollmentTimeDeviceMembershipTarget.ps1 b/Modules/CIPPCore/Public/Set-CIPPEnrollmentTimeDeviceMembershipTarget.ps1
new file mode 100644
index 0000000000000..b1f6602b499a9
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPEnrollmentTimeDeviceMembershipTarget.ps1
@@ -0,0 +1,79 @@
+function Set-CIPPEnrollmentTimeDeviceMembershipTarget {
+    <#
+    .SYNOPSIS
+        Applies the enrollment-time device group to a Device Preparation policy.
+    .DESCRIPTION
+        The enrollment_autopilot_dpp_devicesecuritygroupids setting string in the policy body is
+        only what the portal displays - Intune enrols devices into the group named by this action,
+        so a policy created without it has no device group at all. The action targets an existing
+        policy, so it always runs after the create.
+
+        The action answers 200 with a validation verdict rather than failing the request, so a
+        rejected group would otherwise pass silently. A group created moments earlier is not
+        replicated yet and is rejected as securityGroupNotFound, which clears on its own, so only
+        that verdict is retried. This is the only place the write-side URI
+        and body are built.
+
+        What was applied is recorded in CIPP's own storage, because the read-back action does not
+        route on every tenant: without the marker a half-deployed profile is indistinguishable
+        from a healthy one. A marker that cannot be written does not fail the apply.
+    .PARAMETER PolicyId
+        The configuration policy id.
+    .PARAMETER GroupId
+        The security group to enrol devices into.
+    .PARAMETER TenantFilter
+        The tenant to write to.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$PolicyId,
+        [Parameter(Mandatory = $true)]
+        [string]$GroupId,
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    $Body = @{
+        enrollmentTimeDeviceMembershipTargets = @(
+            @{
+                '@odata.type' = 'microsoft.graph.enrollmentTimeDeviceMembershipTarget'
+                targetType    = 'staticSecurityGroup'
+                targetId      = $GroupId
+            }
+        )
+    } | ConvertTo-Json -Compress -Depth 10
+
+    $Uri = "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$PolicyId')/setEnrollmentTimeDeviceMembershipTarget"
+    $Attempt = 0
+    while ($true) {
+        $Attempt++
+        $Result = New-GraphPOSTRequest -uri $Uri -tenantid $TenantFilter -body $Body -type POST
+        if ($Result.validationSucceeded -eq $true) { break }
+
+        $StatusList = @($Result.enrollmentTimeDeviceMembershipTargetValidationStatuses)
+        $NotReplicated = @($StatusList | Where-Object { $_.targetValidationErrorCode -eq 'securityGroupNotFound' }).Count -gt 0
+        if (-not $NotReplicated -or $Attempt -gt 3) {
+            $Statuses = $StatusList | ConvertTo-Json -Compress -Depth 10
+            throw "Intune rejected the enrollment time device membership target for policy $PolicyId : $Statuses"
+        }
+        Start-Sleep -Seconds 10
+    }
+
+    try {
+        $Table = Get-CIPPTable -TableName 'EnrollmentTimeMembershipTargets'
+        $Entity = @{
+            PartitionKey = [string]$TenantFilter
+            RowKey       = [string]$PolicyId
+            GroupId      = [string]$GroupId
+            AppliedAt    = (Get-Date).ToUniversalTime().ToString('o')
+        }
+        Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
+    } catch {
+        Write-Information "Could not record the enrollment time device membership target for policy $PolicyId : $($_.Exception.Message)"
+    }
+
+    $Result
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPImageName.ps1 b/Modules/CIPPCore/Public/Set-CIPPImageName.ps1
new file mode 100644
index 0000000000000..9feef21904957
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPImageName.ps1
@@ -0,0 +1,44 @@
+function Set-CIPPImageName {
+    <#
+    .FUNCTIONALITY
+        Internal
+    .SYNOPSIS
+        Names a gallery image, so it can be picked by name wherever the image is offered.
+    .DESCRIPTION
+        Writes the name row Get-CIPPImageNameMap reads (PartitionKey imageMeta, RowKey the image id).
+        An empty name removes the row, which reads back as "unnamed".
+    .PARAMETER PartitionKey
+        The image kind (logo, brandingCover).
+    .PARAMETER Id
+        The image's RowKey GUID.
+    .PARAMETER Name
+        The name to give it; blank to clear.
+    #>
+    [CmdletBinding(SupportsShouldProcess = $true)]
+    param(
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$PartitionKey,
+
+        [Parameter(Mandatory = $true)]
+        [ValidateNotNullOrEmpty()]
+        [string]$Id,
+
+        [AllowEmptyString()]
+        [string]$Name = ''
+    )
+
+    $Table = Get-CIPPTable -TableName 'Images'
+    $Entity = @{
+        PartitionKey = 'imageMeta'
+        RowKey       = $Id.Trim()
+        kind         = $PartitionKey
+        name         = $Name.Trim()
+    }
+    if (-not $PSCmdlet.ShouldProcess($Id, "Name image '$($Entity.name)'")) { return }
+    if ([string]::IsNullOrWhiteSpace($Entity.name)) {
+        try { Remove-CIPPAzDataTableEntity @Table -Entity $Entity -Force | Out-Null } catch { Write-Warning "Failed to clear the name of image '$Id': $($_.Exception.Message)" }
+        return
+    }
+    Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force | Out-Null
+}
diff --git a/Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1 b/Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1
index 445ed7be1aaf9..73d32d325c326 100644
--- a/Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1
@@ -7,6 +7,10 @@ function Set-CIPPIntunePolicy {
         $RawJSON,
         $AssignTo,
         $ExcludeGroup,
+        # Group ids from the deploy drawer's single-tenant picker. When present they win over the
+        # name-based AssignTo/ExcludeGroup resolution inside Set-CIPPAssignedPolicy.
+        $GroupIds,
+        $ExcludeGroupIds,
         $Headers,
         $APIName = 'Set-CIPPIntunePolicy',
         $TenantFilter,
@@ -137,6 +141,11 @@ function Set-CIPPIntunePolicy {
                 $PlatformType = 'deviceManagement'
                 $TemplateTypeURL = 'groupPolicyConfigurations'
                 $CreateBody = '{"description":"' + $Description + '","displayName":"' + $DisplayName + '","roleScopeTagIds":["0"]}'
+                # Settings from an imported ADMX file bind to definition ids that differ per tenant.
+                # Rewrite the template's binds to this tenant's ids before anything is created, so a
+                # template whose ADMX is missing here fails by name instead of leaving an empty policy
+                # behind after Graph rejects updateDefinitionValues.
+                $RawJSON = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON $RawJSON -TenantFilter $TenantFilter -DisplayName $DisplayName -Headers $Headers -APIName $APIName
                 $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL" -tenantid $TenantFilter
                 $FuzzyResult = Find-CIPPFuzzyPolicyMatch -DisplayName $DisplayName -ExistingPolicies $CheckExististing -MaxDistance $LevenshteinDistance
                 if ($FuzzyResult) {
@@ -170,6 +179,12 @@ function Set-CIPPIntunePolicy {
                 if ([string]::IsNullOrWhiteSpace($DisplayName)) {
                     throw "This device configuration template has no name - the template's Displayname column and the payload's displayName are both empty. Recreate the template."
                 }
+                # An OMA-URI secret still encrypted in the template is a placeholder tied to a tenant we can't
+                # identify from here, so the plaintext is unrecoverable and Graph rejects it on create.
+                $EncryptedOma = @($PolicyFile.omaSettings | Where-Object { $_.secretReferenceValueId -or $_.isEncrypted -eq $true -or $_.value -eq 'PGEvPg==' })
+                if ($EncryptedOma.Count -gt 0) {
+                    throw "Template has undecrypted OMA-URI setting(s) '$($EncryptedOma.displayName -join "', '")'. Recapture it from the source tenant or edit in the plaintext value."
+                }
                 $Null = $PolicyFile | Add-Member -MemberType NoteProperty -Name 'description' -Value "$Description" -Force
                 $null = $PolicyFile | Add-Member -MemberType NoteProperty -Name 'displayName' -Value $DisplayName -Force
                 $CheckExististing = New-GraphGETRequest -uri "https://graph.microsoft.com/beta/$PlatformType/$TemplateTypeURL" -tenantid $TenantFilter
@@ -399,6 +414,9 @@ function Set-CIPPIntunePolicy {
                 ExcludeGroup   = $ExcludeGroup
                 AssignmentMode = $AssignmentMode
             }
+            # '@($null).Count' is 1, so test the value before counting it.
+            if ($GroupIds -and @($GroupIds).Count -gt 0) { $AssignParams.GroupIds = @($GroupIds) }
+            if ($ExcludeGroupIds -and @($ExcludeGroupIds).Count -gt 0) { $AssignParams.ExcludeGroupIds = @($ExcludeGroupIds) }
 
             if ($AssignmentFilterName) {
                 $AssignParams.AssignmentFilterName = $AssignmentFilterName
@@ -410,6 +428,30 @@ function Set-CIPPIntunePolicy {
         return "Successfully $($PostType) policy for $($TenantFilter) with display name $($DisplayName)"
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
+
+        # Microsoft has tightened Intune DCV2 (settings catalog / configurationPolicies) and device
+        # compliance model validation to reject null values on required properties that older template
+        # captures left null. CIPP re-sends the stored template verbatim, so the write now fails on a
+        # value the operator cannot see in the UI. Turn that specific rejection into an actionable
+        # message that names the offending property - patching only the live policy does not help,
+        # because the stored template still carries the null and every later run resends it. We do not
+        # guess a replacement value: many of these (e.g. bitLockerEnabled) are security-relevant.
+        $ErrorText = @($ErrorMessage.NormalizedError, $ErrorMessage.Message, [string]$ErrorMessage.RawError) -join ' '
+        $NullProperty = $null
+        if ($ErrorText -match "A null value was found for the property named '([^']+)'") {
+            $NullProperty = $Matches[1]
+        } elseif ($ErrorText -match '([A-Za-z0-9_]+)\s*:\s*value cannot be null') {
+            $NullProperty = $Matches[1]
+        } elseif ($ErrorText -match 'value cannot be null' -or $ErrorText -match 'ModelValidationFailure') {
+            $NullProperty = 'a required property'
+        }
+
+        if ($NullProperty) {
+            $NullMessage = "Failed to $($PostType ?? 'deploy') Intune policy '$DisplayName' for $TenantFilter. Microsoft now rejects the null value stored for '$NullProperty' on this policy - it no longer allows null on this required property. The stored template carries this null, so re-deploying or patching only the live policy will not fix it: edit or re-capture the template to set a value for '$NullProperty', then deploy again. Underlying error: $($ErrorMessage.NormalizedError)"
+            Write-LogMessage -headers $Headers -API $APIName -tenant $($TenantFilter) -message $NullMessage -Sev 'Error' -LogData $ErrorMessage
+            throw $NullMessage
+        }
+
         Write-LogMessage -headers $Headers -API $APIName -tenant $($TenantFilter) -message "Failed $($PostType) policy $($DisplayName). Error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
         throw "Failed to add or set policy for $($TenantFilter) with display name $($DisplayName): $($ErrorMessage.NormalizedError)"
     }
diff --git a/Modules/CIPPCore/Public/Set-CIPPRegistrationCampaign.ps1 b/Modules/CIPPCore/Public/Set-CIPPRegistrationCampaign.ps1
index 31397a57cc3ac..4300d82beb7cf 100644
--- a/Modules/CIPPCore/Public/Set-CIPPRegistrationCampaign.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPRegistrationCampaign.ps1
@@ -44,8 +44,8 @@ function Set-CIPPRegistrationCampaign {
     if ($DesiredState -notin @('default', 'enabled', 'disabled')) {
         throw "State must be one of 'default', 'enabled' or 'disabled'"
     }
-    if ($DesiredMethod -notin @('microsoftAuthenticator', 'fido2')) {
-        throw "TargetedAuthenticationMethod must be 'microsoftAuthenticator' or 'fido2'"
+    if ($DesiredMethod -notin @('microsoftAuthenticator', 'FIDO2')) {
+        throw "TargetedAuthenticationMethod must be 'microsoftAuthenticator' or 'FIDO2'"
     }
     if ($DesiredSnooze -lt 0 -or $DesiredSnooze -gt 14) {
         throw 'SnoozeDurationInDays must be between 0 and 14'
diff --git a/Modules/CIPPCore/Public/Set-CIPPSAMCertificate.ps1 b/Modules/CIPPCore/Public/Set-CIPPSAMCertificate.ps1
index 9ecf1fba6edf8..1d4652d3c1ab5 100644
--- a/Modules/CIPPCore/Public/Set-CIPPSAMCertificate.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPSAMCertificate.ps1
@@ -44,6 +44,10 @@ function Set-CIPPSAMCertificate {
         if (!$Secret) {
             $Secret = [PSCustomObject]@{ PartitionKey = 'Secret'; RowKey = 'Secret' }
         }
+        # Preserve the prior current as Previous so local rotation can keep current+previous on Entra.
+        if ($Secret.$Name) {
+            $Secret | Add-Member -MemberType NoteProperty -Name "${Name}Previous" -Value $Secret.$Name -Force
+        }
         $Secret | Add-Member -MemberType NoteProperty -Name $Name -Value $PfxBase64 -Force
         Add-AzDataTableEntity @Table -Entity $Secret -Force
         Update-CIPPSAMCertificateEnvCache -Name $Name -PfxBase64 $PfxBase64
diff --git a/Modules/CIPPCore/Public/Set-CIPPSensitivityLabel.ps1 b/Modules/CIPPCore/Public/Set-CIPPSensitivityLabel.ps1
index 0c0b6a1b1887c..386a5885c7926 100644
--- a/Modules/CIPPCore/Public/Set-CIPPSensitivityLabel.ps1
+++ b/Modules/CIPPCore/Public/Set-CIPPSensitivityLabel.ps1
@@ -36,6 +36,14 @@ function Set-CIPPSensitivityLabel {
     $PolicySource = $Template.PolicyParams
     $LabelName = $LabelParams.Name
 
+    # Rights identities can carry replacement tokens - captured templates hold %defaultdomain% where the
+    # source label named its own tenant's domain (see ConvertTo-CIPPSensitivityLabelDomainToken).
+    if ("$($LabelParams['EncryptionRightsDefinitions'])" -match '%') {
+        $LabelParams['EncryptionRightsDefinitions'] = @($LabelParams['EncryptionRightsDefinitions'] | ForEach-Object {
+                if ($_ -is [string] -and $_ -match '%') { Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $_ } else { $_ }
+            })
+    }
+
     # PswsHashtable parameters need the Exchange.GenericHashTable odata type to bind over the AdminApi.
     if ($LabelParams.ContainsKey('AdvancedSettings')) {
         $LabelParams['AdvancedSettings'] = ConvertTo-CIPPExoHashtable -InputObject $LabelParams['AdvancedSettings']
diff --git a/Modules/CIPPCore/Public/Set-CIPPSharePointSiteMember.ps1 b/Modules/CIPPCore/Public/Set-CIPPSharePointSiteMember.ps1
new file mode 100644
index 0000000000000..3243179cd63fd
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CIPPSharePointSiteMember.ps1
@@ -0,0 +1,175 @@
+function Set-CIPPSharePointSiteMember {
+    <#
+    .SYNOPSIS
+    Adds users to, or removes them from, a SharePoint site role (Owners, Members or Visitors)
+
+    .DESCRIPTION
+    Group-connected sites manage Owners/Members through the backing M365 group via Graph;
+    Visitors (and classic/communication sites entirely) are managed through the site's
+    associated SharePoint role groups via the SharePoint REST API using certificate
+    authentication. A removal of a user directly added to a role group on a group-connected
+    site (MemberType 'User') targets that role group rather than the M365 group.
+
+    Returns one message per user. Only throws when no user could be processed, so a partial
+    failure still reports every outcome.
+
+    .PARAMETER UserPrincipalName
+    The UPN(s) to add or remove
+
+    .PARAMETER Role
+    The site role: Owners, Members or Visitors
+
+    .PARAMETER Add
+    Add the users when true, remove them when false
+
+    .PARAMETER SharePointType
+    The site's root web template. 'Group' marks a group-connected site.
+
+    .PARAMETER GroupId
+    The backing M365 group of a group-connected site, as an id or its mail/mailNickname
+
+    .PARAMETER SiteUrl
+    The site URL, required for Visitors and for sites that are not group-connected
+
+    .PARAMETER MemberType
+    The member type from ListSiteMembers, used on removals to target the SharePoint role group
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [string[]]$UserPrincipalName,
+        [string]$Role = 'Members',
+        [bool]$Add = $true,
+        [string]$SharePointType,
+        [string]$GroupId,
+        [string]$SiteUrl,
+        [string]$MemberType,
+        $Headers,
+        [string]$APIName = 'Set SharePoint Site Member'
+    )
+
+    $AssociatedGroups = @{
+        'Owners'   = 'associatedownergroup'
+        'Members'  = 'associatedmembergroup'
+        'Visitors' = 'associatedvisitorgroup'
+    }
+    $UPNs = @($UserPrincipalName | Where-Object { $_ })
+    $FailedCount = 0
+
+    try {
+        if ($UPNs.Count -eq 0) { throw 'No user was selected.' }
+        if (-not $AssociatedGroups.ContainsKey($Role)) {
+            throw "Invalid role '$Role'. Valid roles are: $($AssociatedGroups.Keys -join ', ')."
+        }
+
+        $UseGraphGroup = $SharePointType -eq 'Group' -and $Role -ne 'Visitors' -and ($Add -or $MemberType -ne 'User')
+
+        if ($UseGraphGroup) {
+            if (-not $GroupId) {
+                $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl
+                $GroupId = (New-GraphGetRequest -uri "$($RestContext.BaseUri)/site?`$select=GroupId" -tenantid $TenantFilter -scope $RestContext.Scope -extraHeaders $RestContext.Headers -UseCertificate -AsApp $true).GroupId
+            }
+            if ($GroupId -notmatch '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$') {
+                $GroupId = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=mail eq '$GroupId' or proxyAddresses/any(x:endsWith(x,'$GroupId')) or mailNickname eq '$GroupId'" -ComplexFilter -tenantid $TenantFilter).id
+            }
+
+            if ($Role -eq 'Owners') {
+                $Results = foreach ($UPN in $UPNs) {
+                    try {
+                        $UserID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$UPN`?`$select=id" -tenantid $TenantFilter).id
+                        if ($Add) {
+                            $OwnerBody = ConvertTo-Json -Compress -InputObject @{ '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$UserID" }
+                            $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/owners/`$ref" -tenantid $TenantFilter -type POST -body $OwnerBody
+                            $Message = "Successfully added $UPN as an owner of the M365 group backing the site."
+                        } else {
+                            $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/owners/$UserID/`$ref" -tenantid $TenantFilter -type DELETE -body ''
+                            $Message = "Successfully removed $UPN as an owner of the M365 group backing the site."
+                        }
+                        Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Info
+                    } catch {
+                        $ErrorMessage = Get-CippException -Exception $_
+                        $Message = "Failed to $(if ($Add) { 'add' } else { 'remove' }) $UPN as an owner. Error: $($ErrorMessage.NormalizedError)"
+                        Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Error -LogData $ErrorMessage
+                        $FailedCount++
+                    }
+                    $Message
+                }
+            } else {
+                if ($Add) {
+                    $Results = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UPNs -TenantFilter $TenantFilter -Headers $Headers
+                } else {
+                    $Results = Remove-CIPPGroupMember -GroupType 'Team' -GroupID $GroupId -Member $UPNs -TenantFilter $TenantFilter -Headers $Headers
+                }
+            }
+        } else {
+            if (-not $SiteUrl) { throw 'No site URL was provided for this site.' }
+
+            $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl
+            $Scope = $RestContext.Scope
+            $JsonAccept = $RestContext.Headers
+            $BaseUri = $RestContext.BaseUri
+            $RoleGroup = $AssociatedGroups[$Role]
+            $RoleLabel = $Role.ToLower().TrimEnd('s')
+            $Article = if ($RoleLabel -match '^[aeiou]') { 'an' } else { 'a' }
+
+            $Results = foreach ($UPN in $UPNs) {
+                try {
+                    try {
+                        $EnsureBody = ConvertTo-Json -Compress -InputObject @{ logonName = "i:0#.f|membership|$UPN" }
+                        $EnsuredUser = New-GraphPostRequest -uri "$BaseUri/web/ensureuser" -tenantid $TenantFilter -scope $Scope -type POST -body $EnsureBody -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true
+                    } catch {
+                        throw "Could not resolve $UPN on the site (ensureuser): $($_.Exception.Message)"
+                    }
+                    if (-not $EnsuredUser.Id) {
+                        throw "Could not resolve $UPN on the site."
+                    }
+
+                    if ($Add) {
+                        # Same shape PnP sends: an SP.User entity posted to the group's users
+                        # collection, which requires the odata=verbose content type.
+                        $AddBody = ConvertTo-Json -Compress -Depth 5 -InputObject @{
+                            '__metadata' = @{ 'type' = 'SP.User' }
+                            'LoginName'  = $EnsuredUser.LoginName
+                        }
+                        try {
+                            $null = New-GraphPostRequest -uri "$BaseUri/web/$RoleGroup/users" -tenantid $TenantFilter -scope $Scope -type POST -body $AddBody -contentType 'application/json;odata=verbose' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true
+                        } catch {
+                            throw "Could not add $UPN to the site $Role group: $($_.Exception.Message)"
+                        }
+                        $Message = "Successfully added $UPN as $Article $RoleLabel of $SiteUrl."
+                    } else {
+                        try {
+                            $null = New-GraphPostRequest -uri "$BaseUri/web/$RoleGroup/users/removebyid($($EnsuredUser.Id))" -tenantid $TenantFilter -scope $Scope -type POST -body '{}' -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true
+                        } catch {
+                            if ($_.Exception.Message -match 'Can not find the user') {
+                                throw "$UPN is not in the site's $Role group."
+                            }
+                            throw "Could not remove $UPN from the site $Role group: $($_.Exception.Message)"
+                        }
+                        $Message = "Successfully removed $UPN as $Article $RoleLabel of $SiteUrl."
+                    }
+                    Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Info
+                } catch {
+                    $ErrorMessage = Get-CippException -Exception $_
+                    $Message = "Failed to $(if ($Add) { 'add' } else { 'remove' }) $UPN. Error: $($ErrorMessage.NormalizedError)"
+                    Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Error -LogData $ErrorMessage
+                    $FailedCount++
+                }
+                $Message
+            }
+        }
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Message = "Failed to modify $Role for $($SiteUrl ?? $GroupId). Error: $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Message -sev Error -LogData $ErrorMessage
+        throw $Message
+    }
+
+    if ($FailedCount -eq $UPNs.Count) {
+        throw ($Results -join ' ')
+    }
+    return $Results
+}
diff --git a/Modules/CIPPCore/Public/Set-CippBecCaseContext.ps1 b/Modules/CIPPCore/Public/Set-CippBecCaseContext.ps1
new file mode 100644
index 0000000000000..c5e7b422d7448
--- /dev/null
+++ b/Modules/CIPPCore/Public/Set-CippBecCaseContext.ps1
@@ -0,0 +1,25 @@
+function Set-CippBecCaseContext {
+    <#
+    .SYNOPSIS
+        Stores the BEC case id in CIPPCore module-scoped AsyncLocal storage for the current invocation.
+    .DESCRIPTION
+        Used by the BEC check, containment, content search and evidence export so that Write-LogMessage
+        stamps every log entry written while they run with a BecCaseId column. The evidence package
+        bundles the logbook rows of a case by filtering on that column. Mirrors
+        Set-CippBaselineRunContext / Set-CippScheduledTaskContext: module script scope is used instead
+        of global scope, which is not reliable in Azure Functions.
+    .PARAMETER CaseId
+        The BEC case id. Pass $null or empty to clear.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [string]$CaseId
+    )
+
+    if (-not $script:CippBecCaseIdStorage) {
+        $script:CippBecCaseIdStorage = [System.Threading.AsyncLocal[string]]::new()
+    }
+    $script:CippBecCaseIdStorage.Value = $CaseId
+}
diff --git a/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1 b/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1
index b71b3360b019f..7a41e884f0b6b 100644
--- a/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1
+++ b/Modules/CIPPCore/Public/Test-CIPPAccessPermissions.ps1
@@ -117,46 +117,51 @@ function Test-CIPPAccessPermissions {
         }
 
 
-        $MissingSamPermissions = $GraphPermissions.MissingPermissions
-        if (($MissingSamPermissions.PSObject.Properties.Name | Measure-Object).Count -gt 0) {
+        if ($GraphPermissions.GrantCheckFailed) {
+            $ErrorMessages.Add("Could not verify which permissions are granted on the CIPP-SAM application: $($GraphPermissions.GrantCheckError)") | Out-Null
+            $Success = $false
+        } else {
+            $MissingSamPermissions = $GraphPermissions.MissingPermissions
+            if (($MissingSamPermissions.PSObject.Properties.Name | Measure-Object).Count -gt 0) {
 
-            $MissingPermissions = foreach ($AppId in $MissingSamPermissions.PSObject.Properties.Name) {
-                $ServicePrincipal = $GraphPermissions.UsedServicePrincipals | Where-Object -Property appId -EQ $AppId
+                $MissingPermissions = foreach ($AppId in $MissingSamPermissions.PSObject.Properties.Name) {
+                    $ServicePrincipal = $GraphPermissions.UsedServicePrincipals | Where-Object -Property appId -EQ $AppId
 
-                foreach ($Permission in $MissingSamPermissions.$AppId.applicationPermissions) {
-                    [PSCustomObject]@{
-                        Application  = $ServicePrincipal.displayName
-                        Type         = 'Application'
-                        PermissionId = $Permission.id
-                        Permission   = $Permission.value
+                    foreach ($Permission in $MissingSamPermissions.$AppId.applicationPermissions) {
+                        [PSCustomObject]@{
+                            Application  = $ServicePrincipal.displayName
+                            Type         = 'Application'
+                            PermissionId = $Permission.id
+                            Permission   = $Permission.value
+                        }
                     }
-                }
-                foreach ($Permission in $MissingSamPermissions.$AppId.delegatedPermissions) {
-                    [PSCustomObject]@{
-                        Application  = $ServicePrincipal.displayName
-                        Type         = 'Delegated'
-                        PermissionId = $Permission.id
-                        Permission   = $Permission.value
+                    foreach ($Permission in $MissingSamPermissions.$AppId.delegatedPermissions) {
+                        [PSCustomObject]@{
+                            Application  = $ServicePrincipal.displayName
+                            Type         = 'Delegated'
+                            PermissionId = $Permission.id
+                            Permission   = $Permission.value
+                        }
                     }
                 }
-            }
-            $Success = $false
+                $Success = $false
 
-            # Until now this only ever surfaced on the permissions page, so the only way to find
-            # out that CIPP needs new consent was to go and look. Log it so it reaches the
-            # notification pipeline like any other alert. Write-AlertMessage de-duplicates per
-            # day, so a check that runs on every page load doesn't repeat itself.
-            # Logged against the partner tenant - it's the CIPP application that needs consent,
-            # not a customer's tenant.
-            $MissingCount = ($MissingPermissions | Measure-Object).Count
-            $MissingSummary = ($MissingPermissions | ForEach-Object { $_.Permission } | Sort-Object -Unique) -join ', '
-            # Select-Object -First 1 because an empty TenantFilter makes Get-Tenants return every
-            # tenant, which would otherwise land every domain in the alert's Tenant field.
-            $PartnerTenant = Get-Tenants -TenantFilter $TenantFilter | Select-Object -First 1
-            $AlertTenant = if ($PartnerTenant.defaultDomainName) { $PartnerTenant.defaultDomainName } else { 'None' }
-            Write-AlertMessage -tenant $AlertTenant -tenantId $PartnerTenant.customerId -message "CIPP has $MissingCount new permission(s) to apply: $MissingSummary. Review and apply them under CIPP > Application Settings > Permissions."
-        } else {
-            $Messages.Add('You have all the required permissions.') | Out-Null
+                # Until now this only ever surfaced on the permissions page, so the only way to find
+                # out that CIPP needs new consent was to go and look. Log it so it reaches the
+                # notification pipeline like any other alert. Write-AlertMessage de-duplicates per
+                # day, so a check that runs on every page load doesn't repeat itself.
+                # Logged against the partner tenant - it's the CIPP application that needs consent,
+                # not a customer's tenant.
+                $MissingCount = ($MissingPermissions | Measure-Object).Count
+                $MissingSummary = ($MissingPermissions | ForEach-Object { $_.Permission } | Sort-Object -Unique) -join ', '
+                # Select-Object -First 1 because an empty TenantFilter makes Get-Tenants return every
+                # tenant, which would otherwise land every domain in the alert's Tenant field.
+                $PartnerTenant = Get-Tenants -TenantFilter $TenantFilter | Select-Object -First 1
+                $AlertTenant = if ($PartnerTenant.defaultDomainName) { $PartnerTenant.defaultDomainName } else { 'None' }
+                Write-AlertMessage -tenant $AlertTenant -tenantId $PartnerTenant.customerId -message "CIPP has $MissingCount new permission(s) to apply: $MissingSummary. Review and apply them under CIPP > Application Settings > Permissions."
+            } else {
+                $Messages.Add('You have all the required permissions.') | Out-Null
+            }
         }
 
         $ApplicationToken = Get-GraphToken -returnRefresh $true -SkipCache $true -AsApp $true
diff --git a/Modules/CIPPCore/Public/Test-CIPPRerun.ps1 b/Modules/CIPPCore/Public/Test-CIPPRerun.ps1
index 9ab610c0ace91..aec5f646bd63a 100644
--- a/Modules/CIPPCore/Public/Test-CIPPRerun.ps1
+++ b/Modules/CIPPCore/Public/Test-CIPPRerun.ps1
@@ -20,7 +20,6 @@ function Test-CIPPRerun {
         } else {
             $EstimatedDifference = switch ($Type) {
                 'Standard' { 9800 } # 2 hours 45 minutes ish.
-                'BPA' { 85000 } # 24 hours ish.
                 'CippTests' { 85000 } # 24 hours ish.
                 'ExchangeMonitor' { 3500 } #about an hour
                 default { throw "Unknown type: $Type" }
diff --git a/Modules/CIPPCore/Public/Tools/ConvertTo-CippReportPdf.ps1 b/Modules/CIPPCore/Public/Tools/ConvertTo-CippReportPdf.ps1
new file mode 100644
index 0000000000000..64fbba024b46a
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/ConvertTo-CippReportPdf.ps1
@@ -0,0 +1,100 @@
+function ConvertTo-CippReportPdf {
+    <#
+    .SYNOPSIS
+        Render a report component tree to PDF bytes server-side.
+    .DESCRIPTION
+        Thin wrapper over the CIPPSharp component kit ([CIPP.Reporting.ReportPdf]::Render), which is
+        loaded with CIPPCore via RequiredAssemblies. Takes the declarative component tree (Report
+        Builder blocks, or a fixed report's composed component nodes), the resolved branding, and the
+        %variable% values, and returns the finished PDF as a byte array. All layout lives in the shared
+        component kit - callers never touch OfficeIMO.
+    .PARAMETER Blocks
+        The component tree: an array of block/component nodes, or a JSON string of the same.
+    .PARAMETER Branding
+        Branding settings as an object or JSON string. Omit it to render against the tenant/global
+        branding settings, or name a preset with -BrandingPresetId (a missing preset falls back to the
+        settings, so a report is always branded).
+    .PARAMETER Variables
+        %variable% values for footer/watermark/cover text, as a hashtable or JSON string.
+    .PARAMETER TenantName
+        Client name shown on the cover and available as %tenantname%.
+    .PARAMETER ReportName
+        Report title shown on the cover and in the page header.
+    .PARAMETER GeneratedOn
+        Human-readable generation date shown on the cover / available as %reportdate%. Defaults to today
+        in the instance's timezone (CIPP_TIMEZONE), not the container's UTC clock.
+    #>
+    [CmdletBinding()]
+    [OutputType([byte[]])]
+    param(
+        [Parameter(Mandatory = $true)]$Blocks,
+        $Branding,
+        [string]$BrandingPresetId,
+        $Variables,
+        [string]$TenantName = 'Organization',
+        [string]$ReportName = 'Report',
+        [string]$GeneratedOn,
+        [string]$PageSize = 'A4',
+        [switch]$Landscape,
+        # The tenant whose %variables% (global + tenant custom vars + built-ins like %cippurl%) resolve
+        # the branding footer/watermark and cover text. Omit to skip variable replacement.
+        [string]$TenantFilter
+    )
+
+    # The client prints the viewer's date; the server prints today in the instance's timezone (set at
+    # warmup from the configured or region timezone), else UTC.
+    if (-not $PSBoundParameters.ContainsKey('GeneratedOn')) {
+        $Zone = try { [TimeZoneInfo]::FindSystemTimeZoneById([string]$env:CIPP_TIMEZONE) } catch { [TimeZoneInfo]::Utc }
+        $GeneratedOn = [TimeZoneInfo]::ConvertTime([DateTimeOffset]::UtcNow, $Zone).ToString('MMMM d, yyyy', [cultureinfo]'en-US')
+    }
+
+    if ($null -eq $Branding) {
+        $Branding = try {
+            $Preset = if ($BrandingPresetId) { Get-CIPPBrandingPreset -Id $BrandingPresetId | Select-Object -First 1 }
+            if ($Preset) { $Preset } else { Get-CIPPBrandingSettings }
+        } catch { @{} }
+    }
+
+    # An Infographic page can use a cover from the branding gallery ('gallery:<id>', as the report
+    # builder stores it); the renderer takes image bytes, so the image is read here. An image that is
+    # gone leaves the page's plain background rather than failing the report.
+    if ($Blocks -isnot [string]) {
+        foreach ($Block in @($Blocks)) {
+            $HeroImage = [string]$Block.heroImage
+            if ($Block.type -ne 'hero' -or $HeroImage -notlike 'gallery:*') { continue }
+            $Image = try { Get-CIPPImage -PartitionKey 'brandingCover' -Id $HeroImage.Substring(8) } catch { $null }
+            $Resolved = if ($Image.data) { [string]$Image.data } else { '' }
+            if ($Block -is [System.Collections.IDictionary]) { $Block['heroImage'] = $Resolved }
+            else { $Block | Add-Member -NotePropertyName 'heroImage' -NotePropertyValue $Resolved -Force }
+        }
+    }
+
+    # Accept objects or pre-serialised JSON for each structured input.
+    $BlocksJson = if ($Blocks -is [string]) { $Blocks } else { ConvertTo-Json -InputObject @($Blocks) -Depth 20 -Compress }
+    $BrandingJson = if ($null -eq $Branding) { '{}' } elseif ($Branding -is [string]) { $Branding } else { ConvertTo-Json -InputObject $Branding -Depth 10 -Compress }
+    $VariablesJson = if ($null -eq $Variables) { '{}' } elseif ($Variables -is [string]) { $Variables } else { ConvertTo-Json -InputObject $Variables -Depth 5 -Compress }
+
+    # Resolve CIPP %variables% (%cippurl%, %tenantname%, custom CippReplacemap vars, ...) through the one
+    # central replacement script, JSON-escaped so a value splices safely into these serialized strings.
+    # The branding footer/watermark and cover text carry these tokens; unknown tokens are left as written
+    # for the component kit to substitute (report-specific vars like %footerlabel%). No-op without a tenant.
+    if (-not [string]::IsNullOrWhiteSpace($TenantFilter)) {
+        # %tenantname% names the tenant the way the report does (the branding's tenantLabel, resolved
+        # by the caller into -TenantName) rather than the way the tenant cache does, so a footer and
+        # the cover agree. Substituted before the general replacement, which would use the cache.
+        if ($PSBoundParameters.ContainsKey('TenantName')) {
+            $EscapedName = (ConvertTo-Json -InputObject $TenantName -Compress).Trim('"')
+            $BrandingJson = [regex]::Replace($BrandingJson, '%tenantname%', $EscapedName, [System.Text.RegularExpressions.RegexOptions]::IgnoreCase)
+        }
+        $BrandingJson = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $BrandingJson -EscapeForJson
+        $VariablesJson = Get-CIPPTextReplacement -TenantFilter $TenantFilter -Text $VariablesJson -EscapeForJson
+    }
+
+    # Unary comma: return the byte[] as a single object so PowerShell does not unroll it into a stream
+    # of bytes (which would reach callers as object[] and only work by implicit coercion).
+    return , [CIPP.Reporting.ReportPdf]::Render(
+        $BlocksJson, $BrandingJson, $VariablesJson,
+        $TenantName, $ReportName, $GeneratedOn,
+        $PageSize, [bool]$Landscape
+    )
+}
diff --git a/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 b/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1
index 9da012f1723d9..602c5b14cd166 100644
--- a/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1
+++ b/Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1
@@ -56,9 +56,11 @@ function Get-CIPPSchedulerBlockedCommands {
         'Set-CippKeyVaultSecret'
         'Remove-CippKeyVaultSecret'
         'Get-CIPPSAMCertificate'
+        'Get-CIPPSAMCertificateVersions'
         'New-CIPPSAMCertificate'
         'Set-CIPPSAMCertificate'
         'Update-CIPPSAMCertificate'
+        'ConvertTo-CIPPSAMCertificateInfo'
         'Get-ExtensionAPIKey'
         'Set-ExtensionAPIKey'
         'Remove-ExtensionAPIKey'
diff --git a/Modules/CIPPCore/Public/Tools/Get-CippReportTenantName.ps1 b/Modules/CIPPCore/Public/Tools/Get-CippReportTenantName.ps1
new file mode 100644
index 0000000000000..7c8441f5d82b7
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Get-CippReportTenantName.ps1
@@ -0,0 +1,50 @@
+function Get-CippReportTenantName {
+    <#
+    .SYNOPSIS
+        How a report names its tenant, as the branding decides.
+    .DESCRIPTION
+        Every server-rendered report puts the tenant's name on its cover, in its prose and, through
+        %tenantname%, in its footer. The branding's tenantLabel says which name that is:
+
+          alias   - the name CIPP shows for the tenant: its alias when one is set, else its name (default)
+          name    - the Microsoft 365 organisation name, alias or not
+          domain  - the tenant's default domain
+
+        A preset's choice wins over the global setting when a preset id is given, exactly as the
+        rest of the branding resolves. Anything that cannot be read falls back to the next best
+        thing, and finally to the tenant filter itself, so a report always has something to say.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][string]$TenantFilter,
+        [string]$BrandingPresetId,
+        # Already-resolved branding, when the caller has it; otherwise the preset or global settings are read.
+        $Branding
+    )
+
+    $Tenant = try { Get-Tenants -TenantFilter $TenantFilter | Select-Object -First 1 } catch { $null }
+    $Shown = if ($Tenant.displayName) { [string]$Tenant.displayName } else { $TenantFilter }
+
+    if ($null -eq $Branding) {
+        $Branding = try {
+            $Preset = if ($BrandingPresetId) { Get-CIPPBrandingPreset -Id $BrandingPresetId -SkipImageData | Select-Object -First 1 }
+            if ($Preset) { $Preset } else { Get-CIPPBrandingSettings }
+        } catch { $null }
+    }
+
+    switch ([string]$Branding.tenantLabel) {
+        'domain' {
+            if ($Tenant.defaultDomainName) { [string]$Tenant.defaultDomainName } else { $TenantFilter }
+        }
+        'name' {
+            # The organisation's own name, which the tenant cache overwrites with an alias when one is set.
+            $Organisation = try {
+                New-GraphGetRequest -uri 'https://graph.microsoft.com/v1.0/organization?$select=displayName' -tenantid $TenantFilter -AsApp $true | Select-Object -First 1
+            } catch { $null }
+            if ($Organisation.displayName) { [string]$Organisation.displayName } else { $Shown }
+        }
+        default { $Shown }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Import-CommunityTemplate.ps1 b/Modules/CIPPCore/Public/Tools/Import-CommunityTemplate.ps1
index 9a76171a1ae7e..45f90482a4f64 100644
--- a/Modules/CIPPCore/Public/Tools/Import-CommunityTemplate.ps1
+++ b/Modules/CIPPCore/Public/Tools/Import-CommunityTemplate.ps1
@@ -10,6 +10,7 @@ function Import-CommunityTemplate {
         $MigrationTable,
         $LocationData,
         $Source,
+        $Path,
         [switch]$Force
     )
 
@@ -82,6 +83,12 @@ function Import-CommunityTemplate {
             $Template.JSON = $NewJSON
             $Template | Add-Member -MemberType NoteProperty -Name SHA -Value $SHA -Force
             $Template | Add-Member -MemberType NoteProperty -Name Source -Value $Source -Force
+            if ($Path) {
+                $Template | Add-Member -MemberType NoteProperty -Name SourcePath -Value $Path -Force
+            }
+            if ($Template.PartitionKey -eq 'StandardsTemplateV2') {
+                $Template | Add-Member -MemberType NoteProperty -Name ContentHash -Value (Get-CIPPTemplateContentHash -JSON $NewJSON) -Force
+            }
             Add-CIPPAzDataTableEntity @Table -Entity $Template -Force
 
             if ($Existing -and $Existing.SHA -ne $SHA) {
@@ -150,6 +157,7 @@ function Import-CommunityTemplate {
                         RowKey       = if ($Duplicate) { $Duplicate.RowKey } else { $id }
                         Source       = $Source
                     }
+                    if ($Path) { $entity.SourcePath = $Path }
                     # Full replace: keep the CIPP-assigned Package.
                     if ($Duplicate -and $Duplicate.Package) { $entity.Package = $Duplicate.Package }
                     Add-CIPPAzDataTableEntity @Table -Entity $entity -Force
@@ -224,6 +232,7 @@ function Import-CommunityTemplate {
                         RowKey       = if ($Duplicate) { $Duplicate.RowKey } else { $id }
                         Source       = $Source
                     }
+                    if ($Path) { $entity.SourcePath = $Path }
                     # Full replace: keep the CIPP-assigned Package.
                     if ($Duplicate -and $Duplicate.Package) { $entity.Package = $Duplicate.Package }
                     Write-Information "Final entity: $($entity | ConvertTo-Json -Depth 10)"
@@ -315,6 +324,7 @@ function Import-CommunityTemplate {
                         RowKey       = if ($Duplicate) { $Duplicate.RowKey } else { $id }
                         Source       = $Source
                     }
+                    if ($Path) { $entity.SourcePath = $Path }
 
                     if ($Duplicate -and $Duplicate.Package) {
                         $entity.Package = $Duplicate.Package
diff --git a/Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1 b/Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1
index 6235acfa63c4a..ae16edbf70428 100644
--- a/Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1
+++ b/Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1
@@ -13,7 +13,10 @@ function Push-ExecGenerateReportBuilderReport {
         $Blocks,
         $TemplateGUID,
         $IncludeRawAttachments,
-        $Settings
+        $Settings,
+        # Render and return the PDF without persisting a generated-report row - powers the builder's
+        # live preview/download from the current unsaved state.
+        [switch]$PreviewOnly
     )
 
     try {
@@ -21,9 +24,8 @@ function Push-ExecGenerateReportBuilderReport {
             throw 'TenantFilter is required'
         }
 
-        # Page setup and branding for this report — page size, orientation, cover, footer,
-        # watermark and which branding preset to render against. Carried through untouched: the
-        # PDF is rendered in the browser, so this side only has to store what it was given.
+        # Page setup and branding for this report: page size, orientation, cover, footer,
+        # watermark and which branding preset to render against.
         $ParsedSettings = $null
         if ($Settings) {
             if ($Settings -is [string]) {
@@ -190,21 +192,65 @@ function Push-ExecGenerateReportBuilderReport {
                 $Block
             })
 
+        # Data tokens (&Users&, &Devices.complianceState=compliant&, a chart or table's data source)
+        # resolve against the reporting database here, on the server, so a scheduled run and a
+        # preview read the same data.
+        $EnrichedBlocks = @(Resolve-CippReportDataToken -Blocks $EnrichedBlocks -TenantFilter $TenantFilter)
+
+        # -- Render the PDF server-side via the shared CIPPSharp component kit --
+        # A render failure must not lose the report: the enriched blocks are still stored so the report
+        # exists and can be re-rendered, and the failure is logged rather than thrown.
+        $PdfBytes = $null
+        try {
+            # The tenant's name for the cover, as the branding names it (alias, organisation name or
+            # domain). The template's chosen preset wins, else the global branding settings - the same
+            # resolution ConvertTo-CippReportPdf applies to the rest of the branding.
+            $TenantDisplayName = Get-CippReportTenantName -TenantFilter $TenantFilter -BrandingPresetId ([string]$ParsedSettings.brandingPresetId)
+            $PageSizePref = if ($ParsedSettings -and $ParsedSettings.size) { [string]$ParsedSettings.size } else { 'A4' }
+            $IsLandscape = ($ParsedSettings -and "$($ParsedSettings.orientation)" -eq 'landscape')
+
+            $PdfBytes = ConvertTo-CippReportPdf -Blocks $EnrichedBlocks -BrandingPresetId ([string]$ParsedSettings.brandingPresetId) `
+                -TenantName $TenantDisplayName -TenantFilter $TenantFilter -ReportName ($TemplateName ?? 'Report') `
+                -PageSize $PageSizePref -Landscape:$IsLandscape
+        } catch {
+            $PdfError = Get-CippException -Exception $_
+            Write-LogMessage -API 'ReportBuilder' -tenant $TenantFilter -message "PDF render failed, storing report without a PDF: $($PdfError.NormalizedError)" -Sev 'Warning' -LogData $PdfError
+        }
+
+        # Preview: hand the freshly rendered bytes straight back without persisting a report row.
+        if ($PreviewOnly) {
+            return @{ PdfBytes = $PdfBytes }
+        }
+        $PdfBase64 = if ($PdfBytes) { [Convert]::ToBase64String($PdfBytes) } else { '' }
+        $PdfFileName = ("$($TemplateName ?? 'Report')_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+
         # Store the generated report
         $ReportGUID = (New-Guid).GUID
         $ReportTable = Get-CippTable -tablename 'ReportBuilderReports'
         $ReportEntity = @{
-            PartitionKey = $TenantFilter
-            RowKey       = [string]$ReportGUID
-            TemplateName = [string]($TemplateName ?? 'Scheduled Report')
-            TenantFilter = [string]$TenantFilter
-            Blocks       = [string](ConvertTo-Json -InputObject @($EnrichedBlocks) -Depth 20 -Compress)
-            GeneratedAt  = [string](Get-Date).ToString('o')
-            Status       = 'Completed'
-            Settings     = if ($ParsedSettings) { [string](ConvertTo-Json -InputObject $ParsedSettings -Depth 10 -Compress) } else { '' }
+            PartitionKey   = $TenantFilter
+            RowKey         = [string]$ReportGUID
+            TemplateName   = [string]($TemplateName ?? 'Scheduled Report')
+            TenantFilter   = [string]$TenantFilter
+            Blocks         = [string](ConvertTo-Json -InputObject @($EnrichedBlocks) -Depth 20 -Compress)
+            GeneratedAt    = [string](Get-Date).ToString('o')
+            Status         = 'Completed'
+            Settings       = if ($ParsedSettings) { [string](ConvertTo-Json -InputObject $ParsedSettings -Depth 10 -Compress) } else { '' }
         }
-
         Add-CIPPAzDataTableEntity @ReportTable -Entity $ReportEntity -Force
+
+        # The finished PDF goes in its own table, keyed by the report GUID, so listing reports never pulls
+        # the base64. Add-CIPPAzDataTableEntity auto-splits the oversized property across part rows, so a
+        # multi-MB report survives the Azure Table 64KB/property limit.
+        if ($PdfBase64) {
+            $PdfTable = Get-CippTable -tablename 'ReportBuilderPdfs'
+            Add-CIPPAzDataTableEntity @PdfTable -Force -Entity @{
+                PartitionKey = $TenantFilter
+                RowKey       = [string]$ReportGUID
+                FileName     = $PdfFileName
+                Pdf          = $PdfBase64
+            }
+        }
         Write-LogMessage -API 'ReportBuilder' -tenant $TenantFilter -message "Generated report builder report '$TemplateName' with GUID $ReportGUID" -Sev 'Info'
 
         # Build result message with direct link
@@ -218,9 +264,20 @@ function Push-ExecGenerateReportBuilderReport {
             $ResultMessage += ". View report: $ReportLink"
         }
 
-        # Build file attachments for database blocks if requested
+        # Attachments for the scheduled-email path (Send-CIPPScheduledTaskAlert forwards TaskAttachments).
+        # The rendered PDF always attaches - that is the whole point of rendering server-side; the raw
+        # CSV/JSON data files stay behind the IncludeRawAttachments toggle.
+        $TaskAttachments = [System.Collections.Generic.List[object]]::new()
+
+        if ($PdfBase64) {
+            $TaskAttachments.Add(@{
+                    Name         = $PdfFileName
+                    ContentType  = 'application/pdf'
+                    ContentBytes = $PdfBase64
+                })
+        }
+
         if ($IncludeRawAttachments -eq 'true') {
-            $TaskAttachments = @()
             foreach ($Block in $EnrichedBlocks) {
                 if ($Block.type -ne 'database' -or -not $Block.dbType) { continue }
                 $Format = if ($Block.format) { $Block.format } else { 'csv' }
@@ -260,18 +317,18 @@ function Push-ExecGenerateReportBuilderReport {
                     }
                 }
                 $Bytes = [System.Text.Encoding]::UTF8.GetBytes($FileContent)
-                $Base64 = [Convert]::ToBase64String($Bytes)
-                $TaskAttachments += @{
-                    Name        = $FileName
-                    ContentType = $ContentType
-                    ContentBytes = $Base64
-                }
+                $TaskAttachments.Add(@{
+                        Name         = $FileName
+                        ContentType  = $ContentType
+                        ContentBytes = [Convert]::ToBase64String($Bytes)
+                    })
             }
-            if ($TaskAttachments.Count -gt 0) {
-                return @{
-                    TaskAttachments = $TaskAttachments
-                    Results         = $ResultMessage
-                }
+        }
+
+        if ($TaskAttachments.Count -gt 0) {
+            return @{
+                TaskAttachments = @($TaskAttachments)
+                Results         = $ResultMessage
             }
         }
 
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBaselineWhatIfReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBaselineWhatIfReportTree.ps1
new file mode 100644
index 0000000000000..b393bca4fb0ab
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBaselineWhatIfReportTree.ps1
@@ -0,0 +1,698 @@
+function Build-CippBaselineWhatIfReportTree {
+    <#
+    .SYNOPSIS
+        Compose the Security Baseline report as a component tree (server port of CippBaselineWhatIfReport.jsx).
+    .DESCRIPTION
+        Pure composition from already-gathered baseline data: where the baseline stands today, what is
+        already in place, the policies and settings it will change (today -> target, and why), the
+        rollout waves still to come and the agreed exceptions - plus everything the simulated baselines
+        would add. Nothing is changed by producing it. Returns @{ Blocks; Variables }.
+
+        Every helper mirrors the client document's semantics (JS truthiness, `??`, template-literal
+        stringification), so the report reads the same whether the inputs are hashtables (the branding
+        preview sample) or PSCustomObjects (the live endpoint). Keys match case-sensitively like a JS
+        object's: a PSCustomObject's properties are compared with -ceq, and a hashtable matches with its
+        own comparer - ConvertFrom-Json -AsHashtable's is case-sensitive, an @{} literal's is not, so a
+        caller keying a lookup by data values builds it with an ordinal comparer.
+    .PARAMETER Data
+        TenantName; tenant (rows[] from Get-CIPPBaselineAlignment); stageStates[]; assignedTemplates[]
+        and simulatedTemplates[] (baselines as Get-CIPPBaseline -ResolveIdentityLabels returns them);
+        catalog[] (Get-CIPPBaselineDefinition); resolvers (caByGuid / intuneByGuid: stored template
+        content keyed by template id); sectionConfig (alreadyAligned / rolloutStages, both default on).
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][hashtable]$Data)
+
+    # -- JS-semantics helpers. Functions return collections behind a leading comma so an empty or
+    # one-item array reaches the caller intact instead of being unrolled to $null or a scalar. --
+    function isObj($v) { $v -is [System.Collections.IDictionary] -or $v -is [System.Management.Automation.PSCustomObject] }
+    function isArr($v) { $v -is [System.Collections.IList] }
+    # A property of a hashtable or PSCustomObject, else $null - a string or array never
+    # member-enumerates (JS `x?.key`). PSObject.Properties[$k] ignores case, so the name is
+    # compared with -ceq as a JS key would be.
+    function pv($o, [string]$k) {
+        if ($o -is [System.Collections.IDictionary]) { return , $o[$k] }
+        if ($o -is [System.Management.Automation.PSCustomObject]) {
+            foreach ($p in $o.PSObject.Properties) { if ($p.Name -ceq $k) { return , $p.Value } }
+        }
+        $null
+    }
+    # JS `o[k] !== undefined`: a present null counts as present.
+    function has($o, [string]$k) {
+        if ($o -is [System.Collections.IDictionary]) { return ([System.Collections.IDictionary]$o).Contains($k) }
+        if ($o -is [System.Management.Automation.PSCustomObject]) {
+            foreach ($p in $o.PSObject.Properties) { if ($p.Name -ceq $k) { return $true } }
+        }
+        $false
+    }
+    function keysOf($o) {
+        if ($o -is [System.Collections.IDictionary]) { return , @($o.Keys) }
+        if ($o -is [System.Management.Automation.PSCustomObject]) { return , @(foreach ($p in $o.PSObject.Properties) { $p.Name }) }
+        , @()
+    }
+    # JS `[].concat(v ?? [])`.
+    function arr($v) { if ($null -eq $v) { return , @() } , @($v) }
+    # JS `v?.value ?? v` (legacy saves store option objects {label, value}).
+    function unwrap($v) {
+        if (isObj $v) {
+            $inner = pv $v 'value'
+            if ($null -ne $inner) { return , $inner }
+        }
+        , $v
+    }
+    function truthy($v) {
+        if ($null -eq $v) { return $false }
+        if ($v -is [bool]) { return $v }
+        if ($v -is [string]) { return $v.Length -gt 0 }
+        if ((isArr $v) -or (isObj $v)) { return $true }
+        if ($v -is [ValueType]) { try { $n = [double]$v; return ($n -ne 0 -and -not [double]::IsNaN($n)) } catch { return $true } }
+        $true
+    }
+    # JS template-literal stringification (`${v}`): lowercase true/false, invariant numbers, arrays
+    # comma-joined, objects '[object Object]', dates as the ISO string the client received.
+    function jsStr($v) {
+        if ($null -eq $v) { return 'null' }
+        if ($v -is [string]) { return $v }
+        if ($v -is [bool]) { return $(if ($v) { 'true' } else { 'false' }) }
+        if (isArr $v) { return (@(foreach ($x in $v) { if ($null -eq $x) { '' } else { jsStr $x } }) -join ',') }
+        if (isObj $v) { return '[object Object]' }
+        if ($v -is [datetime] -or $v -is [System.DateTimeOffset]) { return (ConvertTo-Json -InputObject $v -Compress).Trim('"') }
+        [System.Convert]::ToString($v, [cultureinfo]::InvariantCulture)
+    }
+    function orEmpty($v) { if ($null -eq $v) { return '' } jsStr $v }
+    function html($s) { [System.Net.WebUtility]::HtmlEncode([string]$s) }
+    function plural([int]$c, [string]$s) { if ($c -eq 1) { $s } else { "${s}s" } }
+
+    $Dash = [string][char]0x2014
+    $Dot = [string][char]0x00B7
+    $Ellipsis = [string][char]0x2026
+    $Check = [string][char]0x2714 + [char]0xFE0F
+
+    # -- Inputs --
+    $tenant = $Data.tenant
+    $rows = arr (pv $tenant 'rows')
+    $stageStates = arr $Data.stageStates
+    $assignedTemplates = arr $Data.assignedTemplates
+    $simulatedTemplates = arr $Data.simulatedTemplates
+    $caByGuid = pv $Data.resolvers 'caByGuid'
+    $intuneByGuid = pv $Data.resolvers 'intuneByGuid'
+    $tenantName = $Data.TenantName ?? (pv $tenant 'displayName') ?? (pv $tenant 'tenantFilter') ?? 'Organization'
+    # The catalog keyed by standard name, case-sensitively like the client's object lookup.
+    $catalog = [System.Collections.Generic.Dictionary[string, object]]::new()
+    foreach ($entry in (arr $Data.catalog)) {
+        $name = pv $entry 'name'
+        if (truthy $name) { $catalog[(jsStr $name)] = $entry }
+    }
+    function defOf($base) {
+        $found = $null
+        if ($null -ne $base -and $catalog.TryGetValue([string]$base, [ref]$found)) { return $found }
+        $null
+    }
+
+    # -- Report vocabulary (client constants) --
+    $changeStatuses = @('Drift', 'Partially Accepted', 'Denied - Remediate Pending', 'Denied - Delete Pending')
+    $caFamilies = @('ConditionalAccessTemplate', 'ConditionalAccessTemplatePackage')
+    $intuneFamilies = @('IntuneTemplate', 'IntuneTemplatePackage')
+    $policyFamilies = @($caFamilies + $intuneFamilies)
+
+    function baseNameOf($standardName) { ([string]$standardName).Split('#')[0].Split('~')[0] }
+    function definitionFor($row) { defOf (baseNameOf $row.standardName) }
+    function descriptionOf($definition) { orEmpty ((pv $definition 'executiveText') ?? (pv $definition 'helpText')) }
+
+    # How each engine status reads in the current-state table.
+    function statusPresentation($status) {
+        if ($status -ceq 'Compliant') { return @{ tone = 'pass'; label = 'In place'; order = 0 } }
+        if ($changeStatuses -ccontains $status) { return @{ tone = 'warn'; label = 'Being corrected'; order = 1 } }
+        if ($status -ceq 'Accepted') { return @{ tone = 'muted'; label = 'Agreed exception'; order = 2 } }
+        if ($status -ceq 'No Data') { return @{ tone = 'muted'; label = 'First check pending'; order = 3 } }
+        if ($status -ceq 'Failed') { return @{ tone = 'fail'; label = 'Check failed'; order = 4 } }
+        if ($status -ceq 'Skipped - No License') { return @{ tone = 'muted'; label = 'License missing'; order = 5 } }
+        if ((orEmpty $status).StartsWith('Skipped', [System.StringComparison]::Ordinal)) { return @{ tone = 'muted'; label = 'Not applicable'; order = 5 } }
+        @{ tone = 'muted'; label = $(if ($null -eq $status) { 'Unknown' } else { jsStr $status }); order = 6 }
+    }
+
+    # What a CA policy protects against, read from its own content.
+    function caBenefitPhrases($policy) {
+        $phrases = [System.Collections.Generic.List[string]]::new()
+        if (-not (isObj $policy)) { return , $phrases }
+        $grant = pv $policy 'grantControls'
+        $conditions = pv $policy 'conditions'
+        $controls = arr (pv $grant 'builtInControls')
+        $strength = pv (pv $grant 'authenticationStrength') 'displayName'
+        if (truthy $strength) { $phrases.Add("require $(jsStr $strength) (phishing-resistant) sign-in") }
+        elseif ($controls -ccontains 'mfa') { $phrases.Add('enforce multi-factor authentication') }
+        if ($controls -ccontains 'compliantDevice' -or $controls -ccontains 'domainJoinedDevice') {
+            $phrases.Add('only allow access from compliant, company-managed devices')
+        }
+        if ($controls -ccontains 'passwordChange') { $phrases.Add('force a password change when an account looks compromised') }
+        if ($controls -ccontains 'block') { $phrases.Add('block the targeted sign-ins entirely') }
+        $locations = pv $conditions 'locations'
+        $includeLocations = arr (pv $locations 'includeLocations')
+        $excludeLocations = arr (pv $locations 'excludeLocations')
+        if (($includeLocations.Count -gt 0 -and $includeLocations -cnotcontains 'All') -or $excludeLocations.Count -gt 0) {
+            $phrases.Add('only allow sign-ins from approved locations')
+        }
+        $clientApps = arr (pv $conditions 'clientAppTypes')
+        if ($clientApps -ccontains 'exchangeActiveSync' -or $clientApps -ccontains 'other') {
+            $phrases.Add('block legacy sign-in methods that cannot do multi-factor authentication')
+        }
+        if ((arr (pv $conditions 'signInRiskLevels')).Count -gt 0) { $phrases.Add('respond automatically to risky sign-ins') }
+        if ((arr (pv $conditions 'userRiskLevels')).Count -gt 0) { $phrases.Add('respond automatically to accounts marked as at risk') }
+        $frequency = pv (pv $policy 'sessionControls') 'signInFrequency'
+        if (truthy (pv $frequency 'isEnabled')) {
+            $type = pv $frequency 'type'
+            $text = 'require signing in again every {0} {1}' -f (orEmpty (pv $frequency 'value')), $(if ($null -eq $type) { 'hours' } else { jsStr $type })
+            # The client collapses the first double space only (String.replace with a string pattern).
+            $at = $text.IndexOf('  ', [System.StringComparison]::Ordinal)
+            if ($at -ge 0) { $text = $text.Remove($at, 1) }
+            $phrases.Add($text)
+        }
+        , $phrases
+    }
+
+    # A light, one-line description of what a CA policy does, from its own content.
+    function caLightDescription($policy) {
+        $phrases = caBenefitPhrases $policy
+        if ($phrases.Count -eq 0) { return 'Applies custom sign-in controls.' }
+        $text = @($phrases | Select-Object -First 3) -join ', '
+        '{0}{1}.' -f $text.Substring(0, 1).ToUpperInvariant(), $text.Substring(1)
+    }
+
+    function capJoin($values) {
+        $list = @(foreach ($value in (arr $values)) { if (truthy $value) { jsStr $value } })
+        if ($list.Count -le 3) { return ($list -join ', ') }
+        '{0} +{1} more' -f (@($list[0..2]) -join ', '), ($list.Count - 3)
+    }
+
+    # Who a CA policy applies to (or spares), summarised from its users condition.
+    function summarizeCaUsers($policy, [string]$kind) {
+        $users = pv (pv $policy 'conditions') 'users'
+        $parts = [System.Collections.Generic.List[string]]::new()
+        $people = arr (pv $users "${kind}Users")
+        if ($people -ccontains 'All') { $parts.Add('All users') }
+        elseif ($people.Count -gt 0 -and $people -cnotcontains 'None') { $parts.Add((capJoin $people)) }
+        $groups = arr (pv $users "${kind}Groups")
+        if ($groups.Count -gt 0) { $parts.Add("Groups: $(capJoin $groups)") }
+        $roles = arr (pv $users "${kind}Roles")
+        if ($roles.Count -gt 0) { $parts.Add("Roles: $(capJoin $roles)") }
+        $guests = pv $users "${kind}GuestsOrExternalUsers"
+        $guestKeys = if (isArr $guests) { $guests.Count } else { (keysOf $guests).Count }
+        if ((truthy $guests) -and (-not ((isObj $guests) -or (isArr $guests)) -or $guestKeys -gt 0)) {
+            $parts.Add('Guests / external users')
+        }
+        if ($parts.Count -eq 0) { return $(if ($kind -eq 'include') { $Dash } else { 'None' }) }
+        $parts -join "`n"
+    }
+
+    function caStateLabel($state) {
+        $value = (orEmpty $state).ToLowerInvariant()
+        if ($value -ceq 'enabledforreportingbutnotenforced' -or $value -ceq 'reportonly') {
+            return 'in report-only mode first, so we can measure the impact before anyone is blocked'
+        }
+        if ($value -ceq 'disabled') { return 'switched off until we enable them together' }
+        'fully enforced from day one'
+    }
+
+    # A rendered displayName that is a real policy name - never a raw template file id, which is what a
+    # No Data row's unresolved token render still carries.
+    function validName($expectedValue) {
+        $rendered = pv $expectedValue 'displayName'
+        if ((truthy $rendered) -and (jsStr $rendered) -notmatch '\.json\z') { return (jsStr $rendered) }
+        $null
+    }
+
+    # The friendly name of a deployed policy: the rendered name, a saved picker label, else the bundle
+    # a package instance deploys.
+    function policyDisplayName($item) {
+        $packageName = (unwrap (pv $item.variables 'caTemplatePackage')) ?? (unwrap (pv $item.variables 'intuneTemplatePackage'))
+        $name = (validName $item.expectedValue) ?? (pv (pv $item.variables 'caTemplate') 'label') ?? (pv (pv $item.variables 'intuneTemplate') 'label')
+        if ($null -eq $name) {
+            $name = if (truthy $packageName) { "Every policy in the '$(jsStr $packageName)' bundle" } else { $item.label }
+        }
+        orEmpty $name
+    }
+
+    function rowPolicyName($row) { orEmpty ((validName $row.expectedValue) ?? $row.standardLabel ?? $row.standardName) }
+
+    function prettifyKey($key) {
+        $text = (jsStr $key) -creplace '([a-z0-9])([A-Z])', '$1 $2'
+        if ($text.Length -eq 0) { return $text }
+        $text.Substring(0, 1).ToUpperInvariant() + $text.Substring(1)
+    }
+
+    function prettifyValue($value) {
+        if ($value -is [bool]) { return $(if ($value) { 'On' } else { 'Off' }) }
+        if (isArr $value) {
+            $parts = @(foreach ($x in $value) { $part = prettifyValue $x; if ($null -ne $part) { $part } })
+            if ($parts.Count -gt 0) { return ($parts -join ', ') }
+            return $null
+        }
+        if (isObj $value) { return $null }
+        jsStr $value
+    }
+
+    # A variable's configured value, else the definition's recommended/default; '' counts as unset.
+    function resolveVariable($definition, $variables, [string]$name) {
+        $declared = pv (pv $definition 'variables') $name
+        $value = (unwrap (pv $variables $name)) ?? (pv $declared 'recommended') ?? (pv $declared 'default')
+        if ($null -eq $value -or ($value -is [string] -and $value.Length -eq 0)) { return $null }
+        , $value
+    }
+
+    # A definition's expected block rendered with the baseline's variables. Entries still holding a
+    # tenant token (%defaultdomain%) are left out - they resolve per tenant at run time.
+    function renderExpected($definition, $variables) {
+        $expected = pv $definition 'expected'
+        if (-not (truthy $expected)) { return $null }
+        $rendered = [ordered]@{}
+        foreach ($key in (keysOf $expected)) {
+            $template = pv $expected $key
+            if ($template -is [string]) {
+                if ($template -cmatch '^%([A-Za-z0-9_]+)%\z') {
+                    $value = resolveVariable $definition $variables $Matches[1]
+                    if ($null -ne $value) { $rendered[$key] = $value }
+                    continue
+                }
+                $replaced = [regex]::Replace($template, '%([A-Za-z0-9_]+)%', {
+                        param($match)
+                        $value = resolveVariable $definition $variables $match.Groups[1].Value
+                        if ($null -eq $value) { $match.Value } else { jsStr $value }
+                    })
+                if ($replaced -notmatch '%[A-Za-z0-9_]+%') { $rendered[$key] = $replaced }
+            } elseif (-not ((isObj $template) -or (isArr $template))) {
+                $rendered[$key] = $template
+            } elseif (-not (ConvertTo-Json -InputObject $template -Compress -Depth 20).Contains('%')) {
+                $rendered[$key] = $template
+            }
+        }
+        if ($rendered.Count -gt 0) { return $rendered }
+        $null
+    }
+
+    # One "Label: value" line per entry, using the definition's own variable and option labels where an
+    # expected key maps to exactly one variable.
+    function describeValues($definition, $values) {
+        if ($null -eq $values) { return '' }
+        if ((isArr $values) -or -not (isObj $values)) { return (prettifyValue $values) ?? 'Configured' }
+        $expected = pv $definition 'expected'
+        $tokenFor = [System.Collections.Generic.Dictionary[string, string]]::new()
+        foreach ($key in (keysOf $expected)) {
+            $template = pv $expected $key
+            if ($template -is [string] -and $template -cmatch '^%([A-Za-z0-9_]+)%\z') { $tokenFor[$key] = $Matches[1] }
+        }
+        $parts = [System.Collections.Generic.List[string]]::new()
+        foreach ($key in (keysOf $values)) {
+            $value = pv $values $key
+            $variable = if ($tokenFor.ContainsKey($key)) { pv (pv $definition 'variables') $tokenFor[$key] } else { $null }
+            $label = (pv $variable 'label') ?? (prettifyKey $key)
+            $display = prettifyValue $value
+            if ($null -eq $display) {
+                $display = @(foreach ($nestedKey in (keysOf $value)) {
+                        $nested = prettifyValue (pv $value $nestedKey)
+                        if ($null -ne $nested) { '{0}: {1}' -f (prettifyKey $nestedKey), $nested }
+                    }) -join ', '
+                if (-not $display) { $display = 'configured' }
+            }
+            $valueText = jsStr $value
+            foreach ($option in (arr (pv $variable 'options'))) {
+                if ((jsStr (pv $option 'value')) -ceq $valueText) { $display = pv $option 'label'; break }
+            }
+            if ($display -is [string] -and $display.Length -eq 0) { $display = 'Not set' }
+            $parts.Add(('{0}: {1}' -f (jsStr $label), $(if ($null -eq $display) { 'undefined' } else { jsStr $display })))
+        }
+        if ($parts.Count -gt 8) {
+            return (@($parts[0..7]) + "$Ellipsis and $($parts.Count - 8) more values") -join "`n"
+        }
+        $parts -join "`n"
+    }
+
+    function describeChange($definition, $expectedValue) {
+        $text = describeValues $definition $expectedValue
+        if ($text) { return $text }
+        'Enforced as described'
+    }
+
+    # What the setting is today, projected onto the keys the baseline cares about so the "from" column
+    # shows the relevant values rather than the whole object the API returned.
+    function describeToday($definition, $expectedValue, $currentValue) {
+        if ($null -eq $currentValue) { return 'Not configured yet' }
+        if ((isObj $expectedValue) -and (isObj $currentValue)) {
+            $projected = [ordered]@{}
+            foreach ($key in (keysOf $expectedValue)) {
+                if (has $currentValue $key) { $projected[$key] = pv $currentValue $key }
+            }
+            if ($projected.Count -gt 0) { return (describeValues $definition $projected) }
+        }
+        $text = describeValues $definition $currentValue
+        if ($text) { return $text }
+        'Not configured yet'
+    }
+
+    # Why the setting was chosen: who recommends it, which framework requires it, how disruptive it is.
+    function describeWhy($definition) {
+        $parts = [System.Collections.Generic.List[string]]::new()
+        $recommendedBy = @(foreach ($by in (arr (pv $definition 'recommendedBy'))) { if (truthy $by) { jsStr $by } })
+        if ($recommendedBy.Count -gt 0) { $parts.Add("Recommended by $($recommendedBy -join ' and ')") }
+        foreach ($tag in (arr (pv $definition 'tag'))) {
+            if ((jsStr $tag) -match 'CIS|CISA|NIST') { $parts.Add("required for $(jsStr $tag)"); break }
+        }
+        if ($parts.Count -eq 0) { $parts.Add('Security best practice') }
+        $impact = (orEmpty (pv $definition 'impact')).ToLowerInvariant()
+        if ($impact) { $parts.Add("$impact change for users") }
+        '{0}.' -f ($parts -join '; ')
+    }
+
+    # The enforcement content a template instance is configured with: CA/Intune variables hold a
+    # template id the resolvers map to stored content; plain settings render their expected block.
+    function resolveConfiguredExpected($base, $variables) {
+        if ($caFamilies -ccontains $base) {
+            $id = unwrap (pv $variables 'caTemplate')
+            $content = if ($null -ne $id) { pv $caByGuid (jsStr $id) }
+            if (-not (truthy $content)) { return $null }
+            $copy = [ordered]@{}
+            foreach ($key in (keysOf $content)) { $copy[$key] = pv $content $key }
+            $state = unwrap (pv $variables 'state')
+            if ((truthy $state) -and -not ($state -is [string] -and $state -ceq 'donotchange')) { $copy['state'] = $state }
+            else { $copy['state'] = pv $content 'state' }
+            return $copy
+        }
+        if ($intuneFamilies -ccontains $base) {
+            $id = unwrap (pv $variables 'intuneTemplate')
+            $content = if ($null -ne $id) { pv $intuneByGuid (jsStr $id) }
+            if (-not (truthy $content)) { return $null }
+            return [ordered]@{ displayName = (pv $content 'displayName') }
+        }
+        renderExpected (defOf $base) $variables
+    }
+
+    # A No Data row's saved configuration: its own baseline first, then the other assigned ones.
+    function configFor($row) {
+        $own = @($assignedTemplates | Where-Object { $null -ne $row.templateId -and $_.GUID -ceq $row.templateId })
+        $others = @($assignedTemplates | Where-Object { -not ($null -ne $row.templateId -and $_.GUID -ceq $row.templateId) })
+        foreach ($template in @($own + $others)) {
+            foreach ($stage in (arr $template.stages)) {
+                foreach ($candidate in (arr $stage.standardsConfig)) {
+                    if (($candidate.instance ?? $candidate.standard) -ceq $row.standardName) { return $candidate }
+                }
+            }
+        }
+        $null
+    }
+
+    # Everything the baseline will apply: current deviations, standards awaiting their first check
+    # (they WILL be enforced - their values come from the baseline's own configuration), and
+    # everything the simulated baselines would add.
+    $changes = [System.Collections.Generic.List[object]]::new()
+    foreach ($row in $rows) {
+        if ($changeStatuses -cnotcontains $row.status) { continue }
+        $base = baseNameOf $row.standardName
+        $changes.Add(@{
+                key = $row.standardName; base = $base; label = $row.standardLabel
+                expectedValue = $row.expectedValue; currentValue = $row.currentValue; variables = $null
+                definition = (defOf $base); simulated = $false; pending = $false
+            })
+    }
+    foreach ($row in $rows) {
+        if ($row.status -cne 'No Data') { continue }
+        $base = baseNameOf $row.standardName
+        $variables = (configFor $row).variables ?? @{}
+        # A No Data policy row's expectedValue is the RAW token render (its displayName is still the
+        # template file id), so the stored template wins; plain settings keep the engine's render.
+        if ($policyFamilies -ccontains $base) { $expectedValue = (resolveConfiguredExpected $base $variables) ?? $row.expectedValue }
+        else { $expectedValue = $row.expectedValue ?? (resolveConfiguredExpected $base $variables) }
+        $changes.Add(@{
+                key = $row.standardName; base = $base; label = $row.standardLabel
+                expectedValue = $expectedValue; currentValue = $null; variables = $variables
+                definition = (defOf $base); simulated = $false; pending = $true
+            })
+    }
+    $presentNames = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::Ordinal)
+    foreach ($row in $rows) { if ($null -ne $row.standardName) { [void]$presentNames.Add([string]$row.standardName) } }
+    foreach ($template in $simulatedTemplates) {
+        foreach ($stage in (arr $template.stages)) {
+            foreach ($instance in (arr $stage.standards)) {
+                $instanceKey = [string]$instance
+                if ($presentNames.Contains($instanceKey)) { continue }
+                if (@($changes | Where-Object { $_.key -ceq $instanceKey }).Count -gt 0) { continue }
+                $config = $null
+                foreach ($candidate in (arr $stage.standardsConfig)) {
+                    if (($candidate.instance ?? $candidate.standard) -ceq $instanceKey) { $config = $candidate; break }
+                }
+                $base = baseNameOf $instanceKey
+                $variables = $config.variables ?? @{}
+                $definition = defOf $base
+                $changes.Add(@{
+                        key = $instanceKey; base = $base; label = (pv $definition 'label') ?? $base
+                        expectedValue = (resolveConfiguredExpected $base $variables); currentValue = $null; variables = $variables
+                        definition = $definition; simulated = $true; pending = $false; sourceTemplateName = $template.templateName
+                    })
+            }
+        }
+    }
+
+    # The client formats in the viewer's timezone; the server uses the instance's (CIPP_TIMEZONE, set at
+    # warmup from the configured or region timezone), else UTC. A wave's date is when its stage was
+    # entered plus N days, so its time of day is arbitrary and UTC reads a day out for much of the world.
+    $reportZone = [TimeZoneInfo]::Utc
+    if ($env:CIPP_TIMEZONE) {
+        try {
+            $reportZone = [TimeZoneInfo]::FindSystemTimeZoneById($env:CIPP_TIMEZONE)
+        } catch {
+            Write-Information "Baseline report: unknown timezone '$($env:CIPP_TIMEZONE)', dating the waves in UTC"
+        }
+    }
+    function formatAdvanceDate($epoch) {
+        if (-not (truthy $epoch)) { return $null }
+        try {
+            $number = [double]$epoch
+            $ms = if ($number -gt 1e12) { $number } else { $number * 1000 }
+            [TimeZoneInfo]::ConvertTime([DateTimeOffset]::FromUnixTimeMilliseconds([long]$ms), $reportZone).ToString('MMMM d, yyyy', [cultureinfo]::InvariantCulture)
+        } catch { $null }
+    }
+
+    # -- Derived values --
+    # The current-state table: every standard, what it does, and whether it is correct today.
+    $stateRows = @(@(foreach ($row in $rows) {
+                $presentation = statusPresentation $row.status
+                [pscustomobject]@{
+                    name        = (rowPolicyName $row)
+                    description = (descriptionOf (definitionFor $row))
+                    tone        = $presentation.tone
+                    statusLabel = $presentation.label
+                    order       = $presentation.order
+                }
+            }) | Sort-Object -Property @{ Expression = { $_.order } }, @{ Expression = { $_.name } } -Culture 'en-US' -CaseSensitive -Stable)
+
+    $alignedRows = @($rows | Where-Object { $_.status -ceq 'Compliant' })
+    $alignedCa = @($alignedRows | Where-Object { $caFamilies -ccontains (baseNameOf $_.standardName) })
+    $alignedIntune = @($alignedRows | Where-Object { $intuneFamilies -ccontains (baseNameOf $_.standardName) })
+    $alignedSettings = @($alignedRows | Where-Object { $policyFamilies -cnotcontains (baseNameOf $_.standardName) })
+    $acceptedRows = @($rows | Where-Object { $_.status -ceq 'Accepted' })
+    $pendingCount = @($rows | Where-Object { $_.status -ceq 'No Data' }).Count
+
+    $caChanges = @($changes | Where-Object { $caFamilies -ccontains $_.base })
+    $intuneChanges = @($changes | Where-Object { $intuneFamilies -ccontains $_.base })
+    $settingChanges = @($changes | Where-Object { $policyFamilies -cnotcontains $_.base })
+    # Corrections are drift being fixed; pending items apply once their first check runs and have
+    # their own stat card.
+    $corrections = @($changes | Where-Object { -not $_.pending })
+
+    function caStateFor($item) { caStateLabel ((pv $item.expectedValue 'state') ?? (unwrap (pv $item.variables 'state'))) }
+    $caStates = [System.Collections.Generic.List[string]]::new()
+    foreach ($item in $caChanges) { $state = caStateFor $item; if (-not $caStates.Contains($state)) { $caStates.Add($state) } }
+    $simulatedNames = @(foreach ($template in $simulatedTemplates) { orEmpty $template.templateName })
+
+    # The rollout, one bullet per wave, in plain words - what each wave holds and when the next one
+    # lands. Never the raw graduation conditions.
+    $waveBullets = [System.Collections.Generic.List[object]]::new()
+    foreach ($state in $stageStates) {
+        $prefix = if ($stageStates.Count -gt 1) { "$(orEmpty $state.templateName) $Dash " } else { '' }
+        $liveCount = @($rows | Where-Object { -not (truthy $_.templateId) -or -not (truthy $state.templateId) -or $_.templateId -ceq $state.templateId }).Count
+        $stageName = if (truthy $state.stageName) { " ('$(jsStr $state.stageName)')" } else { '' }
+        $waveBullets.Add(@{
+                label = ('{0}Wave {1} of {2}{3}:' -f $prefix, (jsStr $state.currentStage), (jsStr ($state.totalStages ?? $state.currentStage)), $stageName)
+                text  = ('live now{0}.' -f $(if ($liveCount -gt 0) { ", covering $liveCount $(plural $liveCount 'protection')" }))
+            })
+        if (truthy $state.nextStage) {
+            $upcoming = arr $state.nextStage.standards
+            $names = @(foreach ($key in @($upcoming | Select-Object -First 3)) { orEmpty ((pv (defOf (baseNameOf $key)) 'label') ?? (baseNameOf $key)) })
+            $date = formatAdvanceDate $state.estimatedAdvanceAt
+            $text = 'adds {0}' -f $(if ($upcoming.Count -gt 0) { "$($upcoming.Count) more $(plural $upcoming.Count 'protection')" } else { 'further protections' })
+            if ($names.Count -gt 0) { $text = '{0} - {1}{2}' -f $text, ($names -join ', '), $(if ($upcoming.Count -gt $names.Count) { ' and more' }) }
+            $text = '{0}. {1}{2}.' -f $text, $(if ($date) { "Expected around $date" } else { 'Deploys once the current wave has settled in' }), $(if (truthy $state.manualAdvance) { ', after we approve the move together' })
+            $nextName = if (truthy $state.nextStageName) { " ('$(jsStr $state.nextStageName)')" } else { '' }
+            $waveBullets.Add(@{
+                    label = ('{0}Wave {1}{2}:' -f $prefix, (jsStr ($state.currentStage + 1)), $nextName)
+                    text  = $text
+                })
+        }
+    }
+
+    # Section toggles are on unless explicitly false (the client's `!== false`).
+    $alreadyAligned = pv $Data.sectionConfig 'alreadyAligned'
+    $rolloutStages = pv $Data.sectionConfig 'rolloutStages'
+    $fullyAligned = $rows.Count -gt 0 -and $changes.Count -eq 0 -and $pendingCount -eq 0 -and $simulatedTemplates.Count -eq 0
+    $showAligned = -not ($alreadyAligned -is [bool] -and -not $alreadyAligned) -and ($alignedCa.Count + $alignedIntune.Count + $alignedSettings.Count) -gt 0
+    $showStages = -not ($rolloutStages -is [bool] -and -not $rolloutStages) -and $waveBullets.Count -gt 0
+
+    # Both CA tables share one row shape: the policy, what it lightly does, who it includes and excludes.
+    $caColumns = @(
+        @{ header = 'Policy'; key = 'policy'; width = 1.5; bold = $true }
+        @{ header = 'What it does'; key = 'does'; width = 2.3 }
+        @{ header = 'Applies to'; key = 'includes'; width = 1.3 }
+        @{ header = 'Excluded'; key = 'excludes'; width = 1.3 }
+    )
+    $simulatedFootnote = "* added by a simulated baseline ($($simulatedNames -join ', '))."
+
+    $blocks = [System.Collections.Generic.List[object]]::new()
+
+    # -- Executive Summary --
+    $blocks.Add((New-CippReportPage -Title 'Executive Summary' -Subtitle 'What is protecting you today, and what we will improve next'))
+    $simulatedSentence = if ($simulatedNames.Count -gt 0) {
+        '. It also shows everything the following baseline{0} would add: {1}' -f $(if ($simulatedNames.Count -ne 1) { 's' }), (html ($simulatedNames -join ', '))
+    } else { '' }
+    $blocks.Add((New-CippReportParagraph -Html ('<p>Your environment is protected by a <b>managed security baseline</b>: an agreed set of security policies and settings that we deploy, check continuously, and repair when anything drifts out of line. This report shows where that baseline stands today, what we will change next, and why each choice was made{0}.</p>' -f $simulatedSentence)))
+    $blocks.Add((New-CippReportStatRow -Stats @(
+                @{ value = "$($alignedRows.Count)"; label = 'In Place' }
+                @{ value = "$($corrections.Count)"; label = 'Being Improved' }
+                @{ value = "$pendingCount"; label = 'First Check Pending' }
+                @{ value = "$($acceptedRows.Count)"; label = 'Agreed Exceptions' }
+            )))
+    if ($fullyAligned) {
+        $blocks.Add((New-CippReportClearBox -Title "$Check Fully aligned" -Content 'Every part of the baseline is in effect and verified. We keep checking on every run, and anything that drifts is corrected automatically.'))
+    }
+    $blocks.Add((New-CippReportParagraph -Title 'Where The Baseline Stands Today' -Html '<p>Every protection in the baseline is listed below with its current state. <b>In place</b> means it is deployed and verified as correct. <b>Being corrected</b> means it drifted from the agreed value and is covered in the changes on the next pages. <b>First check pending</b> means it was recently assigned - what it will apply is already listed in the changes on the next pages, and the first verification run confirms it.</p>'))
+    $blocks.Add((New-CippReportTable -Limit 150 -EmptyText 'The baseline was just assigned - the first verification run has not completed yet.' -Columns @(
+                @{ header = 'Protection'; key = 'name'; width = 1.7; bold = $true }
+                @{ header = 'What it does'; key = 'description'; width = 2.9 }
+                @{ header = 'Status'; key = 'statusLabel'; width = 1; toneField = 'tone' }
+            ) -Rows @(foreach ($stateRow in $stateRows) {
+                    @{ name = $stateRow.name; description = $stateRow.description; statusLabel = $stateRow.statusLabel; tone = $stateRow.tone }
+                })))
+
+    # -- What Is Already In Place: policies by name and content, settings with their enforced values --
+    if ($showAligned) {
+        $blocks.Add((New-CippReportPage -Title 'What Is Already In Place' -Subtitle 'Deployed, verified, and re-checked on every run'))
+        if ($alignedCa.Count -gt 0) {
+            $blocks.Add((New-CippReportParagraph -Title 'Conditional Access Policies In Force' -Text 'The following Conditional Access policies are deployed and verified:'))
+            $blocks.Add((New-CippReportTable -Columns $caColumns -Limit 50 -Rows @(foreach ($row in $alignedCa) {
+                            @{
+                                policy   = (rowPolicyName $row)
+                                does     = (caLightDescription $row.expectedValue)
+                                includes = (summarizeCaUsers $row.expectedValue 'include')
+                                excludes = (summarizeCaUsers $row.expectedValue 'exclude')
+                            }
+                        })))
+        }
+        if ($alignedIntune.Count -gt 0) {
+            $blocks.Add((New-CippReportParagraph -Title 'Intune Policies In Force' -Text 'The following Intune policies are deployed and keeping your devices configured to the agreed standard:'))
+            $blocks.Add((New-CippReportBullets -Items @(foreach ($row in $alignedIntune) {
+                            @{ label = (orEmpty ((pv $row.expectedValue 'displayName') ?? $row.standardLabel)); text = '' }
+                        })))
+        }
+        if ($alignedSettings.Count -gt 0) {
+            $blocks.Add((New-CippReportTable -Title 'Settings Enforced Today' -Limit 150 -Columns @(
+                        @{ header = 'Setting'; key = 'setting'; width = 1.4; bold = $true }
+                        @{ header = 'What it does'; key = 'description'; width = 2.4 }
+                        @{ header = 'Set to'; key = 'value'; width = 1.5 }
+                        @{ header = 'Why'; key = 'why'; width = 1.4 }
+                    ) -Rows @(foreach ($row in $alignedSettings) {
+                            $definition = definitionFor $row
+                            @{
+                                setting     = (orEmpty $row.standardLabel)
+                                description = (descriptionOf $definition)
+                                value       = (describeChange $definition ($row.currentValue ?? $row.expectedValue))
+                                why         = (describeWhy $definition)
+                            }
+                        })))
+        }
+    }
+
+    # -- Policies We Will Deploy --
+    if ($caChanges.Count -gt 0 -or $intuneChanges.Count -gt 0) {
+        $blocks.Add((New-CippReportPage -Title 'Policies We Will Deploy' -Subtitle 'New protection rolling out, and what it adds'))
+        if ($caChanges.Count -gt 0) {
+            $blocks.Add((New-CippReportParagraph -Title 'Conditional Access Policies' -Text 'We will deploy the following Conditional Access policies, which control who can sign in, from where, and under what conditions:'))
+            $blocks.Add((New-CippReportTable -Columns $caColumns -Limit 50 -Rows @(foreach ($item in $caChanges) {
+                            @{
+                                policy   = ('{0}{1}' -f (policyDisplayName $item), $(if ($item.simulated) { ' *' }))
+                                does     = ('{0}{1}' -f (caLightDescription $item.expectedValue), $(if ($caStates.Count -gt 1) { " Deployed $(caStateFor $item)." }))
+                                includes = (summarizeCaUsers $item.expectedValue 'include')
+                                excludes = (summarizeCaUsers $item.expectedValue 'exclude')
+                            }
+                        })))
+            if ($caStates.Count -eq 1) {
+                $blocks.Add((New-CippReportParagraph -Html ('<p>These policies will be deployed <b>{0}</b>.</p>' -f (html $caStates[0]))))
+            }
+            if (@($caChanges | Where-Object { $_.simulated }).Count -gt 0) {
+                $blocks.Add((New-CippReportParagraph -Text $simulatedFootnote))
+            }
+        }
+        if ($intuneChanges.Count -gt 0) {
+            $blocks.Add((New-CippReportParagraph -Title 'Intune Policies' -Text 'We will implement the following Intune policies:'))
+            $blocks.Add((New-CippReportBullets -Items @(foreach ($item in $intuneChanges) {
+                            @{ label = (policyDisplayName $item); text = $(if ($item.simulated) { "(added by the '$(orEmpty $item.sourceTemplateName)' baseline)" } else { '' }) }
+                        })))
+            $blocks.Add((New-CippReportParagraph -Text 'These policies configure and protect the devices your staff work on, so every device meets the same security bar before it touches company data.'))
+        }
+    }
+
+    # -- Settings We Will Change --
+    if ($settingChanges.Count -gt 0) {
+        $blocks.Add((New-CippReportPage -Title 'Settings We Will Change' -Subtitle 'Each setting: what it does, what it is today, what we set it to, and why'))
+        $blocks.Add((New-CippReportTable -Limit 150 -Columns @(
+                    @{ header = 'Setting'; key = 'setting'; width = 1.3; bold = $true }
+                    @{ header = 'What it does'; key = 'description'; width = 2.1 }
+                    @{ header = 'Today'; key = 'today'; width = 1.3 }
+                    @{ header = 'We will set it to'; key = 'change'; width = 1.4 }
+                    @{ header = 'Why'; key = 'why'; width = 1.3 }
+                ) -Rows @(foreach ($item in $settingChanges) {
+                        @{
+                            setting     = ('{0}{1}' -f (orEmpty $item.label), $(if ($item.simulated) { ' *' }))
+                            description = (descriptionOf $item.definition)
+                            today       = $(if ($item.pending) { 'Not checked yet' } elseif ($item.simulated) { $Dash } else { describeToday $item.definition $item.expectedValue $item.currentValue })
+                            change      = (describeChange $item.definition $item.expectedValue)
+                            why         = (describeWhy $item.definition)
+                        }
+                    })))
+        if (@($settingChanges | Where-Object { $_.simulated }).Count -gt 0) {
+            $blocks.Add((New-CippReportParagraph -Text $simulatedFootnote))
+        }
+    }
+
+    # -- Rollout Plan --
+    if ($showStages -or $acceptedRows.Count -gt 0) {
+        $blocks.Add((New-CippReportPage -Title 'Rollout Plan' -Subtitle 'How the changes arrive, and agreed exceptions'))
+        if ($showStages) {
+            $blocks.Add((New-CippReportParagraph -Title 'How The Rollout Works' -Text 'The baseline is deployed in waves rather than all at once, so your team never faces every change on the same day. Each wave is monitored until it has proven stable before the next one begins.'))
+            $blocks.Add((New-CippReportBullets -Items @($waveBullets)))
+        }
+        if ($acceptedRows.Count -gt 0) {
+            $blocks.Add((New-CippReportParagraph -Title 'Agreed Exceptions We Will Not Change' -Text 'These deviations from the baseline were reviewed and accepted, so they stay as they are:'))
+            $blocks.Add((New-CippReportBullets -Items @(foreach ($row in $acceptedRows) {
+                            @{ label = (orEmpty $row.standardLabel); text = $(if (truthy $row.deviationReason) { "$Dash $(jsStr $row.deviationReason)" } else { '' }) }
+                        })))
+        }
+    }
+
+    $meta = [System.Collections.Generic.List[string]]::new()
+    $meta.Add("$($alignedRows.Count) $(plural $alignedRows.Count 'protection') in place")
+    $meta.Add("$($corrections.Count) $(plural $corrections.Count 'improvement') underway")
+    if ($pendingCount -gt 0) { $meta.Add("$pendingCount applying after $(if ($pendingCount -eq 1) { 'its' } else { 'their' }) first check") }
+    # covertitle/coveraccent are explicit: the kit would otherwise split the report name on its last word.
+    $variables = @{
+        coverlabel         = 'Security Baseline'
+        covertitle         = 'Baseline'
+        coveraccent        = 'Report'
+        coversubtitle      = 'The security protections in place today, the improvements rolling out next, and the reasons behind each choice.'
+        covermeta          = $meta -join " $Dot "
+        coverfallbackimage = '/reportImages/soc.jpg'
+        footerlabel        = "$tenantName $Dash Security Baseline"
+    }
+    if ($simulatedNames.Count -gt 0) { $variables.covermetanote = "Includes a simulation of: $($simulatedNames -join ', ')" }
+
+    @{
+        Blocks    = @($blocks)
+        Variables = $variables
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBecReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBecReportTree.ps1
new file mode 100644
index 0000000000000..29f9db939f7c0
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippBecReportTree.ps1
@@ -0,0 +1,1327 @@
+function Build-CippBecReportTree {
+    <#
+    .SYNOPSIS
+        Compose the BEC (Business Email Compromise) analysis report as a component tree - the server
+        port of BECRemediationReportButton's BECRemediationReportDocument.
+    .DESCRIPTION
+        Returns @{ Blocks; Variables }: the content blocks plus the cover/footer report variables. The
+        cover names the compromised user rather than the tenant. Detail callouts use -Lines so each
+        label/value line is a tight line break.
+
+        The report leads with an executive intelligence section (results roll-up, findings by attacker
+        objective, evidence-driven priority actions, an order-of-events timeline and any containment
+        already run), then educational context, the per-check detail (Checks 1-21), and recommendations
+        and compliance. Every derived value mirrors the client renderer and the case workspace helpers
+        (bec-objectives / bec-timeline) so the PDF and the on-screen case agree. The threat level is read
+        from the server-computed Score on the run; the analysis window is AnalysisWindowDays.
+    .PARAMETER UserData
+        The investigated user: displayName, userPrincipalName.
+    .PARAMETER BecData
+        The completed BEC results payload (from BecResults), with a .Run block attached carrying the
+        run's CaseId and containment history (as the client receives it from execBECCheck).
+    .PARAMETER TenantName
+        The tenant the user belongs to.
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory)]$UserData, [Parameter(Mandatory)]$BecData, [string]$TenantName, [ValidateSet('full', 'summary')][string]$Variant = 'full')
+
+    # 'summary' = the executive pages only (cover + Executive Summary), for a C-suite reader; 'full' =
+    # every page. Mirrors the client BECRemediationReportDocument variant.
+    $isSummary = $Variant -eq 'summary'
+    $bec = $BecData
+    $loc = $bec.LocationAnalysis
+    $ana = $bec.SentMessageAnalysis
+    $windowDays = if ($bec.AnalysisWindowDays) { [int]$bec.AnalysisWindowDays } else { 7 }
+
+    # -- formatting/utility helpers --
+    function Cnt($x) { if ($null -eq $x) { return 0 }; @($x).Count }
+    function AsInt($v) { if ($null -eq $v) { return 0 }; try { [int]$v } catch { 0 } }
+    function ToDate($v) { if (-not $v) { return $null }; try { [datetime]$v } catch { $null } }
+    function FmtDate($d) {
+        if (-not $d) { return 'N/A' }
+        try { return ([datetime]$d).ToString('MMM d, yyyy, hh:mm tt', [Globalization.CultureInfo]::InvariantCulture) } catch { return "$d" }
+    }
+    function FmtSafelist($v) {
+        if (-not $v) { return 'unchanged' }
+        if ($v -is [array]) { $j = ($v -join ', '); if ($j) { return $j } else { return 'unchanged' } }
+        return "$v"
+    }
+    function CleanStr($v) { $t = "$v".Trim(); if ($t.Length -gt 0) { $t } else { $null } }
+    function JoinDetail { param([object[]]$Parts) (@($Parts | ForEach-Object { CleanStr $_ } | Where-Object { $_ })) -join ' - ' }
+    # one host is one source: audit addresses carry a per-connection port (mirrors the client hostIp)
+    function HostIp($v) {
+        $t = CleanStr $v
+        if (-not $t) { return $null }
+        ($t -replace '^(\d{1,3}(?:\.\d{1,3}){3}|\[[0-9a-fA-F:]+\]|[0-9a-fA-F:]+)(?::\d+)?$', '$1') -replace '[\[\]]', ''
+    }
+    function ListNames([object[]]$Names, [int]$Max = 3) {
+        $All = @($Names | Where-Object { $_ })
+        (@($All | Select-Object -First $Max) -join ', ') + $(if ($All.Count -gt $Max) { " and $($All.Count - $Max) more" } else { '' })
+    }
+    # plain-English counts for the statements a non-technical reader sees
+    function Plural([int]$N, [string]$One, [string]$Many) { if (-not $Many) { $Many = "${One}s" }; "$N $(if ($N -eq 1) { $One } else { $Many })" }
+
+    # analysis window: windowDays before extraction (mirrors becWindowStart)
+    $extractedAt = ToDate $bec.ExtractedAt
+    if (-not $extractedAt) { $extractedAt = Get-Date }
+    $windowStart = $extractedAt.AddDays(-$windowDays)
+
+    # -- statistics (mirrors the client stats object) --
+    $stats = @{
+        newRules                       = Cnt $bec.NewRules
+        ruleChanges                    = Cnt $bec.InboxRuleChanges
+        newUsers                       = Cnt $bec.NewUsers
+        newApps                        = Cnt $bec.AddedApps
+        permissionChanges              = Cnt $bec.MailboxPermissionChanges
+        permissionChangesTargetingUser = Cnt @($bec.MailboxPermissionChanges | Where-Object { $_.TargetsSuspect -eq $true })
+        mfaDevices                     = Cnt $bec.MFADevices
+        passwordChanges                = Cnt $bec.ChangedPasswords
+        sentMessages                   = Cnt $bec.SentMessages
+        trustedSenders                 = Cnt $bec.TrustedSenders
+        blockedSenders                 = Cnt $bec.BlockedSenders
+        safelistChanges                = Cnt $bec.SafelistChanges
+        sharingChanges                 = Cnt $bec.SharingChanges
+        anonymousLinks                 = Cnt @($bec.SharingChanges | Where-Object { "$($_.Operation)".StartsWith('AnonymousLink') })
+        intuneDevices                  = Cnt $bec.IntuneDevices
+        signIns                        = Cnt $bec.SuspectUserSignIns
+        sentTotalMessages              = AsInt $ana.TotalMessages
+        sentTotalRecipients            = AsInt $ana.TotalRecipients
+        repeatedSubjects               = AsInt $ana.FlaggedSubjectCount
+        sendBursts                     = Cnt $ana.Bursts
+        massMailFlagged                = ($ana.Flagged -eq $true)
+        maliciousApps                  = (Cnt @($bec.AddedApps | Where-Object { $_.MaliciousMatch })) + (Cnt $bec.MaliciousSPs)
+        foreignSignIns                 = AsInt $loc.ForeignSignInCount
+        foreignSuccessfulSignIns       = AsInt $loc.ForeignSuccessfulSignInCount
+        foreignSentMessages            = AsInt $loc.ForeignSentMessageCount
+    }
+    $stats.foreignActivity = (AsInt $loc.ForeignRuleChangeCount) + (AsInt $loc.ForeignSafelistChangeCount) +
+    (AsInt $loc.ForeignSharingChangeCount) + (AsInt $loc.ForeignSentMessageCount)
+    $stats.recentIntuneDevices = Cnt @($bec.IntuneDevices | Where-Object { $d = ToDate $_.enrolledDateTime; $d -and $d -ge $windowStart })
+    $stats.recentMfaDevices = Cnt @($bec.MFADevices | Where-Object { $d = ToDate $_.createdDateTime; $d -and $d -ge $windowStart })
+
+    # successful foreign sign-ins first
+    $foreignSignInList = @($bec.SuspectUserSignIns | Where-Object { $_.ForeignLocation -eq $true } |
+        Sort-Object -Property @{ Expression = { $_.Status -eq 'Success' }; Descending = $true })
+    $sortedIntune = @($bec.IntuneDevices | Sort-Object -Property @{ Expression = { $d = ToDate $_.enrolledDateTime; if ($d) { $d } else { [datetime]0 } }; Descending = $true })
+
+    # -- threat level (server-computed, read from the run's Score) --
+    $threatLevel = if ($bec.Score.Level) { "$($bec.Score.Level)" } else { 'Low' }
+    $threatValue = AsInt $bec.Score.Value
+    $threatColour = @{ High = '#742A2A'; Medium = '#744210'; Low = '#22543D' }[$threatLevel]
+    if (-not $threatColour) { $threatColour = '#22543D' }
+    $appliedSignals = @($bec.Score.Breakdown | Where-Object { $_.Applied })
+
+    # -- completeness (skipped / partial checks) --
+    $completeness = $bec.Completeness
+    $completenessEntries = if ($completeness) { @($completeness.PSObject.Properties) } else { @() }
+    $skippedCollectors = @($completenessEntries | Where-Object { $_.Value -and $_.Value.Skipped })
+    $incompleteCollectors = @($completenessEntries | Where-Object { $_.Value -and $_.Value.Complete -eq $false -and -not $_.Value.Skipped })
+
+    # -- flagged subsets used by the executive section and the deep checks --
+    $flaggedDelegations = @($bec.Delegations | Where-Object { $_.Flagged })
+    $flaggedGrants = @($bec.UserGrants | Where-Object { $_.Flagged })
+    $flaggedTransportChanges = @($bec.TransportRuleChanges | Where-Object { $_.Flagged })
+    $flaggedTransportRules = @($bec.TransportRulesFlagged)
+    $flaggedAddIns = @($bec.MailboxAddIns | Where-Object { $_.Flagged })
+    $receivedFindings = @($bec.ReceivedMailFindings)
+    $deliveredThreats = @($bec.DefenderDetections | Where-Object { $_.Delivered })
+    $flaggedAudits = @($bec.DirectoryAudits | Where-Object { $_.Flagged })
+    $recentRegisteredDevices = @($bec.RegisteredDevices | Where-Object { $_.RegisteredInWindow })
+    $foreignNonInteractive = @($bec.NonInteractiveSignIns | Where-Object { $_.ForeignLocation -eq $true -and $_.Status -eq 'Success' })
+    $mailActivitySummary = $bec.MailActivitySummary
+    $riskState = $bec.RiskState
+
+    # The attacker's addresses and what was done from them. Only an address judged the attacker's
+    # (Compromised or LikelyAttacker) counts toward a statement; a Suspicious one is listed in the
+    # detail for review, never asserted. The item lists are capped - the evidence export has them all.
+    $attackerVerdicts = @('Compromised', 'LikelyAttacker')
+    $ipVerdicts = @($bec.IPVerdicts | Where-Object { $_ -and $_.IP })
+    $verdictByIp = @{}
+    foreach ($v in $ipVerdicts) { $verdictByIp[(HostIp $v.IP)] = "$($v.Verdict)" }
+    $attackerIps = @($ipVerdicts | Where-Object { $_.Verdict -in $attackerVerdicts })
+    $reviewIps = @($ipVerdicts | Where-Object { $_.Verdict -in $attackerVerdicts -or $_.Verdict -eq 'Suspicious' })
+    $attackerCountries = @($attackerIps | ForEach-Object { $_.Country } | Where-Object { $_ } | Select-Object -Unique)
+    $attackerMail = @($bec.AttackerMailActivity | Where-Object { $_ -and $_.IPVerdict -in $attackerVerdicts })
+    $attackerFiles = @($bec.AttackerFileActivity | Where-Object { $_ -and $_.IPVerdict -in $attackerVerdicts })
+    $attackerForms = @($bec.FormsActivity | Where-Object { $_ -and $_.Flagged -eq $true -and $_.IPVerdict -in $attackerVerdicts })
+    $attackerFormIds = @($attackerForms | ForEach-Object { $_.FormId } | Where-Object { $_ } | Select-Object -Unique)
+    $attackerFormNames = @($attackerForms | ForEach-Object { $_.FormName } | Where-Object { $_ } | Select-Object -Unique)
+    $formsReach = @($bec.FormsSummary.Forms | Where-Object { $_ -and $_.FormId -in $attackerFormIds })
+    $formResponses = (@($formsReach | ForEach-Object { AsInt $_.Responses }) | Measure-Object -Sum).Sum
+    $blastRadius = @($bec.BlastRadius | Where-Object { $_ })
+    $reachedAccounts = @($blastRadius | Where-Object { $_.Reached -eq $true })
+    $delegatedReached = @($bec.DelegatedAccess | Where-Object { $_ -and $_.Flagged -eq $true })
+    $attackerTotals = @{
+        opened     = @($attackerMail | Where-Object { $_.Operation -eq 'MailItemsAccessed' -and $_.InternetMessageId } | ForEach-Object { $_.InternetMessageId } | Select-Object -Unique).Count
+        synced     = @($attackerMail | Where-Object { $_.Operation -eq 'MailItemsAccessed' -and $_.AccessType -eq 'Sync' } | ForEach-Object { "$($_.MailboxOwner)|$($_.Folder)" } | Select-Object -Unique).Count
+        sent       = @($attackerMail | Where-Object { $_.Operation -in @('Send', 'SendAs', 'SendOnBehalf') }).Count
+        deleted    = @($attackerMail | Where-Object { $_.Operation -in @('SoftDelete', 'HardDelete', 'MoveToDeletedItems') }).Count
+        files      = @($attackerFiles | ForEach-Object { if ($_.Url) { $_.Url } else { $_.File } } | Where-Object { $_ } | Select-Object -Unique).Count
+        downloaded = @($attackerFiles | Where-Object { $_.Operation -in @('FileDownloaded', 'FileSyncDownloadedFull') }).Count
+    }
+    $attackerDid = @(
+        if ($attackerTotals.opened) { "opened $(Plural $attackerTotals.opened 'email')" }
+        if ($attackerTotals.synced) { "copied $(Plural $attackerTotals.synced 'mail folder') to a desktop client" }
+        if ($attackerTotals.sent) { "sent $(Plural $attackerTotals.sent 'email')" }
+        if ($attackerTotals.deleted) { "deleted $(Plural $attackerTotals.deleted 'email')" }
+        if ($attackerTotals.files) { "opened $(Plural $attackerTotals.files 'file')$(if ($attackerTotals.downloaded) { " ($(Plural $attackerTotals.downloaded 'download'))" })" }
+    )
+    $attackerReach = @(
+        if ($reachedAccounts.Count) { "$(Plural $reachedAccounts.Count 'other account') signed into or used from the same addresses ($(ListNames @($reachedAccounts | ForEach-Object { $_.UserPrincipalName })))" }
+        if ($delegatedReached.Count) { "$(Plural $delegatedReached.Count 'other mailbox' 'other mailboxes') reached through this account's access ($(ListNames @($delegatedReached | ForEach-Object { $_.Mailbox })))" }
+        if ($attackerFormIds.Count) { "$(Plural $attackerFormIds.Count 'Microsoft Form') created from those addresses (a common phishing lure)$(if ($formResponses) { ", with $(Plural $formResponses 'response')" })" }
+    )
+    # the three strongest reasons behind a verdict, or the list/investigator that decided it
+    function VerdictWhy($v) {
+        if ($v.Source -and $v.Source -ne 'Heuristics') { return "$($v.Source)" }
+        (@($v.Reasons | Where-Object { (AsInt $_.Weight) -gt 0 } | Sort-Object -Property @{ Expression = { AsInt $_.Weight }; Descending = $true } -Stable | Select-Object -First 3 | ForEach-Object { $_.Text })) -join '; '
+    }
+
+    $forwardingAddress = if ($bec.MailboxState.ForwardingSmtpAddress) { "$($bec.MailboxState.ForwardingSmtpAddress)" } elseif ($bec.MailboxState.ForwardingAddress) { "$($bec.MailboxState.ForwardingAddress)" } else { $null }
+    $hasForwarding = [bool]($bec.MailboxState.HasForwarding -or $forwardingAddress)
+
+    $upn = $UserData.userPrincipalName
+    $usageLoc = $loc.UsageLocation
+
+    # ============================================================================================
+    # Findings by attacker objective (the same five-objective lens and flag predicates the case
+    # workspace uses - becFindingFlags / becGroupFlagged). Only the per-finding counts feed the bars.
+    # ============================================================================================
+    $flagCounts = @{
+        IPVerdicts               = $attackerIps.Count
+        AttackerMailActivity     = $attackerMail.Count
+        AttackerFileActivity     = $attackerFiles.Count
+        FormsActivity            = Cnt @($bec.FormsActivity | Where-Object { $_.Flagged -eq $true })
+        DelegatedAccess          = $delegatedReached.Count
+        BlastRadius              = $reachedAccounts.Count
+        SuspectUserSignIns       = AsInt $loc.ForeignSuccessfulSignInCount
+        NonInteractiveSignIns    = Cnt @($bec.NonInteractiveSignIns | Where-Object { $_.ForeignLocation -eq $true -and $_.Status -eq 'Success' })
+        MFADevices               = $stats.recentMfaDevices
+        RiskState                = $(if ($riskState.Listed) { 1 } else { 0 })
+        RegisteredDevices        = $recentRegisteredDevices.Count
+        IntuneDevices            = $stats.recentIntuneDevices
+        NewRules                 = Cnt @($bec.NewRules | Where-Object { $_.Suspicious -or (@($_.RiskReasons).Count -gt 0) })
+        Delegations              = $flaggedDelegations.Count
+        UserGrants               = $flaggedGrants.Count
+        MailboxAddIns            = $flaggedAddIns.Count
+        AddedApps                = (Cnt @($bec.AddedApps | Where-Object { $_.MaliciousMatch })) + (Cnt $bec.MaliciousSPs)
+        MailboxState             = @(if ($bec.MailboxState.HasForwarding) { 1 }; if ($bec.MailboxState.AutoReplyState -and $bec.MailboxState.AutoReplyState -ne 'Disabled') { 1 }).Count
+        TrustedSenders           = $stats.safelistChanges
+        TransportRuleChanges     = $flaggedTransportChanges.Count
+        MailboxPermissionChanges = $stats.permissionChangesTargetingUser
+        SentMessages             = $(if ($stats.massMailFlagged) { 1 } else { 0 })
+        SharingChanges           = $stats.anonymousLinks
+        MailActivity             = $(if ($mailActivitySummary.HardDeleteExceeded) { 1 } else { 0 })
+        ReceivedMailFindings     = $receivedFindings.Count + $deliveredThreats.Count
+        NewUsers                 = $stats.newUsers
+        DirectoryAudits          = $flaggedAudits.Count
+    }
+    $groupKeys = [ordered]@{
+        attacker    = @('IPVerdicts', 'AttackerMailActivity', 'AttackerFileActivity', 'FormsActivity', 'DelegatedAccess')
+        access      = @('SuspectUserSignIns', 'NonInteractiveSignIns', 'MFADevices', 'RiskState', 'RegisteredDevices', 'IntuneDevices')
+        persistence = @('NewRules', 'Delegations', 'UserGrants', 'MailboxAddIns', 'AddedApps')
+        mailflow    = @('MailboxState', 'TrustedSenders', 'TransportRuleChanges', 'MailboxPermissionChanges')
+        exfil       = @('SentMessages', 'SharingChanges', 'MailActivity', 'ReceivedMailFindings')
+        blast       = @('BlastRadius', 'PartnerActions', 'NewUsers', 'ChangedPasswords', 'DirectoryAudits')
+    }
+    $objectiveMeta = @{
+        attacker    = @{ label = 'Attacker IPs & activity'; colour = '#C53030' }
+        access      = @{ label = 'Access'; colour = '#3182CE' }
+        persistence = @{ label = 'Persistence'; colour = '#805AD5' }
+        mailflow    = @{ label = 'Mail flow'; colour = '#DD6B20' }
+        exfil       = @{ label = 'Exfiltration'; colour = '#E53E3E' }
+        blast       = @{ label = 'Blast radius'; colour = '#718096' }
+    }
+    $objectiveData = @(foreach ($id in $groupKeys.Keys) {
+            $sum = (@($groupKeys[$id] | ForEach-Object { AsInt $flagCounts[$_] }) | Measure-Object -Sum).Sum
+            @{ label = $objectiveMeta[$id].label; value = [int]$sum; colour = $objectiveMeta[$id].colour }
+        })
+    $totalFindings = (@($objectiveData | ForEach-Object { $_.value }) | Measure-Object -Sum).Sum
+    $objectiveMax = [Math]::Max((@($objectiveData | ForEach-Object { $_.value }) | Measure-Object -Maximum).Maximum, 1)
+
+    # ============================================================================================
+    # Results roll-up: every check as one row, flagged (with a high-risk sub-count) or clear.
+    # ============================================================================================
+    $summarySource = @(
+        @{ area = 'Attacker network addresses'; count = $attackerIps.Count; danger = @($attackerIps | Where-Object { (AsInt $_.SuccessfulSignIns) -gt 0 -or (AsInt $_.Activities) -gt 0 }).Count }
+        @{ area = 'Mail, files & forms touched by the attacker'; count = ($attackerMail.Count + $attackerFiles.Count + $attackerForms.Count); danger = $attackerFormIds.Count }
+        @{ area = 'Other accounts & mailboxes reached'; count = ($blastRadius.Count + $delegatedReached.Count); danger = $reachedAccounts.Count }
+        @{ area = 'Inbox rules & changes'; count = ($stats.newRules + $stats.ruleChanges) }
+        @{ area = 'Mailbox delegations'; count = $flaggedDelegations.Count }
+        @{ area = 'Application consents'; count = $flaggedGrants.Count; danger = $flaggedGrants.Count }
+        @{ area = 'New / rogue applications'; count = $stats.newApps; danger = $stats.maliciousApps }
+        @{ area = 'Mailbox permission changes'; count = $stats.permissionChanges }
+        @{ area = 'Transport rules'; count = ($flaggedTransportRules.Count + $flaggedTransportChanges.Count) }
+        @{ area = 'Mailbox add-ins'; count = $flaggedAddIns.Count }
+        @{ area = 'Forwarding & auto-reply'; count = $(if ($hasForwarding) { 1 } else { 0 }) }
+        @{ area = 'Trusted / blocked sender changes'; count = $stats.safelistChanges }
+        @{ area = 'Sent mail / mass-mail'; count = $(if ($stats.massMailFlagged) { 1 } else { 0 }) }
+        @{ area = 'Received phishing & threats'; count = ($receivedFindings.Count + $deliveredThreats.Count); danger = $deliveredThreats.Count }
+        @{ area = 'Sharing links'; count = $stats.sharingChanges; danger = $stats.anonymousLinks }
+        @{ area = 'MFA methods (new in window)'; count = $stats.recentMfaDevices }
+        @{ area = 'Registered devices (new in window)'; count = $recentRegisteredDevices.Count }
+        @{ area = 'Intune devices (new in window)'; count = $stats.recentIntuneDevices }
+        @{ area = 'Foreign successful sign-ins'; count = $stats.foreignSuccessfulSignIns; danger = $stats.foreignSuccessfulSignIns }
+        @{ area = 'Directory audit events'; count = $flaggedAudits.Count }
+        @{ area = 'Identity Protection risk'; count = $(if ($riskState.Listed) { 1 } else { 0 }) }
+    )
+    $summaryData = @($summarySource | ForEach-Object {
+            $danger = AsInt $_.danger
+            $flagged = AsInt $_.count
+            $result = if ($danger -gt 0) { "$flagged flagged - $danger high-risk" } elseif ($flagged -gt 0) { "$flagged flagged" } else { 'Clear' }
+            $tone = if ($danger -gt 0) { 'fail' } elseif ($flagged -gt 0) { 'warn' } else { 'pass' }
+            @{ area = $_.area; result = $result; tone = $tone }
+        })
+    $flaggedAreaCount = @($summaryData | Where-Object { $_.result -ne 'Clear' }).Count
+
+    # ============================================================================================
+    # Priority remediation actions, written from what was actually found (mirrors tailoredActions).
+    # ============================================================================================
+    $isHighOrMed = ($threatLevel -eq 'High' -or $threatLevel -eq 'Medium')
+    $ruleNames = (@($bec.NewRules | ForEach-Object { $_.Name } | Where-Object { $_ } | Select-Object -First 3)) -join ', '
+    $rogueAppNames = (@(
+            @($bec.AddedApps | Where-Object { $_.MaliciousMatch } | ForEach-Object { if ($_.DisplayName) { $_.DisplayName } else { $_.AppId } })
+            @($bec.MaliciousSPs | ForEach-Object { if ($_.DisplayName) { $_.DisplayName } else { $_.AppId } })
+        ) | Where-Object { $_ } | Select-Object -First 3) -join ', '
+    $consentNames = (@($flaggedGrants | ForEach-Object { if ($_.ClientDisplayName) { $_.ClientDisplayName } else { $_.ClientAppId } } | Where-Object { $_ } | Select-Object -First 3)) -join ', '
+
+    $tailoredActions = @(
+        if ($isHighOrMed) { @{ ids = @('ResetPassword', 'RevokeSessions'); tag = 'Critical'; text = "Reset $(if ($upn) { $upn } else { 'the user' })'s password and revoke all active sessions to cut off any current attacker access." } }
+        if ($threatLevel -eq 'High') { @{ ids = @('DisableAccount'); tag = 'Critical'; text = 'Block sign-in for the account until the mailbox and identity are confirmed clean.' } }
+        if ($reachedAccounts.Count -gt 0) { @{ tag = 'Critical'; text = "Secure the $($reachedAccounts.Count) other account(s) reached from the attacker's addresses ($(ListNames @($reachedAccounts | ForEach-Object { $_.UserPrincipalName }))): reset, revoke sessions and investigate each one." } }
+        if ($flaggedGrants.Count -gt 0 -or $stats.maliciousApps -gt 0) {
+            $names = if ($consentNames) { $consentNames } elseif ($rogueAppNames) { $rogueAppNames } else { '' }
+            @{ ids = @('RemoveOAuthGrants'); tag = 'Critical'; text = "Revoke $($flaggedGrants.Count + $stats.maliciousApps) risky application consent(s)$(if ($names) { " ($names)" }) - consent survives a password reset." }
+        }
+        if ($stats.maliciousApps -gt 0) { @{ ids = @('DisableServicePrincipals'); tag = 'Critical'; text = "Disable the catalog-matched rogue application(s)$(if ($rogueAppNames) { " ($rogueAppNames)" }) tenant-wide." } }
+        if ($attackerIps.Count -gt 0) { @{ tag = 'High'; text = "Block the $($attackerIps.Count) attacker address(es) ($(ListNames @($attackerIps | ForEach-Object { $_.IP }))) tenant-wide so they cannot be used against any other account." } }
+        if ($attackerFormIds.Count -gt 0) { @{ tag = 'High'; text = "Remove the $($attackerFormIds.Count) Microsoft Form(s) built from the attacker's addresses$(if ($attackerFormNames.Count) { " ($(ListNames $attackerFormNames))" }) and warn anyone who responded: confirm phishing and delete each one from its Microsoft Defender alert, or, after the password reset, delete it in Microsoft Forms as the account." } }
+        if ($delegatedReached.Count -gt 0) { @{ tag = 'High'; text = "Check the $($delegatedReached.Count) other mailbox(es) reached through this account ($(ListNames @($delegatedReached | ForEach-Object { $_.Mailbox }))) for rules, forwarding and sent mail." } }
+        if ($stats.newRules -gt 0 -or $stats.ruleChanges -gt 0) { @{ ids = @('DisableInboxRules'); tag = 'High'; text = "Disable the $($stats.newRules + $stats.ruleChanges) suspicious inbox rule(s)/change(s)$(if ($ruleNames) { " ($ruleNames)" }) that hide replies or auto-forward mail." } }
+        if ($hasForwarding) { @{ ids = @('ClearForwarding'); tag = 'High'; text = "Clear mailbox forwarding$(if ($forwardingAddress) { " to $forwardingAddress" }), which silently copies mail out of the tenant." } }
+        if ($flaggedDelegations.Count -gt 0) { @{ ids = @('RemoveDelegations'); tag = 'High'; text = "Remove $($flaggedDelegations.Count) flagged mailbox delegation(s) - a delegate keeps access after a reset." } }
+        if ($stats.anonymousLinks -gt 0 -or $stats.sharingChanges -gt 0) { @{ ids = @('RemoveSharingLinks'); tag = 'High'; text = "Remove the $($stats.sharingChanges) sharing-link change(s)$(if ($stats.anonymousLinks) { ", including $($stats.anonymousLinks) 'anyone' link(s)" }) and disable OneDrive sharing - anonymous links expose data past any reset." } }
+        if ($stats.massMailFlagged) { @{ tag = 'High'; text = "The mailbox sent a mass-mail campaign ($($stats.sentTotalMessages) message(s) to $($stats.sentTotalRecipients) recipient(s)). Scope the wave and warn recipients before anything is purged." } }
+        if ($stats.foreignSuccessfulSignIns -gt 0) { @{ tag = 'High'; text = "$($stats.foreignSuccessfulSignIns) successful sign-in(s) from outside the assigned usage location confirm access - treat the account as compromised." } }
+        if (($flaggedTransportRules.Count + $flaggedTransportChanges.Count) -gt 0) { @{ ids = @('DisableTransportRules'); tag = 'High'; text = "Review and disable $($flaggedTransportRules.Count + $flaggedTransportChanges.Count) tenant transport rule(s) changed in the window - these affect every mailbox." } }
+        if ($stats.recentMfaDevices -gt 0) { @{ ids = @('RemoveMFA'); tag = 'Medium'; text = "Remove $($stats.recentMfaDevices) MFA method(s) registered during the window, then re-register trusted ones." } }
+        if ($recentRegisteredDevices.Count -gt 0) { @{ ids = @('DisableRegisteredDevices|RemoveRegisteredDevices'); tag = 'Medium'; text = "Disable $($recentRegisteredDevices.Count) device(s) registered during the window so they cannot satisfy device-based Conditional Access." } }
+        if ($stats.safelistChanges -gt 0) { @{ tag = 'Medium'; text = "Review $($stats.safelistChanges) trusted-sender / safelist change(s) that would let an attacker's future mail skip filtering." } }
+        if ($flaggedAddIns.Count -gt 0) { @{ ids = @('DisableMailboxAddIns'); tag = 'Medium'; text = "Disable $($flaggedAddIns.Count) flagged mailbox add-in(s)." } }
+    )
+    $priorityActions = if ($tailoredActions.Count -gt 0) { $tailoredActions } else {
+        @(@{ tag = 'Monitor'; text = 'No specific indicators require remediation. Continue monitoring the account for 30 days and keep MFA enforced as a precaution.' })
+    }
+    # Containment already run, by action id: when it last completed. The latest run that included an
+    # action decides - completed only when none of its results in that run was an error.
+    $completedAt = @{}
+    foreach ($entry in @($bec.Run.Containment | Where-Object { $_ } | Sort-Object -Property { ToDate $_.At })) {
+        foreach ($group in @($entry.Results | Where-Object { $_ -and $_.Action } | Group-Object -Property { "$($_.Action)" })) {
+            $failed = @($group.Group | Where-Object { "$($_.state)" -eq 'error' }).Count -gt 0
+            $completedAt[$group.Name] = if ($failed) { $null } else { ToDate $entry.At }
+        }
+    }
+    # when every id an action needs ('A|B' = either) has completed, the latest of those times
+    function CompletedAt([string[]]$Ids) {
+        if (-not $Ids) { return $null }
+        $times = foreach ($id in $Ids) {
+            $at = @($id -split '\|' | ForEach-Object { $completedAt[$_] } | Where-Object { $_ } | Sort-Object -Descending)[0]
+            if (-not $at) { return $null }
+            $at
+        }
+        @($times | Sort-Object -Descending)[0]
+    }
+    $priorityRows = @($priorityActions | ForEach-Object {
+            $tone = switch ($_.tag) { 'Critical' { 'fail' } 'High' { 'fail' } 'Medium' { 'warn' } default { 'pass' } }
+            # The C-suite summary says which actions are already done instead of listing every result;
+            # the full report keeps the action list as is and the detailed Remediation Taken table.
+            $done = if ($isSummary) { CompletedAt $_.ids } else { $null }
+            @{ tag = $_.tag; text = $(if ($done) { "$($_.text)`nCompleted $(FmtDate $done)" } else { $_.text }); tone = $tone }
+        })
+
+    # -- impact findings (the plain-terms outcome; mirrors impactFindings) --
+    $impactFindings = @(
+        if ($stats.foreignSuccessfulSignIns -gt 0 -or $foreignNonInteractive.Count -gt 0) { "Unauthorized access is confirmed - $($stats.foreignSuccessfulSignIns + $foreignNonInteractive.Count) successful sign-in(s) came from outside the account's assigned location." }
+        if ($attackerIps.Count -gt 0) { "$(Plural $attackerIps.Count 'network address' 'network addresses')$(if ($attackerCountries.Count) { " in $(ListNames $attackerCountries)" }) $(if ($attackerIps.Count -eq 1) { 'was' } else { 'were' }) identified as the attacker's$(if ($attackerDid.Count) { "; from there the attacker $(ListNames $attackerDid 5)" })." }
+        if ($attackerReach.Count -gt 0) { "The attack reached beyond this account: $(ListNames $attackerReach 3)." }
+        if ($riskState.Listed) { "Microsoft Identity Protection currently flags this account as at risk$(if ($riskState.RiskLevel) { " ($($riskState.RiskLevel) risk)" })." }
+        if ($hasForwarding) { "Incoming mail is being copied out of the organization$(if ($forwardingAddress) { " to $forwardingAddress" }), so the attacker keeps reading it even after a reset." }
+        if ($stats.newRules -gt 0 -or $stats.ruleChanges -gt 0) { "$($stats.newRules + $stats.ruleChanges) inbox rule(s) or change(s) hide, delete or redirect the user's mail." }
+        if ($stats.anonymousLinks -gt 0) { "$($stats.anonymousLinks) `"anyone with the link`" sharing link(s) expose files to anyone holding the URL, past any later reset." }
+        if ($stats.massMailFlagged) { "The mailbox sent a mass-mail wave - $($stats.sentTotalMessages) message(s) to $($stats.sentTotalRecipients) recipient(s) - so it is now being used to attack others." }
+        if ($flaggedGrants.Count -gt 0 -or $stats.maliciousApps -gt 0) { "$($flaggedGrants.Count + $stats.maliciousApps) risky application consent(s) or app(s) retain access to data independently of the password." }
+        if ($stats.recentMfaDevices -gt 0 -or $recentRegisteredDevices.Count -gt 0) { "New sign-in persistence was added - $($stats.recentMfaDevices) MFA method(s) and $($recentRegisteredDevices.Count) device(s) registered during the window." }
+        if ($flaggedDelegations.Count -gt 0) { "$($flaggedDelegations.Count) mailbox delegation(s) let another account read this mailbox." }
+    )
+
+    # ============================================================================================
+    # Order of events - the correlated timeline (mirrors buildBecTimeline), collapsed per minute.
+    # ============================================================================================
+    $partnerKinds = @('Partner', 'OtherPartner', 'CIPP')
+    $rawEvents = [System.Collections.Generic.List[object]]::new()
+    # foreign sign-ins, and sign-ins from an address judged the attacker's even when it is at home
+    foreach ($s in @($bec.SuspectUserSignIns | Where-Object { $_ -and ($_.ForeignLocation -eq $true -or (($SignInIp = HostIp (@($_.IPAddress, $_.ipAddress, $_.ClientIP) | Where-Object { $_ } | Select-Object -First 1)) -and $verdictByIp[$SignInIp] -in $attackerVerdicts)) })) {
+        $rawEvents.Add(@{
+                date     = ToDate (@($s.CreatedDateTime, $s.createdDateTime, $s.Timestamp) | Where-Object { $_ } | Select-Object -First 1)
+                label    = "Sign-in $(if ($s.Status -eq 'Success') { 'success' } else { "($(if ($s.Status) { $s.Status } else { 'attempt' }))" })"
+                ip       = HostIp (@($s.IPAddress, $s.ClientIP) | Where-Object { $_ } | Select-Object -First 1)
+                app      = CleanStr (@($s.AppDisplayName, $s.ClientAppUsed) | Where-Object { $_ } | Select-Object -First 1)
+                location = CleanStr ((@($s.City, $s.Country) | Where-Object { $_ }) -join ', ')
+            })
+    }
+    foreach ($a in @($bec.DirectoryAudits | Where-Object { $_.Flagged })) {
+        $rawEvents.Add(@{
+                date    = ToDate $a.ActivityDateTime
+                label   = if ($a.Activity) { "$($a.Activity)" } else { 'Directory change' }
+                ip      = HostIp $a.ClientIP
+                actor   = CleanStr (@($a.ActorResolved, $a.InitiatedBy) | Where-Object { $_ } | Select-Object -First 1)
+                partner = ($partnerKinds -contains "$($a.ActorKind)")
+            })
+    }
+    foreach ($c in @($bec.InboxRuleChanges)) {
+        $rawEvents.Add(@{
+                date    = ToDate $c.Date
+                label   = if ($c.Operation) { "$($c.Operation)" } else { 'Inbox rule change' }
+                ip      = HostIp $c.ClientIP
+                target  = CleanStr $c.RuleName
+                foreign = ($c.ForeignLocation -eq $true)
+                partner = ($partnerKinds -contains "$($c.ActorKind)")
+            })
+    }
+    foreach ($c in @($bec.MailboxPermissionChanges)) {
+        $rawEvents.Add(@{
+                date           = ToDate $c.Date
+                label          = if ($c.Operation) { "$($c.Operation)" } else { 'Mailbox permission change' }
+                ip             = HostIp $c.ClientIP
+                targetsSuspect = [bool]$c.TargetsSuspect
+                partner        = ($partnerKinds -contains "$($c.ActorKind)")
+            })
+    }
+    foreach ($c in @($bec.SafelistChanges)) {
+        $rawEvents.Add(@{
+                date    = ToDate $c.Date
+                label   = if ($c.Operation) { "$($c.Operation)" } else { 'Safelist change' }
+                ip      = HostIp $c.ClientIP
+                partner = ($partnerKinds -contains "$($c.ActorKind)")
+            })
+    }
+    foreach ($c in @($bec.SharingChanges)) {
+        $rawEvents.Add(@{
+                date    = ToDate $c.Date
+                label   = if ($c.Operation) { "$($c.Operation)" } else { 'Sharing change' }
+                ip      = HostIp $c.ClientIP
+                target  = CleanStr $c.FileName
+                partner = ($partnerKinds -contains "$($c.ActorKind)")
+            })
+    }
+    # Sent mail: one event each for a handful, else folded into one event per hour and source IP.
+    $sentMsgs = @($bec.SentMessages)
+    if ($sentMsgs.Count -le 25) {
+        foreach ($m in $sentMsgs) {
+            $rawEvents.Add(@{
+                    date      = ToDate $m.Received
+                    label     = 'Sent mail'
+                    ip        = HostIp $m.FromIP
+                    target    = CleanStr $m.Subject
+                    recipient = CleanStr $m.RecipientAddress
+                })
+        }
+    } else {
+        $buckets = @{}
+        foreach ($m in $sentMsgs) {
+            $d = ToDate $m.Received
+            if (-not $d) { continue }
+            $hour = $d.Date.AddHours($d.Hour)
+            $ip = HostIp $m.FromIP
+            $key = '{0:o}|{1}' -f $hour, $ip
+            if (-not $buckets.ContainsKey($key)) { $buckets[$key] = @{ date = $hour; ip = $ip; rows = [System.Collections.Generic.List[object]]::new() } }
+            $buckets[$key].rows.Add($m)
+        }
+        foreach ($bucket in $buckets.Values) {
+            $rows = @($bucket.rows)
+            $emails = (@($rows | ForEach-Object { $_.MessageTraceId } | Where-Object { $_ } | Select-Object -Unique)).Count
+            if ($emails -eq 0) { $emails = $rows.Count }
+            $recipients = (@($rows | ForEach-Object { CleanStr $_.RecipientAddress } | Where-Object { $_ } | Select-Object -Unique)).Count
+            $subjectGroups = $rows | Group-Object -Property { $s = CleanStr $_.Subject; if ($s) { $s } else { '(no subject)' } } | Sort-Object -Property Count -Descending
+            $topSubject = ($subjectGroups | Select-Object -First 1).Name
+            $rawEvents.Add(@{
+                    date  = $bucket.date
+                    label = "$emails email$(if ($emails -eq 1) { '' } else { 's' }) sent"
+                    ip    = $bucket.ip
+                    target = JoinDetail @("to $recipients recipient$(if ($recipients -eq 1) { '' } else { 's' })", $(if ($topSubject) { "`"$topSubject`"" }))
+                })
+        }
+    }
+    foreach ($f in @($bec.ReceivedMailFindings)) {
+        $rawEvents.Add(@{
+                date   = ToDate $f.Received
+                label  = "Received: $(if ($f.FindingType) { $f.FindingType } else { 'finding' })"
+                target = CleanStr $f.Subject
+                sender = CleanStr $f.SenderAddress
+            })
+    }
+    foreach ($t in @($bec.DefenderDetections | Where-Object { $_.Delivered })) {
+        $rawEvents.Add(@{
+                date   = ToDate $t.ReceivedDateTime
+                label  = 'Threat delivered'
+                target = CleanStr $t.Subject
+                sender = CleanStr $t.SenderAddress
+            })
+    }
+    foreach ($u in @($bec.NewUsers)) {
+        $rawEvents.Add(@{ date = ToDate $u.createdDateTime; label = 'User created'; target = CleanStr $u.displayName })
+    }
+    foreach ($m in @($bec.MFADevices | Where-Object { $d = ToDate $_.createdDateTime; $d -and $d -ge $windowStart })) {
+        $rawEvents.Add(@{ date = ToDate $m.createdDateTime; label = 'MFA method registered'; target = ("$($m.'@odata.type')" -replace '#microsoft\.graph\.', '') })
+    }
+    foreach ($dev in @($bec.RegisteredDevices | Where-Object { $_.RegisteredInWindow })) {
+        $rawEvents.Add(@{ date = ToDate (@($dev.registrationDateTime, $dev.createdDateTime) | Where-Object { $_ } | Select-Object -First 1); label = 'Device registered'; target = CleanStr (@($dev.displayName, $dev.deviceId) | Where-Object { $_ } | Select-Object -First 1) })
+    }
+    foreach ($dev in @($bec.IntuneDevices | Where-Object { $d = ToDate $_.enrolledDateTime; $d -and $d -ge $windowStart })) {
+        $rawEvents.Add(@{ date = ToDate $dev.enrolledDateTime; label = 'Intune device enrolled'; target = CleanStr (@($dev.deviceName, $dev.model) | Where-Object { $_ } | Select-Object -First 1) })
+    }
+    foreach ($u in @($bec.ChangedPasswords)) {
+        $rawEvents.Add(@{ date = ToDate $u.lastPasswordChangeDateTime; label = 'Password changed'; target = CleanStr (@($u.displayName, $u.userPrincipalName) | Where-Object { $_ } | Select-Object -First 1) })
+    }
+
+    # What the attacker-side addresses did, folded to one event per hour, address and kind of action -
+    # a mailbox sync or a scripted download is hundreds of rows that would bury everything else.
+    $mailVerb = @{
+        MailItemsAccessed = 'message(s) opened'; AttachmentAccess = 'attachment(s) read'; SoftDelete = 'item(s) deleted'
+        HardDelete = 'item(s) purged'; MoveToDeletedItems = 'item(s) deleted'; Move = 'item(s) moved'; Send = 'message(s) sent'
+        SendAs = 'message(s) sent as another mailbox'; SendOnBehalf = 'message(s) sent on behalf'; SearchQueryInitiatedExchange = 'mailbox search(es)'
+    }
+    $fileVerb = @{
+        FileDownloaded = 'file(s) downloaded'; FileSyncDownloadedFull = 'file(s) synced down'; FileAccessed = 'file(s) opened'
+        FilePreviewed = 'file(s) previewed'; FileUploaded = 'file(s) uploaded'; FileDeleted = 'file(s) deleted'; FileRecycled = 'file(s) deleted'
+        SearchQueryPerformed = 'SharePoint search(es)'
+    }
+    function TopOf($Rows, [string]$Field) {
+        (@($Rows | ForEach-Object { CleanStr $_.$Field } | Where-Object { $_ }) | Group-Object | Sort-Object -Property Count -Descending -Stable | Select-Object -First 1).Name
+    }
+    function FoldActivity($Rows, [scriptblock]$KeyOf) {
+        $buckets = [ordered]@{}
+        foreach ($row in @($Rows | Where-Object { $_ })) {
+            $d = ToDate $row.When
+            if (-not $d) { continue }
+            $u = $d.ToUniversalTime()
+            $ip = HostIp $row.IP
+            $key = '{0:yyyyMMddHH}|{1}|{2}' -f $u, $ip, (& $KeyOf $row)
+            if (-not $buckets.Contains($key)) { $buckets[$key] = @{ date = $d; ip = $ip; rows = [System.Collections.Generic.List[object]]::new() } }
+            $buckets[$key].rows.Add($row)
+        }
+        @($buckets.Values)
+    }
+    foreach ($bucket in (FoldActivity $bec.AttackerMailActivity { param($row) "$($row.Operation)|$(if ($row.AccessType -eq 'Sync') { 'sync' })" })) {
+        $first = $bucket.rows[0]
+        $n = $bucket.rows.Count
+        if ($first.AccessType -eq 'Sync') {
+            $rawEvents.Add(@{ date = $bucket.date; ip = $bucket.ip; label = "$n folder(s) synced to a desktop client"; target = (TopOf $bucket.rows 'Folder') })
+        } else {
+            $verb = if ($mailVerb[[string]$first.Operation]) { $mailVerb[[string]$first.Operation] } else { "$($first.Operation) event(s)" }
+            $target = TopOf $bucket.rows 'Subject'
+            if (-not $target) { $target = TopOf $bucket.rows 'Folder' }
+            $rawEvents.Add(@{ date = $bucket.date; ip = $bucket.ip; label = "$n $verb"; target = $target })
+        }
+    }
+    foreach ($bucket in (FoldActivity $bec.AttackerFileActivity { param($row) "$($row.Operation)" })) {
+        $first = $bucket.rows[0]
+        $verb = if ($fileVerb[[string]$first.Operation]) { $fileVerb[[string]$first.Operation] } else { "$($first.Operation) event(s)" }
+        $rawEvents.Add(@{ date = $bucket.date; ip = $bucket.ip; label = "$($bucket.rows.Count) $verb"; target = (TopOf $bucket.rows 'File') })
+    }
+    foreach ($f in @($bec.FormsActivity | Where-Object { $_.Flagged -eq $true })) {
+        $rawEvents.Add(@{ date = ToDate $f.When; ip = HostIp $f.IP; label = "Form: $($f.Operation)"; target = CleanStr $f.FormName })
+    }
+
+    $sortedEvents = @($rawEvents | Where-Object { $_.date } | Sort-Object -Property date)
+    $timelineEvents = [System.Collections.Generic.List[object]]::new()
+    $prev = $null
+    foreach ($e in $sortedEvents) {
+        $detail = JoinDetail @(
+            $e.location, $e.app, $e.actor, $e.target,
+            $(if ($e.recipient) { "to $($e.recipient)" }),
+            $e.sender,
+            $(if ($e.foreign) { 'foreign' }),
+            $(if ($e.partner) { 'partner action' }),
+            $(if ($e.targetsSuspect) { 'targets this mailbox' }),
+            $e.ip
+        )
+        $minute = $e.date.ToUniversalTime().ToString('yyyy-MM-ddTHH:mm')
+        if ($prev -and $prev.minute -eq $minute -and $prev.label -eq $e.label -and $prev.detail -eq $detail) {
+            $prev.count++
+            continue
+        }
+        $prev = @{ minute = $minute; label = $e.label; detail = $detail; date = $e.date; count = 1 }
+        $timelineEvents.Add($prev)
+    }
+    $timelineRows = @($timelineEvents | ForEach-Object {
+            @{ when = (FmtDate $_.date); event = $(if ($_.count -gt 1) { "$($_.label) (x$($_.count))" } else { $_.label }); detail = $_.detail }
+        })
+
+    # -- remediation already run (from the run's stored containment history) --
+    $remediationRows = @(@($bec.Run.Containment) | Where-Object { $_ } | Sort-Object -Property { ToDate $_.At } -Descending | ForEach-Object {
+            $entry = $_
+            foreach ($row in @($entry.Results)) {
+                $state = "$($row.state)"
+                $tone = switch ($state) { 'success' { 'pass' } 'error' { 'fail' } 'warning' { 'warn' } default { '' } }
+                @{
+                    when   = (FmtDate $entry.At)
+                    action = (("$($row.Action)" -replace '([a-z0-9])([A-Z])', '$1 $2').Trim())
+                    target = "$($row.Target)"
+                    result = "$($row.resultText)"
+                    state  = $state
+                    tone   = $tone
+                }
+            }
+        })
+
+    $b = [System.Collections.Generic.List[object]]::new()
+
+    # === PAGE 1: EXECUTIVE SUMMARY ===
+    $b.Add((New-CippReportPage -Title 'Executive Summary' -Subtitle 'Overview of Business Email Compromise investigation findings'))
+    $b.Add((New-CippReportParagraph -Html ('<p>This report documents the findings of a Business Email Compromise (BEC) investigation performed for the user account <b>{0}</b> within <b>{1}</b>. The investigation analyzed suspicious activity indicators including mailbox rules, permission changes, new applications, authentication patterns, and sign-in locations over a {2}-day period.</p>' -f [System.Net.WebUtility]::HtmlEncode([string]$upn), [System.Net.WebUtility]::HtmlEncode([string]$TenantName), $windowDays)))
+    $b.Add((New-CippReportParagraph -Text 'Business Email Compromise is a sophisticated scam targeting organizations that regularly perform wire transfers or have established relationships with foreign suppliers. Attackers compromise legitimate email accounts through social engineering or computer intrusion techniques to conduct unauthorized fund transfers, steal sensitive information, or impersonate executives.'))
+
+    $b.Add((New-CippReportHeading -Title 'Investigation Overview'))
+    $b.Add((New-CippReportStatRow -Stats @(
+                @{ value = $stats.newRules; label = 'Mailbox Rules' }
+                @{ value = $stats.permissionChanges; label = 'Permission Changes' }
+                @{ value = $stats.foreignSignIns; label = 'Foreign Sign-ins' }
+                @{ value = $stats.maliciousApps; label = 'Malicious Apps' }
+            )))
+    $threatText = switch ($threatLevel) {
+        'High' { 'HIGH RISK: Multiple indicators of compromise detected. Immediate remediation actions are strongly recommended. This account shows patterns consistent with active Business Email Compromise attacks.' }
+        'Medium' { 'MEDIUM RISK: Suspicious activity patterns detected. Review findings and consider implementing recommended security measures. Some indicators suggest potential unauthorized access.' }
+        default { 'LOW RISK: Minimal suspicious activity detected. The findings show standard user behavior with no significant indicators of compromise. Continue monitoring as a precautionary measure.' }
+    }
+    $b.Add((New-CippReportAlertBox -Colour $threatColour -Title "Threat Assessment: $threatLevel (score $threatValue)" -Content $threatText))
+    if ($appliedSignals.Count -gt 0) {
+        $b.Add((New-CippReportInfoBox -Lines -Title 'Signals that contributed to the score' -Content ((@($appliedSignals | ForEach-Object { "+$(AsInt $_.Weight) $($_.Description) ($(AsInt $_.Count))" })) -join "`n")))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'What We Found'))
+    if ($impactFindings.Count -gt 0) {
+        $b.Add((New-CippReportParagraph -Html ('<p>In plain terms, this is what the investigation established about <b>{0}</b>:</p>' -f [System.Net.WebUtility]::HtmlEncode([string]$upn))))
+        $b.Add((New-CippReportBullets -Items @($impactFindings | ForEach-Object { @{ text = $_ } })))
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No indicators of account compromise' -Content "None of the investigation's checks returned evidence that this account was accessed, altered or misused during the analysis window."))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Findings at a Glance'))
+    $b.Add((New-CippReportParagraph -Text ("Every check in this investigation and its result. $(if (-not $isSummary) { 'Flagged rows are expanded in the detailed findings later in this report. ' })$flaggedAreaCount of $($summaryData.Count) checks returned something to review.")))
+    if ($totalFindings -gt 0) {
+        $b.Add((New-CippReportParagraph -Html '<p><b>Findings by attacker objective</b> - grouped by what each finding would let an attacker do:</p>'))
+        $b.Add((New-CippReportProgress -Items @($objectiveData | ForEach-Object { @{ label = $_.label; value = $_.value; max = $objectiveMax; display = "$($_.value)"; colour = $_.colour } })))
+    }
+    $b.Add((New-CippReportTable -Columns @(
+                @{ header = 'Check'; key = 'area'; width = 3; bold = $true }
+                @{ header = 'Result'; key = 'result'; width = 2; toneField = 'tone' }
+            ) -Rows @($summaryData) -Limit $summaryData.Count))
+    if (-not $isSummary) {
+        $b.Add((New-CippReportNote -Text 'Checks that could not run (missing a licence, permission, mailbox or service) are itemised under Data Source Information below - a check that did not run is not a pass.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Priority Remediation Actions'))
+    $b.Add((New-CippReportParagraph -Text ("Actions specific to what this investigation found, most urgent first. Your IT or security team should carry these out without delay$(if (-not $isSummary) { '; the strategic and preventative measures follow later in this report.' } else { '.' })")))
+    $b.Add((New-CippReportTable -Columns @(
+                @{ header = 'Priority'; key = 'tag'; width = 1; toneField = 'tone' }
+                @{ header = 'Action'; key = 'text'; width = 5 }
+            ) -Rows @($priorityRows) -Limit $priorityRows.Count))
+
+    $b.Add((New-CippReportHeading -Title 'Order of Events'))
+    if ($timelineRows.Count -gt 0) {
+        $b.Add((New-CippReportParagraph -Text 'Every timestamped signal - sign-ins, directory and mailbox changes, sharing, and the mail itself - in the order it happened, with who and where where known. Read it as the shape of the intrusion over time, not as isolated findings.'))
+        $b.Add((New-CippReportTable -Columns @(
+                    @{ header = 'When'; key = 'when'; width = 2; bold = $true }
+                    @{ header = 'Event'; key = 'event'; width = 2 }
+                    @{ header = 'Detail'; key = 'detail'; width = 3 }
+                ) -Rows @($timelineRows) -Limit 40))
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No timestamped events in the window' -Content 'None of the checks returned a dated event inside the analysis window. This usually means no changes were made to the account in the period, not that data was missing.'))
+    }
+
+    if ($remediationRows.Count -gt 0 -and -not $isSummary) {
+        $b.Add((New-CippReportHeading -Title 'Remediation Taken'))
+        $b.Add((New-CippReportParagraph -Text 'The containment actions already run for this account during the investigation, and their result for each target.'))
+        $b.Add((New-CippReportTable -Columns @(
+                    @{ header = 'When'; key = 'when'; width = 2; bold = $true }
+                    @{ header = 'Action'; key = 'action'; width = 2 }
+                    @{ header = 'Target'; key = 'target'; width = 2 }
+                    @{ header = 'Result'; key = 'result'; width = 3 }
+                    @{ header = 'State'; key = 'state'; width = 1; toneField = 'tone' }
+                ) -Rows @($remediationRows) -Limit $remediationRows.Count))
+    }
+
+    # Data Source Information and every detail page (Understanding BEC, Checks 1-21, Recommendations,
+    # Compliance) are the full report only; the summary variant stops after the executive lead.
+    if (-not $isSummary) {
+    $b.Add((New-CippReportHeading -Title 'Data Source Information'))
+    $b.Add((New-CippReportInfoBox -Title 'Audit Log Status' -Content $(if ($bec.ExtractResult) { "$($bec.ExtractResult)" } else { 'Unknown' })))
+    $b.Add((New-CippReportInfoBox -Title 'Analysis Period' -Content ("Last $windowDays days ending {0}" -f (FmtDate $bec.ExtractedAt))))
+    if ($bec.Run.CaseId -or $bec.CaseId) {
+        $caseId = if ($bec.Run.CaseId) { $bec.Run.CaseId } else { $bec.CaseId }
+        $b.Add((New-CippReportInfoBox -Title 'Case' -Content "$caseId - full investigation. Metadata only: audit records, sign-ins, trace headers, permissions, rules and devices were collected; no message content was read."))
+    }
+    if ($skippedCollectors.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Lines -Title "[!] $($skippedCollectors.Count) check(s) could not run (not applicable to this tenant or user)" -Content ((@($skippedCollectors | ForEach-Object { "$($_.Name): $(if ($_.Value.Requirement) { $_.Value.Requirement } elseif ($_.Value.Error) { $_.Value.Error } else { 'not checked' })" })) -join "`n")))
+    }
+    if ($incompleteCollectors.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Lines -Title "[!] $($incompleteCollectors.Count) check(s) returned partial data" -Content ((@($incompleteCollectors | ForEach-Object { "$($_.Name): $(if ($_.Value.Error) { $_.Value.Error } else { "capped at $($_.Value.Cap)" })" })) -join "`n")))
+    }
+    $b.Add((New-CippReportInfoBox -Title 'Assigned Usage Location' -Content $(if ($usageLoc) { "$usageLoc" } else { 'Not assigned - sign-ins and activity could not be compared against an expected country' })))
+
+    # === ATTACKER ADDRESSES & ACTIVITY - capped lists; the evidence export has every row ===
+    if ($ipVerdicts.Count -gt 0) {
+        $b.Add((New-CippReportPage -Title 'Attacker Addresses & Activity' -Subtitle 'Where the attacker connected from, and what was done from there'))
+        $b.Add((New-CippReportHeading -Title 'Attacker and Suspicious Addresses'))
+        $b.Add((New-CippReportParagraph -Text "Every address seen on this account was judged from the user's sign-in history, network and location, the IP allow and block lists, and the other accounts using it. Addresses judged the attacker's drive the findings below; suspicious ones are listed for review only."))
+        if ($reviewIps.Count -gt 0) {
+            $b.Add((New-CippReportTable -Columns @(
+                        @{ header = 'Address'; key = 'ip'; width = 2; bold = $true }
+                        @{ header = 'Verdict'; key = 'verdict'; width = 2; toneField = 'tone' }
+                        @{ header = 'Location'; key = 'location'; width = 2 }
+                        @{ header = 'Sign-ins'; key = 'signIns'; width = 1 }
+                        @{ header = 'Why'; key = 'why'; width = 4 }
+                    ) -Rows @($reviewIps | ForEach-Object {
+                        $place = (@($_.City, $_.Country) | Where-Object { $_ }) -join ', '
+                        @{
+                            ip       = "$($_.IP)"
+                            verdict  = ("$($_.Verdict)" -creplace '([a-z])([A-Z])', '$1 $2')
+                            tone     = $(if ($_.Verdict -in $attackerVerdicts) { 'fail' } else { 'warn' })
+                            location = $(if ($place) { $place } else { 'Unknown' })
+                            signIns  = "$(AsInt $_.SuccessfulSignIns) ok / $(AsInt $_.FailedSignIns) failed"
+                            why      = (VerdictWhy $_)
+                        }
+                    }) -Limit 15))
+        } else {
+            $b.Add((New-CippReportClearBox -Title "[Pass] No address was judged the attacker's" -Content "None of the $($ipVerdicts.Count) address(es) seen on this account was judged to be the attacker's or suspicious."))
+        }
+
+        if (($attackerMail.Count + $attackerFiles.Count) -gt 0) {
+            $b.Add((New-CippReportHeading -Title "What Was Done From the Attacker's Addresses"))
+            $b.Add((New-CippReportStatRow -Stats @(
+                        @{ value = "$($attackerTotals.opened)"; label = 'Emails Opened' }
+                        @{ value = "$($attackerTotals.sent)"; label = 'Emails Sent' }
+                        @{ value = "$($attackerTotals.deleted)"; label = 'Emails Deleted' }
+                        @{ value = "$($attackerTotals.files)"; label = 'Files Opened' }
+                    )))
+            if ($attackerMail.Count -gt 0) {
+                $b.Add((New-CippReportTable -Columns @(
+                            @{ header = 'When'; key = 'when'; width = 2; bold = $true }
+                            @{ header = 'Action'; key = 'action'; width = 2 }
+                            @{ header = 'Mailbox'; key = 'mailbox'; width = 2 }
+                            @{ header = 'Item'; key = 'item'; width = 4 }
+                        ) -Rows @($attackerMail | ForEach-Object {
+                            @{
+                                when    = (FmtDate $_.When)
+                                action  = $(if ($_.AccessType) { "$($_.Operation) ($($_.AccessType))" } else { "$($_.Operation)" })
+                                mailbox = $(if (-not $_.MailboxOwner -or "$($_.MailboxOwner)" -ieq "$upn") { 'This mailbox' } else { "$($_.MailboxOwner)" })
+                                item    = "$(@($_.Subject, $_.Folder, $_.Detail) | Where-Object { $_ } | Select-Object -First 1)"
+                            }
+                        }) -Limit 10))
+            }
+            if ($attackerFiles.Count -gt 0) {
+                $b.Add((New-CippReportTable -Columns @(
+                            @{ header = 'When'; key = 'when'; width = 2; bold = $true }
+                            @{ header = 'Action'; key = 'action'; width = 2 }
+                            @{ header = 'File'; key = 'file'; width = 3 }
+                            @{ header = 'Site'; key = 'site'; width = 3 }
+                        ) -Rows @($attackerFiles | ForEach-Object {
+                            @{ when = (FmtDate $_.When); action = "$($_.Operation)"; file = $(if ($_.File) { "$($_.File)" } else { "$($_.Url)" }); site = "$($_.Site)" }
+                        }) -Limit 10))
+            }
+            $b.Add((New-CippReportNote -Text "The first items of each kind are shown; the complete item list is in the case's evidence export."))
+        }
+
+        if ($blastRadius.Count -gt 0) {
+            $b.Add((New-CippReportHeading -Title 'Other Accounts Reached'))
+            $b.Add((New-CippReportParagraph -Text "Accounts elsewhere in the organization that signed in or acted from the attacker's addresses. A successful sign-in or any recorded action means the account was reached; failed sign-ins alone are an attempt."))
+            $b.Add((New-CippReportTable -Columns @(
+                        @{ header = 'Account'; key = 'account'; width = 3; bold = $true }
+                        @{ header = 'Status'; key = 'status'; width = 1; toneField = 'tone' }
+                        @{ header = 'Sign-ins'; key = 'signIns'; width = 2 }
+                        @{ header = 'Actions'; key = 'operations'; width = 3 }
+                        @{ header = 'Last seen'; key = 'lastSeen'; width = 2 }
+                    ) -Rows @($blastRadius | ForEach-Object {
+                        @{
+                            account    = "$($_.UserPrincipalName)"
+                            status     = $(if ($_.Reached -eq $true) { 'Reached' } else { 'Attempted' })
+                            tone       = $(if ($_.Reached -eq $true) { 'fail' } else { 'warn' })
+                            signIns    = "$(AsInt $_.SuccessfulSignIns) ok / $(AsInt $_.FailedSignIns) failed"
+                            operations = $(if ($_.Operations) { "$($_.Operations)" } else { '-' })
+                            lastSeen   = (FmtDate $_.LastSeen)
+                        }
+                    }) -Limit 15))
+        }
+
+        if ($delegatedReached.Count -gt 0) {
+            $b.Add((New-CippReportHeading -Title 'Other Mailboxes Reached Through This Account'))
+            $b.Add((New-CippReportTable -Columns @(
+                        @{ header = 'Mailbox'; key = 'mailbox'; width = 3; bold = $true }
+                        @{ header = 'Access'; key = 'access'; width = 3 }
+                        @{ header = 'Opened'; key = 'opened'; width = 1 }
+                        @{ header = 'Synced'; key = 'synced'; width = 1 }
+                        @{ header = 'Sent'; key = 'sent'; width = 1 }
+                    ) -Rows @($delegatedReached | ForEach-Object {
+                        @{ mailbox = "$($_.Mailbox)"; access = "$($_.AccessRights)"; opened = "$(AsInt $_.AttackerOpened)"; synced = "$(AsInt $_.AttackerSynced)"; sent = "$(AsInt $_.AttackerSent)" }
+                    }) -Limit 10))
+        }
+
+        if ($attackerFormIds.Count -gt 0) {
+            $b.Add((New-CippReportHeading -Title "Microsoft Forms From the Attacker's Addresses"))
+            $b.Add((New-CippReportParagraph -Text "Forms built or shared from the attacker's addresses, and how far they reached. A form asking for a password is a phishing page hosted on Microsoft's own domain. No API removes a single form: confirm phishing and delete it from its Microsoft Defender alert, or, after the password reset, delete it in Microsoft Forms as the account."))
+            $formRows = if ($formsReach.Count -gt 0) {
+                @($formsReach | ForEach-Object {
+                        @{ name = $(if ($_.FormName) { "$($_.FormName)" } else { "$($_.FormId)" }); responses = "$(AsInt $_.Responses)"; anonymous = "$(AsInt $_.AnonymousResponses)"; views = "$(AsInt $_.Views)"; flagged = $(if ($_.PhishingFlagged -eq $true) { 'Yes' } else { 'No' }) }
+                    })
+            } else {
+                @($attackerFormNames | ForEach-Object { @{ name = "$_"; responses = '-'; anonymous = '-'; views = '-'; flagged = '-' } })
+            }
+            $b.Add((New-CippReportTable -Columns @(
+                        @{ header = 'Form'; key = 'name'; width = 4; bold = $true }
+                        @{ header = 'Responses'; key = 'responses'; width = 1 }
+                        @{ header = 'Anonymous'; key = 'anonymous'; width = 1 }
+                        @{ header = 'Views'; key = 'views'; width = 1 }
+                        @{ header = 'Phishing flag'; key = 'flagged'; width = 2 }
+                    ) -Rows @($formRows) -Limit 10))
+        }
+    }
+
+    # === PAGE 2: UNDERSTANDING BEC ===
+    $b.Add((New-CippReportPage -Title 'Understanding Business Email Compromise' -Subtitle 'What is BEC and why does it matter?'))
+    $b.Add((New-CippReportParagraph -Title 'What is Business Email Compromise?' -Text 'Business Email Compromise (BEC) is a type of cyberattack where criminals gain unauthorized access to a business email account. Once inside, attackers can:'))
+    $b.Add((New-CippReportBullets -Items @(
+                @{ label = 'Monitor communications:'; text = 'Read sensitive emails to learn about business operations, financial processes, and key relationships.' }
+                @{ label = 'Impersonate executives:'; text = 'Send fraudulent emails appearing to come from company leadership requesting wire transfers or sensitive data.' }
+                @{ label = 'Manipulate transactions:'; text = 'Intercept legitimate invoices and alter payment information to redirect funds to attacker-controlled accounts.' }
+                @{ label = 'Hide their tracks:'; text = 'Create email rules to automatically delete or hide messages, preventing detection.' }
+            )))
+    $b.Add((New-CippReportParagraph -Title 'Common Attack Methods' -Text 'Attackers typically gain access to email accounts through:'))
+    $b.Add((New-CippReportBullets -Items @(
+                @{ label = 'Phishing:'; text = 'Deceptive emails that trick users into providing their login credentials on fake websites.' }
+                @{ label = 'Password Spraying:'; text = 'Automated attempts to log in using common passwords across many accounts.' }
+                @{ label = 'Credential Stuffing:'; text = 'Using usernames and passwords leaked from other breached websites.' }
+                @{ label = 'Malware:'; text = 'Software that captures keystrokes or steals stored passwords from compromised devices.' }
+            )))
+    $b.Add((New-CippReportParagraph -Title 'Why This Investigation Was Performed' -Text 'This analysis was initiated because suspicious activity was detected or reported for this user account. The investigation examines multiple indicators that might suggest account compromise, including unusual mailbox rules, unexpected permission changes, new application authorizations, and abnormal sign-in patterns. Early detection is critical to minimize potential damage and prevent financial loss or data theft.'))
+
+    # === PAGE 3: DETAILED FINDINGS - Check 1 ===
+    $b.Add((New-CippReportPage -Title 'Detailed Findings' -Subtitle 'Investigation results and analysis'))
+    $b.Add((New-CippReportHeading -Title 'Check 1: Mailbox Rules'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Attackers often create email rules to automatically forward, delete, or hide messages so victims never see evidence of fraudulent activity. A rule is flagged when it forwards or redirects mail (especially to an external address), deletes messages, moves them to a low-visibility folder (RSS, Archive, Deleted Items), stops processing other rules, targets financial keywords, or takes any of these actions on all incoming mail with no condition.'))
+    if ($stats.newRules -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($stats.newRules) Mailbox Rule(s) Found" -Content 'The following mailbox rules were detected. Review each rule carefully to determine if it was created by the user or by an attacker. Rules that forward emails or move them to unusual folders are particularly suspicious.'))
+        foreach ($rule in @($bec.NewRules | Select-Object -First 10)) {
+            $lines = @(
+                if ($rule.MoveToFolder) { "Moves mail to: $($rule.MoveToFolder)" }
+                if ($rule.ForwardTo) { "Forwards to: $($rule.ForwardTo)" }
+                if ($rule.ForwardAsAttachmentTo) { "Forwards as attachment to: $($rule.ForwardAsAttachmentTo)" }
+                if ($rule.RedirectTo) { "Redirects to: $($rule.RedirectTo)" }
+                if ($rule.DeleteMessage) { 'Deletes messages' }
+                if ($rule.MarkAsRead) { 'Marks messages read' }
+                if ($rule.StopProcessingRules) { 'Stops processing further rules' }
+                if ($rule.SubjectContainsWords) { "On subject words: $(if ($rule.SubjectContainsWords -is [array]) { $rule.SubjectContainsWords -join ', ' } else { $rule.SubjectContainsWords })" }
+                if ($rule.RecentlyChanged) { 'Created or changed in the window' }
+                if ($rule.Enabled -eq $false) { 'Currently disabled' }
+            )
+            $content = if ($lines.Count -gt 0) { $lines -join "`n" } elseif ($rule.Description) { "$($rule.Description)" } else { 'No actions recorded on this rule' }
+            $b.Add((New-CippReportInfoBox -Lines -Title "Rule: $(if ($rule.Name) { $rule.Name } else { 'Unnamed Rule' })" -Content $content))
+        }
+        if ($stats.newRules -gt 10) { $b.Add((New-CippReportNote -Text "... and $($stats.newRules - 10) more rules (in the retained investigation record)")) }
+    }
+    if ($stats.ruleChanges -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($stats.ruleChanges) Rule Change(s) in the Last $windowDays Days" -Content 'The audit log recorded inbox rules being created, changed or removed on this mailbox. Rules that were removed after use are a common way for attackers to cover their tracks.'))
+        foreach ($change in @($bec.InboxRuleChanges | Select-Object -First 10)) {
+            $lines = @(
+                "Date: $(if ($change.Date) { $change.Date } else { 'Unknown' })"
+                "By: $(if ($change.UserKey) { $change.UserKey } else { 'Unknown' })"
+                if ($change.ClientIP) { "From: $($change.ClientIP)$(if ($change.Country) { " ($($change.Country))" })" }
+                if ($change.ForeignLocation -eq $true) { '[!] Originated outside the assigned usage location' }
+                if ($change.Parameters) { "Parameters: $($change.Parameters)" }
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($change.Operation) { $change.Operation } else { 'Rule Change' }): $(if ($change.RuleName) { $change.RuleName } else { 'Unnamed Rule' })" -Content ($lines -join "`n")))
+        }
+        if ($stats.ruleChanges -gt 10) { $b.Add((New-CippReportNote -Text "... and $($stats.ruleChanges - 10) more changes (see the retained investigation record for the full list)")) }
+    }
+    if ($stats.newRules -eq 0 -and $stats.ruleChanges -eq 0) {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Suspicious Rules Found' -Content 'No mailbox rules were detected that match suspicious patterns. This is a positive indicator.'))
+    }
+
+    # === PAGE 4: DETAILED FINDINGS (Continued) - Check 2, 3 ===
+    $b.Add((New-CippReportPage -Title 'Detailed Findings (Continued)' -Subtitle 'Investigation results and analysis'))
+    $b.Add((New-CippReportHeading -Title 'Check 2: Recently Created Users'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Attackers sometimes create new user accounts to maintain persistent access or to use as staging accounts for fraudulent activities. Reviewing recently created users helps identify unauthorized account creation.'))
+    if ($stats.newUsers -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[i] $($stats.newUsers) New User(s) Found" -Content "The following users were created in the last $windowDays days. Verify that each account creation was authorized and legitimate."))
+        foreach ($u in @($bec.NewUsers | Select-Object -First 8)) {
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($u.displayName) { $u.displayName } else { 'Unknown' })" -Content ("Email: $(if ($u.userPrincipalName) { $u.userPrincipalName } else { 'N/A' })`nCreated: $(FmtDate $u.createdDateTime)")))
+        }
+        if ($stats.newUsers -gt 8) { $b.Add((New-CippReportNote -Text "... and $($stats.newUsers - 8) more users (see the retained investigation record for the full list)")) }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No New Users Found' -Content 'No new user accounts were created during the analysis period.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 3: New Applications'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content "Attackers may authorize malicious or suspicious third-party applications to access your email and data. These applications can read emails, send messages, and access files without the user's explicit knowledge."))
+    if ($stats.maliciousApps -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($stats.maliciousApps) Known-Malicious Application(s) Detected" -Content 'One or more applications in this tenant match the CIPP known-malicious application catalog. Consent-based access survives a password reset, so these applications should be removed unless their presence is explained.'))
+    }
+    if ($stats.newApps -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($stats.newApps) New Application(s) Found" -Content 'New applications were granted access during the analysis period. Review each application to ensure it was authorized and is from a trusted publisher.'))
+        foreach ($app in @($bec.AddedApps | Select-Object -First 6)) {
+            $lines = @(
+                "Publisher: $(if ($app.publisher) { $app.publisher } else { 'Unknown' })"
+                "App ID: $(if ($app.appId) { $app.appId } else { 'N/A' })"
+                "Created: $(FmtDate $app.createdDateTime)"
+                if ($app.MaliciousMatch) {
+                    $cats = if ($app.MaliciousMatch.Categories) { " ($($app.MaliciousMatch.Categories -join ', '))" } else { '' }
+                    "[!] Matches known-malicious catalog entry `"$($app.MaliciousMatch.Name)`"$cats"
+                }
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($app.displayName) { $app.displayName } elseif ($app.appDisplayName) { $app.appDisplayName } else { 'Unknown' })" -Content ($lines -join "`n")))
+        }
+        if ($stats.newApps -gt 6) { $b.Add((New-CippReportNote -Text "... and $($stats.newApps - 6) more apps (see the retained investigation record for the full list)")) }
+    } elseif ((Cnt $bec.MaliciousSPs) -eq 0) {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No New Applications Found' -Content 'No new applications were authorized during the analysis period, and no known malicious applications are present in the tenant.'))
+    }
+    if ((Cnt $bec.MaliciousSPs) -gt 0) {
+        foreach ($app in @($bec.MaliciousSPs | Select-Object -First 6)) {
+            $lines = @(
+                "Catalog entry: $(if ($app.CatalogName) { $app.CatalogName } else { 'Unknown' })"
+                "App ID: $(if ($app.appId) { $app.appId } else { 'N/A' })"
+                "Categories: $(if ($app.Categories) { $app.Categories -join ', ' } else { 'N/A' })"
+                "Enabled: $(if ($null -ne $app.accountEnabled) { $app.accountEnabled } else { 'Unknown' })"
+                "First seen: $(FmtDate $app.createdDateTime)"
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "[!] $(if ($app.displayName) { $app.displayName } else { 'Unknown' }) (present in tenant)" -Content ($lines -join "`n")))
+        }
+        if ((Cnt $bec.MaliciousSPs) -gt 6) { $b.Add((New-CippReportNote -Text "... and $((Cnt $bec.MaliciousSPs) - 6) more (see the retained investigation record for the full list)")) }
+    }
+
+    # === PAGE 5: ADDITIONAL SECURITY CHECKS - Check 4,5,6,7 ===
+    $b.Add((New-CippReportPage -Title 'Additional Security Checks' -Subtitle 'Permissions, outbound mail, authentication, and access patterns'))
+    $b.Add((New-CippReportHeading -Title 'Check 4: Mailbox Permission Changes'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Unauthorized changes to mailbox permissions can allow attackers to grant themselves or accomplices access to read, send, or manage emails. This is a common technique to maintain persistent access.'))
+    if ($stats.permissionChanges -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($stats.permissionChanges) Permission Change(s) Found" -Content 'Mailbox permission changes were detected. Verify that each change was authorized and necessary for legitimate business purposes.'))
+        foreach ($change in @($bec.MailboxPermissionChanges | Select-Object -First 5)) {
+            $lines = @(
+                "User: $(if ($change.UserKey) { $change.UserKey } else { 'Unknown' })"
+                "Target: $(if ($change.ObjectId) { $change.ObjectId } else { 'N/A' })"
+                "Permissions: $(if ($change.Permissions) { $change.Permissions } else { 'Unknown' })"
+                if ($change.TargetsSuspect -eq $true) { '[!] Targets the investigated mailbox' }
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($change.Operation) { $change.Operation } else { 'Permission Change' })" -Content ($lines -join "`n")))
+        }
+        if ($stats.permissionChanges -gt 5) { $b.Add((New-CippReportNote -Text "... and $($stats.permissionChanges - 5) more changes")) }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Permission Changes Found' -Content 'No mailbox permission changes were detected during the analysis period.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 5: Sent Messages'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Attackers use a compromised mailbox to send fraudulent invoices, phishing, or internal impersonation mail. The message trace shows what actually left the mailbox during the analysis period, including the IP address it was sent from.'))
+    if ($stats.sentMessages -gt 0) {
+        $totMsg = if ($stats.sentTotalMessages) { $stats.sentTotalMessages } else { $stats.sentMessages }
+        $totRcp = if ($stats.sentTotalRecipients) { $stats.sentTotalRecipients } else { $stats.sentMessages }
+        $foreignTail = if ($stats.foreignSentMessages -gt 0) { ", including $($stats.foreignSentMessages) from an IP outside the user's assigned usage location." } else { '.' }
+        $b.Add((New-CippReportParagraph -Indent -Text "[i] $totMsg message(s) to $totRcp recipient(s) were sent by this mailbox during the analysis period$foreignTail"))
+        if ($stats.massMailFlagged) {
+            $mm = -join @(
+                if ($stats.repeatedSubjects -gt 0) { "$($stats.repeatedSubjects) subject(s) were sent as many separate messages or to many recipients. " }
+                if ($stats.sendBursts -gt 0) { "$($stats.sendBursts) short burst(s) of high-volume sending were detected. " }
+                'Identical-subject mass mail and send bursts are how a compromised mailbox spreads phishing or fraudulent invoices. Review the campaigns below and warn the recipients if the content was malicious.'
+            )
+            $b.Add((New-CippReportAlertBox -Title '[!] Mass-Mail Pattern Detected' -Content $mm))
+        }
+        foreach ($g in @($ana.RepeatedSubjects | Select-Object -First 5)) {
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($g.Flagged) { '[!] ' })Repeated subject: $(if ($g.Subject) { $g.Subject } else { '(no subject)' })" -Content ("Messages: $($g.MessageCount)`nRecipients: $($g.RecipientCount)`nFirst sent: $(if ($g.FirstSent) { $g.FirstSent } else { 'N/A' })`nLast sent: $(if ($g.LastSent) { $g.LastSent } else { 'N/A' })")))
+        }
+        if ((Cnt $ana.RepeatedSubjects) -gt 5) { $b.Add((New-CippReportNote -Text "... and $((Cnt $ana.RepeatedSubjects) - 5) more repeated subjects (see the retained investigation record for the full list)")) }
+        foreach ($burst in @($ana.Bursts | Select-Object -First 5)) {
+            $win = if ($burst.WindowMinutes) { $burst.WindowMinutes } else { 10 }
+            $content = @(
+                "Starting: $(if ($burst.WindowStart) { $burst.WindowStart } else { 'N/A' })"
+                if ($burst.TopSubject) { "Most common subject: $($burst.TopSubject)" }
+            ) -join "`n"
+            $b.Add((New-CippReportInfoBox -Lines -Title "[!] Send burst: $($burst.MessageCount) message(s) to $($burst.RecipientCount) recipient(s) in $win minutes" -Content $content))
+        }
+        if ((Cnt $ana.Bursts) -gt 5) { $b.Add((New-CippReportNote -Text "... and $((Cnt $ana.Bursts) - 5) more bursts (see the retained investigation record for the full list)")) }
+        foreach ($msg in @($bec.SentMessages | Select-Object -First 10)) {
+            $lines = @(
+                "To: $(if ($msg.RecipientAddress) { $msg.RecipientAddress } else { 'N/A' })"
+                "Status: $(if ($msg.Status) { $msg.Status } else { 'N/A' })"
+                "Received: $(if ($msg.Received) { $msg.Received } else { 'N/A' })"
+                if ($msg.FromIP) { "From IP: $($msg.FromIP)$(if ($msg.Country) { " ($($msg.Country))" })" }
+                if ($msg.ForeignLocation -eq $true) { '[!] Sent from outside the assigned usage location' }
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($msg.Subject) { $msg.Subject } else { '(no subject)' })" -Content ($lines -join "`n")))
+        }
+        if ($stats.sentMessages -gt 10) { $b.Add((New-CippReportNote -Text "... and $($stats.sentMessages - 10) more messages (see the retained investigation record for the full list)")) }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Sent Messages Found' -Content 'No messages were sent by this mailbox during the analysis period.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 6: MFA Devices'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Multi-factor authentication (MFA) devices provide an additional layer of security. Reviewing registered MFA methods helps identify if attackers have added unauthorized devices to bypass security controls.'))
+    if ($stats.mfaDevices -gt 0) {
+        $mfaTail = if ($stats.recentMfaDevices -gt 0) { ", including $($stats.recentMfaDevices) registered in the last $windowDays days. Verify the recent registrations were made by the user - attackers register their own method to keep access after a password reset." } else { '. Verify each device belongs to the user.' }
+        $b.Add((New-CippReportParagraph -Indent -Text "[i] $($stats.mfaDevices) MFA device(s) registered$mfaTail"))
+        $sortedMfa = @($bec.MFADevices | Sort-Object -Property @{ Expression = { $d = ToDate $_.createdDateTime; if ($d) { $d } else { [datetime]0 } }; Descending = $true } | Select-Object -First 5)
+        foreach ($device in $sortedMfa) {
+            $type = "$($device.'@odata.type')".Replace('#microsoft.graph.', '').Replace('AuthenticationMethod', '')
+            $lines = @(
+                "Display Name: $(if ($device.displayName) { $device.displayName } else { 'N/A' })"
+                "Registered: $(FmtDate $device.createdDateTime)"
+                $(if (($d = ToDate $device.createdDateTime) -and $d -ge $windowStart) { '[!] Registered in the last 7 days' })
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($type) { $type } else { 'Unknown' })" -Content ($lines -join "`n")))
+        }
+        if ($stats.mfaDevices -gt 5) { $b.Add((New-CippReportNote -Text "... and $($stats.mfaDevices - 5) more methods (see the retained investigation record for the full list)")) }
+    } else {
+        $b.Add((New-CippReportInfoBox -Tone warn -Title '[!] No MFA Devices Found' -Content 'No multi-factor authentication devices are registered. MFA is highly recommended to prevent unauthorized access.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 7: Recent Password Changes'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content "Attackers often change passwords to lock out legitimate users. Reviewing recent password changes in the tenant helps identify if the compromised account's password was changed or if other accounts were affected."))
+    if ($stats.passwordChanges -gt 0) {
+        $b.Add((New-CippReportParagraph -Indent -Text "[i] $($stats.passwordChanges) password change(s) detected in the tenant during the analysis period."))
+        foreach ($u in @($bec.ChangedPasswords | Select-Object -First 5)) {
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($u.displayName) { $u.displayName } else { 'Unknown' })" -Content ("Email: $(if ($u.userPrincipalName) { $u.userPrincipalName } else { 'N/A' })`nLast Password Change: $(FmtDate $u.lastPasswordChangeDateTime)")))
+        }
+        if ($stats.passwordChanges -gt 5) { $b.Add((New-CippReportNote -Text "... and $($stats.passwordChanges - 5) more (see the retained investigation record for the full list)")) }
+    } else {
+        $b.Add((New-CippReportParagraph -Indent -Text '[i] No password changes detected during the analysis period.'))
+    }
+
+    # === PAGE 6: MAILBOX LISTS, DEVICES & LOCATIONS - Check 8,9,10,11 ===
+    $b.Add((New-CippReportPage -Title 'Mailbox Lists, Devices & Locations' -Subtitle 'Sender lists, managed devices, and sign-in origins'))
+    $b.Add((New-CippReportHeading -Title 'Check 8: Trusted & Blocked Senders'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Attackers may add their own domain to the Trusted Senders list so their fraudulent messages bypass spam filtering, or add finance/security domains to the Blocked Senders list so warnings and alerts are hidden from the victim in the Junk Email folder.'))
+    if ($bec.SafelistError) {
+        $b.Add((New-CippReportAlertBox -Lines -Title '[!] Could Not Retrieve Sender Lists' -Content ("$($bec.SafelistError)`nAn empty list here does not mean the mailbox has no trusted or blocked senders.")))
+    }
+    if ($stats.safelistChanges -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($stats.safelistChanges) Safelist Change(s) in the Last $windowDays Days" -Content 'The audit log recorded changes to the Trusted/Blocked Senders and Domains list on this mailbox. Review each change carefully.'))
+        foreach ($change in @($bec.SafelistChanges | Select-Object -First 10)) {
+            $lines = @(
+                "Date: $(FmtDate $change.Date)"
+                if ($change.ClientIP) { "From: $($change.ClientIP)$(if ($change.Country) { " ($($change.Country))" })" }
+                if ($change.ForeignLocation -eq $true) { '[!] Originated outside the assigned usage location' }
+                "Trusted: $(FmtSafelist $change.Trusted)"
+                "Blocked: $(FmtSafelist $change.Blocked)"
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($change.Operation) { $change.Operation } else { 'Safelist Change' }) by $(if ($change.UserKey) { $change.UserKey } else { 'Unknown' })" -Content ($lines -join "`n")))
+        }
+        if ($stats.safelistChanges -gt 10) { $b.Add((New-CippReportNote -Text "... and $($stats.safelistChanges - 10) more changes (see the retained investigation record for the full list)")) }
+    }
+    if ($stats.trustedSenders -gt 0) {
+        $b.Add((New-CippReportInfoBox -Title "Trusted Senders/Domains ($($stats.trustedSenders))" -Content (@($bec.TrustedSenders | Select-Object -First 15) -join ', ')))
+    }
+    if ($stats.trustedSenders -gt 15) { $b.Add((New-CippReportNote -Text "... and $($stats.trustedSenders - 15) more trusted entries (see the retained investigation record for the full list)")) }
+    if ($stats.blockedSenders -gt 0) {
+        $b.Add((New-CippReportInfoBox -Title "Blocked Senders/Domains ($($stats.blockedSenders))" -Content (@($bec.BlockedSenders | Select-Object -First 15) -join ', ')))
+    }
+    if ($stats.blockedSenders -gt 15) { $b.Add((New-CippReportNote -Text "... and $($stats.blockedSenders - 15) more blocked entries (see the retained investigation record for the full list)")) }
+    if (-not $bec.SafelistError -and $stats.trustedSenders -eq 0 -and $stats.blockedSenders -eq 0 -and $stats.safelistChanges -eq 0) {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Trusted or Blocked Senders Found' -Content 'No trusted or blocked sender/domain entries were found on this mailbox.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 9: Intune Devices'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Newly enrolled Intune devices can indicate an attacker standing up a VM or BYOD endpoint under the compromised identity, including paths that re-register Windows Hello for Business. Review devices enrolled during the analysis window first.'))
+    if ($completeness.IntuneDevices.Skipped) {
+        $b.Add((New-CippReportAlertBox -Lines -Title '[!] Intune Not Checked' -Content $(if ($completeness.IntuneDevices.Requirement) { "Not checked - $($completeness.IntuneDevices.Requirement). This is not a pass; the result is unknown." } else { "$($completeness.IntuneDevices.Error)" })))
+    } elseif ($bec.IntuneDevicesError) {
+        $b.Add((New-CippReportAlertBox -Lines -Title '[!] Could Not Retrieve Intune Devices' -Content ("$(if ($completeness.IntuneDevices.Error) { $completeness.IntuneDevices.Error } else { $bec.IntuneDevicesError })`nAn empty device list here does not mean the user has no Intune devices.")))
+    } elseif ($stats.intuneDevices -gt 0) {
+        $intuneTail = if ($stats.recentIntuneDevices -gt 0) { ", including $($stats.recentIntuneDevices) enrolled in the last $windowDays days." } else { ". None were enrolled in the last $windowDays days." }
+        $b.Add((New-CippReportParagraph -Indent -Text "[i] $($stats.intuneDevices) Intune-managed device(s) associated with this user$intuneTail"))
+        foreach ($device in @($sortedIntune | Select-Object -First 5)) {
+            $lines = @(
+                "OS: $(if ($device.operatingSystem) { $device.operatingSystem } else { 'N/A' })$(if ($device.osVersion) { " $($device.osVersion)" })"
+                "Enrolled: $(FmtDate $device.enrolledDateTime)"
+                "Compliance: $(if ($device.complianceState) { $device.complianceState } else { 'N/A' })"
+                "Enrollment Type: $(if ($device.deviceEnrollmentType) { $device.deviceEnrollmentType } else { 'N/A' })"
+                if ($device.serialNumber) { "Serial: $($device.serialNumber)" }
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($device.deviceName) { $device.deviceName } else { 'Unknown device' })" -Content ($lines -join "`n")))
+        }
+        if ((Cnt $sortedIntune) -gt 5) { $b.Add((New-CippReportNote -Text "... and $((Cnt $sortedIntune) - 5) more devices (see the retained investigation record for the full list)")) }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Intune Devices Found' -Content 'No Intune-managed devices were found for this user.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 10: Sign-in Locations'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content ("Sign-ins from countries the user does not work from are one of the strongest compromise indicators. Each sign-in is compared against the user's assigned usage location in Entra ID$(if ($usageLoc) { " ($usageLoc)" }), and the client IPs behind rule changes, safelist changes, sharing changes, and sent mail are geo-located and compared the same way.")))
+    if ($bec.SuspectUserSignInsError) {
+        $b.Add((New-CippReportAlertBox -Lines -Title '[!] Could Not Retrieve Sign-in Logs' -Content ("$($bec.SuspectUserSignInsError)`nAn empty list here does not mean the user has not signed in.")))
+    } else {
+        if (-not $usageLoc) {
+            $b.Add((New-CippReportInfoBox -Tone warn -Title '[!] No Usage Location Assigned' -Content $(if ($loc.Note) { "$($loc.Note)" } else { 'The user has no usage location assigned in Entra ID, so activity cannot be compared against an expected country.' })))
+        }
+        if ((Cnt $loc.SignInCountries) -gt 0) {
+            $b.Add((New-CippReportInfoBox -Lines -Title "Sign-in Countries Observed (last $($stats.signIns) sign-ins)" -Content ((@($loc.SignInCountries | ForEach-Object { "$($_.Country): $($_.Count) sign-in(s)" })) -join "`n")))
+        }
+        if ($stats.foreignSignIns -gt 0 -or $stats.foreignActivity -gt 0) {
+            $b.Add((New-CippReportAlertBox -Title '[!] Activity Outside the Assigned Usage Location' -Content ("$($stats.foreignSignIns) sign-in(s) (of which $($stats.foreignSuccessfulSignIns) succeeded), $(AsInt $loc.ForeignRuleChangeCount) inbox rule change(s), $(AsInt $loc.ForeignSafelistChangeCount) safelist change(s), $(AsInt $loc.ForeignSharingChangeCount) sharing change(s), and $(AsInt $loc.ForeignSentMessageCount) sent message(s) originated outside $usageLoc. Failed foreign sign-ins are mostly password-spray noise; the successful ones prove access. Review each carefully - a single legitimate trip can explain some of this, but rule, safelist, or sharing changes from a foreign IP rarely have an innocent explanation.")))
+            foreach ($signIn in @($foreignSignInList | Select-Object -First 10)) {
+                $b.Add((New-CippReportInfoBox -Lines -Title "$(FmtDate $signIn.CreatedDateTime) - $(if ($signIn.Country) { $signIn.Country } else { 'Unknown' })" -Content ("Application: $(if ($signIn.AppDisplayName) { $signIn.AppDisplayName } else { 'N/A' })`nIP Address: $(if ($signIn.IPAddress) { $signIn.IPAddress } else { 'N/A' })`nCity: $(if ($signIn.City) { $signIn.City } else { 'N/A' })`nResult: $(if ($signIn.Status) { $signIn.Status } else { 'N/A' })")))
+            }
+            if ((Cnt $foreignSignInList) -gt 10) { $b.Add((New-CippReportNote -Text "... and $((Cnt $foreignSignInList) - 10) more foreign sign-ins (see the retained investigation record for the full list)")) }
+        } elseif ($usageLoc) {
+            $b.Add((New-CippReportClearBox -Title '[Pass] No Foreign Activity Detected' -Content "All located sign-ins and activity match the user's assigned usage location ($usageLoc)."))
+        }
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 11: Sharing Links'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Attackers share OneDrive and SharePoint folders to give themselves a data feed that survives a password reset, and anonymous links expose the content to anyone holding the URL. This check lists every sharing link the account created or changed during the analysis period, including the IP address it was done from.'))
+    if ($stats.sharingChanges -gt 0) {
+        $anon = if ($stats.anonymousLinks -gt 0) { "$($stats.anonymousLinks) of these involve anonymous links, which anyone with the URL can open. " } else { '' }
+        $b.Add((New-CippReportAlertBox -Title "[!] $($stats.sharingChanges) Sharing Change(s) in the Last $windowDays Days" -Content ("${anon}Review each link and remove any that are not explained, even if the account has since been remediated.")))
+        foreach ($change in @($bec.SharingChanges | Select-Object -First 10)) {
+            $lines = @(
+                "Date: $(FmtDate $change.Date)"
+                "Workload: $(if ($change.Workload) { $change.Workload } else { 'N/A' })"
+                if ($change.Target) { "Shared with: $($change.Target)" }
+                if ($change.ClientIP) { "From: $($change.ClientIP)$(if ($change.Country) { " ($($change.Country))" })" }
+                if ($change.ForeignLocation -eq $true) { '[!] Originated outside the assigned usage location' }
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($change.Operation) { $change.Operation } else { 'Sharing Change' }): $(if ($change.FileName) { $change.FileName } elseif ($change.ItemUrl) { $change.ItemUrl } else { 'Unknown item' })" -Content ($lines -join "`n")))
+        }
+        if ($stats.sharingChanges -gt 10) { $b.Add((New-CippReportNote -Text "... and $($stats.sharingChanges - 10) more changes (see the retained investigation record for the full list)")) }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Sharing Changes Found' -Content 'No sharing links were created or changed by this account during the analysis period.'))
+    }
+
+    # === PAGE 7: FULL INVESTIGATION FINDINGS - Check 12-21 ===
+    $b.Add((New-CippReportPage -Title 'Full Investigation Findings' -Subtitle 'Delegations, consents, transport rules, received mail, directory audit, devices and risk state'))
+
+    $b.Add((New-CippReportHeading -Title 'Check 12: Mailbox Delegations and State'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'A delegate with FullAccess or SendAs, a forwarding address, or an automatic reply lets an attacker keep reading and impersonating after the password is changed.'))
+    if ($bec.MailboxState.HasForwarding) {
+        $fwd = if ($bec.MailboxState.ForwardingSmtpAddress) { $bec.MailboxState.ForwardingSmtpAddress } else { $bec.MailboxState.ForwardingAddress }
+        $b.Add((New-CippReportAlertBox -Title '[!] Mail forwarding is configured' -Content ("Mail is forwarded to $fwd$(if ($bec.MailboxState.DeliverToMailboxAndForward) { ' (a copy stays in the mailbox)' }).")))
+    }
+    if ($flaggedDelegations.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($flaggedDelegations.Count) Flagged Delegation(s)" -Content 'External, guest or catch-all principals hold rights on this mailbox. Remove any the user cannot explain.'))
+        foreach ($d in @($flaggedDelegations | Select-Object -First 10)) {
+            $b.Add((New-CippReportInfoBox -Lines -Title "$($d.PermissionType): $($d.Trustee)" -Content ("Rights: $($d.AccessRights)`nResource: $($d.Resource)")))
+        }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Flagged Delegations' -Content "$(Cnt $bec.Delegations) delegation(s) exist, none to an external, guest or catch-all principal."))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 13: Application Consents'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'Applications the user consented to keep their access after a password reset. A rogue-catalog match or a high-risk scope from an unverified publisher is how mailboxes are synchronised out of the tenant.'))
+    if ($flaggedGrants.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($flaggedGrants.Count) Flagged Consent(s)" -Content 'Revoke the grants below unless the user can explain them.'))
+        foreach ($g in @($flaggedGrants | Select-Object -First 10)) {
+            $lines = @(
+                "Scopes: $(if ($g.Scope) { $g.Scope } else { 'N/A' })"
+                "Publisher: $(if ($g.Publisher) { $g.Publisher } else { 'Unknown' }) $(if ($g.PublisherVerified) { '(verified)' } else { '(not verified)' })"
+                $(if ($g.CatalogMatch.Name) { "Catalog: $($g.CatalogMatch.Name) ($($g.CatalogMatch.Source))" })
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$(if ($g.ClientDisplayName) { $g.ClientDisplayName } else { $g.ClientAppId }) ($($g.Risk))" -Content ($lines -join "`n")))
+        }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Flagged Consents' -Content "$(Cnt $bec.UserGrants) consent(s) and role assignment(s) exist, none matching the rogue-app catalogs or carrying a high-risk scope from an unverified publisher."))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 14: Transport Rules'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'A tenant-wide transport rule that BCCs, redirects, deletes or quarantines mail keeps a feed open after the mailbox itself is cleaned.'))
+    if ($flaggedTransportChanges.Count -gt 0 -or $flaggedTransportRules.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($flaggedTransportChanges.Count) risky change(s) in the window, $($flaggedTransportRules.Count) current rule(s) with diversion or suppression actions" -Content 'Review each rule; disable any that cannot be explained.'))
+        foreach ($c in @($flaggedTransportChanges | Select-Object -First 5)) {
+            $lines = @(
+                "Date: $(FmtDate $c.Date)"
+                "By: $(if ($c.Actor) { $c.Actor } else { 'Unknown' })"
+                if ($c.ClientIP) { "From: $($c.ClientIP)$(if ($c.Country) { " ($($c.Country))" })" }
+                "Risky parameters: $(if ($c.RiskyParameters -is [array]) { $c.RiskyParameters -join ', ' } else { $c.RiskyParameters })"
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$($c.Operation): $($c.RuleName)" -Content ($lines -join "`n")))
+        }
+        foreach ($r in @($flaggedTransportRules | Select-Object -First 5)) {
+            $reasons = if ($r.RiskReasons -is [array]) { $r.RiskReasons -join "`n" } else { "$($r.RiskReasons)" }
+            $b.Add((New-CippReportInfoBox -Lines -Title "Rule: $($r.Name) ($($r.State), $($r.Mode))" -Content $reasons))
+        }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Risky Transport Rules' -Content 'No transport rule with a diversion or suppression action was changed in the window or exists in the tenant.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 15: Mailbox Add-ins'))
+    if ($flaggedAddIns.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Lines -Title "[!] $($flaggedAddIns.Count) user-installed non-Microsoft add-in(s)" -Content ((@($flaggedAddIns | ForEach-Object { "$($_.DisplayName) ($(if ($_.ProviderName) { $_.ProviderName } else { 'unknown provider' }))" })) -join "`n")))
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Flagged Add-ins' -Content 'No enabled user-installed add-in from a non-Microsoft provider was found.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 16: Received Mail'))
+    $b.Add((New-CippReportInfoBox -Title 'Why We Check This' -Content 'The message that started the compromise usually arrived in the window. Trace metadata is checked for phishing-shaped subjects and look-alike sender domains; Defender for Office 365 verdicts are included where licensed. No message content is read.'))
+    if ($bec.ReceivedMailSummary) {
+        $b.Add((New-CippReportParagraph -Indent -Text "[i] $($bec.ReceivedMailSummary.TotalMessages) message(s) from $($bec.ReceivedMailSummary.UniqueSenders) sender(s) were received in the window."))
+    }
+    if ($receivedFindings.Count -gt 0 -or $deliveredThreats.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($receivedFindings.Count) finding(s), $($deliveredThreats.Count) Defender-classified threat(s) delivered" -Content 'Look-alike sender domains are the strongest signal; subject patterns are leads for review, not verdicts.'))
+        foreach ($f in @($receivedFindings | Select-Object -First 8)) {
+            $b.Add((New-CippReportInfoBox -Lines -Title "$($f.FindingType): $($f.SenderAddress)" -Content ("Subject: $(if ($f.Subject) { $f.Subject } else { '(no subject)' })`nReason: $($f.Reason)`nReceived: $(if ($f.Received) { $f.Received } else { 'N/A' }) - $(if ($f.Status) { $f.Status } else { 'N/A' })")))
+        }
+        foreach ($d in @($deliveredThreats | Select-Object -First 5)) {
+            $b.Add((New-CippReportInfoBox -Lines -Title "Defender: $(if ($d.ThreatTypes -is [array]) { $d.ThreatTypes -join ', ' } else { $d.ThreatTypes })" -Content ("From: $(if ($d.SenderAddress) { $d.SenderAddress } else { 'Unknown' })`nSubject: $(if ($d.Subject) { $d.Subject } else { '(no subject)' })`nDelivery: $(if ($d.DeliveryAction) { $d.DeliveryAction } else { 'N/A' }) / $(if ($d.LatestDeliveryLocation) { $d.LatestDeliveryLocation } else { 'N/A' })")))
+        }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Received-mail Findings' -Content 'No phishing-shaped subjects, look-alike sender domains or delivered Defender detections were found.'))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 17: Entra Directory Audit'))
+    if ($flaggedAudits.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Title "[!] $($flaggedAudits.Count) flagged directory event(s)" -Content 'Security-info registration, consent, service principal, device, password, token or role events involving this user.'))
+        foreach ($a in @($flaggedAudits | Select-Object -First 8)) {
+            $lines = @(
+                "Date: $(FmtDate $a.ActivityDateTime)"
+                "By: $(if ($a.InitiatedBy) { $a.InitiatedBy } else { 'Unknown' })"
+                if ($a.ClientIP) { "From: $($a.ClientIP)$(if ($a.Country) { " ($($a.Country))" })" }
+                if ($a.Targets) { "Targets: $($a.Targets)" }
+            )
+            $b.Add((New-CippReportInfoBox -Lines -Title "$($a.Activity) ($($a.Result))" -Content ($lines -join "`n")))
+        }
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Flagged Directory Events' -Content "$(Cnt $bec.DirectoryAudits) directory event(s) involved this user in the window, none of the flagged kinds."))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 18 and 19: Registered Devices and Non-interactive Sign-ins'))
+    if ($recentRegisteredDevices.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Lines -Title "[!] $($recentRegisteredDevices.Count) Entra device(s) registered in the window" -Content ((@($recentRegisteredDevices | ForEach-Object { "$(if ($_.displayName) { $_.displayName } else { $_.deviceId }) ($(if ($_.operatingSystem) { $_.operatingSystem } else { 'unknown OS' }), $(if ($_.trustType) { $_.trustType } else { 'unknown trust' })) registered $(FmtDate $_.registrationDateTime)" })) -join "`n")))
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Devices Registered in the Window' -Content "$(Cnt $bec.RegisteredDevices) registered device(s), none new."))
+    }
+    if ($foreignNonInteractive.Count -gt 0) {
+        $b.Add((New-CippReportAlertBox -Lines -Title "[!] $($foreignNonInteractive.Count) successful non-interactive sign-in(s) from outside the usage location" -Content ((@($foreignNonInteractive | Select-Object -First 8 | ForEach-Object { "$(FmtDate $_.CreatedDateTime) - $(if ($_.AppDisplayName) { $_.AppDisplayName } else { 'N/A' }) from $(if ($_.IPAddress) { $_.IPAddress } else { 'N/A' }) ($(if ($_.Country) { $_.Country } else { 'Unknown' }))" })) -join "`n")))
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] No Foreign Non-interactive Sign-ins' -Content "$(Cnt $bec.NonInteractiveSignIns) recent non-interactive sign-in(s), none successful from outside the usage location."))
+    }
+
+    $b.Add((New-CippReportHeading -Title 'Check 20 and 21: Mailbox Activity and Identity Protection'))
+    if ($mailActivitySummary) {
+        $lines = @(
+            "Item accesses: $($mailActivitySummary.MailItemsAccessedCount)"
+            "Hard deletes: $($mailActivitySummary.HardDeleteCount)$(if ($mailActivitySummary.HardDeleteExceeded) { " [!] exceeds the $($mailActivitySummary.HardDeleteThreshold) threshold" })"
+            "Soft deletes: $($mailActivitySummary.SoftDeleteCount)"
+            "Sends: $($mailActivitySummary.SendCount)"
+            "Distinct client IPs: $($mailActivitySummary.DistinctClientIPs)"
+            $(if ($mailActivitySummary.SendAsByOthersCount -gt 0) { "Sent as/on behalf by others: $($mailActivitySummary.SendAsByOthersCount)" })
+            'Counts only - no items were read.'
+        )
+        $b.Add((New-CippReportInfoBox -Lines -Tone $(if ($mailActivitySummary.HardDeleteExceeded) { 'warn' } else { '' }) -Title 'Mailbox activity counts' -Content ($lines -join "`n")))
+    } else {
+        $b.Add((New-CippReportNote -Text 'Mailbox activity counts were not available for this run.'))
+    }
+    if ($completeness.RiskState.Skipped) {
+        $b.Add((New-CippReportAlertBox -Lines -Title '[!] Identity Protection Not Checked' -Content $(if ($completeness.RiskState.Requirement) { "Not checked - $($completeness.RiskState.Requirement). This is not a pass; whether the account is flagged as risky is unknown." } else { "$($completeness.RiskState.Error)" })))
+    } elseif ($riskState.Listed) {
+        $b.Add((New-CippReportAlertBox -Title "[!] Identity Protection: $($riskState.RiskState) at $($riskState.RiskLevel) risk" -Content ("$(if ($riskState.RiskDetail) { $riskState.RiskDetail } else { 'No detail' }) - last updated $(FmtDate $riskState.RiskLastUpdatedDateTime).$(if ((Cnt $riskState.Detections) -gt 0) { " $(Cnt $riskState.Detections) risk detection(s) in the window." })")))
+    } else {
+        $b.Add((New-CippReportClearBox -Title '[Pass] Not Listed as Risky' -Content 'Identity Protection does not list this user as risky.'))
+    }
+
+    # === PAGE 8: RECOMMENDATIONS ===
+    $b.Add((New-CippReportPage -Title 'Recommendations' -Subtitle 'Actions to take and prevention best practices'))
+    $b.Add((New-CippReportParagraph -Title 'Immediate Actions Required' -Text 'Based on the investigation findings, the following actions should be taken immediately:'))
+    $b.Add((New-CippReportBullets -Items @(
+                @{ marker = '1.'; label = 'Reset Password:'; text = "Change the user's password immediately to prevent further unauthorized access." }
+                @{ marker = '2.'; label = 'Revoke Sessions:'; text = 'Sign out the user from all active sessions to terminate any attacker access.' }
+                @{ marker = '3.'; label = 'Remove Suspicious Rules:'; text = 'Delete any mailbox rules that forward, redirect, or hide emails, especially those moving messages to unusual folders.' }
+                @{ marker = '4.'; label = 'Review MFA Devices:'; text = "Remove any MFA devices that the user doesn't recognize and re-register legitimate devices." }
+                @{ marker = '5.'; label = 'Audit Permissions:'; text = 'Review and revoke any unauthorized mailbox permissions or application consents.' }
+                @{ marker = '6.'; label = 'Monitor Account:'; text = 'Continue monitoring the account for suspicious activity for at least 30 days.' }
+            )))
+    $b.Add((New-CippReportParagraph -Title 'Long-Term Prevention Strategies' -Text 'To prevent future Business Email Compromise attacks, implement these security best practices:'))
+    $b.Add((New-CippReportBullets -Items @(
+                @{ label = 'Enforce Multi-Factor Authentication (MFA):'; text = 'Require MFA for all users, especially those with administrative privileges or access to financial systems.' }
+                @{ label = 'Implement Security Awareness Training:'; text = 'Educate employees about phishing, social engineering, and how to identify suspicious emails. Regular training significantly reduces successful attacks.' }
+                @{ label = 'Enable Advanced Threat Protection:'; text = 'Use email security solutions that detect and block phishing, malware, and suspicious attachments.' }
+                @{ label = 'Configure Conditional Access Policies:'; text = 'Restrict access based on location, device compliance, and risk level to prevent unauthorized sign-ins.' }
+                @{ label = 'Monitor Audit Logs:'; text = 'Regularly review audit logs for suspicious activities such as unusual sign-in patterns, rule creation, or permission changes.' }
+                @{ label = 'Establish Financial Controls:'; text = 'Implement multi-person approval processes for wire transfers and payment changes to prevent fraudulent transactions.' }
+            )))
+    $b.Add((New-CippReportParagraph -Title 'User Education Points' -Text 'Share these key points with the affected user to help prevent future compromises:'))
+    $b.Add((New-CippReportBullets -Items @(
+                @{ text = 'Never click on links or open attachments in unexpected emails, even if they appear to come from known contacts.' }
+                @{ text = 'Always verify unusual requests for money transfers or sensitive information through a separate communication channel (phone call, in person).' }
+                @{ text = 'Use strong, unique passwords for each account and consider using a password manager.' }
+                @{ text = 'Be cautious when authorizing new applications or granting permissions to third-party services.' }
+                @{ text = 'Report suspicious emails or activities to your IT security team immediately.' }
+            )))
+
+    # === PAGE 9: COMPLIANCE & DOCUMENTATION ===
+    $b.Add((New-CippReportPage -Title 'Compliance & Documentation' -Subtitle 'Meeting regulatory and audit requirements'))
+    $b.Add((New-CippReportParagraph -Title 'Compliance Considerations' -Text 'This report supports compliance and documentation requirements for various security frameworks and regulatory standards:'))
+    $b.Add((New-CippReportBullets -Items @(
+                @{ label = 'ISO 27001:'; text = 'Demonstrates incident detection, analysis, and response procedures (Controls A.16.1.1 - A.16.1.7).' }
+                @{ label = 'CMMC Level 2:'; text = 'Provides evidence of security incident monitoring, analysis, and documentation (AC.L2-3.1.12, AU.L2-3.3.1).' }
+                @{ label = 'SOC 2 Type II:'; text = 'Documents detective and responsive controls for security incidents (CC7.3, CC7.4).' }
+                @{ label = 'NIST CSF:'; text = 'Aligns with Detect (DE.AE, DE.CM) and Respond (RS.AN, RS.MI) functions.' }
+                @{ label = 'GDPR:'; text = 'Demonstrates security breach detection and potential data breach assessment (Articles 32, 33).' }
+            )))
+    $b.Add((New-CippReportParagraph -Title 'Audit Trail' -Text 'This investigation and resulting documentation provide an audit trail for security incident response:'))
+    $b.Add((New-CippReportInfoBox -Lines -Title 'Investigation Details' -Content (@(
+                    "Investigation Date: $(FmtDate $bec.ExtractedAt)"
+                    "Analyzed User: $upn"
+                    "Organization: $TenantName"
+                    "Analysis Period: $windowDays days"
+                    "Assigned Usage Location: $(if ($usageLoc) { $usageLoc } else { 'Not assigned' })"
+                    "Audit Log Status: $(if ($bec.ExtractResult) { $bec.ExtractResult } else { 'Unknown' })"
+                ) -join "`n")))
+    $b.Add((New-CippReportInfoBox -Lines -Title 'Findings Summary' -Content (@(
+                    "Threat Level: $threatLevel (score $threatValue)"
+                    "Mailbox Rules Found: $($stats.newRules)"
+                    "Rule Changes: $($stats.ruleChanges)"
+                    "Permission Changes: $($stats.permissionChanges) ($($stats.permissionChangesTargetingUser) targeting this mailbox)"
+                    "New Applications: $($stats.newApps)"
+                    "Known-Malicious Applications: $($stats.maliciousApps)"
+                    "Flagged Application Consents: $($flaggedGrants.Count)"
+                    "Flagged Mailbox Delegations: $($flaggedDelegations.Count)"
+                    "Flagged Transport Rules/Changes: $($flaggedTransportRules.Count + $flaggedTransportChanges.Count)"
+                    "New Users: $($stats.newUsers)"
+                    "Sent Messages: $(if ($stats.sentTotalMessages) { $stats.sentTotalMessages } else { $stats.sentMessages })"
+                    "Repeated Subject Campaigns: $($stats.repeatedSubjects)"
+                    "Send Bursts: $($stats.sendBursts)"
+                    "MFA Devices: $($stats.mfaDevices)"
+                    "Recent MFA Registrations ($windowDays d): $($stats.recentMfaDevices)"
+                    "Password Changes: $($stats.passwordChanges)"
+                    "Trusted Senders: $($stats.trustedSenders)"
+                    "Blocked Senders: $($stats.blockedSenders)"
+                    "Safelist Changes: $($stats.safelistChanges)"
+                    "Sharing Changes: $($stats.sharingChanges)"
+                    "Anonymous Links: $($stats.anonymousLinks)"
+                    "Intune Devices: $($stats.intuneDevices)"
+                    "Recent Intune Enrollments ($windowDays d): $($stats.recentIntuneDevices)"
+                    "Received-mail Findings: $($receivedFindings.Count)"
+                    "Delivered Threats: $($deliveredThreats.Count)"
+                    "Foreign Sign-ins: $($stats.foreignSignIns) ($($stats.foreignSuccessfulSignIns) successful)"
+                    "Foreign Non-interactive Sign-ins: $($foreignNonInteractive.Count)"
+                    "Identity Protection Listed: $(if ($riskState.Listed) { "Yes ($($riskState.RiskLevel))" } else { 'No' })"
+                ) -join "`n")))
+    $b.Add((New-CippReportParagraph -Title 'Document Retention' -Text "This report should be retained according to your organization's document retention policy and regulatory requirements. Typical retention periods range from 3-7 years depending on applicable compliance frameworks. Store this document securely with restricted access as it contains sensitive security information."))
+    $b.Add((New-CippReportParagraph -Title 'Additional Resources' -Text 'For more information about Business Email Compromise and cybersecurity best practices:'))
+    $b.Add((New-CippReportBullets -Items @(
+                @{ text = 'FBI IC3: Internet Crime Complaint Center (ic3.gov)' }
+                @{ text = 'CISA: Cybersecurity & Infrastructure Security Agency (cisa.gov)' }
+                @{ text = 'Microsoft Security: Business Email Compromise resources' }
+            )))
+    }
+
+    @{
+        Blocks    = @($b)
+        Variables = @{
+            coverlabel         = 'Security Incident Report'
+            covertitle         = 'BEC Compromise'
+            coveraccent        = 'Analysis'
+            covertenant        = [string]$UserData.displayName
+            coversubtitle      = "Business Email Compromise Investigation Report for $TenantName"
+            covermeta          = [string]$upn
+            covermetanote      = "Analysis Date: $(FmtDate $bec.ExtractedAt)"
+            coverfallbackimage = '/reportImages/soc.jpg'
+            coverfooternote    = 'Confidential & Proprietary - For Internal Use Only'
+            footerlabel        = "$TenantName - BEC Analysis Report for $($UserData.displayName)"
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippExecutiveReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippExecutiveReportTree.ps1
new file mode 100644
index 0000000000000..8fb26cf9f7989
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippExecutiveReportTree.ps1
@@ -0,0 +1,205 @@
+function Build-CippExecutiveReportTree {
+    <#
+    .SYNOPSIS
+        Compose the Executive report as a component tree (server port of ExecutiveReportButton.jsx).
+    .DESCRIPTION
+        Pure composition: takes the already-gathered/shaped report data and returns @{ Blocks; Variables }
+        - the component nodes for ConvertTo-CippReportPdf and the cover/footer report variables. Holds no
+        data gathering, so it is unit-testable with sample data and drives the same layout the client
+        ExecutiveReportDocument produces.
+    .PARAMETER Data
+        Hashtable of the report's data:
+          TenantName, UserStats, SecureScore (currentScore/maxScore/percentageCurrent/percentageVsSimilar/
+          percentageVsAllTenants/trend), Licenses[], Devices[], CAPolicies[] (raw state), SecurityControls[]
+          (name/description/tags/status).
+    .PARAMETER SectionConfig
+        Which sections to include (executiveSummary/securityStandards/secureScore/licenseManagement/
+        deviceManagement/conditionalAccess/infographics).
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][hashtable]$Data,
+        [hashtable]$SectionConfig = @{}
+    )
+
+    $cfg = @{
+        executiveSummary = $true; securityStandards = $true; secureScore = $true
+        licenseManagement = $true; deviceManagement = $true; conditionalAccess = $true; infographics = $true
+    }
+    foreach ($k in $SectionConfig.Keys) { $cfg[$k] = $SectionConfig[$k] }
+
+    $tenant = $Data.TenantName
+    $blocks = [System.Collections.Generic.List[object]]::new()
+    # Chapter dividers over the bundled stock photos (the renderer resolves /reportImages/ paths).
+    function Hero($image, $ov, $hi, $hl, $sub, $ft) {
+        if ($cfg.infographics) {
+            $blocks.Add((New-CippReportHero -Image "/reportImages/$image.jpg" -Overtitle $ov -Highlight $hi -Headline $hl -SubText $sub -FooterText $ft))
+        }
+    }
+
+    # -- Executive Summary --
+    if ($cfg.executiveSummary) {
+        $blocks.Add((New-CippReportPage -Title 'Executive Summary' -Subtitle 'Strategic overview of your Microsoft 365 security posture'))
+        $blocks.Add((New-CippReportParagraph -Html ("<p>This security assessment for <b>{0}</b> provides a clear picture of your organization's cybersecurity posture and readiness against modern threats. We've evaluated your current security measures against industry best practices to identify strengths and opportunities for improvement.</p>" -f [System.Net.WebUtility]::HtmlEncode([string]$tenant))))
+        $blocks.Add((New-CippReportParagraph -Html '<p>Our assessment follows globally recognized security standards to ensure your organization meets regulatory requirements and industry benchmarks. This approach helps protect your business assets, maintain customer trust, and reduce operational risks from cyber threats.</p>'))
+        $us = $Data.UserStats
+        $gaCaption = if ($us.pimCapable) { "$($us.permanentGlobalAdmins) permanent, $($us.eligibleGlobalAdmins) eligible" } else { $null }
+        $gaStat = @{ value = "$($us.globalAdmins)"; label = 'Global Admins' }
+        if ($gaCaption) { $gaStat.caption = $gaCaption }
+        $blocks.Add((New-CippReportStatRow -Title 'Environment Overview' -Stats @(
+                    @{ value = "$($us.licensedUsers)"; label = 'Licensed Users' }
+                    @{ value = "$($us.unlicensedUsers)"; label = 'Unlicensed Users' }
+                    @{ value = "$($us.guests)"; label = 'Guest Users' }
+                    $gaStat
+                )))
+    }
+
+    Hero 'board' $null '83%' $null "of organizations experienced`nmore than one cyberattack`nin the past year" "Proactive security prevents`nrepeated attacks"
+
+    # -- Security Standards --
+    if ($cfg.securityStandards -and $Data.SecurityControls -and @($Data.SecurityControls).Count -gt 0) {
+        $blocks.Add((New-CippReportPage -Title 'Security Standards Assessment' -Subtitle 'Detailed evaluation of implemented security standards'))
+        $blocks.Add((New-CippReportParagraph -Html '<p>Your security standards have been carefully evaluated against industry best practices to protect your business from cyber threats while ensuring smooth daily operations. These standards help maintain business continuity, protect sensitive data, and meet regulatory requirements that are essential for your industry.</p>'))
+        $rows = foreach ($c in $Data.SecurityControls) {
+            @{ name = $c.name; description = $c.description; tags = $c.tags; status = $c.status
+                tone = @{ Compliant = 'pass'; Partial = 'warn'; Review = 'fail'; 'Review Required' = 'fail' }[$c.status]
+            }
+        }
+        $blocks.Add((New-CippReportTable -Title 'Security Standards Status' -Limit @($Data.SecurityControls).Count -Columns @(
+                    @{ header = 'Standard'; key = 'name'; width = 2; bold = $true }
+                    @{ header = 'Description'; key = 'description'; width = 4 }
+                    @{ header = 'Tags'; key = 'tags'; width = 2 }
+                    @{ header = 'Status'; key = 'status'; width = 1.5; toneField = 'tone' }
+                ) -Rows @($rows)))
+        $blocks.Add((New-CippReportBullets -Title 'Key Recommendations' -Items @(
+                    @{ label = 'Immediate Actions:'; text = 'Address standards marked as "Review" to enhance security posture' }
+                    @{ label = 'Compliance:'; text = 'Ensure all security standards are properly implemented and maintained' }
+                    @{ label = 'Monitoring:'; text = 'Establish regular review cycles for all security standards' }
+                    @{ label = 'Training:'; text = 'Implement security awareness programs to reduce human risk factors' }
+                )))
+    }
+
+    Hero 'glasses' $null '95%' $null "of successful cyber attacks`ncould have been prevented with`nproactive security measures" "Your security resilience is`nour primary mission"
+
+    # -- Microsoft Secure Score --
+    if ($cfg.secureScore -and $Data.SecureScore) {
+        $ss = $Data.SecureScore
+        $blocks.Add((New-CippReportPage -Title 'Microsoft Secure Score' -Subtitle 'Comprehensive security posture measurement and benchmarking'))
+        $blocks.Add((New-CippReportParagraph -Html '<p>Microsoft Secure Score measures how well your organization is protected against cyber threats. This score reflects the effectiveness of your current security measures and helps identify areas where additional protection could strengthen your business resilience.</p>'))
+        $blocks.Add((New-CippReportStatRow -Title 'Score Comparison' -Stats @(
+                    @{ value = "$(if ($null -ne $ss.currentScore) { $ss.currentScore } else { 'N/A' })"; label = 'Current Score' }
+                    @{ value = "$(if ($null -ne $ss.maxScore) { $ss.maxScore } else { 'N/A' })"; label = 'Max Score' }
+                    @{ value = "$(if ($null -ne $ss.percentageVsSimilar) { $ss.percentageVsSimilar } else { 'N/A' })%"; label = 'vs Similar Orgs' }
+                    @{ value = "$(if ($null -ne $ss.percentageVsAllTenants) { $ss.percentageVsAllTenants } else { 'N/A' })%"; label = 'vs All Orgs' }
+                )))
+        $blocks.Add((New-CippReportHeading -Title '7-Day Score Trend'))
+        $blocks.Add((New-CippReportChart -Title 'Secure Score Progress' -Kind trend -Max ([double]$ss.maxScore) -Caption ("Current: {0} / {1} ({2}%)" -f $ss.currentScore, $ss.maxScore, $ss.percentageCurrent) -Data @($ss.trend)))
+        $blocks.Add((New-CippReportInfoBox -Title 'What Your Score Means' -Content ("Your current score of {0} represents {1}% of the maximum protection level available. This indicates how well your organization is currently defended against common cyber threats and data breaches." -f $ss.currentScore, $ss.percentageCurrent)))
+        $blocks.Add((New-CippReportInfoBox -Title 'Why Scores Change' -Content "- Business growth and new employees may temporarily lower scores until security measures are applied`n- Changes in software licenses can affect available security features`n- New security threats require updated protections, which may impact scores`n- Regular security improvements help maintain and increase your protection level"))
+    }
+
+    Hero 'working' 'Every' '39' 'seconds' "a business falls victim to`nransomware attacks" "Proactive defense beats`nreactive recovery"
+
+    # -- License Management --
+    if ($cfg.licenseManagement -and $Data.Licenses -and @($Data.Licenses).Count -gt 0) {
+        $blocks.Add((New-CippReportPage -Title 'License Management' -Subtitle 'Microsoft 365 license allocation and utilization analysis'))
+        $blocks.Add((New-CippReportParagraph -Html '<p>Smart license management helps control costs while ensuring your team has the tools they need to be productive. This analysis shows how your current licenses are being used and identifies opportunities to optimize spending without compromising business operations.</p>'))
+        $blocks.Add((New-CippReportTable -Title 'License Allocation Summary' -Limit @($Data.Licenses).Count -Columns @(
+                    @{ header = 'License Type'; key = 'name'; width = 5; bold = $true }
+                    @{ header = 'Used'; key = 'used'; width = 1.5; align = 'center'; bold = $true }
+                    @{ header = 'Available'; key = 'available'; width = 1.5; align = 'center'; bold = $true }
+                    @{ header = 'Total'; key = 'total'; width = 1.5; align = 'center'; bold = $true }
+                ) -Rows @($Data.Licenses)))
+        $blocks.Add((New-CippReportBullets -Title 'License Optimization Recommendations' -Items @(
+                    @{ label = 'Usage Monitoring:'; text = 'Track how licenses are being used to identify cost-saving opportunities' }
+                    @{ label = 'Cost Control:'; text = 'Review unused licenses to reduce unnecessary spending' }
+                    @{ label = 'Growth Planning:'; text = 'Ensure you have enough licenses for business expansion without overspending' }
+                    @{ label = 'Regular Reviews:'; text = 'Conduct quarterly reviews to maintain cost-effective license allocation' }
+                )))
+    }
+
+    Hero 'laptop' $null '$4.45M' $null "average cost of a`ndata breach in 2024" "Investment in security`nsaves millions in recovery"
+
+    # -- Device Management --
+    if ($cfg.deviceManagement -and $Data.Devices -and @($Data.Devices).Count -gt 0) {
+        $devices = @($Data.Devices)
+        $compliant = @($devices | Where-Object { $_.compliant }).Count
+        $blocks.Add((New-CippReportPage -Title 'Device Management' -Subtitle 'Device compliance status and management overview'))
+        $blocks.Add((New-CippReportParagraph -Html '<p>Managing employee devices is essential for protecting your business data and maintaining productivity. This analysis shows which devices meet your security standards and identifies any that may need attention to prevent data breaches or operational disruptions.</p>'))
+        $blocks.Add((New-CippReportStatRow -Title 'Device Compliance Overview' -Stats @(
+                    @{ value = "$($devices.Count)"; label = 'Total Devices' }
+                    @{ value = "$compliant"; label = 'Compliant' }
+                    @{ value = "$($devices.Count - $compliant)"; label = 'Non-Compliant' }
+                    @{ value = "$([math]::Round(($compliant / $devices.Count) * 100))%"; label = 'Compliance Rate' }
+                )))
+        $devRows = foreach ($d in $devices) {
+            @{ name = $d.name; os = $d.os; compliance = $d.compliance; lastSync = $d.lastSync
+                tone = if ($d.compliant) { 'pass' } else { 'fail' }
+            }
+        }
+        $blocks.Add((New-CippReportTable -Title 'Device Management Summary' -Limit 8 -Columns @(
+                    @{ header = 'Device Name'; key = 'name'; width = 3; bold = $true }
+                    @{ header = 'OS'; key = 'os'; width = 2; bold = $true }
+                    @{ header = 'Compliance'; key = 'compliance'; width = 2; toneField = 'tone' }
+                    @{ header = 'Last Sync'; key = 'lastSync'; width = 2; bold = $true }
+                ) -Rows @($devRows)))
+        $blocks.Add((New-CippReportStatRow -Title 'Device Insights' -Stats @(
+                    @{ value = "$(@($devices | Where-Object { $_.os -eq 'Windows' }).Count)"; label = 'Windows Devices' }
+                    @{ value = "$(@($devices | Where-Object { $_.os -eq 'iOS' }).Count)"; label = 'iOS Devices' }
+                    @{ value = "$(@($devices | Where-Object { $_.os -eq 'Android' }).Count)"; label = 'Android Devices' }
+                    @{ value = "$(@($devices | Where-Object { $_.encrypted }).Count)"; label = 'Encrypted' }
+                )))
+        $blocks.Add((New-CippReportInfoBox -Title 'Device Management Recommendations' -Content 'Keep devices updated and secure to protect business data. Regularly check that all employee devices meet security standards and address any issues promptly. Consider automated policies to maintain consistent security across all devices and conduct regular reviews to identify potential risks.'))
+    }
+
+    Hero 'city' $null '277' 'days' "average time to identify and`ncontain a data breach" "Early detection minimizes`nbusiness impact"
+
+    # -- Conditional Access --
+    if ($cfg.conditionalAccess -and $Data.CAPolicies -and @($Data.CAPolicies).Count -gt 0) {
+        $ca = @($Data.CAPolicies)
+        $stateLabel = @{ enabled = 'Enabled'; enabledForReportingButNotEnforced = 'Report Only'; disabled = 'Disabled' }
+        $stateTone = @{ enabled = 'pass'; enabledForReportingButNotEnforced = 'warn'; disabled = 'fail' }
+        $enabled = @($ca | Where-Object { $_.state -eq 'enabled' }).Count
+        $reportOnly = @($ca | Where-Object { $_.state -eq 'enabledForReportingButNotEnforced' }).Count
+        $mfa = @($ca | Where-Object { $_.controls -contains 'mfa' -or $_.controlsText -eq 'MFA' }).Count
+        $blocks.Add((New-CippReportPage -Title 'Conditional Access Policies' -Subtitle 'Identity and access management security controls'))
+        $blocks.Add((New-CippReportParagraph -Html '<p>Access control policies help protect your business by ensuring only the right people can access sensitive information under appropriate circumstances. These smart security measures automatically evaluate each access request and apply additional verification when needed, balancing security with employee productivity.</p>'))
+        $blocks.Add((New-CippReportParagraph -Title 'How Access Controls Protect Your Business' -Html '<p>These policies work like intelligent security guards, making decisions based on who is trying to access what, from where, and when. For example, accessing email from the office might be seamless, but accessing it from an unusual location might require additional verification. This approach protects your data while minimizing disruption to daily work.</p>'))
+        $caRows = foreach ($p in $ca) {
+            @{ name = $p.name; state = ($stateLabel[$p.state] ?? $p.state); tone = ($stateTone[$p.state]); applications = $p.applications; controls = $p.controlsText }
+        }
+        $blocks.Add((New-CippReportTable -Title 'Current Policy Configuration' -Limit 8 -Columns @(
+                    @{ header = 'Policy Name'; key = 'name'; width = 4; bold = $true }
+                    @{ header = 'State'; key = 'state'; width = 2; toneField = 'tone' }
+                    @{ header = 'Applications'; key = 'applications'; width = 2; bold = $true }
+                    @{ header = 'Controls'; key = 'controls'; width = 3; bold = $true }
+                ) -Rows @($caRows)))
+        $blocks.Add((New-CippReportStatRow -Title 'Policy Overview' -Stats @(
+                    @{ value = "$($ca.Count)"; label = 'Total Policies' }
+                    @{ value = "$enabled"; label = 'Enabled' }
+                    @{ value = "$reportOnly"; label = 'Report Only' }
+                    @{ value = "$mfa"; label = 'MFA Policies' }
+                )))
+        $blocks.Add((New-CippReportBullets -Title 'Policy Analysis' -Items @(
+                    @{ label = 'Policy Coverage:'; text = "$($ca.Count) conditional access policies configured" }
+                    @{ label = 'Enforcement Status:'; text = "$enabled policies actively enforced" }
+                    @{ label = 'Testing Phase:'; text = "$reportOnly policies in report-only mode" }
+                    @{ label = 'Security Controls:'; text = 'Multi-factor authentication and access blocking implemented' }
+                )))
+        $caRec = if ($reportOnly -gt 0) { "Consider activating $reportOnly policies currently in testing mode after ensuring they don't disrupt business operations. " } else { 'Your access controls are properly configured. ' }
+        $blocks.Add((New-CippReportInfoBox -Title 'Access Control Recommendations' -Content ($caRec + 'Regularly review how these policies affect employee productivity and adjust as needed. Consider additional location-based protections for enhanced security without impacting daily operations.')))
+    }
+
+    @{
+        Blocks    = @($blocks)
+        Variables = @{
+            coverlabel         = 'SECURITY ASSESSMENT'
+            covertitle         = 'Executive'
+            coveraccent        = 'Summary'
+            covertenant        = [string]$tenant
+            coversubtitle      = "Security & Compliance Assessment for $tenant"
+            coverfallbackimage = '/reportImages/soc.jpg'
+            footerlabel        = "$tenant - Executive Summary"
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippLicenseReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippLicenseReportTree.ps1
new file mode 100644
index 0000000000000..8bc10b023e4a8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippLicenseReportTree.ps1
@@ -0,0 +1,378 @@
+function Build-CippLicenseReportTree {
+    <#
+    .SYNOPSIS
+        Compose the License Optimisation report as a component tree (server port of the client
+        LicenseReportButton.jsx LicenseReportDocument).
+    .PARAMETER Data
+        TenantName plus the Get-CIPPLicenseRecommendation result fields (Summary, Optimization,
+        Downgrades, Upgrades, Terms, Products, Capabilities). Hashtables (a sample read with
+        ConvertFrom-Json -AsHashtable) and PSCustomObjects (a live report) both work.
+    .PARAMETER Sections
+        Optional section switches: spend, reclaim, downgrades, upgrades, terms, method. Only an explicit
+        $false drops a section; the summary page is always included.
+    .PARAMETER GeneratedOn
+        The generation date quoted on the method page (the cover date is ConvertTo-CippReportPdf's).
+        Defaults to today in the instance's timezone (CIPP_TIMEZONE), as the cover's does.
+        Returns @{ Blocks; Variables }.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory)][hashtable]$Data,
+        [hashtable]$Sections = @{},
+        [string]$GeneratedOn = [TimeZoneInfo]::ConvertTime([DateTimeOffset]::UtcNow, $(try { [TimeZoneInfo]::FindSystemTimeZoneById([string]$env:CIPP_TIMEZONE) } catch { [TimeZoneInfo]::Utc })).ToString('MMMM d, yyyy', [cultureinfo]'en-US')
+    )
+
+    # This file stays ASCII: the typographic characters the client prints are built here.
+    $MiddleDot = [string][char]0x00B7
+    $EmDash = [string][char]0x2014
+    $Ellipsis = [string][char]0x2026
+    $OpenQuote = [string][char]0x201C
+    $CloseQuote = [string][char]0x201D
+    # Heavy check mark + VS16: the kit draws it as the same Twemoji image the client shows.
+    $Check = [string][char]0x2714 + [string][char]0xFE0F
+    $Colours = @{ danger = '#742A2A'; warning = '#744210'; success = '#22543D' }
+    $Invariant = [cultureinfo]::InvariantCulture
+
+    # Number(v ?? 0) and toLocaleString() (en-US) from the client.
+    function nz($v) { if ($null -eq $v) { 0 } else { [double]$v } }
+    function num($v) { ([decimal](nz $v)).ToString('#,0.###', $Invariant) }
+    # JS Math.round: half rounds up, where [math]::Round rounds half to even.
+    function jsRound([double]$x) { [math]::Floor($x + 0.5) }
+    # `nz(v) || fallback`.
+    function orDefault($v, $Fallback) { if ((nz $v) -ne 0) { nz $v } else { $Fallback } }
+
+    $Summary = $Data.Summary ?? @{}
+    # `?? @()` so a missing list is empty rather than @($null), which would render as one blank row.
+    $Products = @($Data.Products ?? @())
+    $Opportunities = @($Data.Optimization.Opportunities ?? @())
+    $Downgrades = @($Data.Downgrades ?? @())
+    $Upgrades = @($Data.Upgrades ?? @())
+    $Terms = @($Data.Terms ?? @())
+    $Capabilities = @($Data.Capabilities ?? @())
+    $TenantName = [string]$Data.TenantName
+    $TenantHtml = [System.Net.WebUtility]::HtmlEncode($TenantName)
+    $Show = @{}
+    foreach ($Key in 'spend', 'reclaim', 'downgrades', 'upgrades', 'terms', 'method') { $Show[$Key] = $Sections[$Key] -ne $false }
+
+    # Money as the client's Intl.NumberFormat('en-US', { style: 'currency' }) prints it: whole units for
+    # the big figures, cents for a per-seat price, half away from zero on the decimal value (formatting a
+    # double would round 58.5 to 58 where Intl gives 59). An unusable code falls back to USD as the
+    # client's try/catch does.
+    $Currency = ([string]$Summary.Currency).ToUpperInvariant()
+    if ($Currency -notmatch '^[A-Z]{3}$') { $Currency = 'USD' }
+    # ponytail: symbols for the catalog currencies the PDF fonts can draw; any other code prints as
+    # "CODE 1,234" like Intl does for CHF/SEK. Glyphs such as INR/KRW's are not in the fonts, so they
+    # stay as codes rather than turning into '?'. Intl joins code and number with a no-break space; a plain
+    # one is kept here so a narrow table cell wraps between the two instead of inside the number
+    # ("KRW 19,237." / "50").
+    $Symbol = switch ($Currency) {
+        'USD' { '$' } 'EUR' { [string][char]0x20AC } 'GBP' { [string][char]0x00A3 } 'JPY' { [string][char]0x00A5 }
+        'CAD' { 'CA$' } 'AUD' { 'A$' } 'NZD' { 'NZ$' } 'CNY' { 'CN' + [char]0x00A5 } 'HKD' { 'HK$' }
+        'MXN' { 'MX$' } 'BRL' { 'R$' } 'TWD' { 'NT$' }
+        default { $Currency + ' ' }
+    }
+    function money($v, [int]$Digits) {
+        $x = [math]::Round([decimal](nz $v), $Digits, [MidpointRounding]::AwayFromZero)
+        $Sign = if ($x -lt 0) { '-' } else { '' }
+        $Sign + $Symbol + [math]::Abs($x).ToString("N$Digits", $Invariant)
+    }
+    function whole($v) { money $v 0 }
+    function cents($v) { money $v 2 }
+
+    $ReportDays = orDefault $Summary.ReportPeriodDays 180
+    $InactiveDays = orDefault $Summary.InactiveDays 90
+    $TenureMonths = orDefault $Summary.TenureMonths 6
+    $UpliftPct = jsRound ((orDefault $Summary.MonthlyCommitmentUplift 0.2) * 100)
+    $MonthlySpend = nz $Summary.MonthlySpend
+    $PotentialMonthly = nz $Summary.TotalPotentialMonthly
+    $PotentialAnnual = nz $Summary.TotalPotentialAnnual
+    # The client tests `=== false`, so a missing setting counts as protected.
+    $ProtectOff = ($Summary.ProtectSecurityFeatures -is [bool]) -and -not $Summary.ProtectSecurityFeatures
+
+    # Grade the licensing from the share of monthly spend the report could recover.
+    $Share = 0
+    if ($MonthlySpend -le 0) { $Level = 'No priced spend'; $Severity = 'low' }
+    else {
+        $Share = jsRound ($PotentialMonthly / $MonthlySpend * 100)
+        if ($Share -ge 15) { $Level = 'Significant savings available'; $Severity = 'high' }
+        elseif ($Share -ge 5) { $Level = 'Some savings available'; $Severity = 'medium' }
+        else { $Level = 'Well matched'; $Severity = 'low' }
+    }
+    $SeverityColour = @{ high = $Colours.danger; medium = $Colours.warning }[$Severity] ?? $Colours.success
+
+    $Blocks = [System.Collections.Generic.List[object]]::new()
+
+    # -- Summary (always included) --
+    $Blocks.Add((New-CippReportPage -Title 'Summary' -Subtitle 'The numbers that matter'))
+    $Blocks.Add((New-CippReportParagraph -Html ('<p>Microsoft 365 is bought per person, per plan, per month. Every plan bundles a set of services, and each person is meant to hold the plan that matches what they do. Over time that drifts: people leave, roles change, and plans bought for one reason keep renewing. This report compares what <b>{0}</b> pays for with what its people actually used over the last {1} days.</p>' -f $TenantHtml, $ReportDays)))
+    $Blocks.Add((New-CippReportStatRow -Stats @(
+                @{ value = (whole $MonthlySpend); label = 'Spend per month' }
+                @{ value = (whole $PotentialMonthly); label = 'Could be saved per month'; colour = $(if ($PotentialMonthly -gt 0) { $Colours.success }) }
+                @{ value = (whole $PotentialAnnual); label = 'Could be saved per year'; colour = $(if ($PotentialAnnual -gt 0) { $Colours.success }) }
+                @{ value = (num $Summary.ReclaimableSeats); label = 'Licenses nobody uses'; colour = $(if ((nz $Summary.ReclaimableSeats) -gt 0) { $Colours.warning }) }
+            )))
+    $Assessment = switch ($Severity) {
+        'high' { "About $Share% of the monthly licensing bill could be recovered. That is well past what normal staff turnover explains, and it means plans are being paid for out of habit rather than need. The actions in this report are worth scheduling now." }
+        'medium' { "About $Share% of the monthly licensing bill could be recovered. Licensing is broadly right; the savings are in a handful of licenses and plans that no longer match how people work." }
+        default {
+            if ($MonthlySpend -gt 0) { 'What is paid for closely matches what is used. Nothing here needs action beyond repeating this review as people join and leave.' }
+            else { 'No list price is known for the plans in this tenant, so no spend or savings could be calculated. Prices can be added on the License Pricing page.' }
+        }
+    }
+    $Blocks.Add((New-CippReportAlertBox -Title "Licensing: $Level" -Colour $SeverityColour -Content $Assessment))
+
+    $Sources = @(
+        if ((nz $Summary.ReclaimableMonthly) -gt 0) {
+            @{ label = '{0} a month by removing licenses nobody uses.' -f (whole $Summary.ReclaimableMonthly); text = '{0} licenses are paid for but sit with nobody, with switched-off accounts, or with people who have not signed in for {1} days.' -f (num $Summary.ReclaimableSeats), $InactiveDays }
+        }
+        if ((nz $Summary.DowngradeMonthly) -gt 0) {
+            @{ label = '{0} a month by moving people to a cheaper plan.' -f (whole $Summary.DowngradeMonthly); text = '{0} people hold a plan that includes services they have not used in the last {1} days.' -f (num $Summary.DowngradeSeats), $ReportDays }
+        }
+        if ((nz $Summary.ConsolidationMonthly) -gt 0) {
+            @{ label = '{0} a month by combining separate plans into one bundle.' -f (whole $Summary.ConsolidationMonthly); text = 'Some people hold two or more plans that together cost more than a single bundle with the same features.' }
+        }
+        if ((nz $Summary.TermMonthly) -gt 0) {
+            @{ label = '{0} a month by paying yearly for stable seats.' -f (whole $Summary.TermMonthly); text = 'Month-to-month licenses cost {0}% more than a yearly commitment. Seats that have been with the same person for {1} months or longer are safe to commit to.' -f $UpliftPct, $TenureMonths }
+        }
+    )
+    if ($Sources.Count -gt 0) { $Blocks.Add((New-CippReportBullets -Title 'Where the savings come from' -Items $Sources)) }
+
+    $Blocks.Add((New-CippReportHeading -Title 'How to read this report'))
+    $Blocks.Add((New-CippReportInfoBox -Title 'What was measured' -Content 'Microsoft records, per person, the last day each service was used: email, Teams, files, the installed Office apps, and Copilot. Those dates were compared with what each plan includes. A recommendation is only made where that evidence exists.'))
+    $NotMeasured = if ($ProtectOff) { 'This report was configured to treat them as optional, so a cheaper plan may drop them; each such case lists exactly what would be lost.' }
+    else { 'This report keeps every one of them: nobody is moved to a plan that removes a security feature they hold today.' }
+    $Blocks.Add((New-CippReportInfoBox -Title 'What was not measured' -Content "Security and management features such as device management, sign-in protection and threat protection have no per-person usage record. $NotMeasured"))
+
+    # -- What you pay for --
+    if ($Show.spend) {
+        $Blocks.Add((New-CippReportPage -Title 'What you pay for' -Subtitle 'Every plan, seats owned versus in use'))
+        $Blocks.Add((New-CippReportParagraph -Html '<p>Each row is one plan. <b>Owned</b> is how many seats are bought; <b>in use</b> is how many are given to a person; the difference is paid for and unused. Prices are Microsoft public list prices unless a price has been set specifically for this organisation.</p>'))
+        # The six largest priced plans, then everything else as one slice.
+        $Priced = @($Products | Where-Object { (nz $_.MonthlySpend) -gt 0 })
+        $SpendSeries = [System.Collections.Generic.List[object]]::new()
+        foreach ($Row in ($Priced | Select-Object -First 6)) { $SpendSeries.Add(@{ label = [string]$Row.License; value = (nz $Row.MonthlySpend) }) }
+        $Rest = ($Priced | Select-Object -Skip 6 | ForEach-Object { nz $_.MonthlySpend } | Measure-Object -Sum).Sum
+        if ($Rest -gt 0) { $SpendSeries.Add(@{ label = 'Other plans'; value = $Rest }) }
+        if ($SpendSeries.Count -gt 0) { $Blocks.Add((New-CippReportChart -Kind donut -Title 'Monthly spend by plan' -CentreLabel 'per month' -Data @($SpendSeries))) }
+        $SpendRows = foreach ($Row in $Products) {
+            @{
+                plan         = [string]$Row.License
+                owned        = (num $Row.TotalSeats)
+                used         = (num $Row.AssignedSeats)
+                unused       = (num $Row.UnusedSeats)
+                unusedColour = $(if ((nz $Row.UnusedSeats) -gt 0) { $Colours.warning })
+                unit         = $(if ($Row.PriceKnown) { cents $Row.UnitCost } else { $EmDash })
+                monthly      = $(if ($Row.PriceKnown) { whole $Row.MonthlySpend } else { 'not priced' })
+            }
+        }
+        $Blocks.Add((New-CippReportTable -Limit 30 -Rows @($SpendRows) -EmptyText 'No licenses were found for this organisation.' -Columns @(
+                    @{ header = 'Plan'; key = 'plan'; width = 3; bold = $true }
+                    @{ header = 'Owned'; key = 'owned'; width = 0.8; align = 'right' }
+                    @{ header = 'In use'; key = 'used'; width = 0.8; align = 'right' }
+                    @{ header = 'Unused'; key = 'unused'; width = 0.8; align = 'right'; colourField = 'unusedColour' }
+                    @{ header = 'Per seat'; key = 'unit'; width = 1; align = 'right' }
+                    @{ header = 'Per month'; key = 'monthly'; width = 1.1; align = 'right' }
+                )))
+    }
+
+    # -- Licenses you can remove --
+    if ($Show.reclaim) {
+        $TierText = @{
+            UnassignedSeats = 'Paid for but not given to anyone'
+            DisabledAccount = 'Given to an account that has been switched off'
+            Inactive        = 'Given to someone who has not signed in for a long time'
+            Overlap         = 'Duplicate: another plan already includes it'
+        }
+        $Blocks.Add((New-CippReportPage -Title 'Licenses you can remove' -Subtitle 'Paid for, used by nobody'))
+        $Blocks.Add((New-CippReportParagraph -Text 'These licenses cost money every month and do no work. Removing them changes nothing for anyone who is actually working. Seats bought on a yearly term cannot be reduced until the term renews, but can be reassigned to new starters instead of buying more.'))
+        # The mailbox-only review tier claims no saving and is superseded by the downgrade pass, so it
+        # stays on the admin page. -Stable keeps equal savings in server order, as the client's sort does.
+        $ReclaimRows = @($Opportunities | Where-Object { $_.Tier -ne 'Downgrade' } | ForEach-Object {
+                @{
+                    plan        = [string]$_.License
+                    finding     = $(if ($TierText.ContainsKey([string]$_.Tier)) { $TierText[[string]$_.Tier] } else { [string]$_.FindingLabel })
+                    seats       = (num $_.Seats)
+                    saving      = $(if ($_.PriceKnown) { whole $_.MonthlySaving } else { 'not priced' })
+                    savingValue = (nz $_.MonthlySaving)
+                }
+            } | Sort-Object -Property @{ Expression = { $_.savingValue }; Descending = $true } -Stable)
+        if ($ReclaimRows.Count -gt 0) {
+            $Blocks.Add((New-CippReportTable -Limit 30 -Rows $ReclaimRows -Columns @(
+                        @{ header = 'Plan'; key = 'plan'; width = 2.2; bold = $true }
+                        @{ header = 'Why it can go'; key = 'finding'; width = 3 }
+                        @{ header = 'Seats'; key = 'seats'; width = 0.7; align = 'right' }
+                        @{ header = 'Saving per month'; key = 'saving'; width = 1.3; align = 'right' }
+                    )))
+        } else {
+            $Blocks.Add((New-CippReportClearBox -Title "$Check Nothing to remove" -Content 'Every license is assigned to an active person. Turnover is being handled well.'))
+        }
+    }
+
+    # -- Cheaper plans --
+    if ($Show.downgrades) {
+        $Blocks.Add((New-CippReportPage -Title 'Cheaper plans' -Subtitle 'People whose plan includes more than they use'))
+        $Blocks.Add((New-CippReportParagraph -Text ('Each line groups people on the same plan who used the same subset of it. The suggested plan is the cheapest one that still includes everything they used in the last {0} days. What they would lose is listed so the decision is an informed one; a person who needs one of those services in the coming months should stay where they are.' -f $ReportDays)))
+        if ([bool]$Summary.AnonymizedReports) {
+            $Blocks.Add((New-CippReportAlertBox -Title 'Usage reports are anonymised' -Colour $Colours.warning -Content "Microsoft is configured to hide names in this organisation's usage reports, so activity could not be matched to people and no plan changes are suggested. The setting can be switched off in the Microsoft 365 admin centre."))
+        } elseif ($Downgrades.Count -gt 0) {
+            $DowngradeRows = foreach ($Row in $Downgrades) {
+                @{
+                    from   = [string]$Row.FromLicense
+                    to     = $(if ($Row.Action -eq 'Remove') { 'Remove the plan' } else { [string]$Row.ToLicense })
+                    seats  = (num $Row.Seats)
+                    unit   = (cents $Row.UnitSaving)
+                    saving = (whole $Row.MonthlySaving)
+                }
+            }
+            $Blocks.Add((New-CippReportTable -Limit 20 -Rows @($DowngradeRows) -Columns @(
+                        @{ header = 'Current plan'; key = 'from'; width = 2; bold = $true }
+                        @{ header = 'Suggested'; key = 'to'; width = 2 }
+                        @{ header = 'People'; key = 'seats'; width = 0.7; align = 'right' }
+                        @{ header = 'Each'; key = 'unit'; width = 1; align = 'right' }
+                        @{ header = 'Saving per month'; key = 'saving'; width = 1.3; align = 'right' }
+                    )))
+            # The client's arrow (U+2192) is not in the PDF fonts, so the label uses '->'.
+            $DowngradeItems = foreach ($Row in ($Downgrades | Select-Object -First 8)) {
+                $Keeps = @($Row.Keeps ?? @())
+                $Loses = @($Row.Loses ?? @())
+                $Target = if ($Row.Action -eq 'Remove') { 'no plan' } else { [string]$Row.ToLicense }
+                $KeepText = if ($Keeps.Count -gt 0) { 'keeps {0}. ' -f ($Keeps -join ', ') } else { '' }
+                $LoseText = if ($Loses.Count -gt 0) { 'Loses {0}.' -f ($Loses -join ', ') } else { 'Loses nothing that was used.' }
+                @{ label = '{0} -> {1}:' -f $Row.FromLicense, $Target; text = $KeepText + $LoseText }
+            }
+            $Blocks.Add((New-CippReportBullets -Items @($DowngradeItems)))
+            if ($Downgrades.Count -gt 8) {
+                $Blocks.Add((New-CippReportNote -Text ('{0} and {1} more groups, listed in full on the admin page.' -f $Ellipsis, ($Downgrades.Count - 8))))
+            }
+        } else {
+            $Blocks.Add((New-CippReportClearBox -Title "$Check Plans match usage" -Content 'Nobody holds a plan whose measured services they left unused. No cheaper plan is suggested.'))
+        }
+    }
+
+    # -- Better plans --
+    if ($Show.upgrades) {
+        $Blocks.Add((New-CippReportPage -Title 'Better plans' -Subtitle 'Where a different plan pays off'))
+        $Blocks.Add((New-CippReportParagraph -Title 'Combine separate plans' -Text 'Some people hold two or more plans bought at different times. When one bundle includes the same features for less, the bundle is the better buy.'))
+        $Consolidations = @($Upgrades | Where-Object { $_.Type -eq 'Consolidate' })
+        if ($Consolidations.Count -gt 0) {
+            $ConsolidationRows = foreach ($Row in $Consolidations) {
+                @{
+                    from   = (@($Row.FromLicenses ?? @()) -join ' + ')
+                    to     = [string]$Row.ToLicense
+                    seats  = (num $Row.Seats)
+                    now    = (cents $Row.UnitCost)
+                    bundle = (cents $Row.TargetCost)
+                    saving = (whole (-1 * (nz $Row.MonthlyDelta)))
+                }
+            }
+            $Blocks.Add((New-CippReportTable -Limit 15 -Rows @($ConsolidationRows) -Columns @(
+                        @{ header = 'Current plans'; key = 'from'; width = 2.6; bold = $true }
+                        @{ header = 'Suggested bundle'; key = 'to'; width = 2 }
+                        @{ header = 'People'; key = 'seats'; width = 0.7; align = 'right' }
+                        @{ header = 'Now'; key = 'now'; width = 0.9; align = 'right' }
+                        @{ header = 'Bundle'; key = 'bundle'; width = 0.9; align = 'right' }
+                        @{ header = 'Saving per month'; key = 'saving'; width = 1.3; align = 'right' }
+                    )))
+        } else {
+            $Blocks.Add((New-CippReportClearBox -Title "$Check No cheaper bundles" -Content "Nobody's combination of plans costs more than a single bundle would."))
+        }
+
+        $Blocks.Add((New-CippReportParagraph -Title 'People with no security protection' -Text 'These people hold plans that include no device management, no advanced sign-in protection and no device threat protection. That is a business risk rather than a saving, so the figure below is an added cost. It is the cheapest plan that gives them all three.'))
+        $Protections = @($Upgrades | Where-Object { $_.Type -eq 'Protect' })
+        if ($Protections.Count -gt 0) {
+            $ProtectionRows = foreach ($Row in $Protections) {
+                @{
+                    from  = (@($Row.FromLicenses ?? @()) -join ' + ')
+                    to    = [string]$Row.ToLicense
+                    seats = (num $Row.Seats)
+                    unit  = (cents $Row.UnitDelta)
+                    delta = (whole $Row.MonthlyDelta)
+                }
+            }
+            $Blocks.Add((New-CippReportTable -Limit 15 -Rows @($ProtectionRows) -Columns @(
+                        @{ header = 'Current plans'; key = 'from'; width = 2.4; bold = $true }
+                        @{ header = 'Suggested'; key = 'to'; width = 2 }
+                        @{ header = 'People'; key = 'seats'; width = 0.7; align = 'right' }
+                        @{ header = 'Extra per person'; key = 'unit'; width = 1.2; align = 'right' }
+                        @{ header = 'Extra per month'; key = 'delta'; width = 1.3; align = 'right' }
+                    )))
+        } else {
+            $Blocks.Add((New-CippReportClearBox -Title "$Check Everyone is covered" -Content 'Every licensed person holds a plan with device management, sign-in protection and device threat protection.'))
+        }
+    }
+
+    # -- Yearly or monthly --
+    if ($Show.terms) {
+        $Blocks.Add((New-CippReportPage -Title 'Yearly or monthly' -Subtitle 'Committing to the seats that will stay'))
+        $Blocks.Add((New-CippReportParagraph -Html ('<p>Microsoft sells the same plan two ways. A <b>yearly</b> commitment is cheaper but cannot be reduced until it renews. A <b>monthly</b> commitment costs about {0}% more but can be dropped at any time. The right mix is to commit yearly to the seats that will still be there in a year and keep the rest monthly. A seat that has been with the same person for {1} months or more is treated as one that will stay.</p>' -f $UpliftPct, $TenureMonths)))
+        if ($Terms.Count -gt 0) {
+            $TermRows = foreach ($Row in $Terms) {
+                @{
+                    plan      = [string]$Row.License
+                    used      = (num $Row.AssignedSeats)
+                    stable    = (num $Row.StableSeats)
+                    yearlyNow = $(if ($Row.TermKnown) { num $Row.YearlySeats } else { 'unknown' })
+                    yearly    = (num $Row.RecommendedAnnual)
+                    monthly   = (num $Row.RecommendedMonthly)
+                    saving    = $(if ($Row.TermKnown -and $Row.PriceKnown) { whole $Row.MonthlySaving } else { $EmDash })
+                }
+            }
+            $Blocks.Add((New-CippReportTable -Limit 30 -Rows @($TermRows) -Columns @(
+                        @{ header = 'Plan'; key = 'plan'; width = 2.4; bold = $true }
+                        @{ header = 'In use'; key = 'used'; width = 0.7; align = 'right' }
+                        @{ header = "Held $TenureMonths+ mo"; key = 'stable'; width = 0.9; align = 'right' }
+                        @{ header = 'Yearly now'; key = 'yearlyNow'; width = 0.9; align = 'right' }
+                        @{ header = 'Suggested yearly'; key = 'yearly'; width = 1.1; align = 'right' }
+                        @{ header = 'Suggested monthly'; key = 'monthly'; width = 1.1; align = 'right' }
+                        @{ header = 'Saving per month'; key = 'saving'; width = 1.2; align = 'right' }
+                    )))
+        } else {
+            $Blocks.Add((New-CippReportClearBox -Title 'No plans to assess' -Content 'No assigned plans were found.'))
+        }
+        $Locked = @(foreach ($Row in $Terms) {
+                $Seats = nz $Row.LockedUnusedSeats
+                if ($Seats -le 0) { continue }
+                $Renewal = if ($null -ne $Row.NextRenewalDays) { ', renews in {0} days' -f (num $Row.NextRenewalDays) } else { '' }
+                '{0}: {1} yearly seat{2} unassigned{3}' -f $Row.License, (num $Seats), $(if ($Seats -eq 1) { '' } else { 's' }), $Renewal
+            })
+        if ($Locked.Count -gt 0) {
+            $Blocks.Add((New-CippReportInfoBox -Title 'Yearly seats that nobody holds' -Content (($Locked -join '. ') + '. These are paid for until renewal; reduce the count before that date.')))
+        }
+        if (@($Terms | Where-Object { -not $_.TermKnown }).Count -gt 0) {
+            $Blocks.Add((New-CippReportNote -Text ('{0}Unknown{1} means Microsoft did not report the commitment term for that plan, so the current yearly/monthly split could not be read and no saving is claimed.' -f $OpenQuote, $CloseQuote)))
+        }
+    }
+
+    # -- How this was measured --
+    if ($Show.method) {
+        $Measured = @($Capabilities | Where-Object { $_.measurable } | ForEach-Object { [string]$_.label }) -join ', '
+        $Unmeasured = @($Capabilities | Where-Object { -not $_.measurable } | ForEach-Object { [string]$_.label }) -join ', '
+        $PriceCurrency = if ($Summary.Currency) { [string]$Summary.Currency } else { 'USD' }
+        $Blocks.Add((New-CippReportPage -Title 'How this was measured' -Subtitle 'Sources, window and assumptions'))
+        $Blocks.Add((New-CippReportBullets -Items @(
+                    @{ label = 'Prices.'; text = "Microsoft public list prices per user per month on a yearly commitment, in $PriceCurrency, unless a specific price was entered for this organisation. Real invoices may differ from list price." }
+                    @{ label = 'Usage window.'; text = "The last $ReportDays days of Microsoft usage reports for email, Teams, OneDrive and SharePoint, the installed Office apps, and Copilot. A person counts as inactive after $InactiveDays days without a sign-in." }
+                    @{ label = 'Measured services.'; text = $Measured }
+                    @{ label = 'Services with no usage record.'; text = "$Unmeasured. $(if ($ProtectOff) { 'Treated as optional in this report.' } else { 'Always kept in this report.' })" }
+                    @{ label = 'Plan comparison.'; text = 'Plans are compared by the services Microsoft lists for each one. Business plans are only suggested where the organisation is within their 300-user limit; frontline plans only to people already on one.' }
+                    @{ label = 'Yearly versus monthly.'; text = "Microsoft records when each person's license was last changed. A seat unchanged for $TenureMonths months or more is treated as stable. The saving is the $UpliftPct% premium on monthly-commitment seats that could move to a yearly term." }
+                    @{ label = 'Report generated.'; text = "$GeneratedOn, from data collected by the management platform." }
+                )))
+    }
+
+    $Separator = " $MiddleDot "
+    @{
+        Blocks    = @($Blocks)
+        Variables = @{
+            coverlabel         = 'Microsoft 365 Licensing Review'
+            covertitle         = 'Licensing'
+            coveraccent        = 'Report'
+            coversubtitle      = "What $TenantName pays Microsoft for each month, which of it is used, and where the same work could be done for less."
+            covermeta          = '{0} people licensed{1}{2} plans{1}{3} per month' -f (num $Summary.LicensedUsers), $Separator, (num $Products.Count), (whole $MonthlySpend)
+            covermetanote      = $(if ($PotentialAnnual -gt 0) { 'Potential saving: {0} per year' -f (whole $PotentialAnnual) } else { 'No savings identified' })
+            coverfooternote    = "Confidential $EmDash Prepared for the leadership team"
+            coverfallbackimage = '/reportImages/city.jpg'
+            footerlabel        = "$TenantName $EmDash Licensing"
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippMailFlowReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippMailFlowReportTree.ps1
new file mode 100644
index 0000000000000..a79b2fa80f34c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippMailFlowReportTree.ps1
@@ -0,0 +1,126 @@
+function Build-CippMailFlowReportTree {
+    <#
+    .SYNOPSIS
+        Compose the Exchange Mail Flow report as a component tree (server port of MailFlowReportButton.jsx).
+    .PARAMETER Data
+        Mail flow data: days, totals, directionTotals, daily[], topSenders[], topSpamRecipients[].
+        Returns @{ Blocks; Variables }.
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][hashtable]$Data)
+
+    function nz($v) { if ($null -eq $v) { 0 } else { [double]$v } }
+    function num($v) { '{0:N0}' -f (nz $v) }
+    function pct($part, $whole) { if ($whole -gt 0) { [math]::Round(($part / $whole) * 1000) / 10 } else { 0 } }
+    $dispositions = @(
+        @{ key = 'GoodMail'; label = 'Good mail' }, @{ key = 'TransportRules'; label = 'Transport rules' }
+        @{ key = 'SpamDetections'; label = 'Spam' }, @{ key = 'EdgeBlockSpam'; label = 'Edge blocked spam' }
+        @{ key = 'EmailPhish'; label = 'Phish' }, @{ key = 'EmailMalware'; label = 'Malware' }
+    )
+    $days = if ((nz $Data.days) -gt 0) { [int]$Data.days } else { 14 }
+    $totals = if ($Data.totals) { $Data.totals } else { @{} }
+    $dir = if ($Data.directionTotals) { $Data.directionTotals } else { @{} }
+    # `?? @()` so a missing list is empty rather than @($null), which would render as one blank row.
+    $daily = @($Data.daily ?? @())
+    $topSenders = @($Data.topSenders ?? @())
+    $topSpam = @($Data.topSpamRecipients ?? @())
+
+    $totalMail = ($dispositions | ForEach-Object { nz $totals[$_.key] } | Measure-Object -Sum).Sum
+    $goodPct = pct (nz $totals.GoodMail) $totalMail
+    $phish = nz $totals.EmailPhish; $malware = nz $totals.EmailMalware; $threats = $phish + $malware
+    $transportRules = nz $totals.TransportRules
+    $targeted = pct $threats $totalMail
+    $spam = pct ((nz $totals.SpamDetections) + (nz $totals.EdgeBlockSpam)) $totalMail
+    $hygiene = if ($totalMail -le 0) { 'Good' }
+    elseif ($targeted -gt 1 -or $spam -gt 25) { 'Attention Needed' }
+    elseif ($targeted -gt 0.25 -or $spam -gt 10) { 'Fair' }
+    else { 'Good' }
+    $dangerC = '#742A2A'; $warnC = '#744210'
+    $sevColour = @{ 'Attention Needed' = $dangerC; Fair = $warnC; Good = '#22543D' }[$hygiene]
+
+    $dayLabel = { param($v) if ($v) { ([datetime]$v).ToString('MMM d') } else { '' } }
+    $volumeSeries = foreach ($row in $daily) { @{ label = (& $dayLabel $row.date); value = ($dispositions | ForEach-Object { nz $row[$_.key] } | Measure-Object -Sum).Sum } }
+    $directionSeries = @(
+        @{ label = 'Inbound'; value = (nz $dir.Inbound) }
+        @{ label = 'Outbound'; value = (nz $dir.Outbound) }
+        @{ label = 'Intra-org'; value = (nz $dir.IntraOrg) }
+    )
+    $dispositionRows = foreach ($d in $dispositions) { @{ disposition = $d.label; messages = (num $totals[$d.key]); share = "$(pct (nz $totals[$d.key]) $totalMail)%" } }
+
+    $blocks = [System.Collections.Generic.List[object]]::new()
+
+    # -- Executive Summary --
+    $blocks.Add((New-CippReportPage -Title 'Executive Summary' -Subtitle "Email traffic over the last $days days"))
+    $blocks.Add((New-CippReportParagraph -Html ('<p>Every message entering or leaving the organisation is given a disposition - delivered, held by a transport rule, filtered as spam, or blocked as phishing or malware. Those dispositions are the clearest single measure of what the mail environment is being asked to handle, because they count what the filters actually did rather than what they are configured to do. This report covers the last {0} days of mail flow at <b>{1}</b>.</p>' -f $days, [System.Net.WebUtility]::HtmlEncode([string]$Data.TenantName))))
+    $blocks.Add((New-CippReportStatRow -Stats @(
+                @{ value = (num $totalMail); label = 'Total Messages' }
+                @{ value = "$goodPct%"; label = 'Delivered Clean' }
+                @{ value = (num $phish); label = 'Phish Blocked'; colour = $(if ($phish -gt 0) { $warnC }) }
+                @{ value = (num $malware); label = 'Malware Blocked'; colour = $(if ($malware -gt 0) { $dangerC }) }
+            )))
+    $hygText = switch ($hygiene) {
+        'Attention Needed' { 'Threat traffic is a material share of total mail. At this rate the organisation is being targeted rather than incidentally caught by bulk campaigns, and the filters are absorbing volume that protection policy and user awareness should be reducing at source. Treat the recommendations as current work.' }
+        'Fair' { 'Threats are being caught at a level that is normal for an organisation of this profile, but not negligible. The filtering is working; the value now is in checking which users absorb most of it and whether their protection matches their exposure.' }
+        default { 'Threat traffic is a small fraction of total mail and is being stopped before delivery. Nothing here needs action beyond keeping the review cadence, since a change in this profile is usually the first visible sign of a campaign starting.' }
+    }
+    $blocks.Add((New-CippReportAlertBox -Title "Mail Hygiene: $hygiene" -Colour $sevColour -Content $hygText))
+    $blocks.Add((New-CippReportInfoBox -Title 'What this data is' -Content "Figures come from Microsoft's mail flow status report for the tenant, aggregated as daily counts per disposition and direction. It is a count of messages, not a record of them: individual senders, subjects and recipients are not part of this data set, and a message appears once under the disposition that was applied to it."))
+    $blocks.Add((New-CippReportInfoBox -Title 'What it does not show' -Content 'A blocked message is a filter working, not an incident. Nothing here indicates that a threat reached a user or that an account was compromised - that requires message trace and sign-in data, which are reviewed separately. Equally, a clean result does not prove nothing got through; it proves nothing was recognised.'))
+
+    # -- Volume & Dispositions --
+    $blocks.Add((New-CippReportPage -Title 'Volume & Dispositions' -Subtitle 'How much mail, and what happened to it'))
+    $blocks.Add((New-CippReportHeading -Title 'Daily Volume'))
+    $blocks.Add((New-CippReportParagraph -Text 'Total messages handled per day across every disposition. Steady volume with occasional peaks is normal; a sustained step change usually reflects a business event - a campaign, an onboarding, a new integration - and is worth being able to explain.'))
+    $blocks.Add((New-CippReportChart -Kind trend -Title 'Messages per day' -Caption ("{0} messages over {1} days" -f (num $totalMail), $days) -Data @($volumeSeries)))
+    $blocks.Add((New-CippReportHeading -Title 'Dispositions'))
+    $blocks.Add((New-CippReportParagraph -Text 'The share each disposition accounts for matters more than the counts. Good mail should dominate; anything else growing as a proportion is the signal.'))
+    $blocks.Add((New-CippReportTable -Columns @(@{ header = 'Disposition'; key = 'disposition'; width = 2.4 }, @{ header = 'Messages'; key = 'messages'; width = 1.2 }, @{ header = '% of Total'; key = 'share'; width = 1 }) -Rows @($dispositionRows)))
+    $blocks.Add((New-CippReportHeading -Title 'Direction'))
+    $blocks.Add((New-CippReportParagraph -Text 'Inbound, outbound and internal traffic in proportion. An unusual outbound share is the one to watch: mail leaving in volume that the business did not generate is how a compromised mailbox or an unsecured relay first shows up in these figures.'))
+    $blocks.Add((New-CippReportChart -Kind donut -Title 'Messages by direction' -CentreLabel 'messages' -Data @($directionSeries)))
+
+    # -- Senders & Spam Targets --
+    $blocks.Add((New-CippReportPage -Title 'Senders & Spam Targets' -Subtitle 'Who sends the most, and who is targeted'))
+    $blocks.Add((New-CippReportHeading -Title 'Top Mail Senders'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'The heaviest senders are normally the ones you would expect - shared mailboxes, ticketing systems, scan-to-email devices, marketing platforms. What is worth a second look is a name that does not belong on that list. A user account sending at machine volume is either an unmanaged automation nobody documented, or a mailbox someone else is using.'))
+    if ($topSenders.Count -gt 0) {
+        $blocks.Add((New-CippReportTable -Limit 10 -Columns @(@{ header = 'Sender'; key = 'name'; width = 3 }, @{ header = 'Messages'; key = 'count'; width = 1 }) -Rows @($topSenders | ForEach-Object { @{ name = ($_.Name ?? $_.name ?? 'Unknown'); count = (num ($_.Count ?? $_.count)) } })))
+    } else { $blocks.Add((New-CippReportClearBox -Title 'No sender data' -Content 'Microsoft returned no top-sender breakdown for this window.')) }
+    $blocks.Add((New-CippReportHeading -Title 'Top Spam Recipients'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'Unwanted mail does not spread evenly. A handful of addresses - usually the published ones, and the people whose names appear on the website - absorb most of it, and those same addresses are the ones a targeted attempt will use. Concentration here identifies exactly who benefits most from stricter policy and from being asked to be careful.'))
+    if ($topSpam.Count -gt 0) {
+        $blocks.Add((New-CippReportTable -Limit 10 -Columns @(@{ header = 'Recipient'; key = 'name'; width = 3 }, @{ header = 'Messages'; key = 'count'; width = 1 }) -Rows @($topSpam | ForEach-Object { @{ name = ($_.Name ?? $_.name ?? 'Unknown'); count = (num ($_.Count ?? $_.count)) } })))
+    } else { $blocks.Add((New-CippReportClearBox -Title 'No concentrated spam targets' -Content 'No recipient stands out as absorbing spam over this window.')) }
+
+    # -- Recommendations --
+    $blocks.Add((New-CippReportPage -Title 'Recommendations' -Subtitle 'What to do with these figures'))
+    $blocks.Add((New-CippReportHeading -Title 'Priority Actions'))
+    $blocks.Add((New-CippReportParagraph -Text "Ordered by what this window's data actually shows, rather than by a generic checklist."))
+    $priority = [System.Collections.Generic.List[object]]::new()
+    if ($threats -gt 0) { $priority.Add(@{ label = 'Review anti-phishing and anti-malware policy strength.'; text = "$(num $threats) messages were blocked as phishing or malware in this window. Confirm the tenant is on the current preset security policies, that impersonation protection lists the people who would actually be impersonated, and that Safe Links and Safe Attachments cover every mailbox rather than a pilot group." }) }
+    if ($topSpam.Count -gt 0) { $priority.Add(@{ label = 'Give the most-targeted users stronger protection.'; text = 'The recipients listed in this report absorb a disproportionate share of unwanted mail. Priority accounts, tighter quarantine policy and a short conversation about what they are receiving cost little and are aimed exactly where the traffic is going.' }) }
+    $priority.Add(@{ label = 'Verify SPF, DKIM and DMARC are published and enforcing.'; text = 'These records decide whether mail claiming to be from the domain is accepted elsewhere. A DMARC policy left at p=none reports abuse without stopping it, which means the organisation can be impersonated to its own customers regardless of how well inbound filtering performs.' })
+    if ($transportRules -gt 0) { $priority.Add(@{ label = 'Audit the transport rules acting on mail.'; text = "Transport rules handled $(num $transportRules) messages here. Rules accumulate, outlive the reason they were written, and silently override filtering decisions - confirm each one is still wanted and that none bypasses protection for a sender that no longer needs the exception." }) }
+    $i = 0; $priorityItems = foreach ($p in $priority) { $i++; @{ marker = "$i."; label = $p.label; text = $p.text } }
+    $blocks.Add((New-CippReportBullets -Items @($priorityItems)))
+    $blocks.Add((New-CippReportHeading -Title 'Keeping It That Way'))
+    $blocks.Add((New-CippReportBullets -Items @(
+                @{ label = 'Review mail flow on a fixed cadence.'; text = 'These figures are only meaningful against previous ones. A monthly look establishes the normal shape of the traffic, which is what makes an abnormal month visible at a glance.' }
+                @{ label = 'Watch the outbound share, not just the inbound.'; text = 'Inbound threat volume reflects the internet. Outbound volume reflects the organisation, so a change there is far more likely to mean something has gone wrong inside it.' }
+                @{ label = 'Alert on the conditions, not the counts.'; text = 'Configure alert policies for outbound spam and unusual sending volume. A report read monthly finds a compromised mailbox weeks late; an alert finds it the same day.' }
+                @{ label = 'Keep quarantine reviewed and released promptly.'; text = 'Filtering only holds if people trust it. Where legitimate mail sits in quarantine unattended, users route around the controls - and that habit costs more than the filtering saves.' }
+            )))
+
+    @{
+        Blocks    = @($blocks)
+        Variables = @{
+            coverlabel         = 'Email Traffic Review'
+            coversubtitle      = "Where email at $($Data.TenantName) came from over the last $days days, how much of it was delivered, and what was stopped before it reached a mailbox."
+            covermeta          = ("{0:N0} messages $([char]0x00B7) {1}% delivered $([char]0x00B7) {2:N0} threats caught" -f $totalMail, $goodPct, $threats)
+            covermetanote      = "Mail hygiene: $hygiene"
+            coverfooternote    = "Confidential $([char]0x2014) For Internal Use Only"
+            coverfallbackimage = '/reportImages/city.jpg'
+            footerlabel        = "$($Data.TenantName) $([char]0x2014) Mail Flow"
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippPermissionsReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippPermissionsReportTree.ps1
new file mode 100644
index 0000000000000..76148795e5f05
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippPermissionsReportTree.ps1
@@ -0,0 +1,125 @@
+function Build-CippPermissionsReportTree {
+    <#
+    .SYNOPSIS
+        Compose the SharePoint Permissions report as a component tree (server port of
+        PermissionsReportButton.jsx).
+    .PARAMETER Data
+        Permissions data: summary (counts), assignments[], skippedSites[]. Returns @{ Blocks; Variables }.
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][hashtable]$Data)
+
+    $summary = if ($Data.summary) { $Data.summary } else { @{} }
+    # `?? @()` so a missing list is empty rather than @($null), which would count as one row.
+    $assignments = @($Data.assignments ?? @())
+    $skipped = @($Data.skippedSites ?? @())
+    function nz($v) { if ($null -eq $v) { 0 } else { [int]$v } }
+    function plural($c, $s, $p) { "$c $(if ($c -eq 1) { $s } else { if ($p) { $p } else { "${s}s" } })" }
+
+    $score = (@(
+            if ((nz $summary.broadClaimGrants) -gt 0) { 5 }
+            if ((nz $summary.externalGrants) -gt 0) { 3 }
+            if ((nz $summary.directFullControlGrants) -gt 0) { 2 }
+            if ((nz $summary.uniquePermissionLibraries) -gt 0) { 1 }
+        ) | Measure-Object -Sum).Sum
+    $exposure = if ($score -ge 7) { 'High' } elseif ($score -ge 3) { 'Medium' } else { 'Low' }
+    $dangerC = '#742A2A'; $warnC = '#744210'
+    $sevColour = @{ High = $dangerC; Medium = $warnC; Low = '#22543D' }[$exposure]
+    $claimLabels = @{ Everyone = 'Everyone (includes external users)'; EveryoneExceptExternal = 'Everyone except external users'; AllUsers = 'All Users' }
+
+    $real = @($assignments | Where-Object { $_.principalId -and -not $_.isSystemManaged })
+    $broad = @($real | Where-Object { $_.broadClaim })
+    $external = @($real | Where-Object { $_.isGuest -eq $true })
+    $fullCtl = @($real | Where-Object { $_.permissionLevel -eq 'Full Control' -and $_.principalType -ne 'SharePoint Group' })
+    $libRows = @($real | Where-Object { $_.scope -eq 'Library' })
+    $siteLabel = { param($r) if ($r.siteName) { $r.siteName } elseif ($r.siteUrl) { $r.siteUrl } else { 'Unnamed site' } }
+    $scopeLabel = { param($r) if ($r.scope -eq 'Library') { "$(& $siteLabel $r) / $($r.libraryTitle)" } else { (& $siteLabel $r) } }
+
+    $blocks = [System.Collections.Generic.List[object]]::new()
+
+    # -- Executive Summary --
+    $blocks.Add((New-CippReportPage -Title 'Executive Summary' -Subtitle 'Who is allowed in, and how widely'))
+    $blocks.Add((New-CippReportParagraph -Html ('<p>Permissions are set by administrators on a site or document library and decide who is structurally allowed in. They change rarely, which is what makes them worth auditing: a permission granted for one project stays in place indefinitely, and a permission granted to the whole organisation looks identical to one granted to a single team until somebody reads it. This report covers <b>{0}</b>.</p>' -f [System.Net.WebUtility]::HtmlEncode([string]$Data.TenantName))))
+    $blocks.Add((New-CippReportStatRow -Stats @(
+                @{ value = (nz $summary.broadClaimGrants); label = 'Tenant-Wide Grants'; colour = $(if ((nz $summary.broadClaimGrants) -gt 0) { $dangerC }) }
+                @{ value = (nz $summary.externalGrants); label = 'External Grants'; colour = $(if ((nz $summary.externalGrants) -gt 0) { $warnC }) }
+                @{ value = (nz $summary.directFullControlGrants); label = 'Direct Full Control'; colour = $(if ((nz $summary.directFullControlGrants) -gt 0) { $warnC }) }
+                @{ value = (nz $summary.uniquePermissionLibraries); label = 'Detached Libraries' }
+            )))
+    $expText = switch ($exposure) {
+        'High' { 'Content is reachable by people it was never meant for. A tenant-wide grant is present, which opens the content to the entire organisation regardless of who the site membership says should have it - and it is the most common reason material turns up unexpectedly in search results and AI assistant answers. Treat the findings below as immediate remediation work.' }
+        'Medium' { 'Access extends past the intended audience in places. Each finding below is individually manageable, but each one widens what a single compromised account reaches.' }
+        default { 'Permissions broadly match what the structure intends. No tenant-wide grants were found. Continue reviewing periodically, particularly after site or library changes.' }
+    }
+    $blocks.Add((New-CippReportAlertBox -Title "Permission Exposure: $exposure" -Colour $sevColour -Content $expText))
+    $blocks.Add((New-CippReportInfoBox -Title 'What was examined' -Content ("{0} SharePoint sites and {1} document libraries were read, producing {2} permission assignments. Data is taken from the last completed sync, not read live." -f (nz $summary.sitesScanned), (nz $summary.librariesScanned), (nz $summary.totalAssignments))))
+    $blocks.Add((New-CippReportInfoBox -Title 'What is not covered' -Content 'Permissions are reported as grant paths, not effective access - a group holding a permission is one entry and its members are not expanded, so a person may hold access that shows here only via their group. Permissions on individual folders and files are not enumerated. OneDrive personal sites are out of scope. Access handed out by sharing link is a separate path, covered by the Sharing Report.'))
+    if ($skipped.Count -gt 0) {
+        $blocks.Add((New-CippReportAlertBox -Title ("$(plural $skipped.Count 'site') could not be read") -Colour $warnC -Content 'These sites could not be read on the most recent scan. Where a site was read successfully before, its earlier results are still shown and are as old as that scan; a site never read successfully contributes nothing. Either way, an absence of findings for these sites is not evidence of good configuration.'))
+    }
+
+    # -- Findings --
+    $blocks.Add((New-CippReportPage -Title 'Findings' -Subtitle 'Permissions worth reviewing, most urgent first'))
+    $blocks.Add((New-CippReportHeading -Title 'Finding 1: Tenant-Wide Grants'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content "SharePoint offers a handful of special audiences - Everyone, Everyone except external users, and All Users - that resolve to the whole organisation rather than to named people. A library carrying one is readable by every employee no matter what the site's membership says, and it is the single most common cause of data appearing in search results or AI assistant answers where it was not expected."))
+    if ($broad.Count -gt 0) {
+        $blocks.Add((New-CippReportAlertBox -Title ("$(plural $broad.Count 'tenant-wide grant') found") -Colour $dangerC -Content 'Confirm the content is genuinely meant to be organisation-wide. If not, replace the grant with a specific group - one edit removes access for everyone who was never meant to have it.'))
+        $blocks.Add((New-CippReportTable -Columns @(@{ header = 'Location'; key = 'location'; width = 2.4 }, @{ header = 'Audience'; key = 'audience'; width = 2 }, @{ header = 'Permission'; key = 'level'; width = 1.2 }) -Rows @($broad | ForEach-Object { @{ location = (& $scopeLabel $_); audience = ($claimLabels[$_.broadClaim] ?? $_.broadClaim); level = $_.permissionLevel } })))
+    } else { $blocks.Add((New-CippReportClearBox -Title 'No tenant-wide grants found' -Content 'No site or library grants access to Everyone, Everyone except external users, or All Users.')) }
+    $blocks.Add((New-CippReportHeading -Title 'Finding 2: External and Guest Access'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'Guest accounts holding permissions retain that access until somebody removes it - unlike a sharing link, nothing expires it. Guests from finished projects are a common source of standing access nobody is reviewing.'))
+    if ($external.Count -gt 0) {
+        $blocks.Add((New-CippReportAlertBox -Title ("$(plural $external.Count 'grant') held by external identities") -Colour $warnC -Content 'Verify each guest still needs access and that the relationship is current.'))
+        $blocks.Add((New-CippReportTable -Columns @(@{ header = 'Location'; key = 'location'; width = 2.2 }, @{ header = 'Identity'; key = 'identity'; width = 2.4 }, @{ header = 'Permission'; key = 'level'; width = 1.2 }) -Rows @($external | ForEach-Object { @{ location = (& $scopeLabel $_); identity = ($_.email ?? $_.title ?? $_.loginName); level = $_.permissionLevel } })))
+    } else { $blocks.Add((New-CippReportClearBox -Title 'No external grants found' -Content 'No guest or external identity holds a permission on a scanned site or library.')) }
+
+    # -- Findings continued --
+    $blocks.Add((New-CippReportPage -Title 'Findings (continued)' -Subtitle 'Elevated rights and inheritance'))
+    $blocks.Add((New-CippReportHeading -Title 'Finding 3: Directly Granted Full Control'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'Every site has an Owners group that holds Full Control by design, and that is expected. Full Control granted straight to a person or a directory group is different: it sits outside the membership structure, so it is not removed when someone leaves a team and it is easy to overlook when reviewing who administers a site.'))
+    if ($fullCtl.Count -gt 0) {
+        $blocks.Add((New-CippReportAlertBox -Title (plural $fullCtl.Count 'direct Full Control grant') -Colour $warnC -Content "Move these into the site's Owners group where the access is legitimate, so membership changes take effect automatically."))
+        $blocks.Add((New-CippReportTable -Columns @(@{ header = 'Location'; key = 'location'; width = 2.2 }, @{ header = 'Principal'; key = 'principal'; width = 2.2 }, @{ header = 'Type'; key = 'type'; width = 1.2 }) -Rows @($fullCtl | ForEach-Object { @{ location = (& $scopeLabel $_); principal = ($_.title ?? $_.email ?? $_.loginName); type = $_.principalType } })))
+    } else { $blocks.Add((New-CippReportClearBox -Title 'Full Control is held through Owners groups' -Content "No user or directory group holds Full Control outside a site's Owners group.")) }
+    $blocks.Add((New-CippReportHeading -Title 'Finding 4: Libraries With Their Own Permissions'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'A library normally inherits from its site, so managing the site manages everything in it. A detached library keeps its own permissions and later site-level changes no longer reach it. That is legitimate when deliberate and a blind spot when not - removing somebody from the site does not remove them here.'))
+    if ((nz $summary.uniquePermissionLibraries) -gt 0) {
+        $blocks.Add((New-CippReportParagraph -Text ("{0} of {1} libraries no longer inherit from their site. Their assignments are listed in the appendix. Review whether each detachment was intentional and is still needed." -f (nz $summary.uniquePermissionLibraries), (nz $summary.librariesScanned))))
+    } else { $blocks.Add((New-CippReportClearBox -Title 'All libraries inherit from their site' -Content 'Every scanned library takes its permissions from its site, so site-level access management covers them all.')) }
+
+    # -- Recommendations --
+    $blocks.Add((New-CippReportPage -Title 'Recommendations' -Subtitle 'What to do about the findings'))
+    $blocks.Add((New-CippReportHeading -Title 'Priority Actions'))
+    $blocks.Add((New-CippReportParagraph -Text 'Ordered by how much access each removes relative to the effort involved.'))
+    $blocks.Add((New-CippReportBullets -Items @(
+                @{ marker = '1.'; label = 'Replace tenant-wide grants.'; text = 'Swap Everyone and All Users grants for a specific group. This is the highest-value change available: a single edit removes access for everyone who was never meant to have it.' }
+                @{ marker = '2.'; label = 'Review guest permissions.'; text = 'Guests keep permissions indefinitely. Remove those whose projects have ended, and prefer time-boxed sharing for new external work.' }
+                @{ marker = '3.'; label = 'Move direct Full Control into Owners groups.'; text = 'Administrative rights held through the Owners group follow joiners and leavers. Held directly, they have to be remembered.' }
+                @{ marker = '4.'; label = 'Re-inherit libraries detached without reason.'; text = "Restoring inheritance brings a library back under site-level management. Only do this where the detachment was not deliberate - it discards the library's own permissions." }
+                @{ marker = '5.'; label = 'Prefer groups over individual grants.'; text = 'A permission held by a group updates itself as people join and leave. One held by a person does not.' }
+            )))
+    $blocks.Add((New-CippReportHeading -Title 'Keeping It That Way'))
+    $blocks.Add((New-CippReportBullets -Items @(
+                @{ label = 'Re-run this review regularly.'; text = 'Permissions drift as projects start and end. A periodic review catches drift while it is still small.' }
+                @{ label = 'Manage access at the site, not the library.'; text = 'Leaving libraries inherited keeps one place to look when somebody joins or leaves.' }
+                @{ label = 'Check effective access, not just the lists.'; text = 'A group holding Edit says nothing about who is in it. Use the access check on a site to confirm what a specific person can actually reach.' }
+                @{ label = 'Avoid tenant-wide audiences by default.'; text = 'Where content genuinely is organisation-wide, say so deliberately and review it, rather than reaching for Everyone because it is convenient.' }
+            )))
+
+    # -- Appendix --
+    $blocks.Add((New-CippReportPage -Title 'Appendix: Detached Library Permissions' -Subtitle 'Assignments on libraries that no longer inherit from their site'))
+    $blocks.Add((New-CippReportTable -Limit 40 -EmptyText 'No libraries hold their own permissions.' -Columns @(@{ header = 'Site'; key = 'site'; width = 1.8 }, @{ header = 'Library'; key = 'library'; width = 1.6 }, @{ header = 'Principal'; key = 'principal'; width = 2.2 }, @{ header = 'Permission'; key = 'level'; width = 1.2 }) -Rows @($libRows | ForEach-Object { @{ site = (& $siteLabel $_); library = $_.libraryTitle; principal = ($_.title ?? $_.email ?? $_.loginName); level = $_.permissionLevel } })))
+
+    @{
+        Blocks    = @($blocks)
+        Variables = @{
+            coverlabel         = 'Access Review'
+            coversubtitle      = "Who is structurally allowed into SharePoint sites and document libraries at $($Data.TenantName), and where that access reaches further than intended."
+            covermeta          = ("{0} sites $([char]0x00B7) {1} libraries $([char]0x00B7) {2} permission assignments" -f (nz $summary.sitesScanned), (nz $summary.librariesScanned), (nz $summary.totalAssignments))
+            covermetanote      = "Permission exposure: $exposure"
+            coverfooternote    = "Confidential $([char]0x2014) For Internal Use Only"
+            coverfallbackimage = '/reportImages/soc.jpg'
+            footerlabel        = "$($Data.TenantName) $([char]0x2014) SharePoint Permissions"
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippShadowAIReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippShadowAIReportTree.ps1
new file mode 100644
index 0000000000000..2e94fb5add244
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippShadowAIReportTree.ps1
@@ -0,0 +1,161 @@
+function Build-CippShadowAIReportTree {
+    <#
+    .SYNOPSIS
+        Compose the Shadow AI report as a component tree (server port of ShadowAIReportButton's
+        ShadowAIReportPages).
+    .PARAMETER Data
+        Shadow AI data: summary, detectedApps[], consentedApps[], topTools[], byRisk[]. Returns
+        @{ Blocks; Variables }.
+    .PARAMETER SectionConfig
+        Which sections to include, keyed executiveSummary/infographics/background/riskLevels/
+        sanctionedTools/detectedSoftware/entraApplications/recommendations. Empty (the default) includes
+        every section; a populated map includes only the keys set to $true (mirrors the client's section
+        toggles).
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][hashtable]$Data, [hashtable]$SectionConfig = @{})
+
+    $summary = if ($Data.summary) { $Data.summary } else { @{} }
+    # `?? @()` so a missing list is empty rather than @($null), which would render as one blank row.
+    $detected = @($Data.detectedApps ?? @())
+    $consented = @($Data.consentedApps ?? @())
+    $topTools = @($Data.topTools ?? @())
+    $byRisk = @($Data.byRisk ?? @())
+    $riskColours = @{ high = '#EF4444'; medium = '#F59E0B'; low = '#3B82F6'; informational = '#10B981' }
+    function RiskColour($r) { $k = "$r".ToLower(); if ($riskColours.ContainsKey($k)) { $riskColours[$k] } else { '#A0AEC0' } }
+    function nz($v) { if ($null -eq $v) { 0 } else { $v } }
+    # No config supplied -> full report; a supplied config includes only the keys explicitly set true.
+    $cfg = $SectionConfig
+    $allOn = ($null -eq $cfg -or $cfg.Count -eq 0)
+    function on($k) { if ($allOn) { $true } else { [bool]$cfg[$k] } }
+
+    $riskAreas = @(
+        @{ title = 'Data Leakage'; colour = '#EF4444'; text = 'Customer records, credentials, source code and financials pasted into consumer AI tools may be retained by the provider and used to train future models, permanently placing them outside your control. Every prompt is a data transfer to a third party.' }
+        @{ title = 'Compliance & Legal Exposure'; colour = '#F59E0B'; text = 'Processing personal data through unvetted AI services can breach GDPR, HIPAA and industry-specific regulations, and undermines contractual confidentiality commitments made to customers.' }
+        @{ title = 'Excessive Application Permissions'; colour = '#D69E2E'; text = 'AI meeting assistants and productivity plugins often request broad access to mailboxes, calendars and files. A single user consent can expose organization-wide data to a third-party service, and that access persists until the consent is revoked.' }
+        @{ title = 'Unreliable Output in Business Processes'; colour = '#3B82F6'; text = 'AI-generated content flows into quotes, contracts and customer communication without review. Errors produced by unmanaged tools are difficult to trace because the organization does not know the tools are in use.' }
+    )
+    $riskLevels = @(
+        @{ name = 'High'; text = 'Consumer tools that train on submitted data, retain prompts indefinitely, or operate from jurisdictions without adequate data protection. Content pasted into these tools should be treated as disclosed to an unvetted third party.' }
+        @{ name = 'Medium'; text = 'Tools with business-grade privacy options that are typically used through personal, unmanaged accounts. Risk depends heavily on the plan and account type in use.' }
+        @{ name = 'Low'; text = 'Tools with enterprise controls, contractual data-processing terms and no training on customer data when configured correctly.' }
+        @{ name = 'Informational'; text = 'Company sanctioned tools that have been explicitly approved for use in this tenant. They remain in the report for visibility but no longer contribute to the risk figures.' }
+    )
+
+    # Distinct sanctioned tools across both sources: device installs come from the Intune inventory
+    # rows, 7-day users from the Entra consent rows, summed per tool.
+    $sanctionedList = @($detected + $consented | Where-Object { $_.status -eq 'Sanctioned' } | Group-Object { $_.aiTool } | ForEach-Object {
+            @{
+                tool     = $_.Name
+                vendor   = $_.Group[0].vendor
+                category = $_.Group[0].category
+                devices  = ($_.Group | ForEach-Object { nz $_.deviceCount } | Measure-Object -Sum).Sum
+                users    = ($_.Group | ForEach-Object { nz $_.activeUsersLast7Days } | Measure-Object -Sum).Sum
+            }
+        } | Select-Object -First 18)
+    $detectedRows = @($detected | Select-Object -First 18)
+    $consentedRows = @($consented | Select-Object -First 18)
+
+    $blocks = [System.Collections.Generic.List[object]]::new()
+
+    # -- AI Summary --
+    if (on 'executiveSummary') {
+        $blocks.Add((New-CippReportPage -Title 'AI Summary' -Subtitle 'Strategic overview of AI usage in your Microsoft 365 environment'))
+        $blocks.Add((New-CippReportParagraph -Html ('<p>This report identifies the artificial intelligence tools discovered in the <b>{0}</b> environment, combining software inventory from managed devices (Intune) with cloud application consent data from Entra ID. Each tool is matched against a curated catalog of known AI services and assigned a risk level based on its data handling practices.</p>' -f [System.Net.WebUtility]::HtmlEncode([string]$Data.TenantName))))
+        $blocks.Add((New-CippReportParagraph -Html '<p>Tools that have been explicitly approved are marked as company sanctioned and report the Informational risk level. Everything else represents shadow AI: tools adopted by employees without review or approval, whose handling of company data is unknown.</p>'))
+        $blocks.Add((New-CippReportStatRow -Title 'AI Usage Overview' -Stats @(
+                    @{ value = (nz $summary.aiToolsDetected); label = 'AI Tools' }
+                    @{ value = (nz $summary.deviceInstalls); label = 'Device Installs' }
+                    @{ value = (nz $summary.consentedAiApps); label = 'Entra AI Apps' }
+                    @{ value = (nz $summary.highRiskTools); label = 'High Risk'; colour = (RiskColour 'high') }
+                    @{ value = (nz $summary.sanctionedTools); label = 'Sanctioned'; colour = (RiskColour 'informational') }
+                )))
+        if ($topTools.Count -gt 0) {
+            $blocks.Add((New-CippReportTable -Title 'Most Used AI Tools' -Limit $topTools.Count -Columns @(
+                        @{ header = 'Tool'; key = 'tool'; width = 3; bold = $true }, @{ header = 'Category'; key = 'category'; width = 3 }
+                        @{ header = 'Status'; key = 'status'; width = 2 }, @{ header = 'Devices'; key = 'devices'; width = 1.5 }, @{ header = 'Users (7d)'; key = 'users'; width = 1.5 }
+                    ) -Rows @($topTools | ForEach-Object { @{ tool = $_.tool; category = $_.category; status = ($_.status ?? 'Unsanctioned'); devices = "$($_.devices)"; users = "$($_.users)" } })))
+        }
+    }
+
+    if (on 'infographics') { $blocks.Add((New-CippReportHero -Image '/reportImages/laptop.jpg' -Highlight '75%' -SubText "of knowledge workers already`nuse generative AI at work -`nmost without their employer knowing" -FooterText "Visibility is the first step`nto control")) }
+
+    # -- Understanding Shadow AI --
+    if (on 'background') {
+        $blocks.Add((New-CippReportPage -Title 'Understanding Shadow AI' -Subtitle 'What unmanaged AI usage means for your organization'))
+        $blocks.Add((New-CippReportParagraph -Text 'Shadow AI is the use of artificial intelligence tools by employees without the knowledge or approval of the organization - the AI-era equivalent of shadow IT. Because most AI tools are free, browser-based and immediately useful, adoption happens quietly and quickly: an employee pastes a customer email into a chatbot to draft a reply, uploads a spreadsheet for analysis, or installs an AI notetaker that joins every meeting.'))
+        $blocks.Add((New-CippReportParagraph -Text 'The goal of a shadow AI program is not zero AI usage, but zero unsanctioned usage. Every tool in this report should end up either approved and managed, or replaced and blocked. The four risk areas below explain why unmanaged usage deserves attention.'))
+        $blocks.Add((New-CippReportHeading -Title 'Key Risk Areas'))
+        foreach ($area in $riskAreas) { $blocks.Add((New-CippReportInfoBox -Title $area.title -Colour $area.colour -Content $area.text)) }
+    }
+
+    # -- Risk Levels & Distribution --
+    if (on 'riskLevels') {
+        $blocks.Add((New-CippReportPage -Title 'AI Tool Risk Levels' -Subtitle 'How risk is assigned and how it is distributed in this tenant'))
+        $blocks.Add((New-CippReportParagraph -Text 'Detected tools are matched against a curated catalog of known AI services, each carrying a risk classification based on its data handling practices, account model and enterprise controls. Marking a tool as company sanctioned overrides its catalog risk with the Informational level, so the figures below reflect only unapproved use.'))
+        $blocks.Add((New-CippReportChart -Kind donut -Title 'AI Tool Risk Distribution' -CentreLabel 'Tools' -Data @($byRisk | ForEach-Object { @{ label = $_.risk; value = $_.tools; colour = (RiskColour $_.risk) } })))
+        $blocks.Add((New-CippReportInfoBoxColumns -Columns 2 -Items @($riskLevels | ForEach-Object { @{ title = $_.name; content = $_.text; colour = (RiskColour $_.name); tintTitle = $true } })))
+    }
+
+    # -- Sanctioned Tools --
+    if ((on 'sanctionedTools') -and $sanctionedList.Count -gt 0) {
+        $blocks.Add((New-CippReportPage -Title 'Company Sanctioned AI Tools' -Subtitle 'AI tools that are approved for use in this organization'))
+        $blocks.Add((New-CippReportParagraph -Text 'The tools listed below are permitted in this environment. They are allowed either because a business justification exists for their use, or because the system administrator has explicitly approved these tools for deployment. Sanctioned tools report the Informational risk level and are excluded from the shadow AI risk figures in this report; they remain listed for visibility into where AI is used across the organization.'))
+        $blocks.Add((New-CippReportParagraph -Text "Approval is not permanent: sanctioned tools should be reviewed periodically to confirm that the plan in use, the vendor's data handling terms and the business justification still hold."))
+        $blocks.Add((New-CippReportTable -Limit $sanctionedList.Count -Columns @(
+                    @{ header = 'Tool'; key = 'tool'; width = 3; bold = $true }, @{ header = 'Vendor'; key = 'vendor'; width = 3 }, @{ header = 'Category'; key = 'category'; width = 3 }
+                    @{ header = 'Devices'; key = 'devices'; width = 2 }, @{ header = 'Users (7d)'; key = 'users'; width = 2 }
+                ) -Rows @($sanctionedList | ForEach-Object { @{ tool = $_.tool; vendor = $_.vendor; category = $_.category; devices = "$($_.devices)"; users = "$($_.users)" } })))
+    }
+
+    # -- Detected Software --
+    if (on 'detectedSoftware') {
+        $blocks.Add((New-CippReportPage -Title 'AI Software on Managed Devices' -Subtitle 'AI applications found in the Intune software inventory'))
+        $detNote = if ($detected.Count -gt $detectedRows.Count) { ", showing the top $($detectedRows.Count) of $($detected.Count) entries" } else { '' }
+        $blocks.Add((New-CippReportParagraph -Text "The following AI applications were detected in the software inventory of managed devices$detNote. Device counts indicate how widely each application has spread through the environment."))
+        $blocks.Add((New-CippReportTable -Limit $detectedRows.Count -EmptyText 'No AI software was detected on managed devices during the last inventory sync.' -Columns @(
+                    @{ header = 'Application'; key = 'application'; width = 4; bold = $true }, @{ header = 'AI Tool'; key = 'aiTool'; width = 3 }, @{ header = 'Category'; key = 'category'; width = 3 }
+                    @{ header = 'Risk'; key = 'risk'; width = 2; colourField = 'riskColour' }, @{ header = 'Status'; key = 'status'; width = 2.5 }, @{ header = 'Devices'; key = 'deviceCount'; width = 1.5 }
+                ) -Rows @($detectedRows | ForEach-Object { @{ application = $_.application; aiTool = $_.aiTool; category = $_.category; risk = $_.risk; riskColour = (RiskColour $_.risk); status = $_.status; deviceCount = "$($_.deviceCount)" } })))
+    }
+
+    # -- Entra Applications --
+    if (on 'entraApplications') {
+        $blocks.Add((New-CippReportPage -Title 'AI Applications in Entra ID' -Subtitle 'AI services with a footprint in your identity platform'))
+        $conNote = if ($consented.Count -gt $consentedRows.Count) { ", showing the top $($consentedRows.Count) of $($consented.Count) entries" } else { '' }
+        $blocks.Add((New-CippReportParagraph -Text "The following AI services are registered as applications in the tenant, including any permissions users have consented to$conNote. The consent date shows when each service first gained a foothold in the environment."))
+        $blocks.Add((New-CippReportTable -Limit $consentedRows.Count -EmptyText 'No AI applications were found in Entra ID.' -Columns @(
+                    @{ header = 'Application'; key = 'application'; width = 4; bold = $true }, @{ header = 'AI Tool'; key = 'aiTool'; width = 3 }
+                    @{ header = 'Risk'; key = 'risk'; width = 2; colourField = 'riskColour' }, @{ header = 'Status'; key = 'status'; width = 2.5 }, @{ header = 'Users (7d)'; key = 'activeUsersLast7Days'; width = 2 }, @{ header = 'First Consented'; key = 'firstConsented'; width = 2.5 }
+                ) -Rows @($consentedRows | ForEach-Object { @{ application = $_.application; aiTool = $_.aiTool; risk = $_.risk; riskColour = (RiskColour $_.risk); status = $_.status; activeUsersLast7Days = "$($_.activeUsersLast7Days)"; firstConsented = $(if ($_.firstConsentedDateTime) { ([datetime]$_.firstConsentedDateTime).ToString('M/d/yyyy') } else { 'Unknown' }) } })))
+    }
+
+    if (on 'infographics') { $blocks.Add((New-CippReportHero -Image '/reportImages/working.jpg' -Highlight '1 in 3' -SubText "employees shares sensitive work data`nwith AI tools without approval" -FooterText "Sanctioned alternatives keep`nyour data under contract")) }
+
+    # -- Recommendations --
+    if (on 'recommendations') {
+        $blocks.Add((New-CippReportPage -Title 'Recommendations' -Subtitle 'A structured response to shadow AI in your environment'))
+        $blocks.Add((New-CippReportParagraph -Text 'A structured response to shadow AI combines approval of useful tools with controls on the rest. The following actions are recommended based on the findings in this report:'))
+        $blocks.Add((New-CippReportBullets -Title 'Action Plan' -Items @(
+                    @{ label = 'Review & Decide:'; text = 'Evaluate each detected tool with stakeholders and decide whether it should be sanctioned, replaced with an approved alternative, or blocked.' }
+                    @{ label = 'Sanction Approved Tools:'; text = 'Maintain a list of company sanctioned tools so future reports separate approved AI use from true shadow AI.' }
+                    @{ label = 'Offer an Alternative:'; text = 'Provide a sanctioned option such as Microsoft 365 Copilot before blocking popular tools - blocking without an alternative drives usage to personal devices.' }
+                    @{ label = 'Restrict Consent:'; text = 'Require admin approval for unverified applications in Entra ID so new AI services cannot access company data through user consent.' }
+                    @{ label = 'Block & Monitor:'; text = 'Deploy Conditional Access and Defender for Cloud Apps policies to block or monitor unsanctioned AI web services.' }
+                    @{ label = 'Extend DLP:'; text = 'Cover generative AI endpoints with data loss prevention policies to stop sensitive data from being pasted into chat prompts.' }
+                    @{ label = 'Train Users:'; text = 'Publish an acceptable AI use policy and train users on what data may never be shared with AI tools.' }
+                    @{ label = 'Review Monthly:'; text = 'Re-run this report on a regular cadence - new AI tools appear in tenants within days of release.' }
+                )))
+        $blocks.Add((New-CippReportInfoBox -Title 'Next Review' -Content 'The AI tool landscape changes quickly and new tools appear in tenants within days of release. We recommend re-running this assessment monthly and reviewing newly detected tools against your acceptable AI use policy.'))
+    }
+
+    @{
+        Blocks    = @($blocks)
+        Variables = @{
+            coverlabel         = 'AI Risk Assessment'
+            coversubtitle      = 'Discovery and risk assessment of AI tools in use across managed devices and cloud applications.'
+            coverfallbackimage = '/reportImages/city.jpg'
+            footerlabel        = "$($Data.TenantName) - Shadow AI Report"
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Build-CippSharingReportTree.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippSharingReportTree.ps1
new file mode 100644
index 0000000000000..338cb25fd34c4
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Build-CippSharingReportTree.ps1
@@ -0,0 +1,138 @@
+function Build-CippSharingReportTree {
+    <#
+    .SYNOPSIS
+        Compose the SharePoint/OneDrive Sharing report as a component tree (server port of
+        SharingReportButton.jsx).
+    .DESCRIPTION
+        Pure composition from already-gathered sharing data. Returns @{ Blocks; Variables }: the
+        component nodes for ConvertTo-CippReportPdf and the cover/footer report variables.
+    .PARAMETER Data
+        Sharing data: summary (counts), links[], topRecipients[], topLibraries[].
+    #>
+    [CmdletBinding()]
+    param([Parameter(Mandatory)][hashtable]$Data)
+
+    $summary = if ($Data.summary) { $Data.summary } else { @{} }
+    # `?? @()` so a missing list is empty rather than @($null), which would render as one blank row.
+    $links = @($Data.links ?? @())
+    $topRecipients = @($Data.topRecipients ?? @())
+    $topLibraries = @($Data.topLibraries ?? @())
+    function nz($v) { if ($null -eq $v) { 0 } else { [int]$v } }
+    function plural($c, $s, $p) { "$c $(if ($c -eq 1) { $s } else { if ($p) { $p } else { "${s}s" } })" }
+    function joinList($v) { if ($v -is [array]) { $v -join ', ' } else { [string]$v } }
+
+    # Exposure grade (client assessExposure).
+    $score = (@(
+            if ((nz $summary.anonymousEditLinks) -gt 0) { 5 }
+            if ((nz $summary.neverExpiringAnonymous) -gt 0) { 3 }
+            if ((nz $summary.anonymousLinks) -gt 0) { 2 }
+            if ((nz $summary.folderShares) -gt 0) { 2 }
+            if ((nz $summary.externalLinks) -gt 0) { 1 }
+        ) | Measure-Object -Sum).Sum
+    $exposure = if ($score -ge 7) { 'High' } elseif ($score -ge 3) { 'Medium' } else { 'Low' }
+    $dangerC = '#742A2A'; $warnC = '#744210'
+    $sevColour = @{ High = $dangerC; Medium = $warnC; Low = '#22543D' }[$exposure]
+
+    $canEdit = { param($r) (joinList $r.roles) -match 'write|owner' }
+    $anonEdit = @($links | Where-Object { $_.classification -eq 'Anonymous' -and (& $canEdit $_) })
+    $neverExp = @($links | Where-Object { $_.classification -eq 'Anonymous' -and -not $_.expirationDateTime })
+    $folderShares = @($links | Where-Object { $_.itemType -eq 'Folder' -and @('Anonymous', 'External') -contains $_.classification })
+    $externalRows = @($links | Where-Object { $_.classification -eq 'External' })
+    $locationOf = { param($r) "$(if ($r.siteName) { $r.siteName } elseif ($r.siteUrl) { $r.siteUrl } else { 'Unknown site' })$(if ($r.driveName) { " / $($r.driveName)" })" }
+    $expiryOf = { param($r) if ($r.expirationDateTime) { ([datetime]$r.expirationDateTime).ToString('M/d/yyyy') } else { 'Never' } }
+
+    $blocks = [System.Collections.Generic.List[object]]::new()
+
+    # -- Executive Summary --
+    $blocks.Add((New-CippReportPage -Title 'Executive Summary' -Subtitle 'What has been shared, and how far it reaches'))
+    $blocks.Add((New-CippReportParagraph -Html ('<p>Sharing links are created by users on individual files and folders. They hand out access outside the permission structure an administrator sets on a site or library, they accumulate quietly as people work, and nothing prompts anyone to review them. This report covers what exists today across SharePoint and OneDrive in <b>{0}</b>.</p>' -f [System.Net.WebUtility]::HtmlEncode([string]$Data.TenantName))))
+    $blocks.Add((New-CippReportStatRow -Stats @(
+                @{ value = (nz $summary.anonymousEditLinks); label = 'Anonymous & Editable'; colour = $(if ((nz $summary.anonymousEditLinks) -gt 0) { $dangerC }) }
+                @{ value = (nz $summary.neverExpiringAnonymous); label = 'Anonymous, No Expiry'; colour = $(if ((nz $summary.neverExpiringAnonymous) -gt 0) { $dangerC }) }
+                @{ value = (nz $summary.folderShares); label = 'Shared Folders'; colour = $(if ((nz $summary.folderShares) -gt 0) { $warnC }) }
+                @{ value = (nz $summary.externalRecipients); label = 'External Recipients'; colour = $(if ((nz $summary.externalRecipients) -gt 0) { $warnC }) }
+            )))
+    $expText = switch ($exposure) {
+        'High' { 'Content is reachable by people who cannot be identified. Anonymous links work for anyone holding them, with no sign-in and no record of use - and where those links also allow editing, changes are attributed to nobody. Treat the findings below as immediate remediation work.' }
+        'Medium' { 'Sharing extends beyond the intended audience in places. Each finding below is individually manageable, but every open link widens what a single forwarded message can expose.' }
+        default { 'No high-risk sharing was found. Links are scoped and time-bounded. Continue reviewing periodically, since sharing accumulates as projects come and go.' }
+    }
+    $blocks.Add((New-CippReportAlertBox -Title "Sharing Exposure: $exposure" -Colour $sevColour -Content $expText))
+    $blocks.Add((New-CippReportInfoBox -Title 'What was examined' -Content ("{0} sharing links and external shares across {1} SharePoint sites, {2} Teams-connected sites and {3} OneDrive accounts, covering {4} distinct shared items. Data is taken from the last completed sync, not read live." -f (nz $summary.totalLinks), (nz $summary.sharePointSites), (nz $summary.teamsSites), (nz $summary.oneDriveAccounts), (nz $summary.itemsShared))))
+    $blocks.Add((New-CippReportInfoBox -Title 'What is not covered' -Content 'This report covers sharing links only. Permissions granted on a site or document library are a separate access path, governed differently, and are covered by the Permissions Report. A clean result here does not mean access is restricted - it means nothing has been shared out by link.'))
+
+    # -- Findings --
+    $blocks.Add((New-CippReportPage -Title 'Findings' -Subtitle 'Shares worth reviewing, most urgent first'))
+    $blocks.Add((New-CippReportHeading -Title 'Finding 1: Anonymous Links That Allow Editing'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'An anonymous link works for anyone who holds it - no sign-in, no record of who used it. When that link also grants editing, anyone it has been forwarded to can change or delete the content, and the change is attributed to nobody. This is the only combination that allows untraceable modification.'))
+    if ($anonEdit.Count -gt 0) {
+        $blocks.Add((New-CippReportAlertBox -Title (plural $anonEdit.Count 'anonymous editable link') -Colour $dangerC -Content 'Revoke these, or downgrade them to view-only where the sharing is still needed.'))
+        $blocks.Add((New-CippReportTable -Columns @(@{ header = 'Item'; key = 'item'; width = 2.4 }, @{ header = 'Location'; key = 'location'; width = 2 }, @{ header = 'Expires'; key = 'expires'; width = 1 }) -Rows @($anonEdit | ForEach-Object { @{ item = $_.fileName; location = (& $locationOf $_); expires = (& $expiryOf $_) } })))
+    } else {
+        $blocks.Add((New-CippReportClearBox -Title 'No anonymous editable links' -Content 'No anonymous link grants write access.'))
+    }
+    $blocks.Add((New-CippReportHeading -Title 'Finding 2: Anonymous Links That Never Expire'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'A link with no expiry date stays live indefinitely, long after the reason for sharing has passed. Expiry is the only control that withdraws this access without somebody remembering to do it.'))
+    if ($neverExp.Count -gt 0) {
+        $blocks.Add((New-CippReportAlertBox -Title ("$(plural $neverExp.Count 'anonymous link') with no expiry") -Colour $warnC -Content 'Set a tenant-level default expiry so this cannot recur, then revoke the existing links that are no longer needed.'))
+        $blocks.Add((New-CippReportTable -Columns @(@{ header = 'Item'; key = 'item'; width = 2.4 }, @{ header = 'Location'; key = 'location'; width = 2 }, @{ header = 'Permission'; key = 'roles'; width = 1 }) -Rows @($neverExp | ForEach-Object { @{ item = $_.fileName; location = (& $locationOf $_); roles = (joinList $_.roles) } })))
+    } else {
+        $blocks.Add((New-CippReportClearBox -Title 'All anonymous links expire' -Content 'Every anonymous link has an expiry date set.'))
+    }
+
+    # -- Findings continued --
+    $blocks.Add((New-CippReportPage -Title 'Findings (continued)' -Subtitle 'Reach and recipients'))
+    $blocks.Add((New-CippReportHeading -Title 'Finding 3: Shared Folders'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content "Sharing a folder shares everything inside it, including anything added later. The recipient's access grows over time without anyone re-approving it, which is the main way a small share quietly becomes a large one."))
+    if ($folderShares.Count -gt 0) {
+        $blocks.Add((New-CippReportAlertBox -Title ("$(plural $folderShares.Count 'folder') shared externally or anonymously") -Colour $warnC -Content 'Check what each folder holds now, not what it held when it was shared.'))
+        $blocks.Add((New-CippReportTable -Columns @(@{ header = 'Folder'; key = 'item'; width = 2.2 }, @{ header = 'Location'; key = 'location'; width = 2 }, @{ header = 'Audience'; key = 'audience'; width = 1.2 }) -Rows @($folderShares | ForEach-Object { @{ item = $_.fileName; location = (& $locationOf $_); audience = $_.classification } })))
+    } else {
+        $blocks.Add((New-CippReportClearBox -Title 'No externally shared folders' -Content 'External and anonymous shares point at individual files rather than folders.'))
+    }
+    $blocks.Add((New-CippReportHeading -Title 'Finding 4: External Recipients'))
+    $blocks.Add((New-CippReportInfoBox -Title 'Why this matters' -Content 'Every external recipient is a person outside the organisation holding access that was granted individually, usually for a specific piece of work. Nothing withdraws it when that work ends.'))
+    if ($topRecipients.Count -gt 0) {
+        $blocks.Add((New-CippReportParagraph -Text ("{0} hold shared content, across {1}. The most frequent are listed below." -f (plural (nz $summary.externalRecipients) 'external identity' 'external identities'), (plural $externalRows.Count 'share'))))
+        $blocks.Add((New-CippReportTable -Limit 15 -Columns @(@{ header = 'Recipient'; key = 'recipient'; width = 3 }, @{ header = 'Shares'; key = 'shares'; width = 1 }) -Rows @($topRecipients | ForEach-Object { @{ recipient = $_.recipient; shares = "$($_.links)" } })))
+    } else {
+        $blocks.Add((New-CippReportClearBox -Title 'No external recipients' -Content 'Nothing has been shared with an identity outside the organisation.'))
+    }
+    if ($topLibraries.Count -gt 0) {
+        $blocks.Add((New-CippReportHeading -Title 'Where Sharing Concentrates'))
+        $blocks.Add((New-CippReportParagraph -Text 'The libraries below account for the most sharing links. Concentration is not a problem in itself, but it shows where a review will have the most effect.'))
+        $blocks.Add((New-CippReportTable -Limit 10 -Columns @(@{ header = 'Library'; key = 'library'; width = 3 }, @{ header = 'Links'; key = 'links'; width = 1 }) -Rows @($topLibraries | ForEach-Object { @{ library = $_.library; links = "$($_.links)" } })))
+    }
+
+    # -- Recommendations --
+    $blocks.Add((New-CippReportPage -Title 'Recommendations' -Subtitle 'What to do about the findings'))
+    $blocks.Add((New-CippReportHeading -Title 'Priority Actions'))
+    $blocks.Add((New-CippReportParagraph -Text 'Ordered by how much exposure each removes relative to the effort involved.'))
+    $blocks.Add((New-CippReportBullets -Items @(
+                @{ marker = '1.'; label = 'Revoke or downgrade anonymous editable links.'; text = 'Anonymous plus editable is the only combination allowing untracked changes. Switching to view-only keeps the sharing working while removing the ability to alter content.' }
+                @{ marker = '2.'; label = 'Set a default expiry for anonymous links.'; text = 'A tenant-level expiry policy stops never-expiring links being created again. This fixes the cause rather than the instances, so the problem does not rebuild.' }
+                @{ marker = '3.'; label = 'Review folder-level external shares.'; text = 'Share specific files where practical. A folder share keeps granting access to content that did not exist when it was approved.' }
+                @{ marker = '4.'; label = 'Review long-standing external recipients.'; text = 'Revoke shares belonging to finished engagements. External access has no natural end unless someone gives it one.' }
+                @{ marker = '5.'; label = 'Require sign-in where the audience is known.'; text = 'A link scoped to specific people records who opened it. Anonymous links cannot be attributed to anyone.' }
+            )))
+    $blocks.Add((New-CippReportHeading -Title 'Keeping It That Way'))
+    $blocks.Add((New-CippReportBullets -Items @(
+                @{ label = 'Re-run this review regularly.'; text = 'Sharing accumulates continuously. A periodic review catches it while the list is still short.' }
+                @{ label = 'Set sharing defaults at tenant and site level.'; text = 'Default link type, expiry and permitted domains stop the riskiest shares being created at all, which is far cheaper than finding them later.' }
+                @{ label = 'Restrict anonymous links to view-only.'; text = 'If anonymous sharing is needed at all, removing the edit option eliminates untraceable changes without blocking the sharing itself.' }
+                @{ label = 'Password-protect sensitive shares.'; text = 'A password meaningfully narrows who can use a link that has been forwarded on.' }
+            )))
+
+    @{
+        Blocks    = @($blocks)
+        Variables = @{
+            coverlabel         = 'Data Sharing Review'
+            coversubtitle      = "What has been shared out of SharePoint and OneDrive at $($Data.TenantName), who it reaches, and which of those shares are worth acting on."
+            covermeta          = ("{0} sharing links $([char]0x00B7) {1} items $([char]0x00B7) {2} external recipients" -f (nz $summary.totalLinks), (nz $summary.itemsShared), (nz $summary.externalRecipients))
+            covermetanote      = "Sharing exposure: $exposure"
+            coverfooternote    = "Confidential $([char]0x2014) For Internal Use Only"
+            coverfallbackimage = '/reportImages/glasses.jpg'
+            footerlabel        = "$($Data.TenantName) $([char]0x2014) SharePoint & OneDrive Sharing"
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Convert-CippExecStandardsToControls.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Convert-CippExecStandardsToControls.ps1
new file mode 100644
index 0000000000000..0cc80cad7318e
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Convert-CippExecStandardsToControls.ps1
@@ -0,0 +1,136 @@
+function Convert-CippExecStandardsToControls {
+    <#
+    .SYNOPSIS
+        Resolve the standards-comparison result into the Executive report's SecurityControls rows.
+    .DESCRIPTION
+        Server port of processStandardsData() from ExecutiveReportButton.jsx. Walks the first tenant's
+        standards.* entries in a ListStandardsCompare result, decides Compliant vs Review the same way the
+        client does (CurrentValue/ExpectedValue deep-equal with top-level keys sorted, else Value -eq $true),
+        and resolves each standard's display name / description / tags from the standards catalog
+        (Config\standards.json). Standards with no catalog entry fall back to a template display-name lookup
+        or a formatted key, exactly as the client does. Pure transform - no data gathering - so it is
+        unit-testable with sample data.
+    .PARAMETER Compare
+        The ListStandardsCompare Body: an array whose first element is the tenant's standards object.
+    .PARAMETER Templates
+        The listStandardTemplates Body, used only to resolve Intune/CA template GUIDs to display names.
+    .PARAMETER Catalog
+        The parsed Config\standards.json catalog (array of standard definitions).
+    #>
+    [CmdletBinding()]
+    param(
+        $Compare,
+        $Templates = @(),
+        $Catalog = @()
+    )
+
+    # JS parity: JSON.stringify of an object whose top-level keys are sorted. Nested objects keep their
+    # order, which ConvertTo-Json also does, so structurally-equal values serialize identically on both
+    # sides of the comparison.
+    function ConvertTo-CanonicalJson($Value) {
+        if ($null -eq $Value) { return 'null' }
+        if ($Value -is [hashtable] -or $Value -is [System.Collections.Specialized.OrderedDictionary]) {
+            $o = [ordered]@{}
+            foreach ($k in ($Value.Keys | Sort-Object)) { $o[$k] = $Value[$k] }
+            return ($o | ConvertTo-Json -Depth 20 -Compress)
+        }
+        if ($Value -is [System.Management.Automation.PSCustomObject]) {
+            $o = [ordered]@{}
+            foreach ($n in ($Value.PSObject.Properties.Name | Sort-Object)) { $o[$n] = $Value.$n }
+            return ($o | ConvertTo-Json -Depth 20 -Compress)
+        }
+        return ($Value | ConvertTo-Json -Depth 20 -Compress)
+    }
+
+    $CompareArr = @($Compare)
+    if ($CompareArr.Count -eq 0 -or $null -eq $CompareArr[0]) { return @() }
+    $TenantData = $CompareArr[0]
+
+    # Template GUID -> display name (Intune + Conditional Access templates, incl. Tags expansion).
+    $TemplateMap = @{}
+    foreach ($Template in @($Templates)) {
+        $Std = $Template.standards
+        if (-not $Std) { continue }
+        foreach ($ListName in @('IntuneTemplate', 'ConditionalAccessTemplate')) {
+            $Items = $Std.$ListName
+            if (-not $Items) { continue }
+            foreach ($Item in @($Items)) {
+                $Tl = $Item.TemplateList
+                if ($Tl -and $Tl.value -and $Tl.label) { $TemplateMap[([string]$Tl.value).ToLower()] = [string]$Tl.label }
+                $Tags = $Item.'TemplateList-Tags'
+                $TagTemplates = $null
+                if ($Tags) {
+                    $TagTemplates = $Tags.addedFields.templates
+                    if (-not $TagTemplates) { $TagTemplates = $Tags.rawData.templates }
+                }
+                foreach ($Et in @($TagTemplates)) {
+                    if ($Et.GUID -and ($Et.displayName -or $Et.name)) {
+                        $TemplateMap[([string]$Et.GUID).ToLower()] = [string]($Et.displayName ?? $Et.name)
+                    }
+                }
+            }
+        }
+    }
+
+    # Catalog by full standard name (e.g. 'standards.CopilotSettings').
+    $CatalogMap = @{}
+    foreach ($C in @($Catalog)) { if ($C.name) { $CatalogMap[[string]$C.name] = $C } }
+
+    $PropNames = if ($TenantData -is [hashtable]) { @($TenantData.Keys) } else { @($TenantData.PSObject.Properties.Name) }
+    $Out = [System.Collections.Generic.List[object]]::new()
+
+    foreach ($Key in $PropNames) {
+        $KeyStr = [string]$Key
+        if (-not $KeyStr.StartsWith('standards.') -or $KeyStr -eq 'tenantFilter') { continue }
+        $Val = if ($TenantData -is [hashtable]) { $TenantData[$Key] } else { $TenantData.$Key }
+
+        # Compliance: CurrentValue/ExpectedValue deep-equal (defined -> compared, null counts as defined),
+        # else Value -eq $true.
+        $HasCV = $false; $HasEV = $false; $CV = $null; $EV = $null; $ValueTrue = $false
+        if ($Val -is [hashtable]) {
+            $HasCV = $Val.ContainsKey('CurrentValue'); if ($HasCV) { $CV = $Val['CurrentValue'] }
+            $HasEV = $Val.ContainsKey('ExpectedValue'); if ($HasEV) { $EV = $Val['ExpectedValue'] }
+            if ($Val.ContainsKey('Value')) { $ValueTrue = ($Val['Value'] -eq $true) }
+        } elseif ($Val -is [System.Management.Automation.PSCustomObject]) {
+            $Props = $Val.PSObject.Properties.Name
+            $HasCV = $Props -contains 'CurrentValue'; if ($HasCV) { $CV = $Val.CurrentValue }
+            $HasEV = $Props -contains 'ExpectedValue'; if ($HasEV) { $EV = $Val.ExpectedValue }
+            if ($Props -contains 'Value') { $ValueTrue = ($Val.Value -eq $true) }
+        }
+
+        $IsCompliant = $false
+        if ($HasCV -and $HasEV) {
+            $IsCompliant = ((ConvertTo-CanonicalJson $CV) -eq (ConvertTo-CanonicalJson $EV))
+        } elseif ($ValueTrue) {
+            $IsCompliant = $true
+        }
+        $Status = if ($IsCompliant) { 'Compliant' } else { 'Review' }
+
+        $Def = $CatalogMap[$KeyStr]
+        if ($Def) {
+            $Tags = if ($Def.tag -and @($Def.tag).Count -gt 0) { (@($Def.tag) | Select-Object -First 2) -join ', ' } else { 'No tags' }
+            $Name = [string]$Def.label
+            $Desc = if (-not [string]::IsNullOrWhiteSpace([string]$Def.executiveText)) { [string]$Def.executiveText }
+            elseif (-not [string]::IsNullOrWhiteSpace([string]$Def.helpText)) { [string]$Def.helpText }
+            else { 'No description available' }
+        } else {
+            $Tags = 'No tags'
+            $Desc = 'Security standard implementation'
+            if ($KeyStr -match '^standards\.IntuneTemplate\.([0-9a-fA-F-]+)') {
+                $Guid = $Matches[1]
+                $Name = $TemplateMap[$Guid.ToLower()] ?? ('Intune Template - ' + $Guid.Substring(0, [Math]::Min(8, $Guid.Length)))
+            } elseif ($KeyStr -match '^standards\.ConditionalAccessTemplate\.([0-9a-fA-F-]+)') {
+                $Guid = $Matches[1]
+                $Name = $TemplateMap[$Guid.ToLower()] ?? ('CA Template - ' + $Guid.Substring(0, [Math]::Min(8, $Guid.Length)))
+            } else {
+                $N = $KeyStr -replace '^standards\.', ''
+                $N = ([regex]::Replace($N, '([A-Z])', ' $1')).Trim()
+                $Name = if ($N.Length -gt 0) { $N.Substring(0, 1).ToUpper() + $N.Substring(1) } else { $N }
+            }
+        }
+
+        $Out.Add(@{ name = $Name; description = $Desc; status = $Status; tags = $Tags })
+    }
+
+    return @($Out)
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Get-CippReportSankeyData.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Get-CippReportSankeyData.ps1
new file mode 100644
index 0000000000000..6de5a9a5d321c
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Get-CippReportSankeyData.ps1
@@ -0,0 +1,194 @@
+function Get-CippReportSankeyData {
+    <#
+    .SYNOPSIS
+        Build the { nodes, links } for a dashboard-style sankey from its source collection rows.
+    .DESCRIPTION
+        Faithful server-side ports of the dashboard cards' sankey computations so a report renders the
+        SAME sankey a user sees on the dashboard. Each preset reads the raw collection rows and returns
+        @{ nodes = @(@{ id; label; nodeColor }, ...); links = @(@{ source; target; value }, ...) }.
+
+        Ported one-to-one from the frontend cards (keep them in step):
+          mfaCoverage       <- MFACard.jsx        (MFAState)        enabled -> registered/not -> enforcement
+          authMethods       <- AuthMethodCard.jsx (MFAState)        users -> factor class -> method breakdown
+          licenseAllocation <- LicenseCard.jsx    (LicenseOverview) top-5 licence -> assigned/available
+          deviceCompliance  <- managed devices    (ManagedDevices)  devices -> OS -> compliance state
+
+        Nodes with no link are dropped by the renderer, so declaring the full node set is safe.
+    .PARAMETER Preset
+        Which dashboard sankey to build.
+    .PARAMETER Rows
+        The raw collection rows for that sankey's source (unfiltered; each builder filters as the card does).
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$Preset,
+        [AllowEmptyCollection()][object[]]$Rows = @()
+    )
+
+    $Nodes = [System.Collections.Generic.List[object]]::new()
+    $Links = [System.Collections.Generic.List[object]]::new()
+    $AddNode = { param($Id, $Label, $Colour) $Nodes.Add([ordered]@{ id = $Id; label = $Label; nodeColor = $Colour }) }
+    $AddLink = { param($Source, $Target, $Value) if ($Value -gt 0) { $Links.Add([ordered]@{ source = $Source; target = $Target; value = $Value }) } }
+
+    switch ($Preset) {
+        'mfaCoverage' {
+            # MFACard.jsx: enabled users -> MFA registered / Not registered -> how it is enforced.
+            $Enabled = @($Rows | Where-Object { $_.AccountEnabled -eq $true })
+            $RegisteredUsers = 0; $NotRegisteredUsers = 0
+            $RegCA = 0; $RegSD = 0; $RegPerUser = 0; $RegNone = 0
+            $NotCA = 0; $NotSD = 0; $NotNone = 0
+            foreach ($User in $Enabled) {
+                $HasRegistered = $User.MFARegistration -eq $true
+                $CoveredByCA = "$($User.CoveredByCA)".StartsWith('Enforced')
+                $CoveredBySD = $User.CoveredBySD -eq $true
+                $PerUser = "$($User.PerUser)"
+                $PerUserOn = $PerUser -eq 'enforced' -or $PerUser -eq 'enabled'
+                if ($HasRegistered -or $PerUserOn) {
+                    $RegisteredUsers++
+                    if ($PerUserOn) { $RegPerUser++ }
+                    elseif ($CoveredByCA) { $RegCA++ }
+                    elseif ($CoveredBySD) { $RegSD++ }
+                    else { $RegNone++ }
+                } else {
+                    $NotRegisteredUsers++
+                    if ($CoveredByCA) { $NotCA++ }
+                    elseif ($CoveredBySD) { $NotSD++ }
+                    else { $NotNone++ }
+                }
+            }
+            & $AddNode 'Enabled users' 'Enabled users' 'hsl(28, 100%, 53%)'
+            & $AddNode 'MFA registered' 'MFA registered' 'hsl(99, 70%, 50%)'
+            & $AddNode 'Not registered' 'Not registered' 'hsl(39, 100%, 50%)'
+            & $AddNode 'CA policy' 'CA policy' 'hsl(99, 70%, 50%)'
+            & $AddNode 'Security defaults' 'Security defaults' 'hsl(140, 70%, 50%)'
+            & $AddNode 'Per-user MFA' 'Per-user MFA' 'hsl(200, 70%, 50%)'
+            & $AddNode 'No enforcement' 'No enforcement' 'hsl(0, 100%, 50%)'
+            & $AddLink 'Enabled users' 'MFA registered' $RegisteredUsers
+            & $AddLink 'Enabled users' 'Not registered' $NotRegisteredUsers
+            & $AddLink 'MFA registered' 'CA policy' $RegCA
+            & $AddLink 'MFA registered' 'Security defaults' $RegSD
+            & $AddLink 'MFA registered' 'Per-user MFA' $RegPerUser
+            & $AddLink 'MFA registered' 'No enforcement' $RegNone
+            & $AddLink 'Not registered' 'CA policy' $NotCA
+            & $AddLink 'Not registered' 'Security defaults' $NotSD
+            & $AddLink 'Not registered' 'No enforcement' $NotNone
+        }
+        'authMethods' {
+            # AuthMethodCard.jsx: users -> single/multi factor, phishable vs phish-resistant, + breakdown.
+            $Enabled = @($Rows | Where-Object { $_.AccountEnabled -eq $true })
+            $Phishable = @('mobilePhone', 'alternateMobilePhone', 'officePhone', 'email', 'microsoftAuthenticatorPush', 'softwareOneTimePasscode', 'hardwareOneTimePasscode')
+            $Passkey = @('fido2SecurityKey', 'passKeyDeviceBound', 'passKeyDeviceBoundAuthenticator', 'passKeyDeviceBoundWindowsHello', 'x509Certificate')
+            $PhishResistant = @($Passkey + 'windowsHelloForBusiness')
+            $SingleFactor = 0; $PhishableCount = 0; $PhishResistantCount = 0; $PerUserMFA = 0
+            $PhoneCount = 0; $AuthenticatorCount = 0; $PasskeyCount = 0; $WhfbCount = 0
+            foreach ($User in $Enabled) {
+                $Methods = @($User.MFAMethods | Where-Object { $null -ne $_ -and "$_" -ne '' })
+                $PerUser = "$($User.PerUser)"
+                $PerUserOn = $PerUser -eq 'enforced' -or $PerUser -eq 'enabled'
+                $HasRegistered = $User.MFARegistration -eq $true
+                if ($PerUserOn -and -not $HasRegistered -and $Methods.Count -eq 0) { $PerUserMFA++; continue }
+                if (-not $HasRegistered -or $Methods.Count -eq 0) { $SingleFactor++; continue }
+                $HasPR = @($Methods | Where-Object { $PhishResistant -contains $_ }).Count -gt 0
+                $HasPh = @($Methods | Where-Object { $Phishable -contains $_ }).Count -gt 0
+                if ($HasPR) {
+                    $PhishResistantCount++
+                    if (@($Methods | Where-Object { $Passkey -contains $_ }).Count -gt 0) { $PasskeyCount++ }
+                    if ($Methods -contains 'windowsHelloForBusiness') { $WhfbCount++ }
+                } elseif ($HasPh) {
+                    $PhishableCount++
+                    if (($Methods -contains 'mobilePhone') -or ($Methods -contains 'alternateMobilePhone') -or ($Methods -contains 'officePhone') -or ($Methods -contains 'email')) { $PhoneCount++ }
+                    if (($Methods -contains 'microsoftAuthenticatorPush') -or ($Methods -contains 'softwareOneTimePasscode') -or ($Methods -contains 'hardwareOneTimePasscode')) { $AuthenticatorCount++ }
+                } else {
+                    $PhishableCount++; $AuthenticatorCount++
+                }
+            }
+            & $AddNode 'Users' 'Users' 'hsl(28, 100%, 53%)'
+            & $AddNode 'Single factor' 'Single factor' 'hsl(0, 100%, 50%)'
+            & $AddNode 'Multi factor' 'Multi factor' 'hsl(200, 70%, 50%)'
+            & $AddNode 'Phishable' 'Phishable' 'hsl(39, 100%, 50%)'
+            & $AddNode 'Phone' 'Phone' 'hsl(39, 100%, 45%)'
+            & $AddNode 'Authenticator' 'Authenticator' 'hsl(39, 100%, 55%)'
+            & $AddNode 'Phish resistant' 'Phish resistant' 'hsl(99, 70%, 50%)'
+            & $AddNode 'Passkey' 'Passkey' 'hsl(140, 70%, 50%)'
+            & $AddNode 'WHfB' 'WHfB' 'hsl(160, 70%, 50%)'
+            & $AddLink 'Users' 'Single factor' $SingleFactor
+            & $AddLink 'Users' 'Multi factor' $PerUserMFA
+            & $AddLink 'Users' 'Phishable' $PhishableCount
+            & $AddLink 'Users' 'Phish resistant' $PhishResistantCount
+            & $AddLink 'Phishable' 'Phone' $PhoneCount
+            & $AddLink 'Phishable' 'Authenticator' $AuthenticatorCount
+            & $AddLink 'Phish resistant' 'Passkey' $PasskeyCount
+            & $AddLink 'Phish resistant' 'WHfB' $WhfbCount
+        }
+        'licenseAllocation' {
+            # LicenseCard.jsx: the top-5 licences by total, each fanning out to its own assigned/available.
+            $Top = @($Rows | Where-Object { ($_.TotalLicenses -as [int]) -gt 0 } |
+                    Sort-Object -Property @{ Expression = { $_.TotalLicenses -as [int] }; Descending = $true } |
+                    Select-Object -First 5)
+            $Index = 0
+            foreach ($Lic in $Top) {
+                $Name = if ($Lic.License) { "$($Lic.License)" } elseif ($Lic.skuPartNumber) { "$($Lic.skuPartNumber)" } elseif ($Lic.SkuPartNumber) { "$($Lic.SkuPartNumber)" } else { 'Unknown License' }
+                $Short = if ($Name.Length -gt 30) { $Name.Substring(0, 27) + '...' } else { $Name }
+                $Assigned = ($Lic.CountUsed -as [int]); if ($null -eq $Assigned) { $Assigned = 0 }
+                $Available = ($Lic.CountAvailable -as [int]); if ($null -eq $Available) { $Available = 0 }
+                $NodeId = "$Index-$Short"
+                & $AddNode $NodeId $Short ('hsl({0}, 70%, 50%)' -f (210 + $Index * 30))
+                if ($Assigned -gt 0) {
+                    & $AddNode "$NodeId - Assigned" "$Short - Assigned" 'hsl(99, 70%, 50%)'
+                    & $AddLink $NodeId "$NodeId - Assigned" $Assigned
+                }
+                if ($Available -gt 0) {
+                    & $AddNode "$NodeId - Available" "$Short - Available" 'hsl(28, 100%, 53%)'
+                    & $AddLink $NodeId "$NodeId - Available" $Available
+                }
+                $Index++
+            }
+        }
+        'deviceCompliance' {
+            # Managed devices -> operating system -> compliance state. Compliant green, non-compliant red,
+            # in-grace amber, anything else (unknown/error/conflict) grey.
+            $StateColour = {
+                param($State)
+                switch -Regex ("$State".ToLowerInvariant()) {
+                    '^compliant$' { 'hsl(99, 70%, 50%)' }
+                    '^noncompliant$' { 'hsl(0, 100%, 50%)' }
+                    '^ingraceperiod$' { 'hsl(39, 100%, 50%)' }
+                    default { 'hsl(220, 10%, 60%)' }
+                }
+            }
+            $OsOrder = [System.Collections.Generic.List[string]]::new()
+            $StateSeen = @{}
+            $OsTotals = @{}
+            $PairCounts = [ordered]@{}
+            foreach ($Device in $Rows) {
+                $Os = "$($Device.operatingSystem)"; if (-not $Os) { $Os = 'Unknown' }
+                $State = "$($Device.complianceState)"; if (-not $State) { $State = 'unknown' }
+                if (-not $OsOrder.Contains($Os)) { $OsOrder.Add($Os) }
+                $OsTotals[$Os] = ([int]$OsTotals[$Os]) + 1
+                $Key = "$Os`n$State"
+                $PairCounts[$Key] = ([int]$PairCounts[$Key]) + 1
+            }
+            if ($OsOrder.Count -gt 0) {
+                & $AddNode 'Managed devices' 'Managed devices' 'hsl(28, 100%, 53%)'
+                $OsIndex = 0
+                foreach ($Os in $OsOrder) {
+                    & $AddNode "os:$Os" $Os ('hsl({0}, 70%, 50%)' -f ((200 + $OsIndex * 35) % 360))
+                    & $AddLink 'Managed devices' "os:$Os" ([int]$OsTotals[$Os])
+                    $OsIndex++
+                }
+                foreach ($Key in $PairCounts.Keys) {
+                    $Parts = $Key -split "`n", 2
+                    $Os = $Parts[0]; $State = $Parts[1]
+                    $StateId = "state:$State"
+                    if (-not $StateSeen.ContainsKey($StateId)) { & $AddNode $StateId $State (& $StateColour $State); $StateSeen[$StateId] = $true }
+                    & $AddLink "os:$Os" $StateId ([int]$PairCounts[$Key])
+                }
+            }
+        }
+        default { }
+    }
+
+    return @{ nodes = @($Nodes); links = @($Links) }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/Get-CippReportTableData.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/Get-CippReportTableData.ps1
new file mode 100644
index 0000000000000..623e4cdec1c99
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/Get-CippReportTableData.ps1
@@ -0,0 +1,69 @@
+function Get-CippReportTableData {
+    <#
+    .SYNOPSIS
+        Build flat table rows for a pre-built report table whose data lives in a nested shape a generic
+        single-collection dataSource cannot read.
+    .DESCRIPTION
+        Some report tables need data that is not one flat row per record - for example the Secure Score
+        controls, which live in a nested controlScores array inside a handful of daily snapshot rows. A
+        preset here reads the raw collection rows and returns an ordered list of flat rows (hashtables),
+        each key a field a table column can name. The report resolver feeds these rows through the same
+        column mapping every hand-built table uses, so the columns read their fields exactly as normal.
+
+        Presets:
+          secureScoreFailing <- SecureScore  the latest snapshot's controls that are not fully achieved
+                                              (scoreInPercentage < 100), worst first.
+    .PARAMETER Preset
+        Which table to build.
+    .PARAMETER Rows
+        The raw collection rows for that table's source.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$Preset,
+        [AllowEmptyCollection()][object[]]$Rows = @()
+    )
+
+    $AsDouble = { param($Value) $n = "$Value" -as [double]; if ($null -ne $n) { $n } else { $null } }
+    $Pct = { param($Value) $n = & $AsDouble $Value; if ($null -eq $n) { '' } elseif ([math]::Round($n) -eq $n) { "$([int]$n)%" } else { "$([math]::Round($n, 1))%" } }
+    # Some control statuses arrive as HTML (implementationStatus); flatten to a short line of plain text.
+    $Plain = {
+        param([string]$Text)
+        if ([string]::IsNullOrWhiteSpace($Text)) { return '' }
+        $Clean = [regex]::Replace($Text, '<[^>]+>', ' ')
+        $Clean = [System.Net.WebUtility]::HtmlDecode($Clean)
+        $Clean = [regex]::Replace($Clean, '\s+', ' ').Trim()
+        if ($Clean.Length -gt 160) { $Clean = $Clean.Substring(0, 159).TrimEnd() + [char]0x2026 }
+        $Clean
+    }
+
+    switch ($Preset) {
+        'secureScoreFailing' {
+            # SecureScore is a series of daily snapshots; take the most recent one and read its per-control
+            # scores. A control that is not fully achieved (below 100%) is one worth listing.
+            if (@($Rows).Count -eq 0) { return @() }
+            $Latest = @($Rows | Sort-Object -Property @{ Expression = { [datetime]("$($_.createdDateTime)" -as [datetime]) } } -Descending | Select-Object -First 1)
+            if (-not $Latest) { $Latest = @($Rows)[-1] }
+            $Controls = @($Latest.controlScores)
+            if (@($Controls).Count -eq 0) { return @() }
+            $Failing = @($Controls | Where-Object {
+                    $p = & $AsDouble $_.scoreInPercentage
+                    $null -ne $p -and $p -lt 100
+                })
+            $Ordered = @($Failing | Sort-Object -Property @{ Expression = { [double](& $AsDouble $_.scoreInPercentage) } }, @{ Expression = { "$($_.controlName)" } })
+            return @($Ordered | ForEach-Object {
+                    [ordered]@{
+                        control  = "$($_.controlName)"
+                        category = "$($_.controlCategory)"
+                        status   = $(if ($_.implementationStatus) { (& $Plain "$($_.implementationStatus)") } else { "$($_.on)" })
+                        percent  = (& $Pct $_.scoreInPercentage)
+                    }
+                })
+        }
+        default {
+            throw "Unknown report table preset '$Preset'."
+        }
+    }
+}
diff --git a/Modules/CIPPCore/Public/Tools/Reporting/New-CippReportComponents.ps1 b/Modules/CIPPCore/Public/Tools/Reporting/New-CippReportComponents.ps1
new file mode 100644
index 0000000000000..630a6410c0eba
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Reporting/New-CippReportComponents.ps1
@@ -0,0 +1,161 @@
+#
+# Report component builders - the PowerShell authoring layer for server-side reports.
+#
+# Each function returns one declarative component node (a hashtable) that the CIPPSharp component kit
+# renders (see ConvertTo-CippReportPdf / [CIPP.Reporting.ReportPdf]). A report is composed of these
+# and never hand-writes OfficeIMO or block JSON: gather data, map it to components, hand the array to
+# ConvertTo-CippReportPdf. The node shapes mirror the block types the kit understands
+# (page/blank/scorecard/richtable/richbullets/chart/infobox/alertbox/clearbox/hero/pagebreak).
+#
+
+function New-CippReportPage {
+    # Opens a titled content page (a fixed report's ContentPage): its own header title + subtitle.
+    param([Parameter(Mandatory)][string]$Title, [string]$Subtitle)
+    $n = [ordered]@{ type = 'page'; title = $Title }
+    if ($Subtitle) { $n.subtitle = $Subtitle }
+    $n
+}
+
+function New-CippReportPageBreak {
+    @{ type = 'pagebreak' }
+}
+
+function New-CippReportHeading {
+    # A section heading on its own (renders the section title, no body).
+    param([Parameter(Mandatory)][string]$Title)
+    [ordered]@{ type = 'blank'; title = $Title; content = '' }
+}
+
+function New-CippReportParagraph {
+    # Body copy. -Html passes raw HTML (bold/links); -Text wraps plain text.
+    # -Title adds a section heading above the paragraph. -Indent steps plain -Text in under a heading.
+    param([string]$Text, [string]$Html, [string]$Title, [switch]$Indent)
+    if ($Indent) {
+        $n = [ordered]@{ type = 'paragraphindent'; content = [string]$Text }
+        if ($Title) { $n.title = $Title }
+        return $n
+    }
+    if ($Html) {
+        $n = [ordered]@{ type = 'blank'; content = $Html }
+    } else {
+        $n = [ordered]@{ type = 'blank'; content = ('<p>{0}</p>' -f [System.Net.WebUtility]::HtmlEncode([string]$Text)) }
+    }
+    if ($Title) { $n.title = $Title }
+    $n
+}
+
+function New-CippReportStatRow {
+    # A row of stat cards. -Stats: @( @{ value; label; caption; colour }, ... ). An empty row renders nothing.
+    param([string]$Title, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Stats)
+    $n = [ordered]@{ type = 'scorecard'; stats = @($Stats) }
+    if ($Title) { $n.title = $Title }
+    $n
+}
+
+function New-CippReportTable {
+    # A data table. -Columns: @( @{ header; key; width; bold; align; toneField }, ... ). -Rows: row objects.
+    # -EmptyText is drawn inside the table border when there are no rows (client DataTable emptyText).
+    param([string]$Title, [Parameter(Mandatory)][object[]]$Columns, [object[]]$Rows = @(), [int]$Limit = 25, [string]$EmptyText)
+    $n = [ordered]@{ type = 'richtable'; columns = @($Columns); rows = @($Rows); limit = $Limit }
+    if ($Title) { $n.title = $Title }
+    if ($EmptyText) { $n.emptyText = $EmptyText }
+    $n
+}
+
+function New-CippReportBullets {
+    # Rich bullets. -Items: @( @{ label; text }, ... ) (label is optional bold prefix).
+    param([string]$Title, [Parameter(Mandatory)][object[]]$Items)
+    $n = [ordered]@{ type = 'richbullets'; items = @($Items) }
+    if ($Title) { $n.title = $Title }
+    $n
+}
+
+function New-CippReportNote {
+    # A small italic aside (client Note / truncation line): "... and N more".
+    param([Parameter(Mandatory)][string]$Text)
+    [ordered]@{ type = 'note'; content = $Text }
+}
+
+function New-CippReportChart {
+    # A chart: -Kind bar|donut|trend, -Data @( @{ label; value; colour }, ... ). Title shows in the frame.
+    # Empty data is allowed: the kit draws a "No data available" frame (a tenant with no mail, no risks...).
+    param([string]$Title, [ValidateSet('bar', 'donut', 'trend')][string]$Kind = 'bar', [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Data, [double]$Max, [string]$Caption, [string]$CentreLabel)
+    $n = [ordered]@{ type = 'chart'; chartKind = $Kind; chartData = @($Data) }
+    if ($Title) { $n.title = $Title }
+    if ($PSBoundParameters.ContainsKey('Max')) { $n.max = $Max }
+    if ($Caption) { $n.caption = $Caption }
+    if ($CentreLabel) { $n.centreLabel = $CentreLabel }
+    $n
+}
+
+function New-CippReportProgress {
+    # A list of labelled progress bars (the client ProgressList). -Items: @( @{ label; value; max; display; colour }, ... ).
+    # Each renders a value/max data bar over a grey track - zero-safe (a 0 value draws an empty track), unlike a
+    # bar chart whose rounded bars collapse at zero. -Display overrides the "N%" label (e.g. a raw count).
+    param([string]$Title, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Items)
+    $n = [ordered]@{ type = 'progress'; items = @($Items) }
+    if ($Title) { $n.title = $Title }
+    $n
+}
+
+function New-CippReportInfoBox {
+    # A callout with a left accent stripe. -Tone ok|warn tints it; -Content is markdown, unless -Lines is
+    # set, in which case each '\n' line is kept as a tight line break (label/value detail lists).
+    param([Parameter(Mandatory)][string]$Title, [string]$Content, [ValidateSet('', 'ok', 'warn')][string]$Tone = '', [string]$Colour, [switch]$TintTitle, [switch]$Lines)
+    $n = [ordered]@{ type = 'infobox'; title = $Title; content = $Content }
+    if ($Tone) { $n.tone = $Tone }
+    if ($Colour) { $n.colour = $Colour }
+    if ($TintTitle) { $n.tintTitle = $true }
+    if ($Lines) { $n.lines = $true }
+    $n
+}
+
+function New-CippReportInfoBoxColumns {
+    # A grid of callouts laid out -Columns per row (client Columns of InfoBoxes). -Items:
+    # @( @{ title; content; colour; tone; tintTitle }, ... ). Content is plain prose.
+    param([Parameter(Mandatory)][object[]]$Items, [int]$Columns = 2)
+    [ordered]@{ type = 'infoboxcolumns'; items = @($Items); columns = $Columns }
+}
+
+function New-CippReportAlertBox {
+    # A warning callout. -Content is markdown, unless -Lines keeps each '\n' line as a tight line break.
+    param([Parameter(Mandatory)][string]$Title, [string]$Content, [string]$Colour, [switch]$Lines)
+    $n = [ordered]@{ type = 'alertbox'; title = $Title; content = $Content }
+    if ($Colour) { $n.colour = $Colour }
+    if ($Lines) { $n.lines = $true }
+    $n
+}
+
+function New-CippReportClearBox {
+    param([Parameter(Mandatory)][string]$Title, [string]$Content, [switch]$Lines)
+    $n = [ordered]@{ type = 'clearbox'; title = $Title; content = $Content }
+    if ($Lines) { $n.lines = $true }
+    $n
+}
+
+function New-CippReportHero {
+    # A full-bleed chapter divider. -Image is a data-URL cover photo; the big -Highlight sits over it.
+    param([string]$Image, [string]$Overtitle, [string]$Highlight, [string]$Headline, [string]$SubText, [string]$FooterText)
+    $n = [ordered]@{ type = 'hero' }
+    if ($Image) { $n.heroImage = $Image }
+    if ($Overtitle) { $n.overtitle = $Overtitle }
+    if ($Highlight) { $n.highlight = $Highlight }
+    if ($Headline) { $n.headline = $Headline }
+    if ($SubText) { $n.subText = $SubText }
+    if ($FooterText) { $n.footerText = $FooterText }
+    $n
+}
+
+function New-CippReportSankey {
+    # A flow diagram (the dashboard CippSankey). -Nodes: @( @{ id; nodeColor; label }, ... ) - nodeColor
+    # accepts hex or hsl(); -Links: @( @{ source; target; value }, ... ) referencing node ids. Node columns
+    # and heights are derived from the link flow. -Height sets the plot height (default 240pt). Empty data
+    # draws a "No data available" frame.
+    param([string]$Title, [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Nodes,
+        [Parameter(Mandatory)][AllowEmptyCollection()][object[]]$Links, [string]$Caption, [double]$Height)
+    $n = [ordered]@{ type = 'sankey'; nodes = @($Nodes); links = @($Links) }
+    if ($Title) { $n.title = $Title }
+    if ($Caption) { $n.caption = $Caption }
+    if ($PSBoundParameters.ContainsKey('Height')) { $n.height = $Height }
+    $n
+}
diff --git a/Modules/CIPPCore/Public/Tools/Resolve-CippReportDataToken.ps1 b/Modules/CIPPCore/Public/Tools/Resolve-CippReportDataToken.ps1
new file mode 100644
index 0000000000000..0f04fbaca28f8
--- /dev/null
+++ b/Modules/CIPPCore/Public/Tools/Resolve-CippReportDataToken.ps1
@@ -0,0 +1,447 @@
+function Resolve-CippReportDataToken {
+    <#
+    .SYNOPSIS
+        Resolve &data tokens& in report builder blocks against the reporting database.
+    .DESCRIPTION
+        A block's text can name reporting-database data with a token, and the value is read here on
+        the server when the report renders, so a scheduled run and a preview read the same data:
+
+          &Users&                              the number of rows in that collection
+          &Users.displayName&                  the field's distinct values, comma-separated (the first 25)
+          &Devices.complianceState=compliant&  the number of rows whose field has that value (* wildcards; != for the rest)
+          &Mailboxes.TotalItemSize:sum&        a numeric field's sum, avg, min, max or count of rows carrying it
+
+        Collection names are the reporting database's types, the same names the Database Data block
+        offers as sources; fields are case-insensitive and may reach into nested objects with dots.
+        A chart with a chartSource of &Devices.operatingSystem& gets one slice per value of that field;
+        a table with a dataSource of &Mailboxes& (a filter token works too) gets the rows, each column
+        reading the field it names (its `field`, else its header). A score card block with a statsSource
+        gets one card per value of the field (a count, or an aggregate of a numeric field) and a progress
+        block with an itemsSource one bar each, filled by its share of the total. A token that names
+        nothing is left as written, so the mistake shows in the report instead of silently blanking.
+    .PARAMETER Blocks
+        The enriched blocks, as objects or hashtables. Returned with the tokens replaced in place.
+    .PARAMETER TenantFilter
+        The tenant whose reporting database answers.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [AllowEmptyCollection()][object[]]$Blocks = @(),
+        [Parameter(Mandatory = $true)][string]$TenantFilter
+    )
+
+    $Pattern = '(?:&amp;|&)(?<type>[A-Za-z0-9_-]+)(?:\.(?<field>[A-Za-z0-9_.-]+))?(?:(?<op>!=|=)(?<value>[^&]*?))?(?::(?<agg>sum|avg|min|max|count))?(?:&amp;|&)'
+    $MaxListed = 25
+    $MaxSlices = 8
+    $MaxPoints = 30
+    $MaxRows = 200
+
+    # One read per collection per render; a collection the database does not hold reads as $null. The
+    # reserved collection 'TestResults' reads the in-app compliance test results (CippTestResults) instead
+    # of the reporting database, so a chart/table/flow can be driven by test data (count by Status,
+    # Category, Risk...) the same way it is driven by reporting collections.
+    $Cache = @{}
+    $RowsOf = {
+        param([string]$Type)
+        $Key = $Type.ToLowerInvariant()
+        if (-not $Cache.ContainsKey($Key)) {
+            $Rows = try {
+                if ($Key -eq 'testresults') {
+                    @((Get-CIPPTestResults -TenantFilter $TenantFilter).TestResults) | Where-Object { $null -ne $_ }
+                } else {
+                    @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type) | Where-Object { $null -ne $_ -and $_ -ne $false }
+                }
+            } catch { $null }
+            $Cache[$Key] = if ($null -eq $Rows) { $null } else { @($Rows) }
+        }
+        $Cache[$Key]
+    }
+
+    # A field's values in one row, following a dotted path and flattening arrays along the way.
+    $ValueOf = {
+        param($Row, [string]$Path)
+        $Current = @($Row)
+        foreach ($Segment in $Path.Split('.')) {
+            $Current = @(foreach ($Item in $Current) {
+                    if ($null -eq $Item) { continue }
+                    if ($Item -is [System.Collections.IDictionary]) {
+                        $Name = @($Item.Keys) | Where-Object { "$_" -ieq $Segment } | Select-Object -First 1
+                        if ($null -ne $Name) { $Item[$Name] }
+                    } else {
+                        $Property = $Item.PSObject.Properties | Where-Object { $_.Name -ieq $Segment } | Select-Object -First 1
+                        if ($Property) { $Property.Value }
+                    }
+                })
+        }
+        @($Current | Where-Object { $null -ne $_ -and "$_" -ne '' })
+    }
+
+    $RowMatches = {
+        param($Row, [string]$Field, [string]$Op, [string]$Wanted)
+        $Values = @(& $ValueOf $Row $Field | ForEach-Object { "$_" })
+        $Hit = if ($Wanted.Contains('*')) { @($Values | Where-Object { $_ -like $Wanted }).Count -gt 0 } else { @($Values | Where-Object { $_ -ieq $Wanted }).Count -gt 0 }
+        if ($Op -eq '!=') { -not $Hit } else { $Hit }
+    }
+
+    $FormatNumber = { param([double]$n) if ([math]::Round($n) -eq $n) { "$([long]$n)" } else { "$([math]::Round($n, 2))" } }
+
+    # The text a token stands for; $null when its collection is unknown, so the token stays as written.
+    $Evaluate = {
+        param($Match)
+        $Type = $Match.Groups['type'].Value
+        $Field = $Match.Groups['field'].Value
+        $Op = $Match.Groups['op'].Value
+        $Wanted = $Match.Groups['value'].Value
+        $Agg = $Match.Groups['agg'].Value
+        $Rows = & $RowsOf $Type
+        if ($null -eq $Rows) { return $null }
+        if (-not $Field) { return "$($Rows.Count)" }
+        if ($Op) { return "$(@($Rows | Where-Object { & $RowMatches $_ $Field $Op $Wanted }).Count)" }
+        $Values = @(foreach ($Row in $Rows) { & $ValueOf $Row $Field })
+        if ($Agg) {
+            if ($Agg -eq 'count') { return "$($Values.Count)" }
+            $Numbers = @($Values | ForEach-Object { $_ -as [double] } | Where-Object { $null -ne $_ })
+            if ($Numbers.Count -eq 0) { return '0' }
+            $Measured = $Numbers | Measure-Object -Sum -Average -Minimum -Maximum
+            $Aggregate = switch ($Agg) { 'sum' { $Measured.Sum } 'avg' { $Measured.Average } 'min' { $Measured.Minimum } default { $Measured.Maximum } }
+            return (& $FormatNumber $Aggregate)
+        }
+        $Distinct = @($Values | ForEach-Object { "$_" } | Sort-Object -Unique)
+        if ($Distinct.Count -le $MaxListed) { return ($Distinct -join ', ') }
+        return (($Distinct | Select-Object -First $MaxListed) -join ', ') + " and $($Distinct.Count - $MaxListed) more"
+    }
+
+    # Replace every token in a string. A string that is one token and resolves to a number becomes a
+    # number, so a progress bar's value or a chart point can be a token too.
+    $ReplaceIn = {
+        param([string]$Text)
+        if ($Text -notmatch '&') { return $Text }
+        $Whole = [regex]::Match($Text.Trim(), "^$Pattern$")
+        $Result = [regex]::Replace($Text, $Pattern, [System.Text.RegularExpressions.MatchEvaluator] {
+                param($m)
+                $Value = & $Evaluate $m
+                if ($null -eq $Value) { $m.Value } else { $Value }
+            })
+        if ($Whole.Success -and $Result.Trim() -match '^-?\d+(\.\d+)?$') { return [double]$Result.Trim() }
+        $Result
+    }
+
+    $SetProperty = {
+        param($Target, [string]$Name, $Value)
+        if ($Target -is [System.Collections.IDictionary]) { $Target[$Name] = $Value } else { $Target | Add-Member -NotePropertyName $Name -NotePropertyValue $Value -Force }
+    }
+
+    # Walk a value: strings are resolved, lists and objects walked, everything else kept.
+    $Walk = $null
+    $Walk = {
+        param($Value)
+        if ($Value -is [string]) { return (& $ReplaceIn $Value) }
+        if ($Value -is [System.Collections.IDictionary]) {
+            foreach ($Name in @($Value.Keys)) { $Value[$Name] = & $Walk $Value[$Name] }
+            return $Value
+        }
+        if ($Value -is [array] -or $Value -is [System.Collections.IList]) {
+            return , @(foreach ($Item in $Value) { & $Walk $Item })
+        }
+        if ($Value -is [System.Management.Automation.PSCustomObject]) {
+            foreach ($Property in @($Value.PSObject.Properties)) { $Value.($Property.Name) = & $Walk $Property.Value }
+            return $Value
+        }
+        $Value
+    }
+
+    $ParseToken = { param([string]$Text) $m = [regex]::Match("$Text".Trim(), "^$Pattern$"); if ($m.Success) { $m } }
+
+    # A chart or table source as the builder's picker saves it - { type; field; filter = { field; op;
+    # value } } - or as a token; either way @{ type; field; filter }, with filter $null when there is none.
+    $SourceOf = {
+        param($Source)
+        if ($null -eq $Source) { return $null }
+        if ($Source -is [string]) {
+            $m = & $ParseToken $Source
+            if (-not $m) { return $null }
+            $Field = $m.Groups['field'].Value
+            if ($m.Groups['op'].Value) {
+                return @{ type = $m.Groups['type'].Value; field = $null; filter = @{ field = $Field; op = $m.Groups['op'].Value; value = $m.Groups['value'].Value } }
+            }
+            return @{ type = $m.Groups['type'].Value; field = $(if ($Field) { $Field }); filter = $null }
+        }
+        if (-not $Source.type) { return $null }
+        $Filter = $Source.filter
+        $Spec = if ($Filter -and $Filter.field -and $Filter.op) { @{ field = "$($Filter.field)"; op = "$($Filter.op)"; value = "$($Filter.value)" } }
+        @{
+            type       = "$($Source.type)"
+            field      = $(if ($Source.field) { "$($Source.field)" })
+            # a numeric field to plot instead of counting rows; aggregate combines rows sharing a label
+            valueField = $(if ($Source.valueField -and "$($Source.valueField)" -ne '__count') { "$($Source.valueField)" })
+            aggregate  = $(if ($Source.aggregate -and @('sum', 'avg', 'max', 'min') -contains "$($Source.aggregate)") { "$($Source.aggregate)" })
+            # divide plotted values by this before drawing, so bytes can be shown as GB and so on
+            scale      = $(if (($Source.scale -as [double]) -gt 0) { [double]$Source.scale })
+            filter     = $Spec
+        }
+    }
+    $RowsFor = {
+        param($Spec)
+        $Rows = & $RowsOf $Spec.type
+        if ($null -eq $Rows) { return $null }
+        if ($Spec.filter) { $Rows = @($Rows | Where-Object { & $RowMatches $_ $Spec.filter.field $Spec.filter.op $Spec.filter.value }) }
+        , @($Rows)
+    }
+
+    # Label/value pairs from a source, for score cards and progress bars: one entry per distinct value
+    # of the field (a count of rows, or an aggregate of a numeric field), or a single figure when no
+    # field is named. Sorted by value and capped so a row of cards or bars stays readable.
+    $CardsFrom = {
+        param($Spec, $Rows, [string]$SingleLabel)
+        $Field = $Spec.field
+        $Aggregate = { param($Numbers) if (@($Numbers).Count -eq 0) { return 0 }
+            $Nums = if ($Spec.scale) { @($Numbers | ForEach-Object { $_ / $Spec.scale }) } else { @($Numbers) }
+            $Measured = $Nums | Measure-Object -Sum -Average -Minimum -Maximum
+            switch ($Spec.aggregate) { 'avg' { [math]::Round($Measured.Average, 2) } 'min' { $Measured.Minimum } 'max' { $Measured.Maximum } default { $Measured.Sum } } }
+        $Pairs = if ($Spec.valueField) {
+            if ($Field) {
+                @($Rows | Group-Object { @(& $ValueOf $_ $Field | ForEach-Object { "$_" }) | Select-Object -First 1 } | ForEach-Object {
+                        $Label = "$($_.Name)"
+                        if (-not $Label) { return }
+                        $Numbers = @($_.Group | ForEach-Object { @(& $ValueOf $_ $Spec.valueField | ForEach-Object { $_ -as [double] } | Where-Object { $null -ne $_ }) | Select-Object -First 1 } | Where-Object { $null -ne $_ })
+                        if ($Numbers.Count -eq 0) { return }
+                        @{ label = $Label; value = [double](& $Aggregate $Numbers) }
+                    })
+            } else {
+                $Numbers = @($Rows | ForEach-Object { @(& $ValueOf $_ $Spec.valueField | ForEach-Object { $_ -as [double] } | Where-Object { $null -ne $_ }) | Select-Object -First 1 } | Where-Object { $null -ne $_ })
+                @(@{ label = $(if ($SingleLabel) { $SingleLabel } else { $Spec.type }); value = [double](& $Aggregate $Numbers) })
+            }
+        } elseif ($Field) {
+            $Groups = @(foreach ($Row in $Rows) { @(& $ValueOf $Row $Field | ForEach-Object { "$_" }) }) | Group-Object { $_.ToLowerInvariant() }
+            @($Groups | ForEach-Object { @{ label = "$($_.Group[0])"; value = [double]$_.Count } })
+        } else {
+            @(@{ label = $(if ($SingleLabel) { $SingleLabel } else { $Spec.type }); value = [double]$Rows.Count })
+        }
+        @($Pairs | Sort-Object -Property @{ Expression = { $_.value }; Descending = $true }, @{ Expression = { $_.label } } | Select-Object -First $MaxSlices)
+    }
+
+    foreach ($Block in @($Blocks)) {
+        if ($null -eq $Block) { continue }
+        $Type = "$($Block.type)"
+
+        # A chart drawn from the data. Counting rows: one slice per distinct value of the field, the long
+        # tail as Other, or a single counted slice when no field was picked. Plotting a field's value:
+        # one point per row labelled by the field - chronological when the labels are dates, which is
+        # how a Secure Score trend reads - or, with an aggregate, one point per label.
+        if ($Type -eq 'chart' -and $Block.chartSource) {
+            $Spec = & $SourceOf $Block.chartSource
+            $Rows = if ($Spec) { & $RowsFor $Spec }
+            if ($Spec -and $null -ne $Rows) {
+                $Field = $Spec.field
+                $Points = if ($Spec.valueField) {
+                    $Series = @(foreach ($Row in $Rows) {
+                            $Number = @(& $ValueOf $Row $Spec.valueField | ForEach-Object { $_ -as [double] } | Where-Object { $null -ne $_ }) | Select-Object -First 1
+                            if ($null -eq $Number) { continue }
+                            if ($Spec.scale) { $Number = [double]$Number / $Spec.scale }
+                            $Raw = if ($Field) { @(& $ValueOf $Row $Field | ForEach-Object { "$_" }) | Select-Object -First 1 } else { $null }
+                            $Date = [datetime]::MinValue
+                            $IsDate = $null -ne $Raw -and [datetime]::TryParse("$Raw", [cultureinfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::AssumeUniversal, [ref]$Date)
+                            @{ raw = $Raw; value = [double]$Number; date = $(if ($IsDate) { $Date }) }
+                        })
+                    if ($Spec.aggregate) {
+                        $Combined = @($Series | Group-Object { "$($_.raw)".ToLowerInvariant() } | ForEach-Object {
+                                $Measured = @($_.Group | ForEach-Object { $_.value }) | Measure-Object -Sum -Average -Maximum -Minimum
+                                $Figure = switch ($Spec.aggregate) { 'avg' { [math]::Round($Measured.Average, 2) } 'max' { $Measured.Maximum } 'min' { $Measured.Minimum } default { $Measured.Sum } }
+                                @{ label = "$($_.Group[0].raw)"; value = [double]$Figure }
+                            })
+                        @($Combined | Sort-Object -Property @{ Expression = { $_.value }; Descending = $true }, @{ Expression = { $_.label } } | Select-Object -First $MaxSlices)
+                    } elseif ($Series.Count -gt 0 -and @($Series | Where-Object { $null -ne $_.date }).Count -eq $Series.Count) {
+                        $Ordered = @($Series | Sort-Object -Property { $_.date } | Select-Object -Last $MaxPoints)
+                        $Format = if (@($Ordered | ForEach-Object { $_.date.Year } | Select-Object -Unique).Count -gt 1) { 'MMM d yyyy' } else { 'MMM d' }
+                        @($Ordered | ForEach-Object { @{ label = $_.date.ToString($Format, [cultureinfo]::InvariantCulture); value = $_.value } })
+                    } else {
+                        @($Series | Select-Object -Last $MaxPoints | ForEach-Object { @{ label = $(if ($null -ne $_.raw) { "$($_.raw)" } else { '' }); value = $_.value } })
+                    }
+                } elseif ($Field) {
+                    $Groups = @(foreach ($Row in $Rows) { @(& $ValueOf $Row $Field | ForEach-Object { "$_" }) }) | Group-Object { $_.ToLowerInvariant() } | Sort-Object -Property @{ Expression = 'Count'; Descending = $true }, @{ Expression = 'Name'; Descending = $false }
+                    $Blank = @($Rows | Where-Object { @(& $ValueOf $_ $Field).Count -eq 0 }).Count
+                    $Top = @($Groups | Select-Object -First $MaxSlices | ForEach-Object { @{ label = $_.Group[0]; value = $_.Count } })
+                    $Rest = @($Groups | Select-Object -Skip $MaxSlices | Measure-Object -Property Count -Sum).Sum
+                    @($Top; if ($Rest -gt 0) { @{ label = 'Other'; value = [int]$Rest } }; if ($Blank -gt 0) { @{ label = '(blank)'; value = $Blank } })
+                } else {
+                    @(@{ label = $(if ($Block.title) { "$($Block.title)" } else { $Spec.type }); value = $Rows.Count })
+                }
+                & $SetProperty $Block 'chartData' @($Points)
+            }
+        }
+
+        # A table filled from the data: the rows (the ones the condition keeps), each column reading
+        # the field it names. A dataSource with a preset instead calls a derived builder for data that a
+        # flat single-collection read cannot express (e.g. the Secure Score controls, nested per snapshot);
+        # either way the same column mapping fills the table.
+        if ($Type -eq 'richtable' -and $Block.dataSource) {
+            $TablePreset = "$($Block.dataSource.preset)"
+            $Rows = if ($TablePreset) {
+                $Source = & $RowsOf "$($Block.dataSource.type)"
+                if ($null -ne $Source) { try { @(Get-CippReportTableData -Preset $TablePreset -Rows @($Source)) } catch { $null } }
+            } else {
+                $Spec = & $SourceOf $Block.dataSource
+                if ($Spec) { & $RowsFor $Spec }
+            }
+            if ($null -ne $Rows) {
+                $Columns = @($Block.columns)
+                $TableRows = @(foreach ($Row in (@($Rows) | Select-Object -First $MaxRows)) {
+                        $Cells = [ordered]@{}
+                        foreach ($Column in $Columns) {
+                            $Key = "$($Column.key)"
+                            $From = if ($Column.field) { "$($Column.field)" } else { "$($Column.header)" }
+                            $Cells[$Key] = (@(& $ValueOf $Row $From | ForEach-Object { "$_" }) -join ', ')
+                        }
+                        $Cells
+                    })
+                & $SetProperty $Block 'rows' @($TableRows)
+                if (-not $Block.limit) { & $SetProperty $Block 'limit' $MaxRows }
+            }
+        }
+
+        # Score cards drawn from the data: one card per distinct value of the field, the figure a count
+        # of rows (or an aggregate of a numeric field). Manual stats stay hand-typed and can use tokens.
+        if ($Type -eq 'scorecard' -and $Block.statsSource) {
+            $Spec = & $SourceOf $Block.statsSource
+            $Rows = if ($Spec) { & $RowsFor $Spec }
+            if ($Spec -and $null -ne $Rows) {
+                $Cards = @(& $CardsFrom $Spec @($Rows) "$($Block.title)" | ForEach-Object { @{ value = (& $FormatNumber $_.value); label = $_.label } })
+                if ($Cards.Count -gt 0) { & $SetProperty $Block 'stats' @($Cards) }
+            }
+        }
+
+        # Progress bars drawn from the data: one bar per distinct value of the field, filled by its share
+        # of the total (counting rows) or of the largest bar (aggregating a numeric field).
+        if ($Type -eq 'progress' -and $Block.itemsSource) {
+            $Spec = & $SourceOf $Block.itemsSource
+            $Rows = if ($Spec) { & $RowsFor $Spec }
+            if ($Spec -and $null -ne $Rows) {
+                $Bars = @(& $CardsFrom $Spec @($Rows) "$($Block.title)")
+                if ($Bars.Count -gt 0) {
+                    $Max = if ($Spec.valueField) { [double](@($Bars | ForEach-Object { $_.value }) | Measure-Object -Maximum).Maximum } else { [double]@($Rows).Count }
+                    if ($Max -le 0) { $Max = [double](@($Bars | ForEach-Object { $_.value }) | Measure-Object -Maximum).Maximum }
+                    $Items = @($Bars | ForEach-Object { @{ label = $_.label; value = $_.value; max = $Max } })
+                    & $SetProperty $Block 'items' @($Items)
+                }
+            }
+        }
+
+        # A sankey (flow diagram) drawn from the data. Three shapes:
+        #   preset   - a faithful server-side port of a dashboard sankey (MFA coverage, auth methods,
+        #              licence allocation, device compliance); Get-CippReportSankeyData does the exact
+        #              per-sankey computation the dashboard card does, so the report matches the dashboard.
+        #   measures - one category field on the left, plus numeric measure fields, each a right-hand
+        #              node; every row adds category -> measureLabel weighted by that field.
+        #   flow     - an ordered list of categorical fields; each adjacent pair (a, b) becomes a link
+        #              a -> b weighted by the number of rows (or the sum of valueField). Node ids are
+        #              namespaced by stage so a value shared between two columns does not fold/cycle.
+        if ($Type -eq 'sankey' -and $Block.sankeySource) {
+            $Sankey = $Block.sankeySource
+            $CollectionType = "$($Sankey.type)"
+            $Rows = if ($CollectionType) { & $RowsOf $CollectionType }
+            if ($null -ne $Rows -and $Sankey.preset) {
+                # Faithful dashboard sankey - the ported card logic owns the whole {nodes, links}.
+                $Built = try { Get-CippReportSankeyData -Preset "$($Sankey.preset)" -Rows @($Rows) } catch { $null }
+                if ($Built -and @($Built.links).Count -gt 0) {
+                    & $SetProperty $Block 'nodes' @($Built.nodes)
+                    & $SetProperty $Block 'links' @($Built.links)
+                }
+            } elseif ($null -ne $Rows) {
+                $SankeyFilter = $Sankey.filter
+                if ($SankeyFilter -and $SankeyFilter.field -and $SankeyFilter.op) {
+                    $Rows = @($Rows | Where-Object { & $RowMatches $_ "$($SankeyFilter.field)" "$($SankeyFilter.op)" "$($SankeyFilter.value)" })
+                }
+                $NodeOrder = [System.Collections.Generic.List[string]]::new()
+                $NodeLabel = @{}
+                $NodeColour = @{}
+                $LinkValue = [ordered]@{}
+                $Palette = { param([int]$Index) 'hsl({0}, 70%, 50%)' -f ((205 + $Index * 37) % 360) }
+                $AddNode = {
+                    param([string]$Id, [string]$Label, [string]$Colour)
+                    if (-not $NodeLabel.ContainsKey($Id)) {
+                        $NodeOrder.Add($Id)
+                        $NodeLabel[$Id] = $Label
+                        $NodeColour[$Id] = if ($Colour) { $Colour } else { & $Palette ($NodeOrder.Count - 1) }
+                    }
+                }
+                $AddLink = {
+                    param([string]$Source, [string]$Target, [double]$Value)
+                    $Key = "$Source`n$Target"
+                    $LinkValue[$Key] = ([double]($LinkValue[$Key]) + $Value)
+                }
+
+                if ("$($Sankey.mode)" -eq 'measures') {
+                    $CategoryField = "$($Sankey.field)"
+                    $Measures = @($Sankey.measures)
+                    $Limit = if (($Sankey.limit -as [int]) -gt 0) { [int]$Sankey.limit } else { 8 }
+                    # Rank categories by their total across all measures, keep the top N.
+                    $CategoryTotals = @{}
+                    foreach ($Row in $Rows) {
+                        $Category = @(& $ValueOf $Row $CategoryField | ForEach-Object { "$_" }) | Select-Object -First 1
+                        if (-not $Category) { continue }
+                        foreach ($Measure in $Measures) {
+                            $Number = @(& $ValueOf $Row "$($Measure.field)" | ForEach-Object { $_ -as [double] } | Where-Object { $null -ne $_ }) | Select-Object -First 1
+                            if ($null -ne $Number) { $CategoryTotals[$Category] = ([double]($CategoryTotals[$Category]) + [double]$Number) }
+                        }
+                    }
+                    $KeepCategories = @($CategoryTotals.GetEnumerator() | Sort-Object -Property Value -Descending | Select-Object -First $Limit -ExpandProperty Key)
+                    foreach ($Row in $Rows) {
+                        $Category = @(& $ValueOf $Row $CategoryField | ForEach-Object { "$_" }) | Select-Object -First 1
+                        if (-not $Category -or $Category -notin $KeepCategories) { continue }
+                        & $AddNode $Category $Category $null
+                        foreach ($Measure in $Measures) {
+                            $Label = if ($Measure.label) { "$($Measure.label)" } else { "$($Measure.field)" }
+                            $Number = @(& $ValueOf $Row "$($Measure.field)" | ForEach-Object { $_ -as [double] } | Where-Object { $null -ne $_ }) | Select-Object -First 1
+                            if ($null -eq $Number -or $Number -le 0) { continue }
+                            & $AddNode "measure:$Label" $Label "$($Measure.colour)"
+                            & $AddLink $Category "measure:$Label" ([double]$Number)
+                        }
+                    }
+                } else {
+                    # flow: an ordered list of categorical fields; adjacent pairs become links. Node ids are
+                    # namespaced by stage index so the same value in two columns stays two nodes.
+                    $Fields = @($Sankey.fields | Where-Object { $_ } | ForEach-Object { "$_" })
+                    $ValueField = if ($Sankey.valueField) { "$($Sankey.valueField)" }
+                    if ($Fields.Count -ge 2) {
+                        foreach ($Row in $Rows) {
+                            $Weight = if ($ValueField) {
+                                @(& $ValueOf $Row $ValueField | ForEach-Object { $_ -as [double] } | Where-Object { $null -ne $_ }) | Select-Object -First 1
+                            } else { 1 }
+                            if ($null -eq $Weight -or $Weight -le 0) { continue }
+                            $Stages = @(for ($si = 0; $si -lt $Fields.Count; $si++) {
+                                    $Value = @(& $ValueOf $Row $Fields[$si] | ForEach-Object { "$_" }) | Select-Object -First 1
+                                    if (-not $Value) { $Value = '(blank)' }
+                                    [pscustomobject]@{ Id = ('{0}:{1}' -f $si, $Value); Label = "$Value" }
+                                })
+                            foreach ($Stage in $Stages) { & $AddNode $Stage.Id $Stage.Label $null }
+                            for ($i = 0; $i -lt $Stages.Count - 1; $i++) { & $AddLink $Stages[$i].Id $Stages[$i + 1].Id ([double]$Weight) }
+                        }
+                    }
+                }
+
+                if ($NodeOrder.Count -gt 0 -and $LinkValue.Count -gt 0) {
+                    $Nodes = @(foreach ($Id in $NodeOrder) { @{ id = $Id; label = $NodeLabel[$Id]; nodeColor = $NodeColour[$Id] } })
+                    $Links = @(foreach ($Key in $LinkValue.Keys) {
+                            $Parts = $Key -split "`n", 2
+                            @{ source = $Parts[0]; target = $Parts[1]; value = $LinkValue[$Key] }
+                        })
+                    & $SetProperty $Block 'nodes' @($Nodes)
+                    & $SetProperty $Block 'links' @($Links)
+                }
+            }
+        }
+
+        # Every other string on the block, its rows and its items.
+        if ($Block -is [System.Collections.IDictionary]) {
+            foreach ($Name in @($Block.Keys)) { if ($Name -notin 'chartSource', 'dataSource', 'sankeySource', 'statsSource', 'itemsSource') { $Block[$Name] = & $Walk $Block[$Name] } }
+        } else {
+            foreach ($Property in @($Block.PSObject.Properties)) { if ($Property.Name -notin 'chartSource', 'dataSource', 'sankeySource', 'statsSource', 'itemsSource') { $Block.($Property.Name) = & $Walk $Property.Value } }
+        }
+    }
+
+    # Unrolled, not wrapped: callers collect with @(), and a wrapped array would reach them as one
+    # element holding every block - which the renderer then draws as nothing at all.
+    return $Blocks
+}
diff --git a/Modules/CIPPCore/Public/Update-CIPPSAMCertificate.ps1 b/Modules/CIPPCore/Public/Update-CIPPSAMCertificate.ps1
index 8fb1cec650878..fc718836ac02b 100644
--- a/Modules/CIPPCore/Public/Update-CIPPSAMCertificate.ps1
+++ b/Modules/CIPPCore/Public/Update-CIPPSAMCertificate.ps1
@@ -1,18 +1,15 @@
 function Update-CIPPSAMCertificate {
     <#
     .SYNOPSIS
-    Creates or renews the SAM app certificate
+    Creates, renews, or reconciles the SAM app certificate
 
     .DESCRIPTION
-    Checks the stored SAM certificate and renews it when missing (first-run bootstrap),
-    within the renewal threshold of expiry, or when the stored certificate is not registered
-    on the SAM app (drift from a previously failed run). Renewal generates a new self-signed
-    certificate, registers it on the app registration via a full keyCredentials PATCH
-    (addKey requires a proof-of-possession token signed by an existing key, which is
-    impossible at bootstrap), then stores the PFX via Set-CIPPSAMCertificate. Still-valid
-    existing key credentials are kept during rotation so in-flight assertions keep working;
-    expired ones are pruned in the same PATCH. If storage fails, the new credential is
-    rolled back off the app registration so renewal is retried on the next run.
+    Loads Key Vault SAMCertificate current/previous versions as the Entra keep-set.
+    On every run, removes proven CIPP debris (older KV thumbprints or CIPP-SAM displayName
+    orphans) while preserving unknown credentials. Mints only when missing, near expiry,
+    or -Force. Drift re-registers the same stored public key without minting. Renewal
+    keeps at most the previous current plus the new cert, then stores the PFX under the
+    same KV name. Store failure rolls back only the newly added credential.
 
     .PARAMETER RenewalThresholdDays
     Renew when the stored certificate expires within this many days. Defaults to 30.
@@ -50,49 +47,109 @@ function Update-CIPPSAMCertificate {
     $AppId = if ($ApplicationId) { $ApplicationId } else { $env:ApplicationID }
     $AppRegistration = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$AppId')?`$select=id,keyCredentials" -NoAuthCheck $true -AsApp $true -Headers $Headers -ErrorAction Stop
 
-    $Stored = $null
+    $Versions = $null
     try {
-        $Stored = Get-CIPPSAMCertificate -SkipCache -ErrorAction Stop
+        $Versions = Get-CIPPSAMCertificateVersions -ErrorAction Stop
     } catch {
-        Write-Warning "Could not retrieve stored SAM certificate: $($_.Exception.Message)"
+        Write-Warning "Could not retrieve SAM certificate versions: $($_.Exception.Message). Falling back to latest stored certificate."
+        try {
+            $Fallback = Get-CIPPSAMCertificate -SkipCache -ErrorAction Stop
+            if ($Fallback) {
+                $PublicKeyBase64 = [Convert]::ToBase64String(
+                    $Fallback.Certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Cert)
+                )
+                $CurrentInfo = [PSCustomObject]@{
+                    Certificate     = $Fallback.Certificate
+                    Thumbprint      = $Fallback.Thumbprint
+                    NotBefore       = $Fallback.NotBefore
+                    NotAfter        = $Fallback.NotAfter
+                    PfxBase64       = $null
+                    PublicKeyBase64 = $PublicKeyBase64
+                }
+                $Versions = [PSCustomObject]@{
+                    Current               = $CurrentInfo
+                    Previous              = $null
+                    HistoricalThumbprints = [string[]]@()
+                    AllKnownThumbprints   = @($Fallback.Thumbprint)
+                }
+                Write-Information "Using latest SAM certificate $($Fallback.Thumbprint) after versions load failure; historical prune skipped this run."
+            } else {
+                $Versions = [PSCustomObject]@{
+                    Current               = $null
+                    Previous              = $null
+                    HistoricalThumbprints = [string[]]@()
+                    AllKnownThumbprints   = [string[]]@()
+                }
+            }
+        } catch {
+            # Fail closed: a transient KV error must not be treated as "no cert" and force a mint.
+            Write-LogMessage -API 'SAMCertificate' -message "Could not load SAM certificate versions or the latest stored certificate. Skipping renewal to avoid rotating a still-valid cert. See Log Data for details." -sev 'Warning' -LogData (Get-CippException -Exception $_)
+            throw "SAM certificate storage is temporarily unavailable; renewal skipped to avoid forced rotation. $($_.Exception.Message)"
+        }
+    }
+
+    $Current = $Versions.Current
+    $Previous = $Versions.Previous
+    $HistoricalThumbprints = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    foreach ($Tp in @($Versions.HistoricalThumbprints)) {
+        if ($Tp) { [void]$HistoricalThumbprints.Add($Tp) }
     }
 
-    $RenewalReason = if ($Force) {
-        'Forced renewal requested'
-    } elseif ($null -eq $Stored) {
-        'No stored certificate found, creating initial certificate'
-    } elseif ($Stored.NotAfter -lt (Get-Date).AddDays($RenewalThresholdDays).ToUniversalTime()) {
-        "Stored certificate expires $($Stored.NotAfter), within the $RenewalThresholdDays day renewal threshold"
+    $KnownForResolve = [System.Collections.Generic.List[string]]::new()
+    foreach ($Tp in @($Versions.AllKnownThumbprints)) {
+        if ($Tp) { $KnownForResolve.Add($Tp) }
+    }
+
+    $NeedMint = $false
+    $MintReason = $null
+    if ($Force) {
+        $NeedMint = $true
+        $MintReason = 'Forced renewal requested'
+    } elseif ($null -eq $Current) {
+        $NeedMint = $true
+        $MintReason = 'No stored certificate found, creating initial certificate'
+    } elseif ($Current.NotAfter -lt (Get-Date).AddDays($RenewalThresholdDays).ToUniversalTime()) {
+        $NeedMint = $true
+        $MintReason = "Stored certificate expires $($Current.NotAfter), within the $RenewalThresholdDays day renewal threshold"
+    }
+
+    # Keep-set on Entra: current+previous normally; during mint only pre-write current (becomes previous) + new.
+    $KeepThumbprints = [System.Collections.Generic.HashSet[string]]::new([StringComparer]::OrdinalIgnoreCase)
+    if ($NeedMint) {
+        if ($Current.Thumbprint) { [void]$KeepThumbprints.Add($Current.Thumbprint) }
     } else {
-        # Drift check: the stored certificate should be registered on the app. If it is not,
-        # a previous run failed between storage and Graph (or its rollback failed) - self-heal.
-        # Graph returns customKeyIdentifier as the hex thumbprint string, but tolerate the
-        # base64-encoded thumbprint bytes form as well.
-        $Identifiers = @($AppRegistration.keyCredentials.customKeyIdentifier)
-        if ($Identifiers -notcontains $Stored.Thumbprint -and $Identifiers -notcontains [Convert]::ToBase64String([Convert]::FromHexString($Stored.Thumbprint))) {
-            'Stored certificate is not registered on the app registration, re-registering'
-        } else {
-            $null
+        if ($Current.Thumbprint) { [void]$KeepThumbprints.Add($Current.Thumbprint) }
+        if ($Previous.Thumbprint) { [void]$KeepThumbprints.Add($Previous.Thumbprint) }
+    }
+
+    $Classification = Get-CIPPSAMCredentialClassification -Credentials $AppRegistration.keyCredentials -KeepThumbprints $KeepThumbprints -HistoricalThumbprints $HistoricalThumbprints -KnownThumbprints $KnownForResolve
+    $Drift = $false
+    if ($Current -and -not $NeedMint) {
+        $Drift = -not (Test-CIPPSAMAppHasThumbprint -Credentials $AppRegistration.keyCredentials -Thumbprint $Current.Thumbprint)
+        if ($Drift) {
+            Write-Information "Stored SAM certificate $($Current.Thumbprint) is not registered on the app; will re-register"
         }
     }
 
-    if (-not $RenewalReason) {
-        Write-Information "SAM certificate is valid until $($Stored.NotAfter) and registered on the app. No renewal needed."
+    $NeedReconcile = $Drift -or ($Classification.RemovedCount -gt 0)
+    if (-not $NeedMint -and -not $NeedReconcile) {
+        Write-Information "SAM certificate is valid until $($Current.NotAfter) and registered on the app. No renewal or reconcile needed."
         return [PSCustomObject]@{
-            Renewed    = $false
-            Thumbprint = $Stored.Thumbprint
-            NotAfter   = $Stored.NotAfter
+            Renewed     = $false
+            Reconciled  = $false
+            Thumbprint  = $Current.Thumbprint
+            NotAfter    = $Current.NotAfter
+            RemovedCount = 0
         }
     }
 
-    if (-not $PSCmdlet.ShouldProcess($AppId, "Renew SAM certificate: $RenewalReason")) {
+    $ActionDescription = if ($NeedMint) { "Renew SAM certificate: $MintReason" } elseif ($Drift) { 'Re-register stored SAM certificate (drift)' } else { "Reconcile SAM keyCredentials (remove $($Classification.RemovedCount) CIPP debris)" }
+    if (-not $PSCmdlet.ShouldProcess($AppId, $ActionDescription)) {
         return
     }
 
-    Write-Information "Renewing SAM certificate for $AppId. Reason: $RenewalReason"
+    Write-Information "$ActionDescription for $AppId"
 
-    # Ensure the CIPP exemption policy covers key credential restrictions (asymmetricKeyLifetime /
-    # trustedCertificateAuthority would otherwise block registering a 1 year self-signed certificate)
     try {
         $AppPolicyStatus = Update-AppManagementPolicy -ApplicationId $AppId -Headers $Headers
         if ($AppPolicyStatus.PolicyAction) { Write-Information $AppPolicyStatus.PolicyAction }
@@ -100,62 +157,193 @@ function Update-CIPPSAMCertificate {
         Write-Warning "Error updating app management policy $($_.Exception.Message)."
     }
 
-    $NewCert = New-CIPPSAMCertificate
-
-    # Keep still-valid credentials (rotation overlap) and prune expired ones in the same PATCH.
-    # Existing credentials are sent back with their keyId and null key material, which Graph
-    # preserves; only the appended entry carries new key material.
-    $Now = (Get-Date).ToUniversalTime()
-    $KeyCredentials = [System.Collections.Generic.List[object]]::new()
-    foreach ($Credential in $AppRegistration.keyCredentials) {
-        if ($Credential.endDateTime -ge $Now) {
-            $KeyCredentials.Add($Credential)
-        } else {
-            Write-Information "Pruning expired key credential $($Credential.keyId) (expired $($Credential.endDateTime))"
-        }
-    }
-    # Record which instance issued the certificate: machine name for local dev, site name in Azure
     if ($env:AzureWebJobsStorage -eq 'UseDevelopmentStorage=true' -or $env:NonLocalHostAzurite -eq 'true') {
         $InstanceName = [System.Environment]::MachineName
     } else {
         $InstanceName = $env:WEBSITE_SITE_NAME
     }
-    $KeyCredentials.Add(@{
-            type        = 'AsymmetricX509Cert'
-            usage       = 'Verify'
-            key         = $NewCert.PublicKeyBase64
-            displayName = "CIPP-SAM Certificate ($InstanceName)"
-        })
 
-    $PatchBody = @{ keyCredentials = $KeyCredentials } | ConvertTo-Json -Compress -Depth 10
+    $KeyCredentials = [System.Collections.Generic.List[object]]::new()
+    foreach ($Credential in $Classification.KeepCredentials) {
+        $KeyCredentials.Add($Credential)
+    }
+
+    $NewCert = $null
+    if ($NeedMint) {
+        $NewCert = New-CIPPSAMCertificate
+        if ($NewCert.Thumbprint) { $KnownForResolve.Add($NewCert.Thumbprint) }
+        $KeyCredentials.Add(@{
+                type        = 'AsymmetricX509Cert'
+                usage       = 'Verify'
+                key         = $NewCert.PublicKeyBase64
+                displayName = "CIPP-SAM Certificate ($InstanceName)"
+            })
+    } elseif ($Drift -and $Current.PublicKeyBase64) {
+        $KeyCredentials.Add(@{
+                type        = 'AsymmetricX509Cert'
+                usage       = 'Verify'
+                key         = $Current.PublicKeyBase64
+                displayName = "CIPP-SAM Certificate ($InstanceName)"
+            })
+    }
+
+    $PatchBody = @{ keyCredentials = @($KeyCredentials) } | ConvertTo-Json -Compress -Depth 10
     New-GraphPOSTRequest -type PATCH -uri "https://graph.microsoft.com/v1.0/applications/$($AppRegistration.id)" -Body $PatchBody -NoAuthCheck $true -AsApp $true -Headers $Headers -ErrorAction Stop
-    Write-Information "Registered new SAM certificate $($NewCert.Thumbprint) on application $AppId"
 
-    try {
-        $StoreResult = Set-CIPPSAMCertificate -PfxBase64 $NewCert.PfxBase64 -ErrorAction Stop
-    } catch {
-        # The new certificate is registered on the app but not retrievable where CIPP reads it,
-        # and as the newest credential it would suppress renewal on the next run. Roll it back
-        # off the app registration so state stays consistent and renewal is retried.
-        Write-LogMessage -API 'SAMCertificate' -message "Failed to store new SAM certificate for $AppId. Rolling back the registered key credential, see Log Data for details." -sev 'CRITICAL' -LogData (Get-CippException -Exception $_)
+    if ($NeedMint) {
+        Write-Information "Registered new SAM certificate $($NewCert.Thumbprint) on application $AppId (removed $($Classification.RemovedCount) CIPP debris)"
         try {
-            $RollbackCredentials = $KeyCredentials | Where-Object { $_.key -ne $NewCert.PublicKeyBase64 }
-            $RollbackBody = @{ keyCredentials = @($RollbackCredentials) } | ConvertTo-Json -Compress -Depth 10
-            New-GraphPOSTRequest -type PATCH -uri "https://graph.microsoft.com/v1.0/applications/$($AppRegistration.id)" -Body $RollbackBody -NoAuthCheck $true -AsApp $true -Headers $Headers -ErrorAction Stop
-            Write-Information "Rolled back unstored SAM certificate $($NewCert.Thumbprint) from application $AppId"
+            $StoreResult = Set-CIPPSAMCertificate -PfxBase64 $NewCert.PfxBase64 -ErrorAction Stop
         } catch {
-            # Rollback failed - the drift check on the next run will force a fresh renewal
-            Write-LogMessage -API 'SAMCertificate' -message "Failed to roll back unstored SAM certificate $($NewCert.Thumbprint) for $AppId, see Log Data for details. Renewal will retry on the next run." -sev 'CRITICAL' -LogData (Get-CippException -Exception $_)
+            Write-LogMessage -API 'SAMCertificate' -message "Failed to store new SAM certificate for $AppId. Rolling back the registered key credential, see Log Data for details." -sev 'CRITICAL' -LogData (Get-CippException -Exception $_)
+            try {
+                $RollbackCredentials = @($KeyCredentials | Where-Object { $_.key -ne $NewCert.PublicKeyBase64 })
+                $RollbackBody = @{ keyCredentials = @($RollbackCredentials) } | ConvertTo-Json -Compress -Depth 10
+                New-GraphPOSTRequest -type PATCH -uri "https://graph.microsoft.com/v1.0/applications/$($AppRegistration.id)" -Body $RollbackBody -NoAuthCheck $true -AsApp $true -Headers $Headers -ErrorAction Stop
+                Write-Information "Rolled back unstored SAM certificate $($NewCert.Thumbprint) from application $AppId"
+            } catch {
+                Write-LogMessage -API 'SAMCertificate' -message "Failed to roll back unstored SAM certificate $($NewCert.Thumbprint) for $AppId, see Log Data for details. Renewal will retry on the next run." -sev 'CRITICAL' -LogData (Get-CippException -Exception $_)
+            }
+            throw
+        }
+
+        Write-LogMessage -API 'SAMCertificate' -message "SAM certificate renewed for $AppId. Thumbprint: $($NewCert.Thumbprint), expires: $($NewCert.NotAfter), storage mode: $($StoreResult.StorageMode). Reason: $MintReason. Removed $($Classification.RemovedCount) CIPP debris." -sev 'Info'
+
+        return [PSCustomObject]@{
+            Renewed      = $true
+            Reconciled   = ($Classification.RemovedCount -gt 0)
+            Thumbprint   = $NewCert.Thumbprint
+            NotAfter     = $NewCert.NotAfter
+            StorageMode  = $StoreResult.StorageMode
+            RemovedCount = $Classification.RemovedCount
         }
-        throw
     }
 
-    Write-LogMessage -API 'SAMCertificate' -message "SAM certificate renewed for $AppId. Thumbprint: $($NewCert.Thumbprint), expires: $($NewCert.NotAfter), storage mode: $($StoreResult.StorageMode). Reason: $RenewalReason" -sev 'Info'
+    $ResultThumbprint = $Current.Thumbprint
+    $ResultNotAfter = $Current.NotAfter
+    Write-LogMessage -API 'SAMCertificate' -message "SAM certificate reconciled for $AppId. Thumbprint: $ResultThumbprint, drift=$Drift, removed $($Classification.RemovedCount) CIPP debris." -sev 'Info'
 
     return [PSCustomObject]@{
-        Renewed     = $true
-        Thumbprint  = $NewCert.Thumbprint
-        NotAfter    = $NewCert.NotAfter
-        StorageMode = $StoreResult.StorageMode
+        Renewed      = $false
+        Reconciled   = $true
+        Thumbprint   = $ResultThumbprint
+        NotAfter     = $ResultNotAfter
+        RemovedCount = $Classification.RemovedCount
+        Drift        = $Drift
+    }
+}
+
+function Get-CIPPSAMCredentialClassification {
+    <#
+    .SYNOPSIS
+    Classifies app keyCredentials into keep vs remove for SAM cert reconcile
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        $Credentials,
+        [System.Collections.Generic.HashSet[string]]$KeepThumbprints,
+        [System.Collections.Generic.HashSet[string]]$HistoricalThumbprints,
+        [System.Collections.Generic.List[string]]$KnownThumbprints
+    )
+
+    $KeepCredentials = [System.Collections.Generic.List[object]]::new()
+    $RemovedCount = 0
+
+    foreach ($Credential in @($Credentials)) {
+        $Thumbprint = Resolve-CIPPSAMCredentialThumbprint -Credential $Credential -KnownThumbprints $KnownThumbprints
+
+        if ($Thumbprint -and $KeepThumbprints.Contains($Thumbprint)) {
+            $KeepCredentials.Add($Credential)
+            continue
+        }
+
+        if ($null -eq $Thumbprint) {
+            # Cannot prove identity — leave alone
+            $KeepCredentials.Add($Credential)
+            continue
+        }
+
+        $IsCippDisplayName = $Credential.displayName -like 'CIPP-SAM Certificate*'
+        $InHistorical = $HistoricalThumbprints.Contains($Thumbprint)
+        if ($InHistorical -or $IsCippDisplayName) {
+            $RemovedCount++
+            Write-Information "Pruning CIPP key credential $($Credential.keyId) thumbprint=$Thumbprint displayName=$($Credential.displayName)"
+            continue
+        }
+
+        $KeepCredentials.Add($Credential)
+    }
+
+    return [PSCustomObject]@{
+        KeepCredentials = $KeepCredentials
+        RemovedCount    = $RemovedCount
+    }
+}
+
+function Resolve-CIPPSAMCredentialThumbprint {
+    <#
+    .SYNOPSIS
+    Maps a Graph keyCredential customKeyIdentifier to a known thumbprint when possible
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        $Credential,
+        [System.Collections.Generic.List[string]]$KnownThumbprints
+    )
+
+    $Identifier = $Credential.customKeyIdentifier
+    if ([string]::IsNullOrEmpty($Identifier)) {
+        return $null
+    }
+
+    foreach ($Thumbprint in @($KnownThumbprints)) {
+        if ([string]::IsNullOrEmpty($Thumbprint)) { continue }
+        if ($Identifier -eq $Thumbprint) { return $Thumbprint }
+        try {
+            $AsBase64 = [Convert]::ToBase64String([Convert]::FromHexString($Thumbprint))
+            if ($Identifier -eq $AsBase64) { return $Thumbprint }
+        } catch {
+            # Thumbprint was not valid hex — ignore
+        }
+    }
+
+    # Graph often returns the hex thumbprint directly
+    if ($Identifier -match '^[0-9A-Fa-f]{40}$') {
+        return $Identifier.ToUpperInvariant()
+    }
+
+    return $null
+}
+
+function Test-CIPPSAMAppHasThumbprint {
+    <#
+    .SYNOPSIS
+    Returns true when an app keyCredentials collection includes the given thumbprint
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        $Credentials,
+        [string]$Thumbprint
+    )
+
+    if ([string]::IsNullOrEmpty($Thumbprint)) {
+        return $false
+    }
+
+    $Identifiers = @($Credentials.customKeyIdentifier)
+    if ($Identifiers -contains $Thumbprint) {
+        return $true
+    }
+    try {
+        $AsBase64 = [Convert]::ToBase64String([Convert]::FromHexString($Thumbprint))
+        return ($Identifiers -contains $AsBase64)
+    } catch {
+        return $false
     }
 }
diff --git a/Modules/CIPPCore/Public/Webhooks/Get-CIPPPartnerUserLookup.ps1 b/Modules/CIPPCore/Public/Webhooks/Get-CIPPPartnerUserLookup.ps1
new file mode 100644
index 0000000000000..5a95ef6ec6110
--- /dev/null
+++ b/Modules/CIPPCore/Public/Webhooks/Get-CIPPPartnerUserLookup.ps1
@@ -0,0 +1,50 @@
+function Get-CIPPPartnerUserLookup {
+    <#
+    .SYNOPSIS
+        Returns the partner (CIPP) tenant's users as a hashtable keyed by object id.
+    .DESCRIPTION
+        Audit records in a customer tenant name a partner (GDAP) identity by its object id in the
+        partner tenant: user_<id>@<tenant>.onmicrosoft.com in Entra records, and
+        <customer>.onmicrosoft.com\tenant: <partner tenant id>, object: <id> in Exchange records. This
+        lookup turns that id back into the partner user. The answer is the same for every tenant, so
+        it is memoised per worker for five minutes and cached for a day in the cacheauditloglookups
+        table (PartitionKey '_partner', RowKey 'users'), refreshed from Graph when both are stale.
+        The audit-log pipeline (Test-CIPPAuditLogRules) and the BEC run share it.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param()
+
+    if ($null -eq $script:PartnerUserMemo -or $script:PartnerUserMemo.Expires -le [datetime]::UtcNow) {
+        $script:PartnerUserMemo = [PSCustomObject]@{
+            Expires = [datetime]::UtcNow.AddMinutes(5)
+            Lookup  = $null
+        }
+    } elseif ($null -ne $script:PartnerUserMemo.Lookup) {
+        return $script:PartnerUserMemo.Lookup
+    }
+
+    $Table = Get-CIPPTable -tablename 'cacheauditloglookups'
+    $OneDayAgo = (Get-Date).AddDays(-1).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+    $Cached = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '_partner' and RowKey eq 'users' and Timestamp gt datetime'$OneDayAgo'"
+    $Lookup = if ($Cached -and $Cached.Format -eq 'hashtable') {
+        ($Cached.Data | ConvertFrom-Json -ErrorAction SilentlyContinue -AsHashtable) ?? @{}
+    } else {
+        $PartnerUsers = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$select=id,displayName,userPrincipalName,accountEnabled&`$top=999" -AsApp $true -NoAuthCheck $true
+        $Fresh = @{}
+        foreach ($PartnerUser in $PartnerUsers) {
+            if (![string]::IsNullOrEmpty($PartnerUser.id)) { $Fresh[$PartnerUser.id] = $PartnerUser }
+        }
+        Add-CIPPAzDataTableEntity @Table -Entity @{
+            PartitionKey = '_partner'
+            RowKey       = 'users'
+            Data         = [string]($Fresh | ConvertTo-Json -Compress)
+            Format       = 'hashtable'
+        } -Force
+        $Fresh
+    }
+    $script:PartnerUserMemo.Lookup = $Lookup
+    Write-Information "Partner user hashtable: $($Lookup.Count) partner users"
+    return $Lookup
+}
diff --git a/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 b/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1
index f5067a0a840be..26fda86afa9df 100644
--- a/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1
+++ b/Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1
@@ -19,6 +19,32 @@ function Invoke-CippWebhookProcessing {
 
     $AuditLogTable = Get-CIPPTable -TableName 'AuditLogs'
 
+    # The record Id alone does not identify an event: Entra sign-in records reuse the same Id for
+    # the same user weeks apart, so a claim from an old sign-in would swallow every later one. The
+    # claim therefore carries the event's own time, and a key conflict only yields to a strictly
+    # newer event. Empty when the record has no CreationTime - that falls back to
+    # dedupe on the Id alone. The RowKey stays the bare Id so the audit-log link, the Saved Logs
+    # list endpoint and the split-row OriginalEntityId lookup all keep working unchanged.
+    $EventStamp = ''
+    $CreationTime = $Data.CreationTime ?? $Data.RawData.CreationTime ?? $Data.createdDateTime
+    if ($CreationTime -is [datetime]) {
+        $EventStamp = $CreationTime.ToUniversalTime().ToString('yyyyMMddHHmmss')
+    } elseif ($CreationTime) {
+        $ParsedCreation = [datetime]::MinValue
+        $CreationStyles = [System.Globalization.DateTimeStyles]::AdjustToUniversal -bor [System.Globalization.DateTimeStyles]::AssumeUniversal
+        if ([datetime]::TryParse([string]$CreationTime, [cultureinfo]::InvariantCulture, $CreationStyles, [ref]$ParsedCreation)) {
+            $EventStamp = $ParsedCreation.ToString('yyyyMMddHHmmss')
+        }
+    }
+
+    $ClaimRow = @{
+        PartitionKey      = $TenantFilter
+        RowKey            = $Data.Id
+        Title             = 'Processing'
+        Tenant            = $TenantFilter
+        EventCreationTime = $EventStamp
+    }
+
     # Claim the event ID immediately, with no read first. The claim is an Insert without -Force, so
     # a conflict already tells us another worker (or an earlier run) owns this event - the read that
     # used to precede it answered the same question a round trip earlier and could not make the
@@ -28,15 +54,31 @@ function Invoke-CippWebhookProcessing {
     # instead of a read plus an insert.
     # -ErrorAction Stop ensures non-terminating errors enter the catch block.
     try {
-        Add-CIPPAzDataTableEntity @AuditLogTable -Entity @{
-            PartitionKey = $TenantFilter
-            RowKey       = $Data.Id
-            Title        = 'Processing'
-            Tenant       = $TenantFilter
-        } -ErrorAction Stop
+        Add-CIPPAzDataTableEntity @AuditLogTable -Entity $ClaimRow -ErrorAction Stop
     } catch {
-        Write-Host "Audit log $($Data.Id) already claimed or already processed. Skipping."
-        return
+        # A conflict means the key is taken, not necessarily that this event was handled. Only now
+        # is a read worth a round trip: re-claim when the row belongs to a NEWER event, or when it
+        # is older than the reconciliation window - claims are never pruned, so a row from months
+        # ago can otherwise own the key forever. Anything else is a genuine duplicate and is dropped.
+        #
+        # Strictly newer, not merely different. There is one row per Id, so two same-Id events
+        # inside the reconciliation window would otherwise ping-pong: every 12h pass re-processes
+        # both, each one differs from whatever the other last stored, and both re-alert forever.
+        # Monotonic stamps make the older of the pair a replay. Both stamps are fixed-width
+        # yyyyMMddHHmmss, so a string compare orders them.
+        $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type 'String'
+        $SafeRowKey = ConvertTo-CIPPODataFilterValue -Value ([string]$Data.Id) -Type 'String'
+        $ExistingClaim = Get-CIPPAzDataTableEntity @AuditLogTable -Filter "PartitionKey eq '$SafeTenant' and RowKey eq '$SafeRowKey'" | Select-Object -First 1
+        $ClaimTime = if ($ExistingClaim.Timestamp -is [datetimeoffset]) { $ExistingClaim.Timestamp.UtcDateTime } else { $ExistingClaim.Timestamp -as [datetime] }
+        $NewerEvent = $EventStamp -and $ExistingClaim.EventCreationTime -and $EventStamp -gt $ExistingClaim.EventCreationTime
+        $StaleClaim = $ClaimTime -and $ClaimTime -lt [datetime]::UtcNow.AddDays(-7)
+        if ($NewerEvent -or $StaleClaim) {
+            Write-LogMessage -API $APIName -tenant $TenantFilter -message "Audit log $($Data.Id) matched a $(if ($NewerEvent) { 'claim for an earlier event' } else { 'claim older than 7 days' }). Treating it as a new event." -sev 'Info'
+            Add-CIPPAzDataTableEntity @AuditLogTable -Entity $ClaimRow -Force
+        } else {
+            Write-Host "Audit log $($Data.Id) already claimed or already processed. Skipping."
+            return
+        }
     }
 
     # Memoised per tenant. Get-Tenants does no in-process caching of its own: every call reads the
@@ -85,35 +127,21 @@ function Invoke-CippWebhookProcessing {
                 }
             }
             'becremediate' {
+                # Same dispatcher as the BEC page's containment: the rule's BecActions selection, or - for a
+                # rule that predates selectable containment - the four steps this action always ran. Automation
+                # confirms Critical actions by design. The password never enters the alert payload.
                 $Username = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users/$($Data.UserId)" -tenantid $TenantFilter).UserPrincipalName
+                $BecActionsRaw = try { $Data.CIPPBecActions | ConvertFrom-Json -ErrorAction Stop } catch { @() }
+                $BecActions = @($BecActionsRaw | ForEach-Object { if ($_ -and $_.PSObject.Properties['value']) { $_.value } else { $_ } } | Where-Object { $_ })
+                if ($BecActions.Count -eq 0) { $BecActions = @('ResetPassword', 'DisableAccount', 'RevokeSessions', 'DisableInboxRules') }
                 try {
-                    Set-CIPPResetPassword -UserID $Username -tenantFilter $TenantFilter -APIName 'Alert Engine' -Headers 'Alert Engine'
-                } catch {
-                    Write-Host "Failed to reset password for $Username`: $($_.Exception.Message)"
-                }
-                try {
-                    Set-CIPPSignInState -userid $Username -AccountEnabled $false -tenantFilter $TenantFilter -APIName 'Alert Engine' -Headers 'Alert Engine'
+                    $ContainmentRows = Invoke-CIPPBecContainment -TenantFilter $TenantFilter -UserId $Data.UserId -UserPrincipalName $Username -Actions $BecActions -Confirmed -Redacted -Headers 'Alert Engine' -APIName 'Alert Engine'
+                    foreach ($Row in @($ContainmentRows)) { "$($Row.Action) ($($Row.state)): $($Row.resultText)" }
                 } catch {
-                    Write-Host "Failed to disable sign-in for $Username`: $($_.Exception.Message)"
-                }
-                try {
-                    Revoke-CIPPSessions -userid $Username -username $Username -Headers 'Alert Engine' -APIName 'Alert Engine' -tenantFilter $TenantFilter
-                } catch {
-                    Write-Host "Failed to revoke sessions for $Username`: $($_.Exception.Message)"
-                }
-                $RuleDisabled = 0
-                New-ExoRequest -anchor $Username -tenantid $TenantFilter -cmdlet 'Get-InboxRule' -cmdParams @{Mailbox = $Username; IncludeHidden = $true } | Where-Object { $_.Name -ne 'Junk E-Mail Rule' -and $_.Name -notlike 'Microsoft.Exchange.OOF.*' } | ForEach-Object {
-                    $null = New-ExoRequest -anchor $Username -tenantid $TenantFilter -cmdlet 'Disable-InboxRule' -cmdParams @{Confirm = $false; Identity = $_.Identity }
-                    "Disabled Inbox Rule $($_.Identity) for $Username"
-                    $RuleDisabled++
-                }
-                if ($RuleDisabled) {
-                    "Disabled $RuleDisabled Inbox Rules for $Username"
-                } else {
-                    "No Inbox Rules found for $Username. We have not disabled any rules."
+                    Write-Host "BEC containment failed for $Username`: $($_.Exception.Message)"
+                    "BEC containment failed for $Username`: $($_.Exception.Message)"
                 }
                 "Completed BEC Remediate for $Username"
-                Write-LogMessage -API 'BECRemediate' -tenant $tenantfilter -message "Executed Remediation for $Username" -sev 'Info'
             }
             <#'cippcommand' {
                 $CommandSplat = @{}
@@ -148,12 +176,15 @@ function Invoke-CippWebhookProcessing {
     } | ConvertTo-Json -Depth 15 -Compress
 
     # Built here, written at the very bottom - after the alerts have gone out. See the note there.
+    # EventCreationTime rides along: this row replaces the claim under the same key, so dropping it
+    # here would leave a completed row that no later event can be told apart from.
     $AuditLogRow = @{
-        PartitionKey = $TenantFilter
-        RowKey       = $Data.Id
-        Title        = $GenerateJSON.Title
-        Data         = [string]$JsonContent
-        Tenant       = $TenantFilter
+        PartitionKey      = $TenantFilter
+        RowKey            = $Data.Id
+        Title             = $GenerateJSON.Title
+        Data              = [string]$JsonContent
+        Tenant            = $TenantFilter
+        EventCreationTime = $EventStamp
     }
     $LogId = $Data.Id
 
diff --git a/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1 b/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1
index e9bf9d96dd71a..b828279aff849 100644
--- a/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1
+++ b/Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1
@@ -176,6 +176,7 @@ function Test-CIPPAuditLogRules {
         # second Select-Object projection over the whole property bag.
         $RecordPlaceholders = @{
             CIPPAction             = $null
+            CIPPBecActions         = $null
             CIPPClause             = $null
             CIPPGeoLocation        = $null
             CIPPBadRepIP           = $null
@@ -190,7 +191,6 @@ function Test-CIPPAuditLogRules {
             HasLocationData        = $null
         }
 
-        $TrustedIPTable = Get-CIPPTable -TableName 'trustedIps'
         $ConfigTable = Get-CIPPTable -TableName 'WebhookRules'
 
         # Per-tenant, in-process memo of the resolved rule set. Rebuilding it reads the whole
@@ -248,6 +248,7 @@ function Test-CIPPAuditLogRules {
                             Excluded          = $ExcludedTenants
                             Conditions        = $ConfigEntry.Conditions
                             Actions           = $ConfigEntry.Actions
+                            BecActions        = $ConfigEntry.BecActions
                             LogType           = $ConfigEntry.Type
                             AlertComment      = $ConfigEntry.AlertComment
                             CustomSubject     = $ConfigEntry.CustomSubject
@@ -525,48 +526,8 @@ function Test-CIPPAuditLogRules {
             }
         }
 
-        # Partner users - cache in cacheauditloglookups (PartitionKey '_partner') to avoid a fresh Graph fetch every invocation
-        # Process-wide, not per tenant: this row is keyed '_partner' and is the same answer for
-        # every tenant this worker handles, so a per-tenant memo would still re-read it once per
-        # tenant. It was read on every invocation.
-        if ($null -eq $script:PartnerUserMemo -or $script:PartnerUserMemo.Expires -le [datetime]::UtcNow) {
-            $script:PartnerUserMemo = [PSCustomObject]@{
-                Expires = [datetime]::UtcNow.AddMinutes(5)
-                Lookup  = $null
-            }
-            $PartnerUsersCache = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '_partner' and RowKey eq 'users' and Timestamp gt datetime'$1dayago'"
-        } elseif ($null -ne $script:PartnerUserMemo.Lookup) {
-            $PartnerUserLookup = $script:PartnerUserMemo.Lookup
-            $PartnerUsersCache = $null
-        } else {
-            # Memo exists but holds nothing yet - the previous pass fell through to the Graph
-            # refresh below. Re-read rather than assume, so a concurrent refresh is picked up.
-            $PartnerUsersCache = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '_partner' and RowKey eq 'users' and Timestamp gt datetime'$1dayago'"
-        }
-
-        if ($null -ne $PartnerUserLookup -and $null -eq $PartnerUsersCache) {
-            Write-Information "Partner user hashtable served from memo: $($PartnerUserLookup.Count) partner users"
-        } elseif ($PartnerUsersCache -and $PartnerUsersCache.Format -eq 'hashtable') {
-            Write-Information 'Loading partner user hashtable from cache'
-            $PartnerUserLookup = ($PartnerUsersCache.Data | ConvertFrom-Json -ErrorAction SilentlyContinue -AsHashtable) ?? @{}
-        } else {
-            $PartnerUsers = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$select=id,displayName,userPrincipalName,accountEnabled&`$top=999" -AsApp $true -NoAuthCheck $true
-            $PartnerUserLookup = @{}
-            foreach ($PartnerUser in $PartnerUsers) {
-                if (![string]::IsNullOrEmpty($PartnerUser.id)) {
-                    $PartnerUserLookup[$PartnerUser.id] = $PartnerUser
-                }
-            }
-            Add-CIPPAzDataTableEntity @Table -Entity @{
-                PartitionKey = '_partner'
-                RowKey       = 'users'
-                Data         = [string]($PartnerUserLookup | ConvertTo-Json -Compress)
-                Format       = 'hashtable'
-            } -Force
-            $PartnerUsers = $null
-        }
-        $script:PartnerUserMemo.Lookup = $PartnerUserLookup
-        Write-Information "Partner user hashtable: $($PartnerUserLookup.Count) partner users"
+        # Partner users: the shared lookup (memoised per worker, cached for a day) the BEC run reads too.
+        $PartnerUserLookup = Get-CIPPPartnerUserLookup
 
         Write-Warning '## Audit Log Configuration ##'
         Write-Information ($Configuration | ConvertTo-Json -Depth 10)
@@ -593,7 +554,7 @@ function Test-CIPPAuditLogRules {
         $ListEntry = $script:AuditRuleListCache[$TenantFilter]
         if ($ListEntry -and $ListEntry.Expires -gt $ListNow) {
             $ExcludedUsers = $ListEntry.ExcludedUsers
-            $TrustedIPLookup = $ListEntry.TrustedIPLookup
+            $IPListEntries = $ListEntry.IPListEntries
         } else {
             foreach ($CachedTenant in @($script:AuditRuleListCache.Keys)) {
                 if ($script:AuditRuleListCache[$CachedTenant].Expires -le $ListNow) {
@@ -601,28 +562,34 @@ function Test-CIPPAuditLogRules {
                 }
             }
             $ExcludedUsers = Get-CIPPAzDataTableEntity @AuditLogUserExclusions -Filter "PartitionKey eq '$TenantFilter'"
-            $TrustedIPEntries = Get-CIPPAzDataTableEntity @TrustedIPTable -Filter "((PartitionKey eq '$TenantFilter') or (PartitionKey eq 'AllTenants')) and state eq 'Trusted'"
-            $TrustedIPLookup = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
-            foreach ($TrustedEntry in $TrustedIPEntries) {
-                if (![string]::IsNullOrEmpty($TrustedEntry.RowKey)) {
-                    $null = $TrustedIPLookup.Add([string]$TrustedEntry.RowKey)
-                }
-            }
+            # Trusted and Blocked entries, single addresses and CIDR ranges alike. Blocked ones matter
+            # here only because the most specific range wins: a blocked address inside a trusted
+            # range must stay untrusted.
+            $IPListEntries = @(Get-CIPPIPAllowBlockList -TenantFilter $TenantFilter)
             $script:AuditRuleListCache[$TenantFilter] = [PSCustomObject]@{
-                Expires         = $ListNow.AddMinutes(2)
-                ExcludedUsers   = $ExcludedUsers
-                TrustedIPLookup = $TrustedIPLookup
+                Expires       = $ListNow.AddMinutes(2)
+                ExcludedUsers = $ExcludedUsers
+                IPListEntries = $IPListEntries
             }
         }
 
         if ($LogCount -gt 0) {
 
+            # Each distinct client IP is resolved against the list once per batch, here, and the
+            # record loop below reads the answer from $TrustedIPLookup.
+            $TrustedIPLookup = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+            $ResolvedIPs = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
             $GeoPrefetchIPs = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
             foreach ($AuditRecord in $SearchResults) {
                 $cip = $AuditRecord.auditData.clientip
                 if ([string]::IsNullOrEmpty($cip) -or $cip -match '[X]+') { continue }
                 $cip = $script:ClientIpRegex.Replace([string]$cip, '$1') -replace '[\[\]]', ''
-                if ($TrustedIPLookup.Contains($cip) -or $script:ReservedIpRegex.IsMatch($cip)) { continue }
+                if (-not $ResolvedIPs.Add($cip)) { continue }
+                if ($IPListEntries.Count -gt 0 -and (Resolve-CIPPIPAllowBlockList -IPAddress $cip -Entries $IPListEntries).State -eq 'Trusted') {
+                    $null = $TrustedIPLookup.Add($cip)
+                    continue
+                }
+                if ($script:ReservedIpRegex.IsMatch($cip)) { continue }
                 $null = $GeoPrefetchIPs.Add($cip)
             }
             $GeoLookup = @{}
@@ -840,14 +807,15 @@ function Test-CIPPAuditLogRules {
                     }
 
                     [PSCustomObject]@{
-                        conditions        = $conditions
-                        expectedAction    = $actions
-                        CIPPClause        = $CIPPClause
-                        AlertComment      = $Config.AlertComment
-                        CustomSubject     = $Config.CustomSubject
-                        PsaTicketPriority = $Config.PsaTicketPriority
-                        HasGeoCondition   = $HasGeoCondition
-                        ExcludedUserKeys  = $LocationExcludedUserKeys
+                        conditions         = $conditions
+                        expectedAction     = $actions
+                        expectedBecActions = $Config.BecActions
+                        CIPPClause         = $CIPPClause
+                        AlertComment       = $Config.AlertComment
+                        CustomSubject      = $Config.CustomSubject
+                        PsaTicketPriority  = $Config.PsaTicketPriority
+                        HasGeoCondition    = $HasGeoCondition
+                        ExcludedUserKeys   = $LocationExcludedUserKeys
                     }
                 }
             } catch {
@@ -905,6 +873,7 @@ function Test-CIPPAuditLogRules {
                         Write-Warning "Webhook: There is matching data: $(($ReturnedData.operation | Select-Object -Unique) -join ', ')"
                         $ReturnedData = foreach ($item in $ReturnedData) {
                             $item.CIPPAction = $clause.expectedAction
+                            $item.CIPPBecActions = $clause.expectedBecActions
                             $item.CIPPClause = $clause.CIPPClause -join ' and '
                             $item | Add-Member -NotePropertyMembers ([ordered]@{
                                     CIPPAlertComment      = $clause.AlertComment
@@ -950,13 +919,27 @@ function Test-CIPPAuditLogRules {
 
             $FlushAlertRows = {
                 if ($PendingAlertRows.Count -eq 0) { return }
+                # Collapse rows sharing a key before the batch goes out. One pass can carry two
+                # records with the same Id - Entra sign-in records reuse them - and the table module
+                # silently keeps one of the duplicates. If that is the older event, the stored
+                # EventCreationTime regresses and the newer event is replayable as 'newer' all over
+                # again. Keep the greatest stamp; an absent stamp loses to any stamp.
+                $RowsByKey = [ordered]@{}
+                foreach ($Row in $PendingAlertRows) {
+                    $Key = '{0}|{1}' -f $Row.PartitionKey, $Row.RowKey
+                    $Kept = $RowsByKey[$Key]
+                    if ($null -eq $Kept -or [string]$Row.EventCreationTime -gt [string]$Kept.EventCreationTime) {
+                        $RowsByKey[$Key] = $Row
+                    }
+                }
+                $BatchRows = @($RowsByKey.Values)
                 try {
-                    Add-CIPPAzDataTableEntity @AuditLogTable -Entity $PendingAlertRows.ToArray() -Force
+                    Add-CIPPAzDataTableEntity @AuditLogTable -Entity $BatchRows -Force
                 } catch {
                     # Not fatal: the alerts themselves have already been dispatched, and the claim
                     # rows still prevent a retry from sending them again. What is lost is the stored
                     # copy, which shows in the UI as a row stuck at 'Processing'.
-                    Write-Warning "Could not store $($PendingAlertRows.Count) audit log row(s): $($_.Exception.Message)"
+                    Write-Warning "Could not store $($BatchRows.Count) audit log row(s): $($_.Exception.Message)"
                 }
                 $PendingAlertRows.Clear()
             }
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheActiveUserDetail.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheActiveUserDetail.ps1
index 2050891087c92..3303138c4a9a0 100644
--- a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheActiveUserDetail.ps1
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheActiveUserDetail.ps1
@@ -4,9 +4,10 @@ function Set-CIPPDBCacheActiveUserDetail {
         Caches the Microsoft 365 active-user detail report for a tenant
 
     .DESCRIPTION
-        Stores getOffice365ActiveUserDetail(period='D90') - one row per user carrying per-service
+        Stores getOffice365ActiveUserDetail(period='D180') - one row per user carrying per-service
         last-activity dates (Exchange, OneDrive, SharePoint, Teams, Yammer) and the products
         assigned. Rows are keyed by userPrincipalName so they join to the cached Users dataset.
+        D180 is the longest Graph window so license optimization can filter to any inactive threshold.
 
         Note: when the tenant conceals usage-report names, userPrincipalName is anonymized and the
         rows cannot be joined to users. The license optimization report detects this and points to
@@ -28,7 +29,7 @@ function Set-CIPPDBCacheActiveUserDetail {
     try {
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching active user detail' -sev Debug
 
-        New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getOffice365ActiveUserDetail(period='D90')?`$format=application%2fjson" -tenantid $TenantFilter -Stream |
+        New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getOffice365ActiveUserDetail(period='D180')?`$format=application%2fjson" -tenantid $TenantFilter -Stream |
             Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'ActiveUserDetail' -AddCount
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached active user detail successfully' -sev Debug
 
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDetectedApps.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDetectedApps.ps1
index 0bdabcd46aa2d..736a73405e643 100644
--- a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDetectedApps.ps1
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDetectedApps.ps1
@@ -68,61 +68,46 @@ function Set-CIPPDBCacheDetectedApps {
             return
         }
 
-        $ZipBytes = (Invoke-WebRequest -Uri $Job.url -UseBasicParsing -ErrorAction Stop).Content
-        if ($ZipBytes -isnot [byte[]]) { throw "Expected binary content from $ReportName download" }
-
-        $JsonText = $null
-        $ZipStream = [System.IO.MemoryStream]::new($ZipBytes, $false)
-        try {
-            $Archive = [System.IO.Compression.ZipArchive]::new($ZipStream, [System.IO.Compression.ZipArchiveMode]::Read)
-            try {
-                $Entry = $Archive.Entries | Where-Object { $_.Name -like '*.json' } | Select-Object -First 1
-                if (-not $Entry) { throw "No JSON entry in $ReportName archive" }
-                $EntryStream = $Entry.Open()
-                try {
-                    $Reader = [System.IO.StreamReader]::new($EntryStream)
-                    try { $JsonText = $Reader.ReadToEnd() } finally { $Reader.Dispose() }
-                } finally { $EntryStream.Dispose() }
-            } finally { $Archive.Dispose() }
-        } finally {
-            $ZipStream.Dispose()
-            $ZipBytes = $null
-        }
-
-        $ExportRows = @(($JsonText | ConvertFrom-Json).values)
-        $JsonText = $null
-
+        # Rows stream off the export download and are folded as they arrive, so the export is never
+        # held whole. The export has one row per device x app, and every device repeats under each
+        # app it has installed, so one device object per distinct device tuple is shared by all of
+        # its apps rather than a copy per row. The stored JSON is identical either way.
         $AppsByKey = @{}
-        foreach ($Row in $ExportRows) {
-            $AppId = $Row.ApplicationKey
-            if (-not $AppId) { continue }
-            if (-not $AppsByKey.ContainsKey($AppId)) {
-                $AppsByKey[$AppId] = [pscustomobject]@{
+        $DeviceByTuple = [System.Collections.Generic.Dictionary[string, object]]::new()
+        Get-CIPPIntuneReportExportRows -Url $Job.url | ForEach-Object {
+            $AppId = $_.ApplicationKey
+            if (-not $AppId) { return }
+            $App = $AppsByKey[$AppId]
+            if (-not $App) {
+                $App = [pscustomobject]@{
                     id             = $AppId
-                    displayName    = $Row.ApplicationName
-                    version        = $Row.ApplicationVersion
-                    publisher      = $Row.ApplicationPublisher
-                    platform       = $Row.Platform
+                    displayName    = $_.ApplicationName
+                    version        = $_.ApplicationVersion
+                    publisher      = $_.ApplicationPublisher
+                    platform       = $_.Platform
                     deviceCount    = 0
                     managedDevices = [System.Collections.Generic.List[object]]::new()
                 }
+                $AppsByKey[$AppId] = $App
             }
-            $App = $AppsByKey[$AppId]
-            $App.managedDevices.Add([pscustomobject]@{
-                id                = $Row.DeviceId
-                deviceName        = $Row.DeviceName
-                osVersion         = $Row.OSVersion
-                platform          = $Row.Platform
-                userId            = $Row.UserId
-                userPrincipalName = $Row.UserName
-                emailAddress      = $Row.EmailAddress
-            })
+            $DeviceKey = "$($_.DeviceId)`0$($_.DeviceName)`0$($_.OSVersion)`0$($_.Platform)`0$($_.UserId)`0$($_.UserName)`0$($_.EmailAddress)"
+            $Device = $null
+            if (-not $DeviceByTuple.TryGetValue($DeviceKey, [ref]$Device)) {
+                $Device = [pscustomobject]@{
+                    id                = $_.DeviceId
+                    deviceName        = $_.DeviceName
+                    osVersion         = $_.OSVersion
+                    platform          = $_.Platform
+                    userId            = $_.UserId
+                    userPrincipalName = $_.UserName
+                    emailAddress      = $_.EmailAddress
+                }
+                $DeviceByTuple[$DeviceKey] = $Device
+            }
+            $App.managedDevices.Add($Device)
             $App.deviceCount++
         }
-
-        # The grouped apps already hold every device row, so release the parse tree before the
-        # write rather than carrying both through it.
-        $ExportRows = $null
+        $DeviceByTuple = $null
 
         # Streamed into the writer instead of copied into an array first: Add-CIPPDbItem batches
         # internally, so this drops a full-length copy of the app list at the point where the
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppInstallStatus.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppInstallStatus.ps1
index 90c3cb616d2c8..8c1d68bdbc057 100644
--- a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppInstallStatus.ps1
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppInstallStatus.ps1
@@ -78,32 +78,10 @@ function Set-CIPPDBCacheIntuneAppInstallStatus {
             return
         }
 
-        $ZipBytes = (Invoke-WebRequest -Uri $Job.url -UseBasicParsing -ErrorAction Stop).Content
-        if ($ZipBytes -isnot [byte[]]) { throw "Expected binary content from $ReportName download" }
-
-        $JsonText = $null
-        $ZipStream = [System.IO.MemoryStream]::new($ZipBytes, $false)
-        try {
-            $Archive = [System.IO.Compression.ZipArchive]::new($ZipStream, [System.IO.Compression.ZipArchiveMode]::Read)
-            try {
-                $Entry = $Archive.Entries | Where-Object { $_.Name -like '*.json' } | Select-Object -First 1
-                if (-not $Entry) { throw "No JSON entry in $ReportName archive" }
-                $EntryStream = $Entry.Open()
-                try {
-                    $Reader = [System.IO.StreamReader]::new($EntryStream)
-                    try { $JsonText = $Reader.ReadToEnd() } finally { $Reader.Dispose() }
-                } finally { $EntryStream.Dispose() }
-            } finally { $Archive.Dispose() }
-        } finally {
-            $ZipStream.Dispose()
-            $ZipBytes = $null
-        }
-
-        $ExportRows = @(($JsonText | ConvertFrom-Json).values)
-        $JsonText = $null
-
-        $AppStatuses = foreach ($Row in $ExportRows) {
-            if (-not $Row.ApplicationId) { continue }
+        # Rows stream off the export download, so only the rollup rows are ever held.
+        $AppStatuses = Get-CIPPIntuneReportExportRows -Url $Job.url | ForEach-Object {
+            $Row = $_
+            if (-not $Row.ApplicationId) { return }
             [pscustomobject]@{
                 id                        = $Row.ApplicationId
                 displayName               = $Row.DisplayName
@@ -119,8 +97,6 @@ function Set-CIPPDBCacheIntuneAppInstallStatus {
             }
         }
         $AppStatuses = @($AppStatuses)
-        # The rollup rows are built; the parse tree behind them is dead weight through the write.
-        $ExportRows = $null
 
         Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'IntuneAppInstallStatusAggregate' -Data $AppStatuses -AddCount
         Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached $($AppStatuses.Count) app install status rows from export $JobId" -sev Info
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheM365AppUserDetail.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheM365AppUserDetail.ps1
new file mode 100644
index 0000000000000..7550891361f37
--- /dev/null
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheM365AppUserDetail.ps1
@@ -0,0 +1,43 @@
+function Set-CIPPDBCacheM365AppUserDetail {
+    <#
+    .SYNOPSIS
+        Caches the Microsoft 365 Apps usage detail report for a tenant
+
+    .DESCRIPTION
+        Stores getM365AppUserDetail(period='D180') - one row per user with, per platform (Windows,
+        Mac, mobile, web), whether each Office app (Outlook, Word, Excel, PowerPoint, OneNote,
+        Teams) was used in the period. Rows are keyed by userPrincipalName so they join to the
+        cached Users dataset. D180 is the longest Graph window so license optimization can filter
+        to any inactive threshold.
+
+        The license recommendation report uses the Windows/Mac columns to tell whether a user
+        actually runs the installed desktop apps their plan pays for.
+
+        Note: when the tenant conceals usage-report names, userPrincipalName is anonymized and the
+        rows cannot be joined to users. The report detects this and points to the Anonymous
+        Reports Disable standard.
+
+    .PARAMETER TenantFilter
+        The tenant to cache app usage detail for
+
+    .PARAMETER QueueId
+        The queue ID to update with total tasks (optional)
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [string]$QueueId
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching Microsoft 365 app usage detail' -sev Debug
+
+        New-GraphGetRequest -uri "https://graph.microsoft.com/beta/reports/getM365AppUserDetail(period='D180')?`$format=application%2fjson" -tenantid $TenantFilter -Stream |
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'M365AppUserDetail' -AddCount
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Cached Microsoft 365 app usage detail successfully' -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache Microsoft 365 app usage detail: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailTrafficSummary.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailTrafficSummary.ps1
new file mode 100644
index 0000000000000..1fd59d8c71ce6
--- /dev/null
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailTrafficSummary.ps1
@@ -0,0 +1,60 @@
+function Set-CIPPDBCacheMailTrafficSummary {
+    <#
+    .SYNOPSIS
+        Caches Exchange Online mail traffic summary (top senders and recipients by message volume)
+
+    .DESCRIPTION
+        Runs Get-MailTrafficSummaryReport for the TopMailSender and TopMailRecipient categories over a
+        30-day window and stores one row per address as { category, name, count, windowDays } under the
+        MailTrafficSummary type. This is the same data the live Mail Flow Statistics page reads, cached so
+        a scheduled or pre-built report (mailboxes by messaging volume) can use it without a live EXO call.
+
+    .PARAMETER TenantFilter
+        The tenant to cache mail traffic summary for
+
+    .PARAMETER QueueId
+        The queue ID to update with total tasks (optional)
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [string]$QueueId
+    )
+
+    try {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching mail traffic summary' -sev Debug
+
+        $WindowDays = 30
+        $StartDate = (Get-Date).AddDays(-$WindowDays).ToUniversalTime().ToString('s')
+        $EndDate = (Get-Date).ToUniversalTime().ToString('s')
+
+        # Both categories in one EXO batch; OperationGuid tags each returned row with the category it
+        # came from (the report rows do not otherwise say). C1 is the address/name, C2 the message count.
+        $Batch = @('TopMailSender', 'TopMailRecipient') | ForEach-Object {
+            @{
+                CmdletInput   = @{ CmdletName = 'Get-MailTrafficSummaryReport'; Parameters = @{ Category = $_; StartDate = $StartDate; EndDate = $EndDate } }
+                OperationGuid = $_
+            }
+        }
+        $Summary = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray @($Batch) -useSystemMailbox $true
+
+        $Rows = @(foreach ($Entry in @($Summary)) {
+                if ($Entry.error -or [string]::IsNullOrWhiteSpace("$($Entry.C1)")) { continue }
+                [PSCustomObject]@{
+                    category   = "$($Entry.OperationGuid)"
+                    name       = "$($Entry.C1)"
+                    count      = [int]($Entry.C2)
+                    windowDays = $WindowDays
+                }
+            })
+
+        if ($Rows.Count -gt 0) {
+            $Rows | Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'MailTrafficSummary' -AddCount
+        }
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached mail traffic summary successfully ($($Rows.Count) rows)" -sev Debug
+
+    } catch {
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache mail traffic summary: $($_.Exception.Message)" -sev Error
+    }
+}
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1
index 09346031d3420..d73262ae180af 100644
--- a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1
@@ -32,7 +32,10 @@ function Set-CIPPDBCacheMailboxes {
             @{ CmdletInput = @{ CmdletName = 'Get-Mailbox'; Parameters = @{} } }
             @{ CmdletInput = @{ CmdletName = 'Get-User'; Parameters = @{} } }
         )
-        $BulkResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray $BulkRequests -useSystemMailbox $true -Select $Select -ReturnWithCommand $true
+        # Full-tenant Get-Mailbox/Get-User enumeration is a single batch that legitimately exceeds the
+        # 100s default on large tenants (measured ~114s at 1200 mailboxes); give it headroom so a slow
+        # (but valid) enumeration is not killed and mis-reported as a timeout.
+        $BulkResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray $BulkRequests -useSystemMailbox $true -Select $Select -ReturnWithCommand $true -TimeoutSec 300
 
         # Separate OrgConfig call (avoid shared mailbox $Select on Get-OrganizationConfig).
         # On failure, fall back to mailbox-only resolution and log so live/cache skew is diagnosable.
@@ -160,7 +163,7 @@ function Set-CIPPDBCacheMailboxes {
                     }
                 })
 
-            $ArchiveStatsResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray $ArchiveStatsRequests -useSystemMailbox $true
+            $ArchiveStatsResults = New-ExoBulkRequest -tenantid $TenantFilter -cmdletArray $ArchiveStatsRequests -useSystemMailbox $true -MaxConcurrency 5
             foreach ($ArchiveStat in @($ArchiveStatsResults)) {
                 if ($ArchiveStat.OperationGuid -and $MailboxUPNByArchiveStatsRequestId.ContainsKey($ArchiveStat.OperationGuid) -and -not $ArchiveStat.error) {
                     $ArchiveMailboxUPN = $MailboxUPNByArchiveStatsRequestId[$ArchiveStat.OperationGuid]
diff --git a/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointUsageReport.ps1 b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointUsageReport.ps1
new file mode 100644
index 0000000000000..9e970a8e690e6
--- /dev/null
+++ b/Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointUsageReport.ps1
@@ -0,0 +1,79 @@
+function Set-CIPPDBCacheSharePointUsageReport {
+    <#
+    .SYNOPSIS
+        Caches SharePoint tenant-wide quota usage report for a tenant
+
+    .DESCRIPTION
+        Retrieves SharePoint Online storage quota live from the SPO admin endpoint
+        this can be delayed for multiple days due to SPO server processing times
+
+    .PARAMETER TenantFilter
+        The tenant to cache SharePoint quota usage report for
+    
+    .PARAMETER QueueId
+        The queue ID to update with total tasks (optional)
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter,
+        [string]$QueueId
+    )
+
+    try {
+        $LicenseCheck = Test-CIPPStandardLicense -StandardName 'SharePointUsageReport' -TenantFilter $TenantFilter -Preset SharePoint -SkipLog
+
+        if ($LicenseCheck -eq $false) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Tenant does not have SharePoint license, skipping SharePoint quota usage report cache' -sev Debug
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointUsageReport' -Data @() -AddCount -ClearOnEmpty
+            return
+        }
+
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'Caching SharePoint tenant-wide quota usage report' -sev Debug
+
+        $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter
+        $extraHeaders = @{
+            'Accept' = 'application/json'
+        }
+        $SharePointQuota = New-GraphGetRequest -extraHeaders $extraHeaders -scope "$($SharePointInfo.AdminUrl)/.default" -tenantid $TenantFilter -uri "$($SharePointInfo.AdminUrl)/_api/StorageQuotas()?api-version=1.3.2" -asapp $true -UseCertificate
+
+        # Handle empty response gracefully
+        if ($null -eq $SharePointQuota) {
+            Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message 'SharePoint quota report returned null or empty' -sev Warning
+            Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointUsageReport' -Data @() -AddCount -ClearOnEmpty
+            return
+        }
+
+        $GeoUsedStorageMB = (@($SharePointQuota) | ForEach-Object { [double]($_.GeoUsedStorageMB ?? 0) } | Measure-Object -Sum).Sum
+        $TenantStorageRaw = @($SharePointQuota.TenantStorageMB | Where-Object { $_ }) | Select-Object -First 1
+        $TenantStorageMB = if ($null -ne $TenantStorageRaw) { [double]$TenantStorageRaw } else { 0 }
+        $GeoLocations = @(foreach ($Geo in @($SharePointQuota)) {
+            if ($null -eq $Geo) { continue }
+            [PSCustomObject]@{
+                GeoLocation           = $Geo.GeoLocation
+                GeoUsedStorageMB      = [double]($Geo.GeoUsedStorageMB ?? 0)
+                GeoAllocatedStorageMB = [double]($Geo.GeoAllocatedStorageMB ?? 0)
+                GeoAvailableStorageMB = [double]($Geo.GeoAvailableStorageMB ?? 0)
+            }
+        })
+
+        if ($TenantStorageMB) {
+            $UsedStoragePercentage = [int](($GeoUsedStorageMB / $TenantStorageMB) * 100)
+        }
+
+        $SharePointQuotaDetails = @{
+            GeoUsedStorageMB = $GeoUsedStorageMB
+            TenantStorageMB  = $TenantStorageMB
+            Percentage       = $UsedStoragePercentage
+            Dashboard        = "$($UsedStoragePercentage) / 100"
+            GeoLocations     = @($GeoLocations)
+        }
+
+        Add-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointUsageReport' -Data $SharePointQuotaDetails -AddCount
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Cached SharePoint quota usage report" -sev Debug
+
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -API 'CIPPDBCache' -tenant $TenantFilter -message "Failed to cache SharePoint quota usage report: $($ErrorMessage.NormalizedError)" -sev Warning -LogData $ErrorMessage
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCippFunction.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCippFunction.ps1
index 4ec20a3a4521f..5026812dca209 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCippFunction.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCippFunction.ps1	
@@ -20,9 +20,11 @@ function Invoke-ExecCippFunction {
         'New-CIPPCertificateAssertion'
         'Get-ClassicAPIToken'
         'Get-CIPPSAMCertificate'
+        'Get-CIPPSAMCertificateVersions'
         'New-CIPPSAMCertificate'
         'Set-CIPPSAMCertificate'
         'Update-CIPPSAMCertificate'
+        'ConvertTo-CIPPSAMCertificateInfo'
     )
 
     $Function = $Request.Body.FunctionName
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1
index 6706fbeba1f4d..e4f7c31348cee 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecCloneTemplate.ps1	
@@ -26,6 +26,15 @@ function Invoke-ExecCloneTemplate {
             $NewGuid = [guid]::NewGuid().ToString()
             $Template.RowKey = $NewGuid
             $Template.JSON = $Template.JSON -replace $GUID, $NewGuid
+            # Some template types (e.g. CA) also key lookups off the GUID column, not just RowKey
+            if ($Template.GUID) {
+                $Template.GUID = $NewGuid
+            }
+            # Clearing Source detaches the clone from its library: community sync matches existing
+            # templates on displayName + Source, so a clone keeping the Source could be overwritten
+            if ($Template.Source) {
+                $Template.Source = $null
+            }
             if ($Template.Package) {
                 $Template.Package = $null
             }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecRemoveSnooze.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecRemoveSnooze.ps1
index e20117935b64c..703a6494344ab 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecRemoveSnooze.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecRemoveSnooze.ps1	
@@ -24,12 +24,15 @@ function Invoke-ExecRemoveSnooze {
 
         $SnoozeTable = Get-CIPPTable -tablename 'AlertSnooze'
 
+        # The row is read back for everyone: restricted callers need its Tenant for the scope
+        # check, and the tracked alert item it belongs to is keyed on its Tenant and ContentHash.
+        $SafePartitionKey = ConvertTo-CIPPODataFilterValue -Value $PartitionKey -Type String
+        $SafeRowKey = ConvertTo-CIPPODataFilterValue -Value $RowKey -Type String
+        $Existing = Get-CIPPAzDataTableEntity @SnoozeTable -Filter "PartitionKey eq '$SafePartitionKey' and RowKey eq '$SafeRowKey'" | Select-Object -First 1
+
         # AnyTenant: restricted callers may only remove snoozes for tenants in scope
         $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList
         if ($AllowedTenants -notcontains 'AllTenants') {
-            $SafePartitionKey = ConvertTo-CIPPODataFilterValue -Value $PartitionKey -Type String
-            $SafeRowKey = ConvertTo-CIPPODataFilterValue -Value $RowKey -Type String
-            $Existing = Get-CIPPAzDataTableEntity @SnoozeTable -Filter "PartitionKey eq '$SafePartitionKey' and RowKey eq '$SafeRowKey'"
             if (-not $Existing.Tenant -or -not (Get-Tenants -TenantFilter $Existing.Tenant)) {
                 return ([HttpResponseContext]@{
                         StatusCode = [HttpStatusCode]::Forbidden
@@ -44,6 +47,35 @@ function Invoke-ExecRemoveSnooze {
             ETag         = '*'
         } | Out-Null
 
+        # Put the tracked item back to Open right away; the alert's next run notifies again if
+        # the condition still holds.
+        if ($Existing -and $Existing.Tenant -and $Existing.ContentHash) {
+            try {
+                $Keys = Get-CIPPAlertLifecycleKey -CmdletName $PartitionKey -TenantFilter ([string]$Existing.Tenant) -ContentHash ([string]$Existing.ContentHash)
+                $LifecycleTable = Get-CIPPTable -tablename 'AlertLifecycle'
+                $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $Keys.PartitionKey -Type String
+                $SafeLifecycleKey = ConvertTo-CIPPODataFilterValue -Value $Keys.RowKey -Type String
+                $Tracked = Get-CIPPAzDataTableEntity @LifecycleTable -Filter "PartitionKey eq '$SafeTenant' and RowKey eq '$SafeLifecycleKey'" | Select-Object -First 1
+                if ($Tracked -and [string]$Tracked.Status -eq 'Snoozed') {
+                    $Update = @{}
+                    foreach ($Prop in $Tracked.PSObject.Properties) {
+                        if ($Prop.Name -in @('ETag', 'Timestamp')) { continue }
+                        $Update[$Prop.Name] = $Prop.Value
+                    }
+                    $Update.Status = 'Open'
+                    $Update.SnoozeUntil = ''
+                    $Update.SnoozedBy = ''
+                    $Update.SnoozeRowKey = ''
+                    $Update.SnoozeReason = ''
+                    $Update.SnoozeVisible = ''
+                    $Update.SnoozeUntilResolved = ''
+                    Add-CIPPAzDataTableEntity @LifecycleTable -Entity $Update -Force | Out-Null
+                }
+            } catch {
+                Write-Information "Snooze removed but the tracked alert item could not be updated: $($_.Exception.Message)"
+            }
+        }
+
         $Result = "Successfully removed snooze for $PartitionKey / $RowKey"
         Write-LogMessage -headers $Headers -API $APIName -message $Result -Sev 'Info'
 
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSnoozeAlert.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSnoozeAlert.ps1
index b378074eedcb3..fc49a116ee66c 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSnoozeAlert.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSnoozeAlert.ps1	
@@ -4,6 +4,12 @@ function Invoke-ExecSnoozeAlert {
         Entrypoint,AnyTenant
     .ROLE
         CIPP.AlertSnooze.ReadWrite
+    .DESCRIPTION
+        Snoozes one alert item so it stops notifying. Body: CmdletName, TenantFilter, AlertItem,
+        and either Duration (7, 14, 30 or 90 days) or UntilResolved=true, which keeps the snooze
+        until the alert stops reporting the item and is then removed automatically. KeepVisible=true
+        leaves the item on the dashboard, marked as snoozed, rather than hiding it. Reason is an
+        optional note. There is no indefinite snooze.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -15,7 +21,9 @@ function Invoke-ExecSnoozeAlert {
         $CmdletName = $Request.Body.CmdletName
         $TenantFilter = $Request.Body.TenantFilter
         $AlertItem = $Request.Body.AlertItem
-        $Duration = [int]$Request.Body.Duration
+        $Duration = ($Request.Body.Duration) -as [int]
+        $UntilResolved = [System.Convert]::ToBoolean(($Request.Body.UntilResolved ?? $false))
+        $KeepVisible = [System.Convert]::ToBoolean(($Request.Body.KeepVisible ?? $false))
         $Reason = [string]$Request.Body.Reason
         $SnoozedBy = try {
             ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails
@@ -28,10 +36,10 @@ function Invoke-ExecSnoozeAlert {
                 })
         }
 
-        if ($Duration -notin @(7, 14, 30, 90)) {
+        if (-not $UntilResolved -and $Duration -notin @(7, 14, 30, 90)) {
             return ([HttpResponseContext]@{
                     StatusCode = [HttpStatusCode]::BadRequest
-                    Body       = @{ Results = 'Duration must be 7, 14, 30, or 90 days.' }
+                    Body       = @{ Results = 'Duration must be 7, 14, 30, or 90 days, or set UntilResolved to true.' }
                 })
         }
 
@@ -47,21 +55,19 @@ function Invoke-ExecSnoozeAlert {
         # Compute content hash for this alert item
         $HashResult = Get-AlertContentHash -AlertItem $AlertItem
 
-        # Calculate SnoozeUntil
         $CurrentUnixTime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
-        $SnoozeUntil = if ($Duration -eq -1) {
-            [int64](-1)
-        } else {
-            $CurrentUnixTime + ($Duration * 86400)
-        }
+        $SnoozeUntil = if ($UntilResolved) { [int64]0 } else { $CurrentUnixTime + ($Duration * 86400) }
 
         $SnoozeTable = Get-CIPPTable -tablename 'AlertSnooze'
+        $Keys = Get-CIPPAlertLifecycleKey -CmdletName $CmdletName -TenantFilter $TenantFilter -ContentHash $HashResult.ContentHash
         $SnoozeEntity = @{
-            PartitionKey   = [string]$CmdletName
-            RowKey         = [string]"$($TenantFilter)-$($HashResult.ContentHash)" -replace '[\\/#?\u0000-\u001f\u007f-\u009f]', '_'
+            PartitionKey   = $Keys.SnoozePartitionKey
+            RowKey         = $Keys.SnoozeRowKey
             ContentHash    = [string]$HashResult.ContentHash
             Tenant         = [string]$TenantFilter
             SnoozeUntil    = [string]$SnoozeUntil
+            UntilResolved  = [string]$UntilResolved
+            KeepVisible    = [string]$KeepVisible
             SnoozedBy      = [string]$SnoozedBy
             SnoozedAt      = [string]$CurrentUnixTime
             ContentPreview = [string]$HashResult.ContentPreview
@@ -71,9 +77,36 @@ function Invoke-ExecSnoozeAlert {
 
         Add-CIPPAzDataTableEntity @SnoozeTable -Entity $SnoozeEntity -Force | Out-Null
 
-        $DurationLabel = if ($Duration -eq -1) { 'forever' } else { "$Duration days" }
+        # Reflect the snooze on the tracked item straight away, so the dashboard does not have
+        # to wait for the alert's next run to move it out of the active list.
+        try {
+            $LifecycleTable = Get-CIPPTable -tablename 'AlertLifecycle'
+            $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $Keys.PartitionKey -Type String
+            $SafeRowKey = ConvertTo-CIPPODataFilterValue -Value $Keys.RowKey -Type String
+            $Tracked = Get-CIPPAzDataTableEntity @LifecycleTable -Filter "PartitionKey eq '$SafeTenant' and RowKey eq '$SafeRowKey'" | Select-Object -First 1
+            if ($Tracked -and [string]$Tracked.Status -ne 'Resolved') {
+                $Update = @{}
+                foreach ($Prop in $Tracked.PSObject.Properties) {
+                    if ($Prop.Name -in @('ETag', 'Timestamp')) { continue }
+                    $Update[$Prop.Name] = $Prop.Value
+                }
+                $Update.Status = 'Snoozed'
+                $Update.SnoozeUntil = [string]$SnoozeUntil
+                $Update.SnoozedBy = [string]$SnoozedBy
+                $Update.SnoozeRowKey = $Keys.SnoozeRowKey
+                $Update.SnoozeReason = [string]$Reason
+                $Update.SnoozeVisible = [string]$KeepVisible
+                $Update.SnoozeUntilResolved = [string]$UntilResolved
+                Add-CIPPAzDataTableEntity @LifecycleTable -Entity $Update -Force | Out-Null
+            }
+        } catch {
+            Write-Information "Snooze stored but the tracked alert item could not be updated: $($_.Exception.Message)"
+        }
+
+        $DurationLabel = if ($UntilResolved) { 'until it resolves' } else { "for $Duration days" }
         $ContentPreview = $HashResult.ContentPreview
-        $Result = "Successfully snoozed alert for ${DurationLabel}: ${ContentPreview}"
+        $Result = "Successfully snoozed alert ${DurationLabel}: ${ContentPreview}"
+        if ($KeepVisible) { $Result = "$Result (kept visible on the dashboard)" }
         if (-not [string]::IsNullOrWhiteSpace($Reason)) {
             $Result = "$Result - Reason: $Reason"
         }
@@ -83,10 +116,12 @@ function Invoke-ExecSnoozeAlert {
         return ([HttpResponseContext]@{
                 StatusCode = [HttpStatusCode]::OK
                 Body       = @{
-                    Results     = $Result
-                    ContentHash = $HashResult.ContentHash
-                    SnoozeUntil = $SnoozeUntil
-                    SnoozedBy   = $SnoozedBy
+                    Results       = $Result
+                    ContentHash   = $HashResult.ContentHash
+                    SnoozeUntil   = $SnoozeUntil
+                    UntilResolved = $UntilResolved
+                    KeepVisible   = $KeepVisible
+                    SnoozedBy     = $SnoozedBy
                 }
             })
     } catch {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1
index ab29f66b060a2..ff85d895e0653 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1	
@@ -5,7 +5,7 @@ function Invoke-GetCippAlerts {
     .ROLE
         CIPP.Core.Read
     .DESCRIPTION
-        Returns the CIPP dashboard banner notifications: any hosted maintenance notice, today's most recent entries from the alert log, and warnings for an out-of-date or misconfigured deployment.
+        Returns the CIPP dashboard banner notifications: any hosted maintenance notice, a legacy infrastructure warning for instances still on Function Apps, today's most recent entries from the alert log, and warnings for an out-of-date or misconfigured deployment.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -15,6 +15,8 @@ function Invoke-GetCippAlerts {
     # sorts to the top of the banner stack. Self-suppresses once its end time has passed.
     $MaintenanceNotice = Get-CIPPMaintenanceNotice
     if ($MaintenanceNotice) { $Alerts.Add($MaintenanceNotice) }
+    $LegacyNotice = Get-CIPPLegacyInfrastructureNotice
+    if ($LegacyNotice) { $Alerts.Add($LegacyNotice) }
 
     $Table = Get-CippTable -tablename CippAlerts
     $PartitionKey = Get-Date -UFormat '%Y%m%d'
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAlertResults.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAlertResults.ps1
index 45447d1e1a58d..75b100cb5bf79 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAlertResults.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAlertResults.ps1	
@@ -5,12 +5,14 @@ function Invoke-ListAlertResults {
     .ROLE
         CIPP.Alert.Read
     .DESCRIPTION
-        Lists the currently-active fired alert items for a tenant, read from the
-        AlertLastRun table. AlertLastRun stores the items produced by the most recent
-        run of each scripted alert (Get-CIPPAlert*) after snoozed items have already
-        been filtered out, so this returns the active (non-snoozed) instances. Each
-        item is returned with a content preview/hash (matching the snooze format) and
-        the raw alert item so the frontend can snooze it via ExecSnoozeAlert.
+        Lists the tracked alert items for a tenant from the AlertLifecycle table, which
+        Write-AlertTrace maintains: one row per alert item with its Status (Open, Snoozed or
+        Resolved), when it was first and last seen, when it was last checked, how often it
+        reopened and the snooze details when one applies. Pass tenantFilter (or AllTenants for
+        every tenant the caller may see). Open and Snoozed items are always returned; Resolved
+        items are included when IncludeResolved=true, limited to those resolved within the last
+        Days days (default 2, at most 366). Each item carries the raw alert item and the keys
+        needed to snooze or unsnooze it.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -26,57 +28,67 @@ function Invoke-ListAlertResults {
                 })
         }
 
-        $Table = Get-CIPPTable -tablename 'AlertLastRun'
-        # AlertLastRun: PartitionKey = run date (yyyyMMdd), RowKey = "{tenant}-{cmdlet}"
-        $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String
-        # AnyTenant skips the framework's per-tenant check, so a tenant-restricted caller could
-        # otherwise read any tenant's fired-alert items by naming it. Narrowing on the row's own
-        # Tenant column keeps allowed tenants' rows and drops everything else, estate-wide rows
-        # included, for restricted callers; unrestricted callers pass through untouched.
-        $Rows = Get-CIPPAzDataTableEntity @Table -Filter "Tenant eq '$SafeTenant'" | Select-CippAllowedTenantData -TenantProperty 'Tenant'
+        $IncludeResolved = [System.Convert]::ToBoolean(($Request.Query.IncludeResolved ?? $Request.Body.IncludeResolved ?? $false))
+        $Days = ($Request.Query.Days ?? $Request.Body.Days) -as [int]
+        if (-not $Days -or $Days -lt 1) { $Days = 2 }
+        if ($Days -gt 366) { $Days = 366 }
+        $ResolvedCutoff = [datetime]::UtcNow.AddDays(-$Days)
 
-        # Keep only the most recent run (highest date partition) per alert. RowKey is
-        # "{tenant}-{cmdlet}", uniquely identifying the alert for this tenant. Write-AlertTrace
-        # only writes a new row when the data changes, so the latest row is the current state.
-        $LatestByAlert = @{}
-        foreach ($Row in @($Rows)) {
-            $Key = $Row.RowKey
-            $Existing = $LatestByAlert[$Key]
-            if (-not $Existing -or [string]$Row.PartitionKey -gt [string]$Existing.PartitionKey) {
-                $LatestByAlert[$Key] = $Row
-            }
+        $Table = Get-CIPPTable -tablename 'AlertLifecycle'
+        # AnyTenant skips the framework's per-tenant check, so narrow on the row's own Tenant
+        # column: restricted callers keep only rows for tenants in scope.
+        $Rows = if ($TenantFilter -eq 'AllTenants') {
+            Get-CIPPAzDataTableEntity @Table | Select-CippAllowedTenantData -TenantProperty 'Tenant'
+        } else {
+            $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $TenantFilter -Type String
+            Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$SafeTenant'" | Select-CippAllowedTenantData -TenantProperty 'Tenant'
         }
-        $StaleCutoff = [datetime]::UtcNow.AddDays(-7).ToString('yyyyMMdd')
 
         $Results = [System.Collections.Generic.List[object]]::new()
-        foreach ($Row in $LatestByAlert.Values) {
-            if ([string]$Row.PartitionKey -lt $StaleCutoff) { continue }
-            if ([string]::IsNullOrWhiteSpace($Row.LogData)) { continue }
-            try {
-                $Items = $Row.LogData | ConvertFrom-Json -ErrorAction Stop
-            } catch {
-                Write-Information "Failed to parse AlertLastRun LogData for $($Row.RowKey): $($_.Exception.Message)"
-                continue
+        foreach ($Row in @($Rows)) {
+            if ($null -eq $Row) { continue }
+            $Status = [string]$Row.Status
+            if ($Status -eq 'Resolved') {
+                if (-not $IncludeResolved) { continue }
+                [datetime]$ResolvedAt = [datetime]::MinValue
+                if (-not [datetime]::TryParse([string]$Row.ResolvedAt, [cultureinfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::RoundtripKind, [ref]$ResolvedAt)) { continue }
+                if ($ResolvedAt -lt $ResolvedCutoff) { continue }
             }
 
-            foreach ($Item in @($Items)) {
-                if ($null -eq $Item) { continue }
-                $Hash = Get-AlertContentHash -AlertItem $Item
-                $Results.Add([PSCustomObject]@{
-                        CmdletName     = $Row.CmdletName
-                        AlertComment   = $Row.AlertComment
-                        Tenant         = $Row.Tenant
-                        LastRun        = $Row.PartitionKey
-                        ContentHash    = $Hash.ContentHash
-                        ContentPreview = $Hash.ContentPreview
-                        AlertItem      = $Item
-                    })
+            $AlertItem = $null
+            if (-not [string]::IsNullOrWhiteSpace($Row.AlertItem)) {
+                try { $AlertItem = $Row.AlertItem | ConvertFrom-Json -ErrorAction Stop } catch { $AlertItem = $null }
             }
+            $Keys = Get-CIPPAlertLifecycleKey -CmdletName ([string]$Row.CmdletName) -TenantFilter ([string]$Row.Tenant) -ContentHash ([string]$Row.ContentHash)
+
+            $Results.Add([PSCustomObject]@{
+                    PartitionKey        = $Row.PartitionKey
+                    RowKey              = $Row.RowKey
+                    CmdletName          = $Row.CmdletName
+                    AlertComment        = $Row.AlertComment
+                    Tenant              = $Row.Tenant
+                    ContentHash         = $Row.ContentHash
+                    ContentPreview      = $Row.ContentPreview
+                    AlertItem           = $AlertItem
+                    Status              = $Status
+                    FirstSeen           = $Row.FirstSeen
+                    LastSeen            = $Row.LastSeen
+                    LastChecked         = $Row.LastChecked
+                    ResolvedAt          = $Row.ResolvedAt
+                    ReopenCount         = [int]($Row.ReopenCount ?? 0)
+                    SnoozeUntil         = $Row.SnoozeUntil
+                    SnoozedBy           = $Row.SnoozedBy
+                    SnoozeReason        = $Row.SnoozeReason
+                    SnoozeVisible       = ([string]$Row.SnoozeVisible -eq 'True')
+                    SnoozeUntilResolved = ([string]$Row.SnoozeUntilResolved -eq 'True')
+                    SnoozePartitionKey  = $Keys.SnoozePartitionKey
+                    SnoozeRowKey        = if ([string]::IsNullOrWhiteSpace($Row.SnoozeRowKey)) { $Keys.SnoozeRowKey } else { $Row.SnoozeRowKey }
+                })
         }
 
         return ([HttpResponseContext]@{
                 StatusCode = [HttpStatusCode]::OK
-                Body       = @($Results)
+                Body       = @($Results | Sort-Object -Property @{ Expression = { $_.Status -eq 'Resolved' } }, @{ Expression = 'LastSeen'; Descending = $true })
             })
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1
index 5e9407e17279b..655c20ccca6af 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDBCache.ps1	
@@ -11,17 +11,33 @@ function Invoke-ListDBCache {
 
         Required query parameters:
           - tenantFilter: The tenant domain or 'AllTenants' to query all managed tenants.
-          - type: The cache collection to retrieve (e.g. Users, Groups, Mailboxes, Devices, etc.).
-                  Not required when countsOnly=true.
 
         Optional query parameters:
+          - type: The cache collection to retrieve (e.g. Users, Groups, Mailboxes, Devices, etc.).
+                  Omit it (or pass type=_availableTypes) to get the list of collections for the tenant
+                  instead of records; it is also not needed when countsOnly=true.
           - countsOnly: When 'true', returns one row per tenant per collection containing only the record
                         count and the time that collection was last cached. This reads the pre-computed
                         '<Type>-Count' rows, so it is a single table query regardless of tenant count and
                         never materializes the underlying records. Combine with tenantFilter=AllTenants to
                         get an estate-wide inventory and per-tenant cache freshness in one call. Pass a
                         type alongside it to restrict the result to a single collection.
+          - select: Comma-separated list of top-level fields to keep on each record (e.g.
+                    select=id,displayName,userPrincipalName). Everything else is dropped during parse,
+                    shrinking the response. A kept field keeps its ENTIRE subtree, so select=conditions
+                    keeps conditions.users.includeRoles too; projection never reaches inside a kept
+                    value. The owning Tenant is always stamped on each record regardless of select.
+          - top: Return at most this many records. For tenantFilter=AllTenants this is a GLOBAL cap
+                 across all tenants when ungrouped, so use it to sample rather than to page. When
+                 groupBy=Tenant is also set, top instead caps the records within each tenant bucket.
+          - latestOnly: When 'true', keep only the newest record per tenant, ranked by dateField (or
+                        an auto-detected date field such as createdDateTime). Collapses per-day
+                        snapshot types like SecureScore to one current row per tenant.
+          - groupBy: Set to 'Tenant' to return one bucket per tenant as
+                     { Tenant, Count, Records } objects instead of a flat record list.
+          - dateField: The record field latestOnly ranks by. Omit to auto-detect.
 
+        Use type=_shape for every collection's row count and fields (recorded when the cache was written).
         Use type=_availableTypes to discover which cache collections exist for a given tenant. Omitting the
         type parameter also returns the available types.
 
@@ -54,6 +70,44 @@ function Invoke-ListDBCache {
     $TenantFilter = $Request.Query.tenantFilter
     $Type = $Request.Query.type
     $CountsOnly = $Request.Query.countsOnly -eq $true
+    # Comma-separated list of top-level fields to keep on each record; everything else is dropped
+    # during parse. A kept field keeps its ENTIRE subtree (e.g. select=conditions keeps
+    # conditions.users.includeRoles). The Tenant stamp is always preserved. Omit to return all fields.
+    $Select = $Request.Query.select
+    # Return at most this many records. For AllTenants this is a global cap across all tenants,
+    # unless groupBy=Tenant is set, in which case it caps records within each tenant bucket.
+    $Top = $Request.Query.top -as [int]
+    # When true, keep only the newest record per tenant (by dateField, or an auto-detected date field).
+    # Collapses e.g. SecureScore's per-day snapshots to one current row per tenant.
+    $LatestOnly = $Request.Query.latestOnly -eq $true
+    # Group the result into one bucket per tenant. Only 'Tenant' is supported.
+    $GroupBy = $Request.Query.groupBy
+    # The record date field latestOnly ranks by. Omit to auto-detect (createdDateTime, lastRefresh, etc).
+    $DateField = $Request.Query.dateField
+
+    $SelectFields = if ($Select) {
+        [string[]]@($Select -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ })
+    } else {
+        $null
+    }
+
+    # Ranks a parsed record by a date field for latestOnly. Uses the caller's dateField when given,
+    # otherwise the first present candidate; unparseable/absent dates sort oldest.
+    $DateCandidates = @('createdDateTime', 'createdDate', 'CreatedDateTime', 'lastRefresh', 'LastRefresh', 'activityDateTime', 'date', 'Date', 'Timestamp')
+    $GetRecordDate = {
+        param($Record)
+        $Value = $null
+        if ($DateField) {
+            $Value = $Record.$DateField
+        } else {
+            foreach ($Candidate in $DateCandidates) {
+                $Prop = $Record.PSObject.Properties[$Candidate]
+                if ($Prop -and $Prop.Value) { $Value = $Prop.Value; break }
+            }
+        }
+        if ($null -eq $Value) { return [datetime]::MinValue }
+        try { return [datetime]$Value } catch { return [datetime]::MinValue }
+    }
 
     if (-not $TenantFilter) {
         return ([HttpResponseContext]@{
@@ -120,6 +174,31 @@ function Invoke-ListDBCache {
                 })
         }
 
+        # type=_shape: every collection with its row count and the fields (and types) its rows were seen
+        # to carry, as recorded when the cache was written. What the report builder offers to pick from.
+        if ($Type -eq '_shape') {
+            $ShapeRows = @(Get-CIPPDbItem -CountsOnly -IncludeShape -TenantFilter $Tenant)
+            if ($null -ne $AllowedDomains) {
+                $ShapeRows = @($ShapeRows | Where-Object { $AllowedDomains.Contains([string]$_.PartitionKey) })
+            }
+            $Shapes = @($ShapeRows | Sort-Object -Property RowKey | ForEach-Object {
+                    $Fields = try { @((ConvertFrom-Json -InputObject "$($_.Shape)" -ErrorAction Stop).fields) } catch { @() }
+                    [PSCustomObject]@{
+                        Type   = $_.RowKey -replace '-Count$', ''
+                        Count  = $_.DataCount
+                        Fields = @($Fields | Where-Object { $_.name } | ForEach-Object { [PSCustomObject]@{ name = [string]$_.name; type = [string]$_.type } })
+                    }
+                })
+            return ([HttpResponseContext]@{
+                    StatusCode = [HttpStatusCode]::OK
+                    Body       = @{ Results = $Shapes }
+                })
+        }
+
+        # type is optional: omitting it (or passing _availableTypes) returns the list of cache
+        # collections for the tenant, so a type-less call is a discovery call rather than an error.
+        # This also keeps the OpenAPI generator from marking type required off a missing-type guard;
+        # type is only meaningful for a data read, which countsOnly and this discovery path bypass.
         if (-not $Type -or $Type -eq '_availableTypes') {
             $TypeRows = @(Get-CIPPDbItem -CountsOnly -TenantFilter $Tenant)
             if ($null -ne $AllowedDomains) {
@@ -127,16 +206,6 @@ function Invoke-ListDBCache {
             }
             $Types = @($TypeRows.RowKey | ForEach-Object { $_ -replace '-Count$', '' } | Sort-Object -Unique)
 
-            if (-not $Type) {
-                return ([HttpResponseContext]@{
-                        StatusCode = [HttpStatusCode]::BadRequest
-                        Body       = @{
-                            Results        = 'Error: type query parameter is required'
-                            AvailableTypes = $Types
-                        }
-                    })
-            }
-
             return ([HttpResponseContext]@{
                     StatusCode = [HttpStatusCode]::OK
                     Body       = @{ Results = $Types }
@@ -154,7 +223,7 @@ function Invoke-ListDBCache {
             $Results = foreach ($Row in $Rows) {
                 if ([string]::IsNullOrWhiteSpace($Row.Data)) { continue }
                 try {
-                    $Parsed = [CIPP.CippJson]::ConvertFromJson($Row.Data, $null)
+                    $Parsed = [CIPP.CippJson]::ConvertFromJson($Row.Data, $SelectFields)
                 } catch {
                     Write-Information "Skipping unparseable CippReportingDB row for '$($Row.PartitionKey)'/'$Type': $($_.Exception.Message)"
                     continue
@@ -170,7 +239,31 @@ function Invoke-ListDBCache {
             }
             $Results = @($Results)
         } else {
-            $Results = @(New-CIPPDbRequest -TenantFilter $Tenant -Type $Type)
+            $DbParams = @{ TenantFilter = $Tenant; Type = $Type }
+            if ($SelectFields) { $DbParams.Fields = $SelectFields }
+            $Results = @(New-CIPPDbRequest @DbParams)
+        }
+
+        if ($LatestOnly) {
+            # Keep only the newest record per tenant. Single-tenant results collapse to one row.
+            $Results = @($Results | Group-Object -Property Tenant | ForEach-Object {
+                    @($_.Group) | Sort-Object -Property @{ Expression = { & $GetRecordDate $_ } } -Descending | Select-Object -First 1
+                })
+        }
+
+        if ($GroupBy -eq 'Tenant') {
+            # One bucket per tenant; top (when set) caps the records inside each bucket.
+            $Results = @($Results | Group-Object -Property Tenant | ForEach-Object {
+                    $BucketRecords = @($_.Group)
+                    if ($Top -gt 0) { $BucketRecords = @($BucketRecords | Select-Object -First $Top) }
+                    [PSCustomObject]@{
+                        Tenant  = $_.Name
+                        Count   = @($_.Group).Count
+                        Records = $BucketRecords
+                    }
+                })
+        } elseif ($Top -gt 0) {
+            $Results = @($Results | Select-Object -First $Top)
         }
 
         return ([HttpResponseContext]@{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1
index ce3772aabe642..55798a2a5c631 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1	
@@ -37,6 +37,9 @@ function Invoke-ListGraphBulkRequest {
     if ($BulkRequests) {
         $GraphRequestParams.Requests = @($BulkRequests)
         try {
+            foreach ($GraphRequest in $BulkRequests) {
+                Test-CIPPGraphEndpointBlocked -Uri $GraphRequest.url -Throw
+            }
             $Body = New-GraphBulkRequest @GraphRequestParams
             $Results = @{
                 StatusCode = [System.Net.HttpStatusCode]::OK
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphRequest.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphRequest.ps1
index b9e71e5062c74..9dba13314ff8a 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphRequest.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphRequest.ps1	
@@ -6,7 +6,7 @@ function Invoke-ListGraphRequest {
     .ROLE
         CIPP.Core.Read
     .DESCRIPTION
-        Proxies an arbitrary Microsoft Graph API GET request for a tenant. Supports custom endpoints, filters, pagination, and field selection via query parameters.
+        Proxies an arbitrary Microsoft Graph API GET request for a tenant. Supports custom endpoints, filters, pagination, and field selection via query parameters. If a request returns a permission error, retry with AsApp set to true: admin and application-scoped endpoints (for example admin/sharepoint/settings) require the application's own permissions rather than the default delegated access.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -81,8 +81,18 @@ function Invoke-ListGraphRequest {
         $GraphRequestParams.QueueId = $Request.Query.QueueId
     }
 
-    if ($Request.Query.Version) {
-        $GraphRequestParams.Version = $Request.Query.Version
+    # Graph API version to call: v1.0 or beta. Defaults to beta when omitted.
+    switch ($Request.Query.Version) {
+        'v1.0' { $GraphRequestParams.Version = 'v1.0' }
+        'beta' { $GraphRequestParams.Version = 'beta' }
+        default {
+            if ($Request.Query.Version) {
+                return ([HttpResponseContext]@{
+                        StatusCode = [HttpStatusCode]::BadRequest
+                        Body       = 'Version must be v1.0 or beta.'
+                    })
+            }
+        }
     }
 
     # Return only the first page and stop. The default follows every @odata.nextLink until
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListKnownIPDb.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListKnownIPDb.ps1
index 316b8ea6ae2b9..ccea398ae0e62 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListKnownIPDb.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListKnownIPDb.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListKnownIPDb {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        CIPP.Core.Read
+        CIPP.IPDatabase.Read
     .DESCRIPTION
         Lists known IP address entries from the CIPP IP database, optionally filtered by tenant.
     #>
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListLogs.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListLogs.ps1
index 9a9df64ef972a..0de51445b02bf 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListLogs.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListLogs.ps1	
@@ -3,9 +3,9 @@ function Invoke-ListLogs {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        CIPP.Core.Read
+        CIPP.Logs.Read
     .DESCRIPTION
-        Lists CIPP platform audit logs with filtering by severity, date range, tenant, and user. Supports listing available log categories, fetching a single entry, and server-side pagination via manualPagination/nextLink.
+        Lists CIPP platform audit logs with filtering by severity, date range, tenant, and user. Supports listing available log categories, fetching a single entry, and server-side pagination via manualPagination/nextLink. Pass Search to filter rows by a case-insensitive substring of the log Message. Pass summaryOnly=true (or countsOnly=true) to get per-API and per-severity counts across the requested range with the heavy LogData dropped, instead of the full rows.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -179,6 +179,10 @@ function Invoke-ListLogs {
         Get-CIPPAzDataTableEntity @TemplatesTable
     } else { $null }
 
+    # Free-text search over the log Message (case-insensitive literal substring). Applied client-side
+    # per partition alongside the other row filters, and independent of the Filter flag.
+    $SearchFilter = $Request.Query.Search
+
     # The row-level filters that cannot (or should not) go into the table query.
     $RowFilter = {
         param($Row)
@@ -186,18 +190,49 @@ function Invoke-ListLogs {
         ($Username -eq '*' -or $Row.Username -like $Username) -and
         ([string]::IsNullOrEmpty($TenantFilter) -or $TenantFilter -eq 'AllTenants' -or $Row.Tenant -like "*$TenantFilter*" -or $Row.TenantID -eq $TenantFilter) -and
         ([string]::IsNullOrEmpty($ApiFilter) -or $Row.API -match "$ApiFilter") -and
+        ([string]::IsNullOrEmpty($SearchFilter) -or $Row.Message -match [regex]::Escape($SearchFilter)) -and
         ($AllowedTenants -contains 'AllTenants' -or $TenantList.defaultDomainName -contains $Row.Tenant -or $Row.Tenant -eq 'CIPP' -or $TenantList.customerId -contains $Row.TenantId)
     }
 
+    # summaryOnly/countsOnly: return per-API and per-severity counts for the matching rows across the
+    # requested date range, dropping the (often huge) LogData payloads entirely. Ignores pagination.
+    $CountsOnly = ($Request.Query.summaryOnly -eq $true) -or ($Request.Query.countsOnly -eq $true)
+    if ($CountsOnly) {
+        if ($StartDate -and $EndDate) {
+            $Filter = "PartitionKey ge '$StartDate' and PartitionKey le '$EndDate'"
+        } elseif ($StartDate) {
+            $Filter = "PartitionKey eq '{0}'" -f $StartDate
+        } else {
+            $Filter = "PartitionKey eq '{0}'" -f $LocalNow.ToString('yyyyMMdd')
+        }
+        foreach ($Clause in $ServerSideFilter) { $Filter = "$Filter and $Clause" }
+
+        $Matching = @(Get-CIPPAzDataTableEntity @Table -Filter $Filter | Where-Object { & $RowFilter $_ })
+        $ByApi = @($Matching | Group-Object -Property API | Sort-Object -Property Count -Descending | ForEach-Object {
+                [PSCustomObject]@{ API = $_.Name; Count = $_.Count }
+            })
+        $BySeverity = @($Matching | Group-Object -Property Severity | Sort-Object -Property Count -Descending | ForEach-Object {
+                [PSCustomObject]@{ Severity = $_.Name; Count = $_.Count }
+            })
+        return [HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = [PSCustomObject]@{
+                Total      = $Matching.Count
+                ByAPI      = $ByApi
+                BySeverity = $BySeverity
+            }
+        }
+    }
+
     # Return one page per request plus a continuation token in Metadata.nextLink, which the
     # frontend passes back as nextLink to fetch the next page. Pages walk the requested date
     # range newest-day-first and, within a day, in RowKey order (newest-first for entries
     # written with the inverted-ticks RowKey scheme).
     if ($Request.Query.manualPagination -and [System.Convert]::ToBoolean($Request.Query.manualPagination)) {
-        $PageSize = 400
-        # Rows to return per page, clamped between 50 and 1000. Defaults to 400.
+        $PageSize = 2000
+        # Rows to return per page, clamped between 50 and 5000. Defaults to 2000.
         if ($Request.Query.PageSize -as [int]) {
-            $PageSize = [Math]::Min([Math]::Max([int]$Request.Query.PageSize, 50), 1000)
+            $PageSize = [Math]::Min([Math]::Max([int]$Request.Query.PageSize, 50), 5000)
         }
         # Bound the table round trips a single request can make, so a filter that matches
         # nothing across many partitions returns a short (possibly empty) page with a
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListSnoozedAlerts.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListSnoozedAlerts.ps1
index 32e8876606438..c86359e465b35 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListSnoozedAlerts.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListSnoozedAlerts.ps1	
@@ -5,7 +5,7 @@ function Invoke-ListSnoozedAlerts {
     .ROLE
         CIPP.AlertSnooze.Read
     .DESCRIPTION
-        Lists alerts that have been snoozed (temporarily suppressed), filterable by cmdlet name. Returns snooze duration and scope details.
+        Lists alerts that have been snoozed (temporarily suppressed), filterable by cmdlet name. Returns the snooze duration, whether it runs until the item resolves, whether the item stays visible on the dashboard, and who set it.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -30,16 +30,16 @@ function Invoke-ListSnoozedAlerts {
         # restricted callers); unrestricted callers pass through untouched.
         $SnoozeRecords = $SnoozeRecords | Select-CippAllowedTenantData -TenantProperty 'Tenant'
 
-
-
         $CurrentUnixTime = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
 
         $Results = @($SnoozeRecords | ForEach-Object {
-                $SnoozeUntil = [int64]$_.SnoozeUntil
-                $IsForever = $SnoozeUntil -eq -1
-                $IsExpired = (-not $IsForever) -and ($SnoozeUntil -lt $CurrentUnixTime)
-                $RemainingSeconds = if ($IsForever) { -1 } elseif ($IsExpired) { 0 } else { $SnoozeUntil - $CurrentUnixTime }
-                $RemainingDays = if ($IsForever) { -1 } elseif ($IsExpired) { 0 } else { [math]::Ceiling($RemainingSeconds / 86400) }
+                $UntilResolved = [string]$_.UntilResolved -eq 'True'
+                $KeepVisible = [string]$_.KeepVisible -eq 'True'
+                $SnoozeUntil = ([string]$_.SnoozeUntil) -as [int64]
+                if ($null -eq $SnoozeUntil) { $SnoozeUntil = 0 }
+                $IsExpired = (-not $UntilResolved) -and ($SnoozeUntil -lt $CurrentUnixTime)
+                $RemainingSeconds = if ($UntilResolved -or $IsExpired) { 0 } else { $SnoozeUntil - $CurrentUnixTime }
+                $RemainingDays = if ($UntilResolved -or $IsExpired) { 0 } else { [math]::Ceiling($RemainingSeconds / 86400) }
 
                 [PSCustomObject]@{
                     PartitionKey   = $_.PartitionKey
@@ -52,9 +52,11 @@ function Invoke-ListSnoozedAlerts {
                     SnoozedBy      = $_.SnoozedBy
                     SnoozedAt      = $_.SnoozedAt
                     SnoozeUntil    = $_.SnoozeUntil
+                    UntilResolved  = $UntilResolved
+                    KeepVisible    = $KeepVisible
                     IsExpired      = $IsExpired
                     RemainingDays  = $RemainingDays
-                    Status         = if ($IsForever) { 'Forever' } elseif ($IsExpired) { 'Expired' } else { 'Active' }
+                    Status         = if ($UntilResolved) { 'Until Resolved' } elseif ($IsExpired) { 'Expired' } else { 'Active' }
                 }
             })
 
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-PublicPhishingCheck.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-PublicPhishingCheck.ps1
index 5d9375cba6973..15cbff4eadca2 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-PublicPhishingCheck.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-PublicPhishingCheck.ps1	
@@ -34,7 +34,8 @@ function Invoke-PublicPhishingCheck {
             rawBody                  = "$($Request.body | ConvertTo-Json)"
         }
         $null = Add-CIPPAzDataTableEntity @table -Entity $TableBody -Force
-        Write-AlertTrace -cmdletName 'CheckExtentionAlert' -tenantFilter $Tenant.defaultDomainName -data $TableBody
+        # One event per call: append it without resolving earlier reports.
+        Write-AlertTrace -cmdletName 'CheckExtentionAlert' -tenantFilter $Tenant.defaultDomainName -data $TableBody -Append
         #Write-AlertMessage -message $Message -sev 'Alert' -tenant $Tenant.customerId -LogData $Request.body
     }
 
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1
index 86456117cb391..67d52027c857a 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionSync.ps1	
@@ -84,8 +84,32 @@ Function Invoke-ExecExtensionSync {
             }
         }
         'Hudu' {
-            Register-CIPPExtensionScheduledTasks -Reschedule -Extensions 'Hudu'
-            $Results = [pscustomobject]@{'Results' = 'Extension sync tasks have been rescheduled and will start within 15 minutes' }
+            try {
+                if ($Request.Query.TenantID) {
+                    $CIPPMapping = Get-CIPPTable -TableName CippMapping
+                    $Filter = "PartitionKey eq 'HuduMapping'"
+                    $Mapping = Get-CIPPAzDataTableEntity @CIPPMapping -Filter $Filter | Where-Object { $_.RowKey -eq $Request.Query.TenantID -and $Null -ne $_.IntegrationId -and $_.IntegrationId -ne '' }
+                    $Tenant = Get-Tenants -IncludeErrors | Where-Object { $_.customerId -eq $Request.Query.TenantID }
+
+                    if (($Mapping | Measure-Object).count -eq 1 -and $Tenant) {
+                        # Queue the sync function for immediate execution
+                        $null = Add-CippQueueMessage -Cmdlet 'Push-CippExtensionData' -Parameters @{
+                            TenantFilter = $Tenant.defaultDomainName
+                            Extension    = 'Hudu'
+                        }
+                        Write-LogMessage -API 'HuduSync' -tenant $Tenant.defaultDomainName -message "On-demand Hudu Synchronization queued for $($Mapping.IntegrationName)" -Sev 'Info' -Headers $Request.Headers
+                        $Results = [pscustomobject]@{'Results' = "Hudu Synchronization Queued for $($Mapping.IntegrationName)" }
+                    } else {
+                        $Results = [pscustomobject]@{'Results' = 'Tenant was not found.' }
+                    }
+                } else {
+                    Register-CIPPExtensionScheduledTasks -Reschedule -Extensions 'Hudu'
+                    $Results = [pscustomobject]@{'Results' = 'Extension sync tasks have been rescheduled and will start within 15 minutes' }
+                }
+            } catch {
+                $Results = [pscustomobject]@{'Results' = "Could not start Hudu Sync: $($_.Exception.Message)" }
+                Write-LogMessage -API 'HuduSync' -tenant 'none' -message "Could not start Hudu Sync $($_.Exception.Message)" -sev Error
+            }
         }
 
     }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1
index e6f0a94bcaa26..c6a7ac7fe01ce 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1	
@@ -6,7 +6,13 @@ function Invoke-ExecExtensionsConfig {
         CIPP.Extension.ReadWrite
     #>
     [CmdletBinding()]
-    param($Request, $TriggerMetadata)
+    param(
+        [Parameter(Mandatory = $true)]
+        [object]$Request,
+
+        [Parameter(Mandatory = $false)]
+        [object]$TriggerMetadata
+    )
     $APIName = $Request.Params.CIPPEndpoint
     $Headers = $Request.Headers
 
@@ -28,17 +34,22 @@ function Invoke-ExecExtensionsConfig {
             }
         }
 
+        $ScheduleParameters = @{}
         if ($Body.Hudu.NextSync) {
             #parse unixtime for addedtext
-            $Timestamp = [datetime]::UnixEpoch.AddSeconds([int]$Body.Hudu.NextSync).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
-            Register-CIPPExtensionScheduledTasks -Reschedule -NextSync $Body.Hudu.NextSync -Extensions 'Hudu'
+            $Timestamp = [datetime]::UnixEpoch.AddSeconds([int]$Body.Hudu.NextSync).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
+            $ScheduleParameters = @{
+                Reschedule = $true
+                NextSync   = $Body.Hudu.NextSync
+                Extensions = 'Hudu'
+            }
             $AddedText = " Next sync will be at $Timestamp."
             $Body.Hudu.NextSync = ''
         }
 
         $Table = Get-CIPPTable -TableName Extensionsconfig
         foreach ($APIKey in $Body.PSObject.Properties.Name) {
-            Write-Information "Working on $apikey"
+            Write-Information "Working on $APIKey"
             if ($Body.$APIKey.APIKey -eq 'SentToKeyVault' -or $Body.$APIKey.APIKey -eq '') {
                 Write-Information 'Not sending to keyvault. Key previously set or left blank.'
             } else {
@@ -72,8 +83,11 @@ function Invoke-ExecExtensionsConfig {
         }
         Write-Information ($AddObject | ConvertTo-Json -Compress)
         $ConfigTable = Get-CIPPTable -tablename 'Config'
-        Add-AzDataTableEntity @ConfigTable -Entity $AddObject -Force
+        Add-AzDataTableEntity @ConfigTable -Entity $AddObject -Force | Out-Null
 
+        if ($ScheduleParameters.Count -gt 0) {
+            Register-CIPPExtensionScheduledTasks @ScheduleParameters
+        }
         Register-CIPPExtensionScheduledTasks
         $Result = "Successfully saved the extension configuration. $AddedText"
         Write-LogMessage -headers $Headers -API $APIName -tenant 'Global' -message $Result.Trim() -Sev 'Info'
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1
index d98869d4b6101..eab789ef81a6e 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1	
@@ -58,12 +58,55 @@ function Invoke-PublicMcpRegister {
         return (New-CippMcpRegistrationError -Code 'invalid_redirect_uri' -Description 'redirect_uris is required and must contain at least one URI.' -Headers $CorsHeaders)
     }
 
-    # The "registered client" is always the instance's single MCP resource app registration.
+    # The "registered client" is an MCPAllowed API client - the app the connector signs in AS (the
+    # dedicated CIPP-MCP app is the resource, not handed out here). Several MCPAllowed clients can
+    # coexist, each with its own role/IP/redirects/CA; a connector can pin one with ?client=<appId>
+    # on the MCP URL, otherwise the first that resolves in Entra is used.
     $Table = Get-CippTable -tablename 'ApiClients'
-    $McpClient = Get-CIPPAzDataTableEntity @Table -Filter 'Enabled eq true' |
-        Where-Object { "$($_.MCPAllowed)" -eq 'True' } | Select-Object -First 1
+    $McpCandidates = @(Get-CIPPAzDataTableEntity @Table -Filter 'Enabled eq true' |
+            Where-Object { "$($_.MCPAllowed)" -eq 'True' })
+    $RequestedClient = "$($Request.Query.client)".Trim()
+    if (-not [string]::IsNullOrWhiteSpace($RequestedClient)) {
+        $Scoped = @($McpCandidates | Where-Object { "$($_.RowKey)" -eq $RequestedClient })
+        if ($Scoped.Count -eq 0) {
+            return (New-CippMcpRegistrationError -Code 'invalid_client_metadata' -Description "No enabled MCP client matches ?client=$RequestedClient on this instance." -Headers $CorsHeaders)
+        }
+        $McpCandidates = $Scoped
+    }
+    if ($McpCandidates.Count -eq 0) {
+        return (New-CippMcpRegistrationError -Code 'invalid_client_metadata' -Description 'No MCP client is configured on this instance. Enable "MCP Access Allowed" on an API client in CIPP and run Save to Azure.' -Headers $CorsHeaders)
+    }
+
+    # Only advertise a client whose Entra app registration still exists. A stale holder (its app
+    # registration deleted, or a failed setup that never created one) would otherwise be handed out
+    # as client_id and every connect fails at authorize with AADSTS700016 (issue #619). Existence is
+    # cached 5 min per appId so this anonymous endpoint can't be turned into a Graph-call amplifier.
+    if (-not $script:McpResourceAppExistsCache) { $script:McpResourceAppExistsCache = @{} }
+    $McpClient = $null
+    foreach ($Candidate in $McpCandidates) {
+        $CandidateId = "$($Candidate.RowKey)"
+        $Cached = $script:McpResourceAppExistsCache[$CandidateId]
+        if ($Cached -and ([DateTimeOffset]::UtcNow - $Cached.CheckedAt).TotalSeconds -lt 300) {
+            if ($Cached.Exists) { $McpClient = $Candidate; break }
+            Write-LogMessage -API 'PublicMcpRegister' -message "Skipping MCP client $CandidateId : its Entra app registration no longer exists." -Sev 'Warning'
+            continue
+        }
+        try {
+            $ResourceApp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=appId eq '$CandidateId'&`$select=appId" -NoAuthCheck $true -AsApp $true
+            $Exists = [bool]($ResourceApp.appId)
+            $script:McpResourceAppExistsCache[$CandidateId] = @{ Exists = $Exists; CheckedAt = [DateTimeOffset]::UtcNow }
+            if ($Exists) { $McpClient = $Candidate; break }
+            Write-LogMessage -API 'PublicMcpRegister' -message "Skipping MCP client $CandidateId : its Entra app registration no longer exists." -Sev 'Warning'
+        } catch {
+            # On a Graph error don't hide a possibly-valid client — treat it as present so a
+            # transient outage can't break every connect, and don't cache the uncertain result.
+            Write-LogMessage -API 'PublicMcpRegister' -message "Could not verify MCP resource app $CandidateId exists; proceeding. Error: $($_.Exception.Message)" -Sev 'Warning'
+            $McpClient = $Candidate
+            break
+        }
+    }
     if (-not $McpClient) {
-        return (New-CippMcpRegistrationError -Code 'invalid_client_metadata' -Description 'No MCP resource client is configured on this instance. Enable "MCP Access Allowed" on an API client in CIPP and run Save to Azure.' -Headers $CorsHeaders)
+        return (New-CippMcpRegistrationError -Code 'invalid_client_metadata' -Description 'The configured MCP resource client no longer has a valid app registration in Entra. Re-run MCP setup on an API client in CIPP and Save to Azure.' -Headers $CorsHeaders)
     }
 
     # Known client callbacks and loopback (any port/path) pass directly. Anything else must be a
@@ -102,11 +145,15 @@ function Invoke-PublicMcpRegister {
         return (New-CippMcpRegistrationError -Code 'invalid_redirect_uri' -Description "Redirect URI '$Uri' is not an allowed MCP client callback for this server. To allow a custom client, add its callback to the MCP resource app registration (see the CIPP-API integration docs)." -Headers $CorsHeaders)
     }
 
+    # The MCPAllowed client app is itself the OAuth client the connector signs in as (a different app
+    # from the dedicated CIPP-MCP resource, so the refresh is not "a token for itself"/AADSTS90009).
+    $PublicClientId = "$($McpClient.RowKey)"
+
     $ClientName = "$($Body.client_name ?? 'MCP client')"
-    Write-LogMessage -API 'PublicMcpRegister' -message "MCP client registration served: '$ClientName' -> client_id $($McpClient.RowKey) ($($RedirectUris.Count) redirect URI(s))" -Sev 'Info'
+    Write-LogMessage -API 'PublicMcpRegister' -message "MCP client registration served: '$ClientName' -> client_id $PublicClientId (resource app $($McpClient.RowKey), $($RedirectUris.Count) redirect URI(s))" -Sev 'Info'
 
     $Response = [ordered]@{
-        client_id                  = "$($McpClient.RowKey)"
+        client_id                  = $PublicClientId
         client_id_issued_at        = [DateTimeOffset]::UtcNow.ToUnixTimeSeconds()
         client_name                = $ClientName
         redirect_uris              = @($RedirectUris)
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAccessChecks.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAccessChecks.ps1
index 559fb26481ee0..df8d467e43747 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAccessChecks.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAccessChecks.ps1	
@@ -5,7 +5,7 @@ function Invoke-ExecAccessChecks {
     .ROLE
         CIPP.AppSettings.Read
     .DESCRIPTION
-        Runs the CIPP deployment's self-diagnostics and returns the result. Type selects the check: 'Permissions' verifies the SAM application's Graph permissions, 'Tenants' tests access to each tenant, and 'GDAP' inspects the GDAP relationships and role mappings. Results are cached for an hour unless SkipCache is true.
+        Runs the CIPP deployment's self-diagnostics and returns the result. Type selects the check: 'Permissions' verifies the SAM application's Graph permissions, 'Tenants' tests access to each tenant, and 'GDAP' inspects the GDAP relationships and role mappings. Results are cached for an hour and served from cache by default. Pass SkipCache to trigger a fresh run of the check; the run repopulates the cache and the response only acknowledges it started, so call again without SkipCache to read the updated results. For the 'Tenants' check, supplying TenantId returns just that tenant's cached result; add SkipCache to trigger a re-check of that single tenant.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -22,17 +22,21 @@ function Invoke-ExecAccessChecks {
     # body - reading only the query left both empty and returned an empty result for every Type.
     $Type = $Request.Query.Type ?? $Request.Body.Type
 
-    # Re-run the check instead of serving the cached result.
+    # Trigger a fresh run of the check instead of serving the cached result. The run repopulates
+    # the cache and the response only acknowledges it, so a follow-up call without SkipCache is
+    # what returns the updated result.
     $SkipCache = ($Request.Query.SkipCache ?? $Request.Body.SkipCache) -eq $true
 
-    # The tenant to (re)check for the 'Tenants' type. Query or body, for the same reason as Type.
+    # The tenant to read for the 'Tenants' type: returns just that tenant's cached result. Pair it
+    # with SkipCache to trigger a re-check of that one tenant, then read again without SkipCache to
+    # get the refreshed result. Query or body, as with Type.
     $TenantId = $Request.Body.TenantId ?? $Request.Query.TenantId
 
     switch ($Type) {
         'Permissions' {
             if (-not $SkipCache) {
                 try {
-                    $Cache = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq 'AccessPermissions' and Timestamp and Timestamp ge datetime'$TimestampFilter'"
+                    $Cache = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq 'AccessPermissions' and Timestamp ge datetime'$TimestampFilter'"
                     $Results = $Cache.Data | ConvertFrom-Json -ErrorAction Stop
                 } catch {
                     $Results = $null
@@ -51,10 +55,22 @@ function Invoke-ExecAccessChecks {
             }
         }
         'Tenants' {
-            $AccessChecks = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'TenantAccessChecks'"
-            if (!$TenantId) {
+            # A single-tenant refresh runs synchronously and only when explicitly requested via
+            # SkipCache, returning an acknowledgement (the "Check Tenant" button relies on this).
+            # Every other call - the full list, or a single TenantId without SkipCache - just
+            # serves the cached rows, so a caller can read one tenant's result without side effects.
+            if ($TenantId -and $SkipCache) {
+                $Tenant = Get-Tenants -TenantFilter $TenantId
+                $null = Test-CIPPAccessTenant -Tenant $Tenant.customerId -Headers $Request.Headers
+                $Results = "Refreshing tenant $($Tenant.displayName)"
+            } else {
+                $AccessChecks = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'TenantAccessChecks'"
                 try {
                     $Tenants = Get-Tenants -IncludeErrors | Where-Object { $_.customerId -ne $env:TenantID }
+                    # Narrow to a single tenant when TenantId is supplied (customerId or domain).
+                    if ($TenantId) {
+                        $Tenants = $Tenants | Where-Object { $_.customerId -eq $TenantId -or $_.defaultDomainName -eq $TenantId }
+                    }
                     $Results = foreach ($Tenant in $Tenants) {
                         $TenantCheck = $AccessChecks | Where-Object -Property RowKey -EQ $Tenant.customerId | Select-Object -Property Data
                         $TenantResult = [PSCustomObject]@{
@@ -112,18 +128,13 @@ function Invoke-ExecAccessChecks {
                     Write-Warning "Error running tenant access check - $($_.Exception.Message)"
                     $Results = @()
                 }
-            }
 
-            if ($SkipCache -or $LastRun -lt $4HoursAgo) {
-                $Message = Test-CIPPAccessTenant -Headers $Request.Headers
-            }
-
-            if ($TenantId) {
-                $Tenant = Get-Tenants -TenantFilter $TenantId
-                $null = Test-CIPPAccessTenant -Tenant $Tenant.customerId -Headers $Request.Headers
-                $Results = "Refreshing tenant $($Tenant.displayName)"
+                # Full-list only: queue a background re-check when the cache is stale or a refresh
+                # was requested. A single tenant refreshes synchronously in the branch above.
+                if (-not $TenantId -and ($SkipCache -or $LastRun -lt $4HoursAgo)) {
+                    $Message = Test-CIPPAccessTenant -Headers $Request.Headers
+                }
             }
-
         }
         'GDAP' {
             if (-not $SkipCache) {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAddTrustedIP.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAddTrustedIP.ps1
index 9a1fd93fc25a5..ae0ece13b3f5f 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAddTrustedIP.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecAddTrustedIP.ps1	
@@ -4,6 +4,10 @@ function Invoke-ExecAddTrustedIP {
         Entrypoint
     .ROLE
         CIPP.AppSettings.ReadWrite
+    .SYNOPSIS
+        Adds IP addresses or ranges to CIPP's IP allow/block list.
+    .DESCRIPTION
+        Sets each IP address or CIDR range (IPv4 or IPv6) to Trusted, Blocked or NotTrusted (neutral) for one tenant, or for every tenant with tenantfilter=AllTenants. A tenant entry overrides an AllTenants entry for the same range, and the most specific range decides an address. The audit-log alerts treat Trusted addresses as known; the BEC investigation uses Trusted and Blocked entries as confirmed-safe and confirmed-compromised IPs.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -28,16 +32,46 @@ function Invoke-ExecAddTrustedIP {
         })
     }
 
+    # Trusted, Blocked, or NotTrusted to make the entry neutral again
+    $State = [string]$Request.Body.State
+    if ($State -notin @('Trusted', 'Blocked', 'NotTrusted')) {
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{ results = "State must be Trusted, Blocked or NotTrusted" }
+            })
+    }
+    # IP addresses or CIDR ranges (IPv4 or IPv6); one entry may also hold several separated by commas or spaces
+    $RawIPs = foreach ($Value in $Request.Body.IP) { [string]$Value -split '[,;\s]+' }
+    $Ranges = try {
+        @($RawIPs | Where-Object { $_ } | ForEach-Object { ConvertTo-CIPPIPRange -Value $_ } | Select-Object -Unique)
+    } catch {
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{ results = $_.Exception.Message }
+            })
+    }
+    if ($Ranges.Count -eq 0) {
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{ results = 'At least one IP address or range is required' }
+            })
+    }
+    # Optional note shown with the entry
+    $Note = [string]$Request.Body.Note
+
     try {
         $Table = Get-CippTable -tablename 'trustedIps'
-        foreach ($IP in $Request.body.IP) {
+        foreach ($Range in $Ranges) {
+            # '/' is not allowed in a table key: the key carries '_' and the range itself is stored alongside
             Add-CIPPAzDataTableEntity @Table -Entity @{
                 PartitionKey = $tenantDomain
-                RowKey       = $IP
-                state        = $Request.Body.State
+                RowKey       = $Range -replace '/', '_'
+                Range        = $Range
+                state        = $State
+                Note         = $Note
             } -Force
         }
-        $Result = "Added $($Request.Body.IP) to database with state $($Request.Body.State) for $($tenantDomain)"
+        $Result = "Set $($Ranges -join ', ') to $State for $($tenantDomain)"
         Write-LogMessage -headers $Headers -API $APIName -tenant $tenantDomain -message $Result -Sev 'Info'
         return ([HttpResponseContext]@{
                 StatusCode = [HttpStatusCode]::OK
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1
index 006a0ac161f94..84eb7153bd2a8 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1	
@@ -160,12 +160,24 @@ function Invoke-ExecApiClient {
 
                 Add-CIPPAzDataTableEntity @Table -Entity $Client -Force | Out-Null
 
-                # When this client is MCP-enabled, configure its app registration as the MCP OAuth
-                # resource (host identifier URIs + v2 tokens) so the Claude connector flow can resolve it.
+                # When this client is MCP-enabled it becomes one of the OAuth client apps that AI
+                # connectors sign in as. Several MCPAllowed clients may coexist (each with its own
+                # role/IP/redirects/CA); the dedicated CIPP-MCP app is the shared protected resource.
+                # Configure this client (callbacks, public client flows, resource permissions +
+                # consent) and ensure the resource app exists (Set-CIPPMCPClientApp ->
+                # New-CIPPMcpResourceApp).
                 if ([bool]($Request.Body.MCPAllowed ?? $false)) {
                     try {
-                        $null = Set-CIPPMCPClientApp -AppId $ClientId -Headers $Request.Headers
-                        $Results.Add('MCP resource URIs, v2 tokens, and callbacks for known MCP clients (Claude, ChatGPT, VS Code, Copilot) configured on the app registration. Run Save to Azure to apply the changes.')
+                        $McpResult = Set-CIPPMCPClientApp -AppId $ClientId -Headers $Request.Headers
+                        $Results.Add("Configured '$($Client.AppName)' as an MCP OAuth client (callbacks for Claude, ChatGPT, VS Code and Copilot Studio) against the CIPP-MCP resource app. Run Save to Azure to apply the changes.")
+                        if (-not $McpResult.ResourceAppId) {
+                            $Results.Add(@{
+                                    resultText = 'The CIPP-MCP resource app could not be created or resolved. MCP connectors will not be able to sign in until this succeeds - re-run Save, or check the app registration permissions.'
+                                    state      = 'warning'
+                                })
+                        } else {
+                            $Results.Add('For Copilot Studio, use this client''s Application (Client) ID and its secret (reset it with Actions > Reset Application Secret if you did not save it).')
+                        }
                     } catch {
                         $Results.Add(@{
                                 resultText = "Client saved, but MCP app configuration failed: $($_.Exception.Message)"
@@ -218,6 +230,22 @@ function Invoke-ExecApiClient {
             Write-Information "[ExecApiClient] MCP clients resolved for audiences/scope: $($McpClientIds -join ', ')"
             try {
                 $RGName = Get-CIPPFunctionAppResourceGroup -SiteName $FunctionAppName
+
+                # Ensure the dedicated CIPP-MCP resource app exists and every MCP client app is wired
+                # up (callbacks, resource permission, admin consent) BEFORE writing EasyAuth:
+                # Set-CippApiAuth reads the resource app id for allowedAudiences, so the resource must
+                # exist first. This makes Save to Azure a full deploy for both new and existing setups
+                # (an instance upgraded from the single-app model gets its resource app created and its
+                # client rewired here). Best-effort per client.
+                foreach ($McpId in $McpClientIds) {
+                    if ([string]::IsNullOrEmpty($McpId)) { continue }
+                    try {
+                        $null = Set-CIPPMCPClientApp -AppId $McpId -Headers $Request.Headers
+                    } catch {
+                        Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "MCP client $McpId could not be configured during Save to Azure: $($_.Exception.Message)" -Sev 'Warning'
+                    }
+                }
+
                 Set-CippApiAuth -RGName $RGName -FunctionAppName $FunctionAppName -TenantId $TenantId -ClientIds $ClientIds -McpClientIds $McpClientIds
 
                 if ($McpClientIds.Count -gt 0 -and $env:WEBSITE_HOSTNAME) {
@@ -357,6 +385,150 @@ function Invoke-ExecApiClient {
                 Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "Failed to remove app registration for $ClientId" -sev 'Warning'
             }
         }
+        'GetMcpAuth' {
+            # MCP status for the client-management UI: whether the dedicated CIPP-MCP resource app is
+            # provisioned, plus each MCPAllowed client app and its custom (non-default) redirect URIs.
+            $KnownClients = Get-CippMcpKnownClients
+            $McpResTable = Get-CippTable -tablename 'CippMcpResource'
+            $McpResRow = Get-CIPPAzDataTableEntity @McpResTable -Filter "PartitionKey eq 'McpResource' and RowKey eq 'McpResource'"
+            $ResourceConfigured = $false
+            $ResourceAppId = ''
+            $ResourceObjectId = ''
+            $ResourceDisplayName = ''
+            $ResourceIdentifierUris = @()
+            $PreAuthorizedClientIds = @()
+            if (-not [string]::IsNullOrWhiteSpace($McpResRow.AppId)) {
+                try {
+                    $ResApp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$($McpResRow.AppId)')?`$select=id,appId,displayName,identifierUris,api" -NoAuthCheck $true -asapp $true
+                    $ResourceConfigured = [bool]$ResApp.appId
+                    $ResourceAppId = "$($ResApp.appId)"
+                    $ResourceObjectId = "$($ResApp.id)"
+                    $ResourceDisplayName = "$($ResApp.displayName)"
+                    $ResourceIdentifierUris = @($ResApp.identifierUris)
+                    $PreAuthorizedClientIds = @(@($ResApp.api.preAuthorizedApplications) | ForEach-Object { $_.appId })
+                } catch {
+                    $ResourceConfigured = $false
+                }
+            }
+            # If the resource app isn't set up, check whether the MCP resource URL is being held by a
+            # DIFFERENT app (e.g. a client left over from the old single-app setup) - that blocks
+            # creation and the admin must delete it manually. Surface it so the page can warn.
+            $ResourceConflict = $null
+            if (-not $ResourceConfigured -and $env:WEBSITE_HOSTNAME) {
+                try {
+                    $HostUri = "https://$($env:WEBSITE_HOSTNAME)/api/ExecMcp"
+                    $Holders = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications?`$filter=identifierUris/any(u:u eq '$HostUri')&`$count=true&`$select=appId,displayName" -NoAuthCheck $true -asapp $true -ComplexFilter)
+                    $Conflict = $Holders | Where-Object { $_.appId -and $_.displayName -ne 'CIPP-MCP' } | Select-Object -First 1
+                    if ($Conflict) { $ResourceConflict = @{ AppId = "$($Conflict.appId)"; AppName = "$($Conflict.displayName)" } }
+                } catch {
+                    Write-Information "[ExecApiClient] Could not check for MCP resource URI conflict: $($_.Exception.Message)"
+                }
+                # Fall back to (or enrich with) the conflict error persisted by New-CIPPMcpResourceApp.
+                try {
+                    $ErrRow = Get-CIPPAzDataTableEntity @McpResTable -Filter "PartitionKey eq 'McpResource' and RowKey eq 'Error'"
+                    if ($ErrRow.RowKey) {
+                        if (-not $ResourceConflict) { $ResourceConflict = @{ AppId = "$($ErrRow.ConflictAppId)"; AppName = "$($ErrRow.ConflictAppName)" } }
+                        $ResourceConflict.Message = "$($ErrRow.Message)"
+                    }
+                } catch {
+                    Write-Information "[ExecApiClient] Could not read stored MCP conflict error: $($_.Exception.Message)"
+                }
+            }
+            $McpClients = @(Get-CIPPAzDataTableEntity @Table | Where-Object { ![string]::IsNullOrEmpty($_.RowKey) -and "$($_.MCPAllowed)" -eq 'True' })
+            $ClientInfo = [System.Collections.Generic.List[object]]::new()
+            foreach ($C in $McpClients) {
+                # Custom redirect URIs are surfaced per platform: 'public' (mobile & desktop, PKCE -
+                # Claude/ChatGPT/CLI) and 'web' (confidential, secret - Copilot Studio). Which bucket a
+                # URI is in decides whether the token exchange succeeds, so the UI edits them separately.
+                $CustomPublic = @()
+                $CustomWeb = @()
+                try {
+                    $CApp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$($C.RowKey)')?`$select=publicClient,web" -NoAuthCheck $true -asapp $true
+                    $CustomPublic = @(@($CApp.publicClient.redirectUris) | Where-Object { $_ -notin $KnownClients.PublicClientRedirectUris })
+                    $CustomWeb = @(@($CApp.web.redirectUris) | Where-Object { $_ -notin $KnownClients.ConfidentialRedirectUris -and $_ -notlike "*/.auth/login/aad/callback" })
+                } catch {
+                    $CustomPublic = @()
+                    $CustomWeb = @()
+                }
+                $ClientInfo.Add(@{
+                        AppId                          = "$($C.RowKey)"
+                        AppName                        = "$($C.AppName)"
+                        PublicRedirectUris             = @($CustomPublic)
+                        WebRedirectUris                = @($CustomWeb)
+                        UserImpersonationPreAuthorized = ($PreAuthorizedClientIds -contains "$($C.RowKey)")
+                    })
+            }
+            $Body = @{ Results = @{
+                    ResourceConfigured     = $ResourceConfigured
+                    ResourceAppId          = $ResourceAppId
+                    ResourceObjectId       = $ResourceObjectId
+                    ResourceDisplayName    = $ResourceDisplayName
+                    ResourceIdentifierUris = @($ResourceIdentifierUris)
+                    ResourceConflict       = $ResourceConflict
+                    DefaultRedirectUris    = @($KnownClients.PublicClientRedirectUris)
+                    DefaultWebRedirectUris = @($KnownClients.ConfidentialRedirectUris)
+                    Clients                = @($ClientInfo)
+                } }
+        }
+        'SetMcpRedirectUris' {
+            # Replace the CUSTOM redirect URIs on a specific MCP client app, per platform. The built-in
+            # provider callbacks are always kept. Body.ClientId picks the client; Body.PublicRedirectUris
+            # go under 'publicClient' (mobile & desktop / PKCE - Claude, ChatGPT, CLI) and
+            # Body.WebRedirectUris under 'web' (confidential / secret - Copilot Studio). A URI under the
+            # wrong platform fails at the token exchange, which is why they are edited separately.
+            # Back-compat: a lone Body.RedirectUris is treated as the public list.
+            $KnownClients = Get-CippMcpKnownClients
+            $TargetClientId = $Request.Body.ClientId.value ?? $Request.Body.ClientId
+            if ([string]::IsNullOrWhiteSpace($TargetClientId)) {
+                $Body = @{ Results = @{ resultText = 'No ClientId provided.'; state = 'error' } }
+                break
+            }
+            # Only ever patch an app registration that is a CIPP-managed, MCP-enabled API client -
+            # never an arbitrary appId, which would let a caller rewrite the redirect URIs of any app
+            # in the tenant via CIPP's app-only Graph rights.
+            $ManagedClient = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$TargetClientId'"
+            if (-not $ManagedClient.RowKey -or "$($ManagedClient.MCPAllowed)" -ne 'True') {
+                Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "Blocked MCP redirect URI update for $TargetClientId : not an MCP-enabled CIPP API client." -Sev 'Warning'
+                $Body = @{ Results = @{ resultText = 'That app is not an MCP-enabled CIPP API client.'; state = 'error' } }
+                break
+            }
+            $Invalid = [System.Collections.Generic.List[string]]::new()
+            $ParseUris = {
+                param($Raw)
+                $Out = [System.Collections.Generic.List[string]]::new()
+                foreach ($Uri in @($Raw)) {
+                    $U = "$Uri".Trim()
+                    if ([string]::IsNullOrWhiteSpace($U)) { continue }
+                    $Parsed = $null
+                    if ([System.Uri]::TryCreate($U, [System.UriKind]::Absolute, [ref]$Parsed)) {
+                        if ($Out -notcontains $U) { $Out.Add($U) }
+                    } else {
+                        $Invalid.Add($U)
+                    }
+                }
+                $Out
+            }
+            $CustomPublic = & $ParseUris ($Request.Body.PublicRedirectUris ?? $Request.Body.RedirectUris)
+            $CustomWeb = & $ParseUris $Request.Body.WebRedirectUris
+            if ($Invalid.Count -gt 0) {
+                $Body = @{ Results = @{ resultText = "These are not valid absolute URIs: $($Invalid -join ', ')"; state = 'error' } }
+                break
+            }
+            try {
+                $CApp = New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/applications(appId='$TargetClientId')?`$select=id,web" -NoAuthCheck $true -asapp $true
+                # Preserve the EasyAuth login callback if this app carries one; it is not ours to drop.
+                $KeepWeb = @(@($CApp.web.redirectUris) | Where-Object { $_ -like "*/.auth/login/aad/callback" })
+                $DesiredPublic = @(@($KnownClients.PublicClientRedirectUris) + @($CustomPublic) | Where-Object { $_ } | Select-Object -Unique)
+                $DesiredWeb = @(@($KnownClients.ConfidentialRedirectUris) + @($KeepWeb) + @($CustomWeb) | Where-Object { $_ } | Select-Object -Unique)
+                $PatchBody = @{ publicClient = @{ redirectUris = @($DesiredPublic) }; web = @{ redirectUris = @($DesiredWeb) } } | ConvertTo-Json -Depth 6 -Compress
+                $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/v1.0/applications/$($CApp.id)" -type PATCH -body $PatchBody -NoAuthCheck $true -asapp $true
+                Write-LogMessage -headers $Request.Headers -API 'ExecApiClient' -message "Updated MCP client $TargetClientId redirect URIs ($($CustomPublic.Count) public, $($CustomWeb.Count) web)." -Sev 'Info'
+                $Body = @{ Results = @{ resultText = 'MCP connector redirect URIs updated.'; state = 'success' } }
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                $Body = @{ Results = @{ resultText = "Failed to update redirect URIs: $($ErrorMessage.NormalizedError)"; state = 'error' } }
+            }
+        }
         default {
             $Body = @{Results = 'Invalid action' }
         }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBECRemediationDefaults.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBECRemediationDefaults.ps1
new file mode 100644
index 0000000000000..556dc7782108c
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBECRemediationDefaults.ps1	
@@ -0,0 +1,54 @@
+function Invoke-ExecBECRemediationDefaults {
+    <#
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+    .ROLE
+        CIPP.AppSettings.ReadWrite
+    .SYNOPSIS
+        Gets or sets which BEC containment actions are selected by default.
+    .DESCRIPTION
+        GET with List=true returns the containment catalog (Id, Label, Description, Impact, DefaultSelected) with the instance-wide defaults applied. POST with DefaultActions saves the action ids that start selected in the BEC containment drawer and run when ExecBECRemediate is called without Actions.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $StatusCode = [HttpStatusCode]::OK
+
+    try {
+        $Catalog = Get-CIPPBecContainmentActions
+        if ($Request.Query.List) {
+            $Results = @($Catalog | Select-Object Id, Label, Description, Impact, DefaultSelected)
+        } else {
+            # Containment action ids (ListBECRemediationActions) that start selected
+            $DefaultActions = @($Request.Body.DefaultActions | ForEach-Object { if ($_ -and $_.PSObject.Properties['value']) { $_.value } else { $_ } } | Where-Object { $_ })
+            if ($DefaultActions.Count -eq 0) {
+                $StatusCode = [HttpStatusCode]::BadRequest
+                throw 'Select at least one default action'
+            }
+            $Unknown = @($DefaultActions | Where-Object { $_ -notin $Catalog.Id })
+            if ($Unknown.Count -gt 0) {
+                $StatusCode = [HttpStatusCode]::BadRequest
+                throw "Unknown containment action(s): $($Unknown -join ', ')"
+            }
+            $Table = Get-CIPPTable -TableName Settings
+            Add-CIPPAzDataTableEntity @Table -Entity @{
+                PartitionKey   = 'BecRemediation'
+                RowKey         = 'Defaults'
+                DefaultActions = [string](ConvertTo-Json -InputObject @($DefaultActions) -Compress)
+            } -Force | Out-Null
+            Write-LogMessage -headers $Headers -API $APIName -message "Set BEC remediation defaults: $($DefaultActions -join ', ')" -Sev 'Info'
+            $Results = 'Saved the BEC remediation defaults'
+        }
+    } catch {
+        if ($StatusCode -eq [HttpStatusCode]::OK) { $StatusCode = [HttpStatusCode]::InternalServerError }
+        $Results = "Failed to set BEC remediation defaults: $($_.Exception.Message)"
+        Write-LogMessage -headers $Headers -API $APIName -message $Results -Sev 'Error'
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = @{ Results = $Results }
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1
index 886a547bcd20d..fb53d8ef32360 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecBrandingSettings.ps1	
@@ -240,6 +240,19 @@ Function Invoke-ExecBrandingSettings {
                     }
                 }
 
+                # Which of the tenant's names a report prints: alias (the name CIPP shows), name (the
+                # Microsoft 365 organisation name) or domain (the default domain).
+                if (-not $ErrorMessage -and $Request.Body.PSObject.Properties.Name -contains 'tenantLabel') {
+                    $TenantLabel = "$($Request.Body.tenantLabel)"
+                    if (@('alias', 'name', 'domain') -notcontains $TenantLabel) {
+                        $StatusCode = [HttpStatusCode]::BadRequest
+                        $ErrorMessage = 'Error: tenantLabel must be alias, name or domain.'
+                    } else {
+                        $BrandingConfig | Add-Member -MemberType NoteProperty -Name 'tenantLabel' -Value $TenantLabel -Force
+                        $Updated = $true
+                    }
+                }
+
                 # Show the branded footer text on report pages.
                 if (-not $ErrorMessage -and $Request.Body.PSObject.Properties.Name -contains 'showFooter') {
                     $BrandingConfig | Add-Member -MemberType NoteProperty -Name 'showFooter' -Value ([bool]$Request.Body.showFooter) -Force
@@ -438,6 +451,32 @@ Function Invoke-ExecBrandingSettings {
                 Write-LogMessage -API $APIName -tenant 'Global' -headers $Request.Headers -message 'Reset branding settings to defaults' -Sev 'Info'
                 'Successfully reset branding settings to defaults'
             }
+            'RenameImage' {
+                # A name for a gallery image, so it can be picked by name where the image is offered
+                # elsewhere: the report builder lists uploaded covers as Infographic page backgrounds.
+                $Kind = "$($Request.Body.kind)".ToLowerInvariant()
+                $ImageId = "$($Request.Body.id)".Trim()
+                $ImageName = "$($Request.Body.name)".Trim()
+                if (-not $ImageId) {
+                    $StatusCode = [HttpStatusCode]::BadRequest
+                    'Error: id is required.'
+                    break
+                }
+                if ($ImageName.Length -gt 64) {
+                    $StatusCode = [HttpStatusCode]::BadRequest
+                    'Error: Image name must be 64 characters or fewer.'
+                    break
+                }
+                $PartitionKey = switch ($Kind) { 'logo' { 'logo' } 'cover' { 'brandingCover' } default { $null } }
+                if (-not $PartitionKey) {
+                    $StatusCode = [HttpStatusCode]::BadRequest
+                    'Error: kind must be logo or cover.'
+                    break
+                }
+                Set-CIPPImageName -PartitionKey $PartitionKey -Id $ImageId -Name $ImageName
+                Write-LogMessage -API $APIName -tenant 'Global' -headers $Request.Headers -message "Named branding $Kind image $ImageId '$ImageName'" -Sev 'Info'
+                'Successfully named image'
+            }
             'ListPresets' {
                 Get-CIPPBrandingPreset
             }
@@ -513,6 +552,14 @@ Function Invoke-ExecBrandingSettings {
                     break
                 }
 
+                # Which of the tenant's names the preset's reports print; see the Set action.
+                $PresetTenantLabel = if ($Request.Body.tenantLabel) { "$($Request.Body.tenantLabel)" } else { 'alias' }
+                if (@('alias', 'name', 'domain') -notcontains $PresetTenantLabel) {
+                    $StatusCode = [HttpStatusCode]::BadRequest
+                    'Error: tenantLabel must be alias, name or domain.'
+                    break
+                }
+
                 $PresetId = if ($Request.Body.id) { "$($Request.Body.id)" } else { (New-Guid).Guid }
 
                 Add-CIPPAzDataTableEntity @Table -Force -Entity @{
@@ -530,6 +577,7 @@ Function Invoke-ExecBrandingSettings {
                     showPageNumbers  = [bool]$Request.Body.showPageNumbers
                     watermarkText    = $PresetWatermark
                     watermarkEnabled = [bool]$Request.Body.watermarkEnabled
+                    tenantLabel      = $PresetTenantLabel
                 } | Out-Null
 
                 Write-LogMessage -API $APIName -tenant 'Global' -headers $Request.Headers -message "Saved branding preset '$PresetName'" -Sev 'Info'
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPreviewBrandingReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPreviewBrandingReportPdf.ps1
new file mode 100644
index 0000000000000..2785ef5a5e77b
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecPreviewBrandingReportPdf.ps1	
@@ -0,0 +1,77 @@
+function Invoke-ExecPreviewBrandingReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+    .ROLE
+        CIPP.AppSettings.Read
+    .DESCRIPTION
+        Renders a sample report against a branding configuration - normally the unsaved state of the
+        branding editor - and returns it as application/pdf bytes, so a colour, logo, cover, footer or
+        watermark can be judged on every page of a real report before it is saved. Each report type has
+        a fixed sample of the data its builder needs (Config/ReportSamples/<type>.json); nothing is read
+        from a tenant.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    $ReportNames = @{
+        executive = 'Executive Summary'; reportBuilder = 'Quarterly Security Review'; shadowAI = 'Shadow AI Report'
+        bec = 'BEC Analysis Report'; becSummary = 'BEC Executive Summary'; sharing = 'Sharing Report'; permissions = 'Permissions Report'; mailFlow = 'Mail Flow Report'
+        licensing = 'Licensing Report'
+        baseline = 'Security Baseline Report'
+    }
+    # Report types that reuse another type's sample file (the BEC C-suite summary is the same
+    # investigation as the full report, rendered from the same sample, just a shorter variant).
+    $SampleAliases = @{ becSummary = 'bec' }
+
+    try {
+        # Which report to preview: executive, reportBuilder, shadowAI, bec, becSummary, sharing, permissions, mailFlow, licensing or baseline.
+        $ReportType = [string]($Request.Body.reportType ?? 'executive')
+        if (-not $ReportNames.ContainsKey($ReportType)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = "Unknown report type '$ReportType'. Use one of: $($ReportNames.Keys -join ', ')." })
+        }
+        $SampleType = if ($SampleAliases.ContainsKey($ReportType)) { $SampleAliases[$ReportType] } else { $ReportType }
+        $Sample = Get-Content (Join-Path $env:CIPPRootPath "Config\ReportSamples\$SampleType.json") -Raw | ConvertFrom-Json -AsHashtable
+        # The branding to render against, in the shape Get-CIPPBrandingSettings returns: colours (flat or
+        # under roleColours), a data-URL logo and cover or a coverStock path, footer, watermark and
+        # tenantLabel. Omitted -> the saved branding settings.
+        $Branding = $Request.Body.branding
+        # The sample tenant, named the way the branding under edit would name a real one.
+        $TenantName = switch ([string]$Branding.tenantLabel) {
+            'domain' { 'contoso.onmicrosoft.com' }
+            'name' { 'Contoso Ltd (sample data)' }
+            default { 'Contoso (sample data)' }
+        }
+        $Data = @{ TenantName = $TenantName } + $Sample
+        $Report = switch ($ReportType) {
+            'reportBuilder' { @{ Blocks = @($Sample.blocks); Variables = @{} } }
+            'shadowAI' { Build-CippShadowAIReportTree -Data $Data }
+            'bec' { Build-CippBecReportTree -UserData $Sample.userData -BecData $Sample.becData -TenantName $TenantName -Variant full }
+            'becSummary' { Build-CippBecReportTree -UserData $Sample.userData -BecData $Sample.becData -TenantName $TenantName -Variant summary }
+            'sharing' { Build-CippSharingReportTree -Data $Data }
+            'permissions' { Build-CippPermissionsReportTree -Data $Data }
+            'mailFlow' { Build-CippMailFlowReportTree -Data $Data }
+            'licensing' { Build-CippLicenseReportTree -Data $Data }
+            'baseline' { Build-CippBaselineWhatIfReportTree -Data $Data }
+            default { Build-CippExecutiveReportTree -Data $Data }
+        }
+
+        # Optional: the tenant whose %variables% (%cippurl%, custom variables) resolve in the footer and cover.
+        $TenantFilter = [string]$Request.Body.tenantFilter
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -Branding $Branding -TenantName $TenantName -TenantFilter $TenantFilter -ReportName $ReportNames[$ReportType]
+
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = 'inline; filename="Branding_Preview.pdf"' }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render the branding preview: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1
index 3974edd519321..eb7c3db9c246f 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecSAMAppPermissions.ps1	
@@ -18,8 +18,8 @@ function Invoke-ExecSAMAppPermissions {
 
                 # Persist the full applied set = manifest base ∪ submitted extras, so the AppPermissions
                 # table always reflects everything the CIPP-SAM app should have (the manifest is always
-                # applied and cannot be removed). Get-CippSamPermissions diffs the manifest against this
-                # table to decide when a Permissions repair is needed.
+                # applied and cannot be removed). The grant flow reads this table when applying
+                # permissions to the service principal, which is what the permission check diffs against.
                 $Applied = @{}
                 $AppIds = @(@($ManifestPermissions.PSObject.Properties.Name) + @($Submitted.PSObject.Properties.Name)) | Where-Object { $_ } | Sort-Object -Unique
                 foreach ($AppId in $AppIds) {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListIPWhitelist.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListIPWhitelist.ps1
index da56411a4e91b..72fed430e154d 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListIPWhitelist.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListIPWhitelist.ps1	
@@ -3,14 +3,18 @@ Function Invoke-ListIPWhitelist {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        CIPP.Core.Read
+        CIPP.IPDatabase.Read
     .DESCRIPTION
-        Lists trusted IP addresses configured in CIPP for IP-based access control.
+        Lists CIPP's IP allow/block list: every tenant or AllTenants entry with its address or CIDR range (Range) and state (Trusted, Blocked or NotTrusted).
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
     $Table = Get-CippTable -tablename 'trustedIps'
-    $body = Get-CIPPAzDataTableEntity @Table
+    $body = @(Get-CIPPAzDataTableEntity @Table | ForEach-Object {
+            # Rows from before ranges existed carry the address only in RowKey
+            if (-not $_.Range) { $_ | Add-Member -NotePropertyName 'Range' -NotePropertyValue ([string]$_.RowKey -replace '_', '/') -Force }
+            $_
+        })
 
     return [HttpResponseContext]@{
             StatusCode = [HttpStatusCode]::OK
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1
index 7a07c581cf133..5fcc43c60b51b 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecAddTenant.ps1	
@@ -107,7 +107,6 @@ function Invoke-ExecAddTenant {
                 Excluded                      = $false
                 ExcludeUser                   = ''
                 ExcludeDate                   = ''
-                GraphErrorCount               = 0
                 LastGraphError                = ''
                 RequiresRefresh               = $false
                 LastRefresh                   = (Get-Date).ToUniversalTime()
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1
index 0e6fe7123457e..feaebb1d7e894 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1	
@@ -48,6 +48,18 @@ function Invoke-ExecUpdateRefreshToken {
             }
         }
 
+        # Cached access tokens were minted from the old refresh token; drop them so the new one takes effect now.
+        # The partner token backs every GDAP tenant, a direct tenant's token only itself (cached under GUID or domain).
+        if ($IsPartnerTenant) {
+            $null = Clear-CippTokenCache
+        } else {
+            $null = Clear-CippTokenCache -TenantFilter $Request.body.tenantId
+            $TenantsTable = Get-CippTable -tablename 'Tenants'
+            $SafeTenantId = ConvertTo-CIPPODataFilterValue -Value $Request.body.tenantId -Type String
+            $Domain = (Get-CIPPAzDataTableEntity @TenantsTable -Filter "PartitionKey eq 'Tenants' and customerId eq '$SafeTenantId'" -Property defaultDomainName).defaultDomainName
+            if ($Domain) { $null = Clear-CippTokenCache -TenantFilter $Domain }
+        }
+
         if ($IsPartnerTenant) {
             try {
                 $Queue = New-CippQueueEntry -Name 'Update Permissions - Partner Tenant' -TotalTasks 1
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ExecGetMailFlowReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ExecGetMailFlowReportPdf.ps1
new file mode 100644
index 0000000000000..b94e26a6ee75c
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ExecGetMailFlowReportPdf.ps1	
@@ -0,0 +1,74 @@
+function Invoke-ExecGetMailFlowReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Exchange.Mailbox.Read
+    .DESCRIPTION
+        Server-renders the Exchange mail flow report as application/pdf bytes. Reads the same three Exchange
+        reports the Mail Flow page uses (Get-MailFlowStatusReport plus the TopMailSender and
+        TopSpamRecipient traffic summaries), aggregates the daily disposition rows the way the page does,
+        and composes them through the shared CIPPSharp kit (Build-CippMailFlowReportTree) - the server-side
+        replacement for the client react-pdf MailFlowReportButton.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A tenantFilter is required' })
+        }
+        # Reporting window in days (1-90).
+        $Days = [Math]::Min([Math]::Max([int]($Request.Query.days ?? 14), 1), 90)
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter
+
+        $Window = @{
+            StartDate = (Get-Date).AddDays(-$Days).ToUniversalTime().ToString('s')
+            EndDate   = (Get-Date).ToUniversalTime().ToString('s')
+        }
+        $FlowRows = @(New-ExoRequest -TenantId $TenantFilter -Cmdlet 'Get-MailFlowStatusReport' -CmdParams $Window)
+        # For the Top* traffic summary categories C1 is the address and C2 the message count.
+        function Get-TopList($Category) {
+            @(New-ExoRequest -TenantId $TenantFilter -Cmdlet 'Get-MailTrafficSummaryReport' -CmdParams ($Window + @{ Category = $Category }) |
+                    ForEach-Object { @{ name = $_.C1; count = $_.C2 } })
+        }
+
+        # Message counts summed per event type, per direction and per day (the page's useMemo aggregation).
+        $Totals = @{}
+        foreach ($g in ($FlowRows | Group-Object EventType)) { $Totals[$g.Name] = ($g.Group | Measure-Object -Property MessageCount -Sum).Sum }
+        $DirectionTotals = @{}
+        foreach ($g in ($FlowRows | Group-Object Direction)) { $DirectionTotals[$g.Name] = ($g.Group | Measure-Object -Property MessageCount -Sum).Sum }
+        $Daily = @($FlowRows | Group-Object { ([datetime]$_.Date).ToString('yyyy-MM-dd') } | Sort-Object Name | ForEach-Object {
+                $Day = @{ date = $_.Name }
+                foreach ($t in ($_.Group | Group-Object EventType)) { $Day[$t.Name] = ($t.Group | Measure-Object -Property MessageCount -Sum).Sum }
+                $Day
+            })
+
+        $Report = Build-CippMailFlowReportTree -Data @{
+            TenantName        = $TenantName
+            days              = $Days
+            totals            = $Totals
+            directionTotals   = $DirectionTotals
+            daily             = $Daily
+            topSenders        = Get-TopList 'TopMailSender'
+            topSpamRecipients = Get-TopList 'TopSpamRecipient'
+        }
+
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName $TenantName -TenantFilter $TenantFilter -ReportName 'Mail Flow Report'
+        $FileName = ("Mail_Flow_Report_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render Mail Flow report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilterTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilterTemplate.ps1
index 8069797a7b5c2..e6ca15c32f50a 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilterTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-AddSpamFilterTemplate.ps1	
@@ -23,7 +23,7 @@ Function Invoke-AddSpamFilterTemplate {
                 $_ | Select-Object -Property $NonEmptyProperties
             }
         }
-        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, @{n = 'comments'; e = { $_.comments } }, * | ConvertTo-Json -Depth 10)
+        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, @{n = 'comments'; e = { $_.comments } }, * -ExcludeProperty Name, Comments | ConvertTo-Json -Depth 10)
         $Table = Get-CippTable -tablename 'templates'
         $Table.Force = $true
         Add-CIPPAzDataTableEntity @Table -Entity @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1
index d10a3436cb778..728846b4e4827 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessage.ps1	
@@ -15,6 +15,8 @@ function Invoke-ListMailQuarantineMessage {
 
     try {
         $GraphRequest = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Export-QuarantineMessage' -cmdParams @{ 'Identity' = $Identity }
+        # This is one of the few places CIPP hands message content to an operator; record who pulled what.
+        Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Exported the raw EML of quarantined message $Identity" -Sev 'Info'
         $EmlBase64 = $GraphRequest.Eml
         $EmlContent = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($EmlBase64))
         $Body = @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageDetails.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageDetails.ps1
index 68673232378fe..44a41c5ec173a 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageDetails.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageDetails.ps1	
@@ -35,6 +35,8 @@ function Invoke-ListMailQuarantineMessageDetails {
     # used to investigate messages the operator was never authorized to see.
     try {
         $QuarantineMessage = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessage' -cmdParams @{ Identity = $Identity }
+        # The fallback path below exports and parses the EML; record who looked at this message either way.
+        Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Viewed the analysis details of quarantined message $Identity" -Sev 'Info'
     } catch {
         return ([HttpResponseContext]@{
                 StatusCode = [HttpStatusCode]::NotFound
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1
index 2734bfbf58946..0abdc752cfc01 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantineMessageHeader.ps1	
@@ -15,6 +15,8 @@ function Invoke-ListMailQuarantineMessageHeader {
 
     try {
         $GraphRequest = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-QuarantineMessageHeader' -cmdParams @{ 'Identity' = $Identity }
+        # Headers are message content as far as the customer is concerned; record who viewed them.
+        Write-LogMessage -headers $Request.Headers -API $Request.Params.CIPPEndpoint -tenant $TenantFilter -message "Viewed the headers of quarantined message $Identity" -Sev 'Info'
         $Body = @{
             'Identity' = $Identity
             'Header'   = [string]($GraphRequest.Header ?? $GraphRequest)
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecIRMConfiguration.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecIRMConfiguration.ps1
index 20e62512b293e..bad64206b3ba9 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecIRMConfiguration.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecIRMConfiguration.ps1	
@@ -5,7 +5,7 @@ function Invoke-ExecIRMConfiguration {
     .ROLE
         Exchange.Mailbox.ReadWrite
     .DESCRIPTION
-        Enables or disables Microsoft Purview Message Encryption for a tenant by setting AzureRMSLicensingEnabled and the Outlook Encrypt button by setting SimplifiedClientAccessEnabled, or runs Test-IRMConfiguration to verify that encryption and decryption work end to end.
+        Updates the Microsoft Purview Message Encryption configuration for a tenant (AzureRMSLicensingEnabled, SimplifiedClientAccessEnabled, EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled, TransportDecryptionSetting; only the settings present in the body are changed), or runs Test-IRMConfiguration to verify that encryption and decryption work end to end.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -30,19 +30,22 @@ function Invoke-ExecIRMConfiguration {
                 Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message "Tested the message encryption configuration for $SenderAddress" -Sev Info
             }
             'Set' {
-                $cmdParams = @{ AzureRMSLicensingEnabled = [System.Convert]::ToBoolean($Request.Body.AzureRMSLicensingEnabled) }
-                # Only touch the Encrypt button setting when the caller sent it, so an API client
-                # that posts just AzureRMSLicensingEnabled does not silently disable it.
-                if ($null -ne $Request.Body.SimplifiedClientAccessEnabled) {
-                    $cmdParams.SimplifiedClientAccessEnabled = [System.Convert]::ToBoolean($Request.Body.SimplifiedClientAccessEnabled)
+                # Only touch the settings the caller sent, so an API client that posts just
+                # AzureRMSLicensingEnabled does not silently flip the others. Whitelisted: the body is
+                # caller-controlled and goes straight to Set-IRMConfiguration.
+                $cmdParams = @{}
+                foreach ($Key in 'AzureRMSLicensingEnabled', 'SimplifiedClientAccessEnabled', 'EnablePdfEncryption', 'DecryptAttachmentForEncryptOnly', 'SimplifiedClientAccessDoNotForwardDisabled', 'SimplifiedClientAccessEncryptOnlyDisabled') {
+                    if ($null -ne $Request.Body.$Key) { $cmdParams[$Key] = [System.Convert]::ToBoolean($Request.Body.$Key) }
                 }
-                $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-IRMConfiguration' -cmdParams $cmdParams
-                $ResultParts = [System.Collections.Generic.List[string]]::new()
-                $ResultParts.Add("$(if ($cmdParams.AzureRMSLicensingEnabled) { 'enabled' } else { 'disabled' }) Microsoft Purview Message Encryption")
-                if ($cmdParams.ContainsKey('SimplifiedClientAccessEnabled')) {
-                    $ResultParts.Add("$(if ($cmdParams.SimplifiedClientAccessEnabled) { 'enabled' } else { 'disabled' }) the Outlook Encrypt button")
+                if ($Request.Body.TransportDecryptionSetting -in 'Disabled', 'Optional', 'Mandatory') {
+                    $cmdParams.TransportDecryptionSetting = $Request.Body.TransportDecryptionSetting
+                }
+                if ($cmdParams.Count -eq 0) {
+                    throw 'No message encryption settings were provided.'
                 }
-                $Results = "Successfully $($ResultParts -join ' and ')."
+                $null = New-ExoRequest -tenantid $TenantFilter -cmdlet 'Set-IRMConfiguration' -cmdParams $cmdParams
+                $Applied = ($cmdParams.GetEnumerator() | Sort-Object Name | ForEach-Object { "$($_.Name) = $($_.Value)" }) -join ', '
+                $Results = "Successfully updated the message encryption configuration: $Applied."
                 Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -Sev Info
             }
             default {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListIRMConfiguration.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListIRMConfiguration.ps1
index a1ba70761589c..a69ded6ddca16 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListIRMConfiguration.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListIRMConfiguration.ps1	
@@ -23,15 +23,19 @@ function Invoke-ListIRMConfiguration {
         $AdRmsDetected = @($LicensingLocation | Where-Object { $_ -notmatch 'aadrm\.|azurerms|\.microsoft\.(com|us)' }).Count -gt 0
 
         $Results = [PSCustomObject]@{
-            AzureRMSLicensingEnabled       = $IRMConfig.AzureRMSLicensingEnabled
-            InternalLicensingEnabled       = $IRMConfig.InternalLicensingEnabled
-            ExternalLicensingEnabled       = $IRMConfig.ExternalLicensingEnabled
-            SimplifiedClientAccessEnabled  = $IRMConfig.SimplifiedClientAccessEnabled
-            TransportDecryptionSetting     = $IRMConfig.TransportDecryptionSetting
-            JournalReportDecryptionEnabled = $IRMConfig.JournalReportDecryptionEnabled
-            LicensingLocation              = $LicensingLocation
-            MessageEncryptionEnabled       = [bool]$IRMConfig.AzureRMSLicensingEnabled
-            AdRmsDetected                  = $AdRmsDetected
+            AzureRMSLicensingEnabled                   = $IRMConfig.AzureRMSLicensingEnabled
+            InternalLicensingEnabled                   = $IRMConfig.InternalLicensingEnabled
+            ExternalLicensingEnabled                   = $IRMConfig.ExternalLicensingEnabled
+            SimplifiedClientAccessEnabled              = $IRMConfig.SimplifiedClientAccessEnabled
+            SimplifiedClientAccessDoNotForwardDisabled = $IRMConfig.SimplifiedClientAccessDoNotForwardDisabled
+            SimplifiedClientAccessEncryptOnlyDisabled  = $IRMConfig.SimplifiedClientAccessEncryptOnlyDisabled
+            EnablePdfEncryption                        = $IRMConfig.EnablePdfEncryption
+            DecryptAttachmentForEncryptOnly            = $IRMConfig.DecryptAttachmentForEncryptOnly
+            TransportDecryptionSetting                 = $IRMConfig.TransportDecryptionSetting
+            JournalReportDecryptionEnabled             = $IRMConfig.JournalReportDecryptionEnabled
+            LicensingLocation                          = $LicensingLocation
+            MessageEncryptionEnabled                   = [bool]$IRMConfig.AzureRMSLicensingEnabled
+            AdRmsDetected                              = $AdRmsDetected
         }
         $StatusCode = [HttpStatusCode]::OK
     } catch {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilterTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilterTemplate.ps1
index 729e7e9f6da4c..4780d39957dca 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilterTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddConnectionFilterTemplate.ps1	
@@ -26,7 +26,7 @@ function Invoke-AddConnectionFilterTemplate {
                 $_ | Select-Object -Property $NonEmptyProperties
             }
         }
-        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, @{n = 'comments'; e = { $_.comments } }, * | ConvertTo-Json -Depth 10)
+        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, @{n = 'comments'; e = { $_.comments } }, * -ExcludeProperty Name, Comments | ConvertTo-Json -Depth 10)
         $Table = Get-CippTable -tablename 'templates'
         $Table.Force = $true
         Add-CIPPAzDataTableEntity @Table -Entity @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnectorTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnectorTemplate.ps1
index 67c3d5e582b5d..5e308b98e8cc4 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnectorTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddExConnectorTemplate.ps1	
@@ -34,7 +34,7 @@ Function Invoke-AddExConnectorTemplate {
             $NonEmptyProperties = $_.psobject.Properties | Where-Object { $null -ne $_.Value } | Select-Object -ExpandProperty Name
             $_ | Select-Object -Property $NonEmptyProperties
         }
-        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, * | ConvertTo-Json -Depth 10)
+        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, * -ExcludeProperty Name | ConvertTo-Json -Depth 10)
         $Table = Get-CippTable -tablename 'templates'
         $Table.Force = $true
         Add-CIPPAzDataTableEntity @Table -Entity @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportTemplate.ps1
index df00724a6385d..f1e9c165b1ef5 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Transport/Invoke-AddTransportTemplate.ps1	
@@ -29,7 +29,7 @@ Function Invoke-AddTransportTemplate {
                     $_ | Select-Object -Property $NonEmptyProperties
                 }
         }
-        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, @{n = 'comments'; e = { $_.comments } }, * | ConvertTo-Json -Depth 10)
+        $JSON = ($JSON | Select-Object @{n = 'name'; e = { $_.name } }, @{n = 'comments'; e = { $_.comments } }, * -ExcludeProperty Name, Comments | ConvertTo-Json -Depth 10)
         $Table = Get-CippTable -tablename 'templates'
         $Table.Force = $true
         Add-CIPPAzDataTableEntity @Table -Entity @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1
index 4209c24c648a5..6a37f31f452bb 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1	
@@ -36,6 +36,10 @@ function Invoke-AddChocoApp {
     $intuneBody = Get-Content -LiteralPath $AppTemplatePath -Raw | ConvertFrom-Json
     $AssignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
     $ExcludeGroup = $Request.Body.excludeGroup
+    # Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still
+    # carry the display names for logging and as a fallback if the ids are ever dropped.
+    $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ })
+    $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ })
     $intuneBody.description = $ChocoApp.description
     $intuneBody.displayName = $ChocoApp.ApplicationName
     $intuneBody.installExperience.runAsAccount = if ($ChocoApp.InstallAsSystem) { 'system' } else { 'user' }
@@ -70,6 +74,8 @@ function Invoke-AddChocoApp {
                 ApplicationName    = $ChocoApp.ApplicationName
                 assignTo           = $AssignTo
                 excludeGroup       = $ExcludeGroup
+                GroupIds           = $GroupIds
+                ExcludeGroupIds    = $ExcludeGroupIds
                 InstallationIntent = $Request.Body.InstallationIntent
                 IntuneBody         = $TenantIntuneBody
             } | ConvertTo-Json -Depth 15
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1
index da7116e13f553..0a5c5025052fb 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddEdgeApp.ps1	
@@ -14,6 +14,10 @@ function Invoke-AddEdgeApp {
     if ('AllTenants' -in $Tenants) { $Tenants = (Get-Tenants).defaultDomainName }
     $AssignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
     $ExcludeGroup = $Request.Body.excludeGroup
+    # Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still
+    # carry the display names for logging and as a fallback if the ids are ever dropped.
+    $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ })
+    $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ })
 
     $Results = foreach ($Tenant in $Tenants) {
         try {
@@ -31,7 +35,18 @@ function Invoke-AddEdgeApp {
             }
             Write-LogMessage -headers $Headers -API $APIName -tenant $($Tenant) -message "Added Edge app to $($Tenant)" -Sev 'Info'
             if ($AssignTo -and $AssignTo -ne 'On') {
-                Set-CIPPAssignedApplication -ApplicationId $EdgeAppID.id -TenantFilter $Tenant -Intent 'Required' -GroupName $AssignTo -ExcludeGroup $ExcludeGroup -APIName $APIName -Headers $Headers
+                $AssignParams = @{
+                    ApplicationId = $EdgeAppID.id
+                    TenantFilter  = $Tenant
+                    Intent        = 'Required'
+                    GroupName     = $AssignTo
+                    ExcludeGroup  = $ExcludeGroup
+                    APIName       = $APIName
+                    Headers       = $Headers
+                }
+                if ($GroupIds.Count -gt 0) { $AssignParams.GroupIds = $GroupIds }
+                if ($ExcludeGroupIds.Count -gt 0) { $AssignParams.ExcludeGroupIds = $ExcludeGroupIds }
+                Set-CIPPAssignedApplication @AssignParams
                 Write-LogMessage -headers $Headers -API $APIName -tenant $($Tenant) -message "Assigned Edge to $AssignTo" -Sev 'Info'
             }
             "Successfully added Edge App for $($Tenant)"
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1
index bc84d86991c7a..67c76e0609af7 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1	
@@ -27,6 +27,10 @@ function Invoke-AddMSPApp {
 
     $AssignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
     $ExcludeGroup = $Request.Body.excludeGroup
+    # Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still
+    # carry the display names for logging and as a fallback if the ids are ever dropped.
+    $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ })
+    $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ })
     $AppTemplatePath = Join-Path $env:CIPPRootPath "AddMSPApp\$RmmName.app.json"
     $AppTemplateJson = Get-Content -LiteralPath $AppTemplatePath -Raw
 
@@ -55,6 +59,8 @@ function Invoke-AddMSPApp {
                 ApplicationName = $RMMApp.DisplayName
                 assignTo        = $AssignTo
                 excludeGroup    = $ExcludeGroup
+                GroupIds        = $GroupIds
+                ExcludeGroupIds = $ExcludeGroupIds
                 IntuneBody      = $intuneBody
                 type            = 'MSPApp'
                 MSPAppName      = $RMMApp.RMMName.value
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1
index 67fd49e6dd1b7..958819fa4dcad 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1	
@@ -15,6 +15,10 @@ function Invoke-AddOfficeApp {
     if ('AllTenants' -in $Tenants) { $Tenants = (Get-Tenants).defaultDomainName }
     $AssignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
     $ExcludeGroup = $Request.Body.excludeGroup
+    # Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still
+    # carry the display names for logging and as a fallback if the ids are ever dropped.
+    $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ })
+    $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ })
 
     $Results = foreach ($Tenant in $Tenants) {
         try {
@@ -34,7 +38,18 @@ function Invoke-AddOfficeApp {
             }
             Write-LogMessage -headers $Headers -API $APIName -tenant $($Tenant) -message "Added Office profile to $($Tenant)" -Sev 'Info'
             if ($AssignTo -and $AssignTo -ne 'On') {
-                Set-CIPPAssignedApplication -ApplicationId $OfficeAppID.id -TenantFilter $Tenant -Intent 'Required' -GroupName $AssignTo -ExcludeGroup $ExcludeGroup -APIName $APIName -Headers $Headers
+                $AssignParams = @{
+                    ApplicationId = $OfficeAppID.id
+                    TenantFilter  = $Tenant
+                    Intent        = 'Required'
+                    GroupName     = $AssignTo
+                    ExcludeGroup  = $ExcludeGroup
+                    APIName       = $APIName
+                    Headers       = $Headers
+                }
+                if ($GroupIds.Count -gt 0) { $AssignParams.GroupIds = $GroupIds }
+                if ($ExcludeGroupIds.Count -gt 0) { $AssignParams.ExcludeGroupIds = $ExcludeGroupIds }
+                Set-CIPPAssignedApplication @AssignParams
                 Write-LogMessage -headers $Headers -API $APIName -tenant $($Tenant) -message "Assigned Office to $AssignTo" -Sev 'Info'
             }
             "Successfully added Office App for $($Tenant)"
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1
index 04950b61c5f78..cb8aac66c1a6a 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddStoreApp.ps1	
@@ -14,6 +14,11 @@ function Invoke-AddStoreApp {
 
     $WinGetApp = $Request.Body
     $assignTo = $Request.Body.AssignTo -eq 'customGroup' ? $Request.Body.CustomGroup : $Request.Body.AssignTo
+    $ExcludeGroup = $Request.Body.excludeGroup
+    # Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still
+    # carry the display names for logging and as a fallback if the ids are ever dropped.
+    $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ })
+    $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ })
 
     # winGetAppInstallExperience only supports runAsAccount (no restart behavior). Default to
     # system when the toggle is absent so older callers keep the previous behavior.
@@ -36,6 +41,9 @@ function Invoke-AddStoreApp {
                 tenant             = $Tenant
                 ApplicationName    = $WinGetApp.ApplicationName
                 assignTo           = $assignTo
+                excludeGroup       = $ExcludeGroup
+                GroupIds           = $GroupIds
+                ExcludeGroupIds    = $ExcludeGroupIds
                 InstallationIntent = $Request.Body.InstallationIntent
                 type               = 'WinGet'
                 IntuneBody         = $WinGetData
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1
index 3ee3383f71df5..0ab6ebf41840f 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddWin32ScriptApp.ps1	
@@ -13,6 +13,11 @@ function Invoke-AddWin32ScriptApp {
 
     $Win32ScriptApp = $Request.Body
     $AssignTo = $Win32ScriptApp.AssignTo -eq 'customGroup' ? $Win32ScriptApp.CustomGroup : $Win32ScriptApp.AssignTo
+    $ExcludeGroup = $Win32ScriptApp.excludeGroup
+    # Group ids from the deploy drawer's single-tenant picker. CustomGroup/excludeGroup still
+    # carry the display names for logging and as a fallback if the ids are ever dropped.
+    $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ })
+    $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ })
 
     # Validate required fields
     if ([string]::IsNullOrEmpty($Win32ScriptApp.ApplicationName) -and [string]::IsNullOrEmpty($Win32ScriptApp.applicationName)) {
@@ -41,6 +46,9 @@ function Invoke-AddWin32ScriptApp {
                 tenant                = $Tenant
                 Applicationname       = $AppName
                 assignTo              = $AssignTo
+                excludeGroup          = $ExcludeGroup
+                GroupIds              = $GroupIds
+                ExcludeGroupIds       = $ExcludeGroupIds
                 InstallationIntent    = $Win32ScriptApp.InstallationIntent
                 type                  = 'Win32ScriptApp'
                 description           = $Win32ScriptApp.description
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-AddAPDevice.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-AddAPDevice.ps1
index ee7a42396de3a..3c56eda672ddc 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-AddAPDevice.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-AddAPDevice.ps1	
@@ -15,82 +15,91 @@ function Invoke-AddAPDevice {
 
     $TenantFilter = (Get-Tenants -TenantFilter $Request.Body.TenantFilter.value).customerId
     $GroupName = if ($Request.Body.Groupname) { $Request.Body.Groupname } else { (New-Guid).GUID }
-    Write-Host $GroupName
+    $Scope = 'https://api.partnercenter.microsoft.com/user_impersonation'
 
-    $rawDevices = $Request.Body.autopilotData
-    $Devices = ConvertTo-Json @($rawDevices)
-    $Result = try {
-        $CurrentStatus = (New-GraphGetRequest -uri "https://api.partnercenter.microsoft.com/v1/customers/$TenantFilter/DeviceBatches" -scope 'https://api.partnercenter.microsoft.com/user_impersonation')
-        if ($GroupName -in $CurrentStatus.items.id) {
-            Write-Host 'Gonna do an update!'
-            $Body = $Request.Body.autopilotData | ForEach-Object {
-                $Device = $_
-                [pscustomobject]@{
-                    deviceBatchId       = $GroupName
-                    hardwareHash        = $Device.hardwareHash
-                    serialNumber        = $Device.SerialNumber
-                    productKey          = $Device.productKey
-                    oemManufacturerName = $Device.oemManufacturerName
-                    modelName           = $Device.modelName
-                }
+    $rawDevices = @($Request.Body.autopilotData)
+    # One device shape for both the create and the append call. Empty cells from the CSV/manual
+    # import are dropped so Partner Center only sees the identifiers that were actually supplied.
+    $Devices = @($rawDevices | ForEach-Object {
+            $Device = [ordered]@{}
+            foreach ($Property in $_.PSObject.Properties) {
+                if (-not [string]::IsNullOrWhiteSpace($Property.Value)) { $Device[$Property.Name] = $Property.Value }
             }
-            $Body = ConvertTo-Json -Depth 10 -Compress -InputObject @($Body)
-            Write-Host $Body
-            $GraphRequest = (New-GraphPOSTRequest -returnHeaders $true -uri "https://api.partnercenter.microsoft.com/v1/customers/$TenantFilter/deviceBatches/$GroupName/devices" -body $Body -scope 'https://api.partnercenter.microsoft.com/user_impersonation')
+            [pscustomobject]$Device
+        })
+
+    $Result = try {
+        $CurrentStatus = (New-GraphGetRequest -uri "https://api.partnercenter.microsoft.com/v1/customers/$TenantFilter/DeviceBatches" -scope $Scope)
+        # Batch ids are exact strings in Partner Center, so reuse its spelling rather than the user's.
+        $ExistingBatch = @($CurrentStatus.items) | Where-Object { $_.id -eq $GroupName } | Select-Object -First 1
+        if ($ExistingBatch) {
+            $GroupName = $ExistingBatch.id
+            Write-Information "Appending $($Devices.Count) device(s) to existing Partner Center batch '$GroupName'"
+            $Body = ConvertTo-Json -InputObject $Devices -Depth 10 -Compress
+            $GraphRequest = (New-GraphPOSTRequest -returnHeaders $true -uri "https://api.partnercenter.microsoft.com/v1/customers/$TenantFilter/deviceBatches/$([uri]::EscapeDataString($GroupName))/devices" -body $Body -scope $Scope)
+            $LogText = "Added $($Devices.Count) Autopilot device(s) to existing batch $GroupName"
         } else {
-            $Body = '{"batchId":"' + $($GroupName) + '","devices":' + $Devices + '}'
-            $GraphRequest = (New-GraphPOSTRequest -returnHeaders $true -uri "https://api.partnercenter.microsoft.com/v1/customers/$TenantFilter/DeviceBatches" -body $Body -scope 'https://api.partnercenter.microsoft.com/user_impersonation')
+            Write-Information "Creating Partner Center batch '$GroupName' with $($Devices.Count) device(s)"
+            $Body = @{ batchId = $GroupName; devices = $Devices } | ConvertTo-Json -Depth 10 -Compress
+            $GraphRequest = (New-GraphPOSTRequest -returnHeaders $true -uri "https://api.partnercenter.microsoft.com/v1/customers/$TenantFilter/DeviceBatches" -body $Body -scope $Scope)
+            $LogText = "Created Autopilot batch $GroupName with $($Devices.Count) device(s)"
         }
+
+        # Appending to an existing batch has to dedupe against it and is slower than a fresh batch,
+        # so give Partner Center up to ~30s before handing the wait back to the user.
         $Amount = 0
         do {
-            Write-Host "Checking status of import job for $GroupName"
             $Amount++
-            Start-Sleep 1
-            $NewStatus = New-GraphGetRequest -uri "https://api.partnercenter.microsoft.com/v1/$($GraphRequest.Location)" -scope 'https://api.partnercenter.microsoft.com/user_impersonation'
-        } until ($NewStatus.status -in @('finished', 'finished_with_errors') -or $Amount -eq 4)
-        if ($NewStatus.status -notin @('finished', 'finished_with_errors')) { throw 'Could not retrieve status of import - This job might still be running. Check the autopilot device list in 10 minutes for the latest status.' }
-        Write-LogMessage -headers $Headers -API $APIName -tenant $($Request.body.TenantFilter.value) -message "Created Autopilot devices group. Group ID is $GroupName" -Sev 'Info'
+            Start-Sleep 2
+            $NewStatus = New-GraphGetRequest -uri "https://api.partnercenter.microsoft.com/v1/$($GraphRequest.Location)" -scope $Scope
+        } until ($NewStatus.status -in @('finished', 'finished_with_errors') -or $Amount -ge 15)
 
-        # DEBUG: dump the raw status so we can inspect what Partner Center returns per device.
-        Write-Host "RAW NewStatus: $($NewStatus | ConvertTo-Json -Depth 10)"
+        if ($NewStatus.status -notin @('finished', 'finished_with_errors')) {
+            $Text = "Import job for batch '$GroupName' is still processing (status: $($NewStatus.status)). Partner Center usually finishes within 10 minutes; check the Autopilot Devices list rather than resubmitting."
+            Write-LogMessage -headers $Headers -API $APIName -tenant $($Request.Body.TenantFilter.value) -message $Text -Sev 'Warning'
+            $StatusCode = [HttpStatusCode]::OK
+            [PSCustomObject]@{ resultText = $Text; state = 'warning' }
+        } else {
+            Write-LogMessage -headers $Headers -API $APIName -tenant $($Request.body.TenantFilter.value) -message $LogText -Sev 'Info'
 
-        # Build one result per device (DeviceUploadDetails) so the frontend renders a
-        # single bar each, instead of flattening raw device fields into many stray bars.
-        $Index = 0
-        $DeviceResults = foreach ($Device in @($NewStatus.devicesStatus)) {
-            $Index++
-            # Hash-only uploads return no serial/productKey/deviceId; fall back to a number.
-            $DeviceId = $Device.serialNumber ?? $Device.productKey ?? $Device.deviceId
-            $Label = $DeviceId ?? "Device $Index"
-            $IsError = $Device.status -match 'error'
-            $Text = "$($Label): $($Device.status)"
-            if ($IsError -and $Device.errorDescription) {
-                $Text += " - $($Device.errorCode) $($Device.errorDescription)"
+            # Build one result per device (DeviceUploadDetails) so the frontend renders a
+            # single bar each, instead of flattening raw device fields into many stray bars.
+            $Index = 0
+            $DeviceResults = foreach ($Device in @($NewStatus.devicesStatus)) {
+                $Index++
+                # Hash-only uploads return no serial/productKey/deviceId; fall back to a number.
+                $DeviceId = $Device.serialNumber ?? $Device.productKey ?? $Device.deviceId
+                $Label = $DeviceId ?? "Device $Index"
+                $IsError = $Device.status -match 'error'
+                $Text = "$($Label): $($Device.status)"
+                if ($IsError -and $Device.errorDescription) {
+                    $Text += " - $($Device.errorCode) $($Device.errorDescription)"
+                }
+                # Log each device with the input data that was submitted for it (matched by position).
+                $InputDevice = $rawDevices[$Index - 1]
+                Write-LogMessage -headers $Headers -API $APIName -tenant $($Request.Body.TenantFilter.value) -message "Autopilot import - $Text" -Sev $(if ($IsError) { 'Error' } else { 'Info' }) -LogData $InputDevice
+                [PSCustomObject]@{
+                    resultText = $Text
+                    state      = if ($IsError) { 'error' } else { 'success' }
+                    copyField  = $DeviceId
+                    details    = $Device
+                }
             }
-            # Log each device with the input data that was submitted for it (matched by position).
-            $InputDevice = @($rawDevices)[$Index - 1]
-            Write-LogMessage -headers $Headers -API $APIName -tenant $($Request.Body.TenantFilter.value) -message "Autopilot import - $Text" -Sev $(if ($IsError) { 'Error' } else { 'Info' }) -LogData $InputDevice
-            [PSCustomObject]@{
-                resultText = $Text
-                state      = if ($IsError) { 'error' } else { 'success' }
-                copyField  = $DeviceId
-                details    = $Device
+            if (-not $DeviceResults) {
+                $DeviceResults = [PSCustomObject]@{ resultText = "Import job '$($NewStatus.status)' for batch $GroupName"; state = 'success' }
             }
+            $StatusCode = [HttpStatusCode]::OK
+            # Emit as the try block's value so the outer `$Result = try {...}` captures it.
+            $DeviceResults
         }
-        if (-not $DeviceResults) {
-            $DeviceResults = [PSCustomObject]@{ resultText = "Import job '$($NewStatus.status)' for group $GroupName"; state = 'success' }
-        }
-        $StatusCode = [HttpStatusCode]::OK
-        # Emit as the try block's value so the outer `$Result = try {...}` captures it.
-        $DeviceResults
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         $StatusCode = [HttpStatusCode]::InternalServerError
         [PSCustomObject]@{
-            resultText = "$($Request.Body.TenantFilter.value): Failed to create autopilot devices. $($ErrorMessage.NormalizedError)"
+            resultText = "$($Request.Body.TenantFilter.value): Failed to add autopilot devices to batch '$GroupName'. $($ErrorMessage.NormalizedError)"
             state      = 'error'
         }
-        Write-LogMessage -headers $Headers -API $APIName -tenant $($Request.Body.TenantFilter.value) -message "Failed to create autopilot devices. $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        Write-LogMessage -headers $Headers -API $APIName -tenant $($Request.Body.TenantFilter.value) -message "Failed to add autopilot devices to batch '$GroupName'. $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
     }
 
     return ([HttpResponseContext]@{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1
index aad4740a7111a..f4ed9b6e08c38 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-ListAutopilotconfig.ps1	
@@ -13,7 +13,29 @@ function Invoke-ListAutopilotconfig {
     $TenantFilter = $Request.Query.TenantFilter
     try {
         if ($Request.Query.type -eq 'ApProfile') {
-            $GraphRequest = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeploymentProfiles?`$expand=assignments" -tenantid $TenantFilter
+            # Graph's groupAssignmentTarget carries only groupId, so fetch group names in the same batch
+            # and resolve them into PolicyAssignment like the MEM policy list does.
+            # ponytail: $top=999 group cap, same ceiling ListIntunePolicy accepts; page if a tenant exceeds it
+            $BulkRequests = @(
+                [PSCustomObject]@{ id = 'Profiles'; method = 'GET'; url = '/deviceManagement/windowsAutopilotDeploymentProfiles?$expand=assignments' }
+                [PSCustomObject]@{ id = 'Groups'; method = 'GET'; url = '/groups?$top=999&$select=id,displayName' }
+            )
+            $BulkResults = New-GraphBulkRequest -Requests $BulkRequests -tenantid $TenantFilter
+
+            $GroupLookup = @{}
+            $GroupResult = $BulkResults | Where-Object { $_.id -eq 'Groups' } | Select-Object -First 1
+            foreach ($Group in @($GroupResult.body.value)) {
+                if ($Group.id) { $GroupLookup[$Group.id] = $Group.displayName }
+            }
+
+            $ProfileResult = $BulkResults | Where-Object { $_.id -eq 'Profiles' } | Select-Object -First 1
+            if ($null -ne $ProfileResult.status -and ($ProfileResult.status -lt 200 -or $ProfileResult.status -ge 300)) {
+                throw ($ProfileResult.body.error.message ?? "Graph returned status $($ProfileResult.status) listing Autopilot profiles")
+            }
+            $GraphRequest = foreach ($Profile in @($ProfileResult.body.value)) {
+                if ($null -eq $Profile) { continue }
+                ConvertTo-CIPPIntunePolicyListItem -Policy $Profile -URLName 'windowsAutopilotDeploymentProfiles' -DefaultPolicyTypeName 'Autopilot Profile' -GroupLookup $GroupLookup
+            }
         }
 
         if ($Request.Query.type -eq 'ESP') {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1
index 33a20da436103..65de6461911be 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-AddPolicy.ps1	
@@ -17,6 +17,10 @@ function Invoke-AddPolicy {
     $description = $Request.Body.Description
     $AssignTo = if ($Request.Body.AssignTo -ne 'on') { $Request.Body.AssignTo }
     $ExcludeGroup = $Request.Body.excludeGroup
+    # Sent by the deploy drawer when a single tenant is selected and groups were picked by id.
+    # customGroup/excludeGroup still carry the display names for logging and as a fallback.
+    $GroupIds = @($Request.Body.GroupIds | Where-Object { $_ })
+    $ExcludeGroupIds = @($Request.Body.ExcludeGroupIds | Where-Object { $_ })
     $AssignmentFilterSelection = $Request.Body.AssignmentFilterName ?? $Request.Body.assignmentFilter
     $AssignmentFilterType = $Request.Body.AssignmentFilterType ?? $Request.Body.assignmentFilterType
     $AssignmentFilterName = switch ($AssignmentFilterSelection) {
@@ -87,6 +91,8 @@ function Invoke-AddPolicy {
                 Headers          = $Headers
                 APIName          = $APIName
             }
+            if ($GroupIds.Count -gt 0) { $params.GroupIds = $GroupIds }
+            if ($ExcludeGroupIds.Count -gt 0) { $params.ExcludeGroupIds = $ExcludeGroupIds }
 
             if (-not [string]::IsNullOrWhiteSpace($AssignmentFilterName)) {
                 $params.AssignmentFilterName = $AssignmentFilterName
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1
index b735e80f3fde0..119d936a52a95 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecCompareIntunePolicy.ps1	
@@ -114,6 +114,15 @@ function Invoke-ExecCompareIntunePolicy {
                         Write-Warning "$Label : Could not resolve available settings, comparing against the full template - $($_.Exception.Message)"
                     }
                 }
+                if ($TemplateType -eq 'Admin') {
+                    # Imported ADMX settings bind to per-tenant definition ids; compare against the
+                    # binds deployment would write to this tenant.
+                    try {
+                        $Object = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (ConvertTo-Json -InputObject $Object -Depth 100 -Compress) -TenantFilter $TenantFilter -DisplayName $JSONData.Displayname | ConvertFrom-Json -Depth 100
+                    } catch {
+                        Write-Warning "$Label : Could not resolve the administrative template settings in this tenant, comparing against the stored template - $($_.Exception.Message)"
+                    }
+                }
             }
 
             return @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1
index 0431e666b0cb1..a3f12462a4a27 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1	
@@ -12,27 +12,42 @@ function Invoke-ListDefenderTVM {
     $TenantFilter = $Request.Query.tenantFilter
     # Interact with query parameters or the body of the request.
     try {
-        $GraphRequest = New-GraphGetRequest -tenantid $TenantFilter -uri 'https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilitiesByMachine' -scope 'https://api.securitycenter.microsoft.com/.default' | Group-Object cveId
-        $GroupObj = foreach ($cve in $GraphRequest) {
-            # Start with base properties
+        # Fold the streamed export into one bucket per CVE as records arrive, rather than grouping
+        # every device x CVE record in memory. Per property the bucket keeps the lowest non-null
+        # value (arrays flattened), which is what sorting the group's values and taking the first did.
+        $Buckets = @{}
+        Get-DefenderTvmRaw -TenantId $TenantFilter -Stream | ForEach-Object {
+            $CveId = [string]$_.cveId
+            $Bucket = $Buckets[$CveId]
+            if (-not $Bucket) {
+                $Bucket = @{ Count = 0; Devices = [System.Collections.Generic.List[object]]::new(); Values = @{} }
+                $Buckets[$CveId] = $Bucket
+            }
+            $Bucket.Count++
+            foreach ($Property in $_.PSObject.Properties) {
+                if ($Property.Name -eq 'deviceName') {
+                    foreach ($Name in @($Property.Value)) { $Bucket.Devices.Add(@{ deviceName = $Name }) }
+                    continue
+                }
+                if (-not $Bucket.Values.ContainsKey($Property.Name)) { $Bucket.Values[$Property.Name] = $null }
+                foreach ($Value in @($Property.Value)) {
+                    if ($null -ne $Value -and ($null -eq $Bucket.Values[$Property.Name] -or $Value -lt $Bucket.Values[$Property.Name])) {
+                        $Bucket.Values[$Property.Name] = $Value
+                    }
+                }
+            }
+        }
+
+        $GroupObj = foreach ($CveId in ($Buckets.Keys | Sort-Object)) {
+            $Bucket = $Buckets[$CveId]
             $obj = [ordered]@{
                 customerId           = $TenantFilter
-                affectedDevicesCount = $cve.count
-                cveId                = $cve.name
+                affectedDevicesCount = $Bucket.Count
+                cveId                = $CveId
+                affectedDevices      = @($Bucket.Devices)
             }
-
-            # Get all unique property names from the group
-            $allProperties = $cve.group | Get-Member -MemberType Properties | Select-Object -ExpandProperty Name | Sort-Object -Unique
-
-            # Add all properties from the group with appropriate processing
-            foreach ($property in $allProperties) {
-                if ($property -eq 'deviceName') {
-                    # Special handling for deviceName - create array of objects
-                    $obj['affectedDevices'] = @($cve.group.$property | ForEach-Object { @{ $property = $_ } })
-                } else {
-                    # For all other properties, get unique values
-                    $obj[$property] = ($cve.group.$property | Sort-Object -Unique) | Select-Object -First 1
-                }
+            foreach ($Property in ($Bucket.Values.Keys | Sort-Object)) {
+                $obj[$Property] = $Bucket.Values[$Property]
             }
 
             # Convert and output as PSCustomObject. Not really needed, but hey, why not.
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveAssignmentFilterTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveAssignmentFilterTemplate.ps1
index e8973960f75c9..68556230676ed 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveAssignmentFilterTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-RemoveAssignmentFilterTemplate.ps1	
@@ -15,11 +15,9 @@ Function Invoke-RemoveAssignmentFilterTemplate {
     $ID = $request.Query.ID ?? $Request.Body.ID
     try {
         $Table = Get-CippTable -tablename 'templates'
-        Write-Host $ID
 
         $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type Guid
         $Filter = "PartitionKey eq 'AssignmentFilterTemplate' and RowKey eq '$SafeID'"
-        Write-Host $Filter
         $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey
         Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow
         $Result = "Removed Assignment Filter Template with ID $ID"
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1
index 0f12d80773df0..cf5f5ee7b7b6f 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddJITAdminTemplate.ps1	
@@ -86,6 +86,9 @@ function Invoke-AddJITAdminTemplate {
             defaultNotificationActions  = $Request.Body.defaultNotificationActions
             generateTAPByDefault        = [bool]$Request.Body.generateTAPByDefault
             reasonTemplate              = $Request.Body.reasonTemplate
+            defaultVacationMode         = [bool]$Request.Body.defaultVacationMode
+            defaultVacationCAPolicy     = $Request.Body.defaultVacationCAPolicy
+            defaultVacationExcludeAuditAlerts = [bool]$Request.Body.defaultVacationExcludeAuditAlerts
             createdBy                   = $UserDetails
             createdDate                 = (Get-Date).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ')
         }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1
index c9b58c10e6788..6c0afd4dfa739 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-AddUserDefaults.ps1	
@@ -50,7 +50,7 @@ function Invoke-AddUserDefaults {
         # Settings
         $Autopassword = $Request.Body.Autopassword
         $Password = $Request.Body.password
-        $MustChangePass = $Request.Body.MustChangePass
+        $MustChangePass = [System.Convert]::ToBoolean($Request.Body.MustChangePass)
         $PerUserMfa = [System.Convert]::ToBoolean($Request.Body.perUserMfa)
 
         $UsageLocation = if ($Request.Body.usageLocation -is [string]) {
@@ -104,6 +104,14 @@ function Invoke-AddUserDefaults {
         $SharedMailboxes = $Request.Body.sharedMailboxes
         $SharedMailboxPermission = $Request.Body.sharedMailboxPermission
 
+        # SharePoint sites new users are added to, with one role for all of them
+        $SharePointSites = $Request.Body.sharePointSites
+        $SharePointSiteRole = if ($Request.Body.sharePointSiteRole -is [string]) {
+            $Request.Body.sharePointSiteRole
+        } else {
+            $Request.Body.sharePointSiteRole.value
+        }
+
         # Create template object with all fields from CippAddEditUser
         $TemplateObject = @{
             tenantFilter             = $TenantFilter
@@ -143,6 +151,9 @@ function Invoke-AddUserDefaults {
             sharedCalendarPermission = $SharedCalendarPermission
             sharedMailboxes          = $SharedMailboxes
             sharedMailboxPermission  = $SharedMailboxPermission
+            sharePointSites          = $SharePointSites
+            sharePointSiteRole       = $SharePointSiteRole
+            defaultAttributes        = $Request.Body.defaultAttributes
         }
 
         # Use existing GUID if editing, otherwise generate new one
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1
index 4abb488e7f032..40f5339ae4c8e 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditJITAdminTemplate.ps1	
@@ -102,6 +102,9 @@ function Invoke-EditJITAdminTemplate {
             defaultNotificationActions  = $Request.Body.defaultNotificationActions
             generateTAPByDefault        = [bool]$Request.Body.generateTAPByDefault
             reasonTemplate              = $Request.Body.reasonTemplate
+            defaultVacationMode         = [bool]$Request.Body.defaultVacationMode
+            defaultVacationCAPolicy     = $Request.Body.defaultVacationCAPolicy
+            defaultVacationExcludeAuditAlerts = [bool]$Request.Body.defaultVacationExcludeAuditAlerts
             createdBy                   = $ExistingData.createdBy
             createdDate                 = $ExistingData.createdDate
             modifiedBy                  = $UserDetails
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECBulkCheck.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECBulkCheck.ps1
new file mode 100644
index 0000000000000..7ed96c96211e6
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECBulkCheck.ps1	
@@ -0,0 +1,80 @@
+function Invoke-ExecBECBulkCheck {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.User.Read
+    .SYNOPSIS
+        Queues Business Email Compromise investigations for many users at once.
+    .DESCRIPTION
+        Queues one BEC investigation per user as a single orchestration with a queue entry for progress. Accepts either an array of { UserIds, tenantFilter } items (the Users table bulk action) or one object with UserIds[]. Each run gets its own case id; results appear on the BEC Reports page and each user's Compromise Remediation tab.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    try {
+        $Entries = @($Request.Body | Where-Object { $_ })
+        if ($Entries.Count -eq 0) { throw 'No request body' }
+        $Unwrap = { param($Value) if ($Value -and $Value.PSObject.Properties['value']) { $Value.value } else { $Value } }
+        $TenantFilter = [string](& $Unwrap ($Entries | ForEach-Object { $_.tenantFilter } | Where-Object { $_ } | Select-Object -First 1))
+        if (-not $TenantFilter) { throw 'tenantFilter is required' }
+        # object ids of the users to investigate
+        $UserIds = @($Entries | ForEach-Object { @($_.UserIds) } | Where-Object { $_ } | ForEach-Object { [string](& $Unwrap $_) } | Where-Object { $_ } | Select-Object -Unique)
+        if ($UserIds.Count -eq 0) { throw 'No users to check' }
+
+        # Resolve UPN and display name in chunks of 15 ids
+        $Resolved = @{}
+        $Requests = for ($i = 0; $i -lt $UserIds.Count; $i += 15) {
+            $Chunk = $UserIds[$i..([Math]::Min($i + 14, $UserIds.Count - 1))]
+            @{ id = "u$i"; method = 'GET'; url = "users?`$filter=id in ('$($Chunk -join "','")')&`$select=id,userPrincipalName,displayName" }
+        }
+        foreach ($Response in @(New-GraphBulkRequest -Requests @($Requests) -tenantid $TenantFilter -asapp $true)) {
+            foreach ($User in @($Response.body.value)) { if ($User.id) { $Resolved[[string]$User.id] = $User } }
+        }
+
+        $RequestedBy = try { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } catch { 'CIPP' }
+        # the technician's own address (first x-forwarded-for hop) is never the user's or the attacker's
+        $RequestedFromIP = ConvertTo-CIPPBecHostAddress -Address ([string](([string]$Headers.'x-forwarded-for' -split ',')[0])).Trim()
+        $Queue = New-CippQueueEntry -Name "BEC investigation - $TenantFilter" -Link "/identity/administration/bec?tenantFilter=$TenantFilter" -Reference "bec-$TenantFilter-$([guid]::NewGuid().ToString('N'))" -TotalTasks $UserIds.Count
+        $Batch = [System.Collections.Generic.List[object]]::new()
+        $Cases = [System.Collections.Generic.List[object]]::new()
+        foreach ($UserId in $UserIds) {
+            $User = $Resolved[$UserId]
+            if (-not $User) {
+                $Cases.Add([pscustomobject]@{ UserId = $UserId; UserPrincipalName = $null; CaseId = $null; Error = 'User not found' })
+                continue
+            }
+            $Prepared = New-CIPPBecRunRequest -TenantFilter $TenantFilter -UserId ([string]$User.id) -UserPrincipalName ([string]$User.userPrincipalName) -DisplayName ([string]$User.displayName) -RequestedBy ([string]$RequestedBy) -QueueId ([string]$Queue.RowKey) -RequestedFromIP ([string]$RequestedFromIP)
+            $Batch.Add($Prepared.Item)
+            $Cases.Add([pscustomobject]@{ UserId = [string]$User.id; UserPrincipalName = [string]$User.userPrincipalName; CaseId = $Prepared.CaseId })
+        }
+        if ($Batch.Count -eq 0) { throw 'None of the selected users could be resolved' }
+        $Unresolved = @($Cases | Where-Object { $_.Error } | ForEach-Object { $_.UserId })
+        $InputObject = [PSCustomObject]@{
+            OrchestratorName = 'BECRunOrchestrator'
+            Batch            = @($Batch)
+            SkipLog          = $true
+        }
+        $null = Start-CIPPOrchestrator -InputObject $InputObject
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Queued $($Batch.Count) BEC investigation(s) (queue $($Queue.RowKey))" -Sev 'Info'
+        $Body = @{
+            Results = "Queued $($Batch.Count) BEC investigation(s). Results appear on the BEC Reports page and each user's Compromise Remediation tab.$(if ($Unresolved.Count -gt 0) { " $($Unresolved.Count) selected user(s) could not be found and were skipped: $($Unresolved -join ', ')." })"
+            QueueId = $Queue.RowKey
+            Cases   = @($Cases)
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Bulk BEC investigation not queued: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        $Body = @{ Results = "Bulk BEC investigation not queued: $($ErrorMessage.NormalizedError)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECCheck.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECCheck.ps1
index 00058a5319df9..84e70e147d01f 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECCheck.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECCheck.ps1	
@@ -1,66 +1,138 @@
-Function Invoke-ExecBECCheck {
+function Invoke-ExecBECCheck {
     <#
     .FUNCTIONALITY
         Entrypoint
     .ROLE
         Identity.User.Read
+    .SYNOPSIS
+        Reads, polls or starts a Business Email Compromise investigation.
     .DESCRIPTION
-        Returns the business email compromise assessment for a user: sign-ins with a location analysis against the user's assigned usage location, mailbox rules and rule changes, trusted/blocked sender changes, OneDrive and SharePoint sharing link activity, added applications matched against the known-malicious catalog, MFA methods, Intune devices, sent mail, and tenant-wide password changes. If no cached result exists the check is queued as a background job and the response reports it as waiting, so poll rather than expecting results on the first call. Pass overwrite=true to force a fresh run.
+        GET with GUID (or caseId) returns that run: while it is queued or running { Waiting = true, Progress } where Progress is the job status (queued until a worker picks it up, then running) and the per-step state the page renders; { Error, Progress } when it failed; otherwise the results payload with the server-side Score, per-collector Completeness and a Run block. A queued or running run whose progress has not moved for 20 minutes is marked failed by this poll (the worker restarted or the run was abandoned) and returned as { Error }. GET without a GUID returns the user's latest run as { GUID, Status } and starts nothing (GUID is null when the user has no runs). POST with tenantFilter, userid and userName queues a new run and returns its { GUID }. Every run is the full investigation and is kept in the BecReports table; metadata only, never message content.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
 
-    $Table = Get-CippTable -tablename 'cachebec'
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $Payload = $Request.Body
+    # Query first, then the body; a query key that is present but empty counts as missing.
+    $Pick = { param($FromQuery, $FromBody) if (-not [string]::IsNullOrWhiteSpace([string]$FromQuery)) { $FromQuery } else { $FromBody } }
+    $TenantFilter = & $Pick $Request.Query.tenantFilter $Payload.tenantFilter
+    # Object id of the user to investigate
+    $UserId = [string](& $Pick $Request.Query.userid $Payload.userid)
+    # The user's UPN (stored on the run and used by the collectors)
+    $UserName = [string](& $Pick $Request.Query.userName $Payload.userName)
+    # The run to read; GUID keeps the original poll contract
+    $CaseId = [string](& $Pick $Request.Query.GUID $Request.Query.caseId)
+    # A POST body with a userid starts a new run
+    $Start = -not [string]::IsNullOrWhiteSpace([string]$Payload.userid)
+    # A queued/running run with no progress update for this long is abandoned: the worker restarted
+    # (Craft retries once, then gives up) or the queue lost it. One audit-log phase can take several
+    # minutes on a large tenant, so the threshold is generous.
+    $StaleMinutes = 20
 
-    $UserId = $Request.Query.userid ?? $Request.Query.GUID
-    $Filter = "PartitionKey eq 'bec' and RowKey eq '$UserId'"
-    $JSONOutput = Get-CIPPAzDataTableEntity @Table -Filter $Filter
-    Write-Host ($Request.Query | ConvertTo-Json)
+    try {
+        if (-not $TenantFilter) { throw 'tenantFilter is required' }
+        if ($CaseId) {
+            $Run = Get-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -IncludeResults:$true -ErrorAction Stop
+            $Body = if (-not $Run) {
+                @{ Waiting = $false; Error = "BEC run $CaseId was not found for $TenantFilter" }
+            } elseif ($Run.Status -in @('Waiting', 'Running', 'Error')) {
+                # the live progress rows: queued until a worker starts, then one step per phase
+                $Progress = try { @(Get-CIPPAsyncDeployment -JobId $Run.CaseId) | Select-Object -First 1 } catch { $null }
 
-    $body = if (([string]::IsNullOrEmpty($JSONOutput.Results) -and $JSONOutput.Status -ne 'Waiting' ) -or $Request.Query.overwrite -eq $true) {
-        $Batch = @{
-            'FunctionName' = 'BECRun'
-            'UserID'       = $Request.Query.userid
-            'TenantFilter' = $Request.Query.tenantFilter
-            'userName'     = $Request.Query.userName
-        }
-
-        $Table = Get-CippTable -tablename 'cachebec'
-
-        $Entity = @{
-            UserId       = $Request.Query.userid
-            Results      = ''
-            RowKey       = $Request.Query.userid
-            Status       = 'Waiting'
-            PartitionKey = 'bec'
-        }
-        Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
-
-        $InputObject = [PSCustomObject]@{
-            OrchestratorName = 'BECRunOrchestrator'
-            Batch            = @($Batch)
-            SkipLog          = $true
-        }
-        #Write-Host ($InputObject | ConvertTo-Json)
-        $null = Start-CIPPOrchestrator -InputObject $InputObject
+                if ($Run.Status -in @('Waiting', 'Running')) {
+                    # last sign of life: the job row's last change, else when the run started or was requested
+                    $LastActivity = $null
+                    foreach ($Candidate in @($Progress.LastUpdate, $Run.StartedAt, $Run.RequestedAt)) {
+                        if ($null -eq $Candidate -or "$Candidate" -eq '') { continue }
+                        try {
+                            $LastActivity = if ($Candidate -is [DateTimeOffset]) { $Candidate.UtcDateTime } else { ([datetime]$Candidate).ToUniversalTime() }
+                            break
+                        } catch { $LastActivity = $null }
+                    }
+                    if ($LastActivity -and $LastActivity -lt (Get-Date).ToUniversalTime().AddMinutes(-$StaleMinutes)) {
+                        $StaleMessage = "No progress for more than $StaleMinutes minutes - the worker was restarted or the run was abandoned. Start a new run."
+                        try {
+                            $null = Set-CIPPBecReport -TenantFilter $TenantFilter -CaseId $Run.CaseId -Properties @{ Status = 'Error'; ErrorMessage = $StaleMessage; ExtractedAt = (Get-Date).ToUniversalTime().ToString('o') }
+                            if ($Progress) {
+                                $Steps = @($Progress.Steps)
+                                for ($i = 0; $i -lt $Steps.Count; $i++) {
+                                    if ($Steps[$i].Status -eq 'running') { Set-CIPPAsyncDeploymentStep -JobId $Run.CaseId -Name $Progress.Name -StepIndex $i -StepStatus 'failed' -Message $StaleMessage; break }
+                                }
+                                Set-CIPPAsyncDeploymentStatus -JobId $Run.CaseId -Name $Progress.Name -Status 'failed' -Logs $StaleMessage
+                                $Progress = try { @(Get-CIPPAsyncDeployment -JobId $Run.CaseId) | Select-Object -First 1 } catch { $Progress }
+                            }
+                            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC run $($Run.CaseId) marked failed: $StaleMessage" -Sev 'Warning'
+                        } catch {
+                            Write-Information "BEC: could not mark the stale run $($Run.CaseId) failed: $($_.Exception.Message)"
+                        }
+                        $Run | Add-Member -NotePropertyName 'Status' -NotePropertyValue 'Error' -Force
+                        $Run | Add-Member -NotePropertyName 'ErrorMessage' -NotePropertyValue $StaleMessage -Force
+                    }
+                }
 
-        @{ GUID = $Request.Query.userid }
-    } else {
-        if (!$Request.Query.GUID) {
-            @{ GUID = $Request.Query.userid }
+                $Summary = @{
+                    CaseId      = $Run.CaseId
+                    Status      = $Run.Status
+                    RequestedAt = $Run.RequestedAt
+                    RequestedBy = $Run.RequestedBy
+                    StartedAt   = $Run.StartedAt
+                    Progress    = $Progress
+                }
+                if ($Run.Status -eq 'Error') {
+                    $Summary.Waiting = $false
+                    $Summary.Error = ($Run.ErrorMessage ?? 'The BEC run failed')
+                } else {
+                    $Summary.Waiting = $true
+                }
+                $Summary
+            } else {
+                $Results = $Run.Results
+                $Results | Add-Member -NotePropertyName 'Run' -NotePropertyValue ([pscustomobject]@{
+                        CaseId            = $Run.CaseId
+                        Status            = $Run.Status
+                        ExtractedAt       = $Run.ExtractedAt
+                        RequestedAt       = $Run.RequestedAt
+                        RequestedBy       = $Run.RequestedBy
+                        Containment       = $Run.Containment
+                    }) -Force
+                $Results
+            }
+        } elseif ($Start) {
+            if (-not $UserId) { throw 'userid is required' }
+            $RequestedBy = try { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } catch { 'CIPP' }
+            # the technician's own address (first x-forwarded-for hop) is never the user's or the attacker's
+            $RequestedFromIP = ConvertTo-CIPPBecHostAddress -Address ([string](([string]$Headers.'x-forwarded-for' -split ',')[0])).Trim()
+            $Prepared = New-CIPPBecRunRequest -TenantFilter $TenantFilter -UserId $UserId -UserPrincipalName $UserName -RequestedBy ([string]$RequestedBy) -RequestedFromIP ([string]$RequestedFromIP)
+            $InputObject = [PSCustomObject]@{
+                OrchestratorName = 'BECRunOrchestrator'
+                Batch            = @($Prepared.Item)
+                SkipLog          = $true
+            }
+            $null = Start-CIPPOrchestrator -InputObject $InputObject
+            Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Queued a BEC investigation for $UserName [case $($Prepared.CaseId)]" -Sev 'Info'
+            $Body = @{ GUID = $Prepared.CaseId; CaseId = $Prepared.CaseId; Status = 'Waiting' }
         } else {
-            if (!$JSONOutput -or $JSONOutput.Status -eq 'Waiting') {
-                @{ Waiting = $true }
+            if (-not $UserId) { throw 'userid is required' }
+            # the latest run that is not a failure; never starts one
+            $Latest = @(Get-CIPPBecReport -TenantFilter $TenantFilter -UserId $UserId | Where-Object { $_.Status -in @('Completed', 'Waiting', 'Running') }) | Select-Object -First 1
+            $Body = if ($Latest) {
+                @{ GUID = $Latest.CaseId; CaseId = $Latest.CaseId; Status = $Latest.Status }
             } else {
-                $JSONOutput.Results
+                @{ GUID = $null; CaseId = $null; Status = $null; NoRuns = $true }
             }
         }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC check request failed: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        $Body = @{ Waiting = $false; Error = $ErrorMessage.NormalizedError }
+        $StatusCode = [HttpStatusCode]::InternalServerError
     }
 
-
     return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = $body
+            StatusCode = $StatusCode
+            Body       = $Body
         })
-
 }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECEvidenceExport.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECEvidenceExport.ps1
new file mode 100644
index 0000000000000..0c387af612b1a
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECEvidenceExport.ps1	
@@ -0,0 +1,48 @@
+function Invoke-ExecBECEvidenceExport {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.User.Read
+    .SYNOPSIS
+        Builds the evidence package for a Business Email Compromise run and returns it.
+    .DESCRIPTION
+        Collates the run's stored results, one CSV per finding set, the score, the containment history, every logbook entry stamped with the case id and the full and C-suite-summary report PDFs (rendered server-side) into a ZIP. Nothing is stored: the ZIP is returned base64-encoded (ZipBase64) for the browser to save. Metadata only - nothing in the package is message content.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $TenantFilter = $Request.Body.tenantFilter
+    $CaseId = [string]$Request.Body.caseId
+
+    Set-CippBecCaseContext -CaseId $CaseId
+    try {
+        if (-not $TenantFilter) { throw 'tenantFilter is required' }
+        if (-not $CaseId) { throw 'caseId is required' }
+        $Package = New-CIPPBecEvidencePackage -TenantFilter $TenantFilter -CaseId $CaseId -Headers $Headers -APIName $APIName
+        $Body = @{
+            Results  = "Evidence package for case $CaseId created: $($Package.FileCount) files, $([math]::Round($Package.Bytes / 1KB)) KB"
+            Evidence = [pscustomobject]@{
+                CaseId    = $Package.CaseId
+                Bytes     = $Package.Bytes
+                FileCount = $Package.FileCount
+                ZipBase64 = [System.Convert]::ToBase64String($Package.ZipBytes)
+            }
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Evidence export for BEC case $CaseId failed: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        $Body = @{ Results = "Evidence export failed: $($ErrorMessage.NormalizedError)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    } finally {
+        Set-CippBecCaseContext -CaseId $null
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECIPReview.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECIPReview.ps1
new file mode 100644
index 0000000000000..1040c68d6d458
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECIPReview.ps1	
@@ -0,0 +1,66 @@
+function Invoke-ExecBECIPReview {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.User.ReadWrite
+    .SYNOPSIS
+        Re-judges the IP addresses of a BEC case with the investigator's overrides and chosen accounts.
+    .DESCRIPTION
+        Validates the request and queues a background re-run of the case's address-dependent sections: the investigator's overrides (an address or CIDR range marked Safe or Compromised, with an optional note) become the case's complete override set, the sign-ins of the chosen accounts are correlated with the case's addresses, the address lists are re-read, and mailbox activity, IP verdicts, attacker activity, delegated mailboxes and the score are recomputed for the original window. Returns a DeploymentId whose per-step progress ListOffboardingProgress returns. To make a verdict permanent for the tenant, add the address to CIPP's IP allow/block list (ExecAddTrustedIP).
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $TenantFilter = [string]($Request.Body.tenantFilter.value ?? $Request.Body.tenantFilter)
+    # The BEC case (run) to review
+    $CaseId = [string]$Request.Body.CaseId
+
+    $StatusCode = [HttpStatusCode]::OK
+    $DeploymentId = $null
+    $Results = try {
+        if (-not $TenantFilter) { $StatusCode = [HttpStatusCode]::BadRequest; throw 'tenantFilter is required' }
+        if (-not $CaseId) { $StatusCode = [HttpStatusCode]::BadRequest; throw 'CaseId is required' }
+        # The complete set of overrides for the case: an address or CIDR range, Safe or Compromised, and a note. Auto drops the override.
+        $Overrides = foreach ($Override in $Request.Body.Overrides) {
+            $Verdict = [string]($Override.Verdict.value ?? $Override.Verdict)
+            if ($Verdict -eq 'Auto' -or -not $Verdict) { continue }
+            if ($Verdict -notin @('Safe', 'Compromised')) { $StatusCode = [HttpStatusCode]::BadRequest; throw "Verdict must be Safe, Compromised or Auto, not '$Verdict'" }
+            $Range = try { ConvertTo-CIPPIPRange -Value ([string]$Override.IP) } catch { $StatusCode = [HttpStatusCode]::BadRequest; throw }
+            @{ IP = $Range; Verdict = $Verdict; Note = [string]$Override.Note }
+        }
+        # Object ids of other accounts whose sign-ins to correlate with the case's addresses
+        $CorrelateUserIds = foreach ($User in $Request.Body.CorrelateUsers) { [string]($User.value ?? $User) }
+        $CorrelateUserIds = @($CorrelateUserIds | Where-Object { $_ } | Select-Object -Unique)
+        $Run = Get-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -IncludeResults
+        if (-not $Run) { $StatusCode = [HttpStatusCode]::NotFound; throw "Case $CaseId was not found in $TenantFilter" }
+        if ($Run.Status -ne 'Completed') { $StatusCode = [HttpStatusCode]::BadRequest; throw "Case $CaseId has not completed yet" }
+        # Auto is what the case already ran with: a re-run needs at least one address set to Safe or
+        # Compromised (or accounts to correlate), and a set that differs from the one already applied.
+        if (@($Overrides).Count -eq 0 -and $CorrelateUserIds.Count -eq 0) {
+            $StatusCode = [HttpStatusCode]::BadRequest
+            throw 'Set at least one address to Safe or Compromised before re-running'
+        }
+        $Signature = { param($Set) (@($Set | ForEach-Object { "$(ConvertTo-CIPPIPRange -Value ([string]($_.IP ?? $_.Range)))|$($_.Verdict)" }) | Sort-Object) -join ';' }
+        if ($CorrelateUserIds.Count -eq 0 -and (& $Signature @($Overrides)) -eq (& $Signature @($Run.Results.IPOverrides | Where-Object { $_ }))) {
+            $StatusCode = [HttpStatusCode]::BadRequest
+            throw 'Nothing changed: set at least one address to a different verdict before re-running'
+        }
+
+        $DeploymentId = Start-CIPPBecIPReviewJob -TenantFilter $TenantFilter -CaseId $CaseId -Overrides @($Overrides) -CorrelateUserIds $CorrelateUserIds -UserPrincipalName ([string]$Run.UserPrincipalName) -Headers $Headers
+        [pscustomobject]@{ resultText = "Re-judging the IP addresses of case $CaseId with $(@($Overrides).Count) override(s) and $($CorrelateUserIds.Count) correlated account(s). Progress is shown below."; state = 'info' }
+    } catch {
+        if ($StatusCode -eq [HttpStatusCode]::OK) { $StatusCode = [HttpStatusCode]::InternalServerError }
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC IP review of case $CaseId was not queued: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        [pscustomobject]@{ resultText = $ErrorMessage.NormalizedError; state = 'error' }
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            # DeploymentId is set only when the review was queued: the id to poll with ListOffboardingProgress
+            Body       = [pscustomobject]@{ Results = @($Results); DeploymentId = $DeploymentId }
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1
index f9516ce5ab29c..e5b9b45265bd7 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1	
@@ -4,6 +4,10 @@ function Invoke-ExecBECRemediate {
         Entrypoint
     .ROLE
         Identity.User.ReadWrite
+    .SYNOPSIS
+        Runs selectable Business Email Compromise containment for a user.
+    .DESCRIPTION
+        Runs the selected containment actions (see ListBECRemediationActions) for a user. With no Actions the default set runs (the DefaultSelected actions, configurable instance-wide from CIPP settings). Actions marked Critical require Confirmation to equal the user's UPN. With Async the request is validated, queued as a scheduled task that runs straight away, and answered with a DeploymentId whose per-action progress ListOffboardingProgress returns; without it the actions run inline and their results are returned. Pass CaseId to resolve default targets (flagged consents, delegations, rules, devices) from that BEC run and to record the outcome on it; Parameters carries explicit per-action targets (MfaMethodIds, GrantIds, AppRoleAssignmentIds, ServicePrincipalIds, RuleIds, Delegations, TransportRuleIds, AddInIds, Protocols, MobileDeviceIds, RegisteredDeviceIds, CAPolicy).
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -11,217 +15,60 @@ function Invoke-ExecBECRemediate {
     $APIName = $Request.Params.CIPPEndpoint
     $Headers = $Request.Headers
 
-
     $TenantFilter = $Request.Body.tenantFilter
     $SuspectUser = $Request.Body.userid
     $Username = $Request.Body.username
-    Write-Host $TenantFilter
-    Write-Host $SuspectUser
-
+    # Action ids from ListBECRemediationActions; empty runs the default set
+    $Actions = @($Request.Body.Actions | ForEach-Object { if ($_ -and $_.PSObject.Properties['value']) { $_.value } else { $_ } } | Where-Object { $_ })
+    # must equal the user's UPN when a Critical action is selected
+    $Confirmation = [string]$Request.Body.Confirmation
+    # the BEC run whose findings supply default targets and which records the outcome
+    $CaseId = [string]$Request.Body.CaseId
+    $Parameters = $Request.Body.Parameters
+    # run as a background scheduled task and report progress under the returned DeploymentId
+    $Async = [bool]$Request.Body.Async
+
+    $StatusCode = [HttpStatusCode]::OK
+    $AsyncDeploymentId = $null
     $Results = try {
-        $AllResults = [System.Collections.Generic.List[object]]::new()
-
-        # Step 1: Reset Password
-        $Step = 'Reset Password'
-        try {
-            $PasswordResult = Set-CIPPResetPassword -UserID $Username -tenantFilter $TenantFilter -APIName $APIName -Headers $Headers
-            $AllResults.Add($PasswordResult)
-        } catch {
-            $AllResults.Add([pscustomobject]@{
-                    resultText = "Failed to reset password: $($_.Exception.Message)"
-                    state      = 'error'
-                })
-        }
-
-        # Step 2: Disable Account
-        $Step = 'Disable Account'
-        try {
-            $DisableResult = Set-CIPPSignInState -userid $Username -AccountEnabled $false -tenantFilter $TenantFilter -APIName $APIName -Headers $Headers
-            $AllResults.Add([pscustomobject]@{
-                    resultText = $DisableResult
-                    state      = if ($DisableResult -like '*WARNING*') { 'warning' } else { 'success' }
-                })
-        } catch {
-            $AllResults.Add([pscustomobject]@{
-                    resultText = "Failed to disable account: $($_.Exception.Message)"
-                    state      = 'error'
-                })
-        }
-
-        # Step 3: Revoke Sessions
-        $Step = 'Revoke Sessions'
-        try {
-            $SessionResult = Revoke-CIPPSessions -userid $SuspectUser -username $Username -Headers $Headers -APIName $APIName -tenantFilter $TenantFilter
-            $AllResults.Add([pscustomobject]@{
-                    resultText = $SessionResult
-                    state      = if ($SessionResult -like '*Failed*') { 'error' } else { 'success' }
-                })
-        } catch {
-            $AllResults.Add([pscustomobject]@{
-                    resultText = "Failed to revoke sessions: $($_.Exception.Message)"
-                    state      = 'error'
-                })
+        if (-not $TenantFilter) { throw 'tenantFilter is required' }
+        if (-not $Username) {
+            if (-not $SuspectUser) { throw 'username or userid is required' }
+            $Username = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$SuspectUser?`$select=userPrincipalName" -tenantid $TenantFilter -AsApp $true).userPrincipalName
         }
 
-        # Step 4: Remove MFA methods
-        $Step = 'Remove MFA methods'
-        try {
-            $MFAResult = Remove-CIPPUserMFA -UserPrincipalName $Username -TenantFilter $TenantFilter -Headers $Headers
-            $AllResults.Add([pscustomobject]@{
-                    resultText = $MFAResult
-                    state      = if ($MFAResult -like '*No MFA methods*') { 'info' } elseif ($MFAResult -like '*Successfully*') { 'success' } else { 'error' }
-                })
-        } catch {
-            $AllResults.Add([pscustomobject]@{
-                    resultText = "Failed to remove MFA methods: $($_.Exception.Message)"
-                    state      = 'error'
-                })
-        }
-
-        # Step 5: Disable Inbox Rules
-        $Step = 'Disable Inbox Rules'
-        try {
-            Write-LogMessage -headers $Headers -API $APIName -message "Starting inbox rules processing for user: $Username" -Sev 'Info' -tenant $TenantFilter
-            $Rules = New-ExoRequest -anchor $Username -tenantid $TenantFilter -cmdlet 'Get-InboxRule' -cmdParams @{Mailbox = $Username; IncludeHidden = $true }
-            Write-LogMessage -headers $Headers -API $APIName -message "Retrieved $(($Rules | Measure-Object).Count) total rules for $Username" -Sev 'Info' -tenant $TenantFilter
-            $RuleDisabled = 0
-            $RuleFailed = 0
-            $DelegateRulesSkipped = 0
-            $RuleMessages = [System.Collections.Generic.List[string]]::new()
-
-            if (($Rules | Measure-Object).Count -eq 0) {
-                # No rules exist at all
-                $AllResults.Add([pscustomobject]@{
-                        resultText = "No Inbox Rules found for $Username."
-                        state      = 'info'
-                    })
-            } else {
-                # Rules exist, filter and process them
-                $ProcessableRules = $Rules | Where-Object {
-                    $_.Name -ne 'Junk E-Mail Rule' -and
-                    $_.Name -notlike 'Microsoft.Exchange.OOF.*'
-                }
-
-                if (($ProcessableRules | Measure-Object).Count -eq 0) {
-                    # Rules exist but none are processable after filtering
-                    $SystemRulesCount = ($Rules | Measure-Object).Count - $DelegateRulesSkipped
-                    if ($SystemRulesCount -gt 0) {
-                        $AllResults.Add([pscustomobject]@{
-                                resultText = "Found $(($Rules | Measure-Object).Count) inbox rules for $Username, but none require disabling (only system rules found)."
-                                state      = 'info'
-                            })
-                    }
-                } else {
-                    # Process the filterable rules
-                    $ProcessableRules | ForEach-Object {
-                        $CurrentRule = $_
-                        Write-LogMessage -headers $Headers -API $APIName -message "Processing rule: Name='$($CurrentRule.Name)', Identity='$($CurrentRule.Identity)'" -Sev 'Info' -tenant $TenantFilter
-
-                        try {
-                            Set-CIPPMailboxRule -Username $Username -UserId $Username -TenantFilter $TenantFilter -RuleId $CurrentRule.Identity -RuleName $CurrentRule.Name -Disable -APIName $APIName -Headers $Headers
-
-                            Write-LogMessage -headers $Headers -API $APIName -message "Successfully disabled rule: $($CurrentRule.Name)" -Sev 'Info' -tenant $TenantFilter
-                            $RuleDisabled++
-                        } catch {
-                            # Check if this is a system delegate rule, if so we can ignore the error
-                            if ($CurrentRule.Name -match '^Delegate Rule -\d+$') {
-                                Write-LogMessage -headers $Headers -API $APIName -message "Skipping delegate rule '$($CurrentRule.Name)' - unable to disable (expected behavior)" -Sev 'Info' -tenant $TenantFilter
-                                $DelegateRulesSkipped++
-                            } else {
-                                # Handle as normal error
-                                $ErrorMsg = "Could not disable rule '$($CurrentRule.Name)': $($_.Exception.Message)"
-                                Write-LogMessage -headers $Headers -API $APIName -message $ErrorMsg -Sev 'Error' -tenant $TenantFilter
-                                $RuleMessages.Add($ErrorMsg)
-                                $RuleFailed++
-                            }
-                        }
-                    }
-
-                    # Report results
-                    if ($RuleDisabled -gt 0) {
-                        $AllResults.Add([pscustomobject]@{
-                                resultText = "Successfully disabled $RuleDisabled inbox rules for $Username"
-                                state      = 'success'
-                            })
-                    } elseif ($DelegateRulesSkipped -gt 0 -and $RuleDisabled -eq 0 -and $RuleFailed -eq 0) {
-                        # Only system rules were found, report as no processable rules
-                        $AllResults.Add([pscustomobject]@{
-                                resultText = "No processable inbox rules found for $Username"
-                                state      = 'info'
-                            })
-                    }
-
-                    if ($RuleFailed -gt 0) {
-                        $AllResults.Add([pscustomobject]@{
-                                resultText = "Failed to process $RuleFailed inbox rules for $Username"
-                                state      = 'warning'
-                            })
-
-                        # Add individual rule failure messages as objects
-                        foreach ($RuleMessage in $RuleMessages) {
-                            $AllResults.Add([pscustomobject]@{
-                                    resultText = $RuleMessage
-                                    state      = 'error'
-                                })
-                        }
-                    }
-                }
-            }
-
-            $TotalProcessed = $RuleDisabled + $RuleFailed + $DelegateRulesSkipped
-            Write-LogMessage -headers $Headers -API $APIName -message "Completed inbox rules processing for $Username. Total rules: $(($Rules | Measure-Object).Count), Processed: $TotalProcessed, Disabled: $RuleDisabled, Failed: $RuleFailed, Delegate rules skipped: $DelegateRulesSkipped" -Sev 'Info' -tenant $TenantFilter
-
-        } catch {
-            $ErrorMsg = "Failed to process inbox rules: $($_.Exception.Message)"
-            Write-LogMessage -headers $Headers -API $APIName -message $ErrorMsg -Sev 'Error' -tenant $TenantFilter
-            $AllResults.Add([pscustomobject]@{
-                    resultText = $ErrorMsg
-                    state      = 'error'
-                })
+        $Catalog = Get-CIPPBecContainmentActions
+        $Selected = if ($Actions.Count -eq 0) { @($Catalog | Where-Object { $_.DefaultSelected }) } else { @($Catalog | Where-Object { $_.Id -in $Actions }) }
+        $Unknown = @($Actions | Where-Object { $_ -notin $Catalog.Id })
+        if ($Unknown.Count -gt 0) { throw "Unknown containment action(s): $($Unknown -join ', ')" }
+        $Critical = @($Selected | Where-Object { $_.Impact -eq 'Critical' })
+        $ConfirmationOk = $Confirmation -and ($Confirmation.Trim() -ieq ([string]$Username).Trim())
+        if ($Critical.Count -gt 0 -and -not $ConfirmationOk) {
+            $StatusCode = [HttpStatusCode]::BadRequest
+            throw "Type the user's UPN ($Username) to confirm: the selected actions include Critical changes ($($Critical.Label -join ', '))"
         }
 
-        # Step 6: Disable OneDrive Sharing
-        $Step = 'Disable OneDrive Sharing'
-        try {
-            $OneDriveResult = Set-CIPPOneDriveSharing -UserId $Username -TenantFilter $TenantFilter -SharingCapability 'Disabled' -APIName $APIName -Headers $Headers
-            $AllResults.Add([pscustomobject]@{
-                    resultText = $OneDriveResult
-                    state      = if ($OneDriveResult -like '*Successfully*') { 'success' } else { 'error' }
-                })
-        } catch {
-            $AllResults.Add([pscustomobject]@{
-                    resultText = "Failed to disable OneDrive sharing: $($_.Exception.Message)"
-                    state      = 'error'
-                })
+        $Rows = if ($Async) {
+            $AsyncDeploymentId = Start-CIPPBecContainmentJob -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $Username -Actions @($Selected.Id) -Parameters $Parameters -CaseId $CaseId -Headers $Headers -APIName $APIName
+            [pscustomobject]@{ resultText = "Queued $($Selected.Count) containment action(s) for $Username. Progress is shown below and on the scheduled task."; state = 'info' }
+        } else {
+            Invoke-CIPPBecContainment -TenantFilter $TenantFilter -UserId $SuspectUser -UserPrincipalName $Username -Actions $Actions -Parameters $Parameters -Confirmed:$ConfirmationOk -CaseId $CaseId -Headers $Headers -APIName $APIName
         }
-
-        $StatusCode = [HttpStatusCode]::OK
-        Write-LogMessage -API 'BECRemediate' -tenant $TenantFilter -message "Executed Remediation for $Username" -sev 'Info' -LogData @($AllResults)
-
-        # Return the results array
-        $AllResults.ToArray()
-
+        @($Rows | ForEach-Object {
+                $Row = [ordered]@{ resultText = $_.resultText; state = $_.state; Action = $_.Action; Target = $_.Target }
+                if ($_.copyField) { $Row.copyField = $_.copyField }
+                [pscustomobject]$Row
+            })
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
-        $ErrorList = [System.Collections.Generic.List[object]]::new()
-        $ErrorList.Add([pscustomobject]@{
-                resultText = "Failed to execute remediation at step '$Step'. $($ErrorMessage.NormalizedError)"
-                state      = 'error'
-            })
-        Write-LogMessage -API 'BECRemediate' -tenant $TenantFilter -message "Executed Remediation for $Username failed at the $Step step" -sev 'Error' -LogData $ErrorMessage
-        $StatusCode = [HttpStatusCode]::InternalServerError
-
-        # Return the error array
-        $ErrorList.ToArray()
+        if ($StatusCode -eq [HttpStatusCode]::OK) { $StatusCode = [HttpStatusCode]::InternalServerError }
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC containment for $Username was not executed: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        @([pscustomobject]@{ resultText = $ErrorMessage.NormalizedError; state = 'error' })
     }
 
-    # Create the final response structure
-    $ResponseBody = [pscustomobject]@{'Results' = @($Results) }
-
-    # Associate values to output bindings
     return ([HttpResponseContext]@{
             StatusCode = $StatusCode
-            Body       = $ResponseBody
+            # DeploymentId is set only for an Async run: the id to poll with ListOffboardingProgress
+            Body       = [pscustomobject]@{ Results = @($Results); DeploymentId = $AsyncDeploymentId }
         })
-
 }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECReport.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECReport.ps1
new file mode 100644
index 0000000000000..58f53131498d3
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECReport.ps1	
@@ -0,0 +1,40 @@
+function Invoke-ExecBECReport {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.User.ReadWrite
+    .SYNOPSIS
+        Manages a stored Business Email Compromise run.
+    .DESCRIPTION
+        Action=Delete removes a BEC run permanently: its results payload, its evidence package and the run row. Runs are otherwise kept indefinitely.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+    $TenantFilter = $Request.Body.tenantFilter
+    # Currently only Delete
+    $Action = [string]$Request.Body.Action
+    $CaseId = [string]$Request.Body.caseId
+
+    try {
+        if (-not $CaseId) { throw 'caseId is required' }
+        if ($Action -ne 'Delete') { throw "Unknown action '$Action'" }
+        $Result = Remove-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Deleted BEC run $CaseId" -Sev 'Info'
+        $Body = @{ Results = $Result }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "BEC run action '$Action' failed for $CaseId`: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        $Body = @{ Results = "Failed: $($ErrorMessage.NormalizedError)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrImmId.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrImmId.ps1
index dd3de53ae513b..d5c1c0c8e29ab 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrImmId.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrImmId.ps1	
@@ -1,4 +1,4 @@
-Function Invoke-ExecClrImmId {
+function Invoke-ExecClrImmId {
     <#
     .FUNCTIONALITY
         Entrypoint
@@ -10,14 +10,14 @@ Function Invoke-ExecClrImmId {
 
     $APIName = $Request.Params.CIPPEndpoint
     $Headers = $Request.Headers
-    Write-LogMessage -headers $Headers -API $APIName -message 'Accessed this API' -Sev Debug
 
     # Interact with body parameters or the body of the request.
-    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
-    $UserID = $Request.Query.ID ?? $Request.Body.ID
+    $TenantFilter = $Request.Body.tenantFilter
+    $UserID = $Request.Body.ID
 
     try {
-        $Result = Clear-CIPPImmutableID -UserID $UserID -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName
+        # Kept for API-module and script callers; the UI now uses ExecClrOnPremAttributes. Never needs the offboarding scheduling logic.
+        $Result = Clear-CIPPOnPremisesAttributes -UserID $UserID -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName -Attributes 'onPremisesImmutableId'
         $StatusCode = [HttpStatusCode]::OK
     } catch {
         $Result = $_.Exception.Message
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrOnPremAttributes.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrOnPremAttributes.ps1
new file mode 100644
index 0000000000000..16420447f2d2b
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrOnPremAttributes.ps1	
@@ -0,0 +1,29 @@
+function Invoke-ExecClrOnPremAttributes {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.User.ReadWrite
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    $TenantFilter = $Request.Body.tenantFilter
+    # Object ID of the cloud-only user whose on-premises attributes should be cleared
+    $UserID = $Request.Body.ID
+    # On-premises attributes to clear (onPremisesImmutableId, onPremisesDistinguishedName, ...), as plain names or {label,value} objects. Omit to clear every clearable attribute.
+    $Attributes = @($Request.Body.Attributes | ForEach-Object { $_.value ?? $_ } | Where-Object { $_ })
+
+    try {
+        $Result = Clear-CIPPOnPremisesAttributes -UserID $UserID -TenantFilter $TenantFilter -Headers $Headers -APIName $APIName -Attributes $Attributes
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $Result = $_.Exception.Message
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{ StatusCode = $StatusCode; Body = @{'Results' = $Result } })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecCreateTAP.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecCreateTAP.ps1
index 8804650bb3108..f946f25fb765e 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecCreateTAP.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecCreateTAP.ps1	
@@ -20,17 +20,21 @@ Function Invoke-ExecCreateTAP {
     # string 'false' yields $true, so this must be normalised before it is forwarded.
     $IsUsableOnce = ($Request.Query.isUsableOnce -eq $true) -or ($Request.Body.isUsableOnce -eq $true)
     $StartDateTime = $Request.Query.startDateTime ?? $Request.Body.startDateTime
+    # Opt-in: most TAPs are used directly by the admin, so the pass is returned in plain text
+    # unless the caller asks for a PwPush link. Same string-to-bool normalisation as above.
+    $GeneratePwPushLink = ($Request.Query.generatePwPushLink -eq $true) -or ($Request.Body.generatePwPushLink -eq $true)
 
     try {
         # Create parameter hashtable for splatting
         $TAPParams = @{
-            UserID            = $UserID
-            TenantFilter      = $TenantFilter
-            APIName           = $APIName
-            Headers           = $Headers
-            LifetimeInMinutes = $LifetimeInMinutes
-            IsUsableOnce      = $IsUsableOnce
-            StartDateTime     = $StartDateTime
+            UserID             = $UserID
+            TenantFilter       = $TenantFilter
+            APIName            = $APIName
+            Headers            = $Headers
+            LifetimeInMinutes  = $LifetimeInMinutes
+            IsUsableOnce       = $IsUsableOnce
+            StartDateTime      = $StartDateTime
+            GeneratePwPushLink = $GeneratePwPushLink
         }
 
         $TAPResult = New-CIPPTAP @TAPParams
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecGetBecReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecGetBecReportPdf.ps1
new file mode 100644
index 0000000000000..bdae093fe2286
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecGetBecReportPdf.ps1	
@@ -0,0 +1,92 @@
+function Invoke-ExecGetBecReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.User.Read
+    .DESCRIPTION
+        Server-renders a stored Business Email Compromise (BEC) run as application/pdf bytes. Reads the
+        run through Get-CIPPBecReport (the BecReports metadata row plus its BecResults payload) and
+        composes it through the shared CIPPSharp component kit (Build-CippBecReportTree) - the server-side
+        replacement for the client react-pdf BECRemediationReportButton. A run is named by its caseId;
+        pass userId instead to render the user's newest completed run. The run must have completed - the
+        report reads its stored result, it does not trigger a new investigation.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        # The stored run to render. A caseId names it directly; a userId picks the user's newest completed run.
+        $CaseId = $Request.Query.caseId ?? $Request.Body.caseId
+        $UserId = $Request.Query.userId ?? $Request.Body.userId
+        # 'full' (default) = every page; 'summary' = the executive lead only, for a C-suite reader
+        $Variant = switch ([string]($Request.Query.variant ?? $Request.Body.variant)) {
+            'summary' { 'summary' }
+            default { 'full' }
+        }
+        if ([string]::IsNullOrWhiteSpace($TenantFilter) -or ([string]::IsNullOrWhiteSpace($CaseId) -and [string]::IsNullOrWhiteSpace($UserId))) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A tenantFilter and either a caseId or a userId are required' })
+        }
+
+        # Without a caseId, fall back to the user's most recent completed run (the list is newest-first).
+        if ([string]::IsNullOrWhiteSpace($CaseId)) {
+            $Runs = @(Get-CIPPBecReport -TenantFilter $TenantFilter -UserId $UserId)
+            $CaseId = ($Runs | Where-Object { $_.Status -eq 'Completed' } | Select-Object -First 1).CaseId
+            if ([string]::IsNullOrWhiteSpace($CaseId)) {
+                return ([HttpResponseContext]@{
+                        StatusCode = [HttpStatusCode]::NotFound
+                        Body       = 'No completed BEC analysis is stored for this user. Run the BEC check first, then generate the report.'
+                    })
+            }
+        }
+
+        $Run = Get-CIPPBecReport -TenantFilter $TenantFilter -CaseId $CaseId -IncludeResults
+        if (-not $Run -or $Run.Status -ne 'Completed' -or -not $Run.Results) {
+            return ([HttpResponseContext]@{
+                    StatusCode = [HttpStatusCode]::NotFound
+                    Body       = "No completed BEC analysis is stored for case '$CaseId'. Run the BEC check first, then generate the report."
+                })
+        }
+
+        # The results payload is what the check pages render. The containment history and the run's own
+        # identifiers live on the metadata row, and the client renderer reads them off becData.Run - so
+        # attach the same .Run block here, and the builder reads it exactly as the client does.
+        $BecData = $Run.Results
+        $RunBlock = [pscustomobject]@{
+            CaseId      = $Run.CaseId
+            Status      = $Run.Status
+            ExtractedAt = $Run.ExtractedAt
+            RequestedAt = $Run.RequestedAt
+            RequestedBy = $Run.RequestedBy
+            Containment = $Run.Containment
+        }
+        $BecData | Add-Member -NotePropertyName 'Run' -NotePropertyValue $RunBlock -Force
+
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter
+        # The investigated user labels the cover and footer; the run stored who it was for.
+        $DisplayName = @($Run.DisplayName, $Run.UserPrincipalName, $Request.Query.userDisplayName, $Request.Body.userDisplayName, $Run.UserId) |
+            Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 1
+        $UserName = @($Run.UserPrincipalName, $Request.Query.userName, $Request.Body.userName) |
+            Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 1
+        $UserData = [pscustomobject]@{ displayName = $DisplayName; userPrincipalName = $UserName; id = $Run.UserId }
+
+        $Report = Build-CippBecReportTree -UserData $UserData -BecData $BecData -TenantName $TenantName -Variant $Variant
+
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName $TenantName -TenantFilter $TenantFilter -ReportName 'BEC Analysis Report'
+        $FileName = ("BEC_$(if ($Variant -eq 'summary') { 'Summary' } else { 'Report' })_$DisplayName" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render BEC report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECPhishingSpread.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECPhishingSpread.ps1
new file mode 100644
index 0000000000000..729cd8375f146
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECPhishingSpread.ps1	
@@ -0,0 +1,77 @@
+function Invoke-ListBECPhishingSpread {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Identity.User.Read
+    .SYNOPSIS
+        Lists who else received mail from a sender, from message-trace metadata.
+    .DESCRIPTION
+        Given a sender address (and optionally a subject fragment), walks the message trace for the last N days and groups the recipients: address, internal or external, message count, first and last delivery and the subjects seen. Use it to find the spread of a phishing message from a compromised or look-alike sender. Metadata only - no message content is read.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $TenantFilter = $Request.Query.tenantFilter
+    # the sender to trace
+    $SenderAddress = [string]$Request.Query.sender
+    # optional subject fragment to narrow the trace (case-insensitive contains)
+    $Subject = [string]$Request.Query.subject
+
+    try {
+        if (-not $SenderAddress) { throw 'sender is required' }
+        # look-back in days (1-90)
+        $Days = [Math]::Min([Math]::Max([int]($Request.Query.days ?? 7), 1), 90)
+        $End = (Get-Date).ToUniversalTime()
+        $Start = $End.AddDays(-$Days)
+        $Accepted = try { @((New-ExoRequest -tenantid $TenantFilter -cmdlet 'Get-AcceptedDomain').DomainName | Where-Object { $_ } | ForEach-Object { ([string]$_).ToLowerInvariant() }) } catch { @() }
+
+        # Trace V2 takes at most 10 days per query; walk the range in 10-day windows, newest first.
+        $Rows = [System.Collections.Generic.List[object]]::new()
+        $Complete = $true
+        $WindowEnd = $End
+        while ($WindowEnd -gt $Start) {
+            $WindowStart = $WindowEnd.AddDays(-10)
+            if ($WindowStart -lt $Start) { $WindowStart = $Start }
+            $Trace = Get-CIPPBecMessageTrace -TenantFilter $TenantFilter -SenderAddress $SenderAddress -StartDate $WindowStart -EndDate $WindowEnd
+            foreach ($Row in $Trace.Rows) { $Rows.Add($Row) }
+            if (-not $Trace.Complete) { $Complete = $false }
+            $WindowEnd = $WindowStart
+        }
+        if ($Subject) { $Rows = [System.Collections.Generic.List[object]]@($Rows | Where-Object { [string]$_.Subject -like "*$Subject*" }) }
+
+        $Recipients = @($Rows | Where-Object { $_.RecipientAddress } | Group-Object -Property { ([string]$_.RecipientAddress).ToLowerInvariant() } | ForEach-Object {
+                $Times = @($_.Group | ForEach-Object { try { ([datetime]$_.Received).ToUniversalTime() } catch { $null } } | Where-Object { $_ } | Sort-Object)
+                $Domain = ($_.Name -split '@')[-1]
+                [pscustomobject]@{
+                    Recipient     = $_.Name
+                    Internal      = ($Accepted.Count -gt 0 -and $Domain -in $Accepted)
+                    MessageCount  = @($_.Group.MessageTraceId | Select-Object -Unique).Count
+                    FirstReceived = if ($Times.Count -gt 0) { $Times[0].ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                    LastReceived  = if ($Times.Count -gt 0) { $Times[-1].ToString('yyyy-MM-ddTHH:mm:ssZ') } else { $null }
+                    Statuses      = (@($_.Group.Status | Where-Object { $_ } | Select-Object -Unique) -join ', ')
+                    Subjects      = (@($_.Group.Subject | Where-Object { $_ } | Select-Object -Unique | Select-Object -First 3) -join ' | ')
+                }
+            } | Sort-Object -Property @{ Expression = { $_.Internal }; Descending = $true }, Recipient)
+
+        $Body = [pscustomobject]@{
+            Sender       = $SenderAddress
+            Days         = $Days
+            Complete     = $Complete
+            TotalMessages = @($Rows.MessageTraceId | Select-Object -Unique).Count
+            Recipients   = $Recipients
+            InternalCount = @($Recipients | Where-Object { $_.Internal }).Count
+            ExternalCount = @($Recipients | Where-Object { -not $_.Internal }).Count
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Body = @{ Results = "Failed to trace the spread from $SenderAddress`: $($ErrorMessage.NormalizedError)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECRemediationActions.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECRemediationActions.ps1
new file mode 100644
index 0000000000000..d003cd7a22a59
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECRemediationActions.ps1	
@@ -0,0 +1,27 @@
+function Invoke-ListBECRemediationActions {
+    <#
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+    .ROLE
+        Identity.User.ReadWrite
+    .SYNOPSIS
+        Lists the available Business Email Compromise containment actions.
+    .DESCRIPTION
+        Returns the catalog of containment actions ExecBECRemediate accepts - id, label, description, impact (Low/Medium/High/Critical), whether it is reversible and whether it runs by default (the instance-wide defaults from CIPP settings).
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    try {
+        $Body = @(Get-CIPPBecContainmentActions | Select-Object Id, Label, Description, Impact, Reversible, DefaultSelected, Order, TargetSource, ParameterName)
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $Body = @{ Results = "Failed to list containment actions: $($_.Exception.Message)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECReports.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECReports.ps1
new file mode 100644
index 0000000000000..e15f2a96ae179
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListBECReports.ps1	
@@ -0,0 +1,52 @@
+function Invoke-ListBECReports {
+    <#
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+    .ROLE
+        Identity.User.Read
+    .SYNOPSIS
+        Lists Business Email Compromise runs.
+    .DESCRIPTION
+        Lists every stored BEC run (case id, user, status, threat level and score, when it was extracted, who requested it) for a tenant, or for every tenant with tenantFilter=AllTenants. Optionally narrowed to one user with userId. Runs are kept until deleted; this list never reads the result payloads.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $TenantFilter = $Request.Query.tenantFilter ?? 'AllTenants'
+    # Narrow the list to one user's run history
+    $UserId = $Request.Query.userId
+
+    try {
+        $Params = @{ TenantFilter = $TenantFilter }
+        if ($UserId) { $Params.UserId = $UserId }
+        $Runs = @(Get-CIPPBecReport @Params)
+        $Body = @($Runs | ForEach-Object {
+                [pscustomobject]@{
+                    CaseId            = $_.CaseId
+                    Tenant            = $_.Tenant
+                    UserId            = $_.UserId
+                    UserPrincipalName = $_.UserPrincipalName
+                    DisplayName       = $_.DisplayName
+                    Status            = $_.Status
+                    Level             = $_.Level
+                    Score             = $_.Score
+                    IncompleteCount   = $_.IncompleteCount
+                    ExtractedAt       = $_.ExtractedAt
+                    RequestedAt       = $_.RequestedAt
+                    RequestedBy       = $_.RequestedBy
+                    ErrorMessage      = $_.ErrorMessage
+                    ContainmentRuns   = @($_.Containment | Where-Object { $_ }).Count
+                }
+            })
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $Body = @{ Results = "Failed to list BEC runs: $($ErrorMessage.NormalizedError)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListOffboardingProgress.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListOffboardingProgress.ps1
index e96afac7ff28b..993db6cd0edd9 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListOffboardingProgress.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListOffboardingProgress.ps1	
@@ -5,17 +5,18 @@ function Invoke-ListOffboardingProgress {
     .ROLE
         Identity.User.Read
     .SYNOPSIS
-        Get the live progress of an offboarding job
+        Get the live progress of an offboarding or BEC remediation job
     .DESCRIPTION
-        Returns the progress rows of an offboarding job started from the wizard: one row per user with
-        its overall status and the status and message of every step. Same rows as ListAsyncDeployment.
+        Returns the progress rows of an offboarding job started from the wizard, or of a background BEC
+        remediation (ExecBECRemediate with Async): one row per user with its overall status and the
+        status and message of every step. Same rows as ListAsyncDeployment.
         This is a read-only GET, so it carries a read role; an offboarding operator (who holds the
         broader user write role) can still follow and re-run their jobs.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
 
-    # The DeploymentId handed back by ExecOffboardUser, also stored on each offboarding task
+    # The DeploymentId handed back by ExecOffboardUser (also stored on each offboarding task) or ExecBECRemediate
     $DeploymentId = $Request.Query.DeploymentId
     if (-not $DeploymentId) {
         return ([HttpResponseContext]@{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserConditionalAccessPolicies.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserConditionalAccessPolicies.ps1
deleted file mode 100644
index f13e72c768247..0000000000000
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserConditionalAccessPolicies.ps1	
+++ /dev/null
@@ -1,46 +0,0 @@
-Function Invoke-ListUserConditionalAccessPolicies {
-    <#
-    .FUNCTIONALITY
-        Entrypoint
-    .ROLE
-        Identity.User.Read
-    .DESCRIPTION
-        Lists Conditional Access policies that apply to a specific user in a tenant.
-    #>
-    [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-    # XXX - Unused endpoint?
-
-    # Interact with query parameters or the body of the request.
-    $TenantFilter = $Request.Query.tenantFilter
-    $UserID = $Request.Query.UserID
-
-    try {
-        $IncludeApplications = '67ad5377-2d78-4ac2-a867-6300cda00e85'
-        $CAContext = @{
-            '@odata.type'         = '#microsoft.graph.whatIfApplicationContext'
-            'includeApplications' = @($IncludeApplications)
-        }
-        $ConditionalAccessWhatIfDefinition = @{
-            'conditionalAccessWhatIfSubject'    = @{
-                '@odata.type' = '#microsoft.graph.userSubject'
-                'userId'      = "$UserID"
-            }
-            'conditionalAccessContext'          = $CAContext
-            'conditionalAccessWhatIfConditions' = @{}
-        }
-        $JSONBody = ConvertTo-Json -Depth 10 -InputObject $ConditionalAccessWhatIfDefinition -Compress
-
-        $GraphRequest = (New-GraphPostRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/evaluate' -tenantid $TenantFilter -type POST -body $JsonBody -AsApp $true).value
-    } catch {
-        $GraphRequest = @{}
-    }
-
-    Write-Host $GraphRequest
-
-    return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = @($GraphRequest)
-        })
-
-}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUsers.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUsers.ps1
index aecc61f06115c..d7d5fabda579e 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUsers.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUsers.ps1	
@@ -25,8 +25,9 @@ Function Invoke-ListUsers {
             'consentProvidedForMinor', 'country', 'createdDateTime', 'department', 'displayName',
             'employeeHireDate', 'employeeId', 'employeeLeaveDateTime', 'employeeType', 'faxNumber',
             'givenName', 'jobTitle', 'lastPasswordChangeDateTime', 'legalAgeGroupClassification', 'mail',
-            'mailNickname', 'mobilePhone', 'officeLocation', 'onPremisesDistinguishedName',
-            'onPremisesImmutableId', 'onPremisesLastSyncDateTime', 'onPremisesSyncEnabled', 'otherMails', 'postalCode',
+            'mailNickname', 'mobilePhone', 'officeLocation', 'onPremisesDistinguishedName', 'onPremisesDomainName',
+            'onPremisesImmutableId', 'onPremisesLastSyncDateTime', 'onPremisesSamAccountName', 'onPremisesSecurityIdentifier',
+            'onPremisesSyncEnabled', 'onPremisesUserPrincipalName', 'otherMails', 'postalCode',
             'preferredLanguage', 'proxyAddresses', 'showInAddressList', 'state', 'streetAddress',
             'surname', 'usageLocation', 'userPrincipalName', 'userType'
         )
@@ -127,10 +128,9 @@ Function Invoke-ListUsers {
             UserIds        = @($GraphRequest.userPrincipalName)
         }
         $AuditlogsLogon = (New-ExoRequest -tenantid $TenantFilter -cmdlet 'Search-unifiedAuditLog' -cmdParams $SearchParam | Sort-Object -Property CreationDate | Select-Object -Last 1).auditdata | ConvertFrom-Json
-        $AppName = '[{"Application Name":"ACOM Azure Website","Application IDs":"23523755-3a2b-41ca-9315-f81f3f566a95"},{"Application Name":"AEM-DualAuth","Application IDs":"69893ee3-dd10-4b1c-832d-4870354be3d8"},{"Application Name":"ASM Campaign Servicing","Application IDs":"0cb7b9ec-5336-483b-bc31-b15b5788de71"},{"Application Name":"Azure Advanced Threat Protection","Application IDs":"7b7531ad-5926-4f2d-8a1d-38495ad33e17"},{"Application Name":"Azure Data Lake","Application IDs":"e9f49c6b-5ce5-44c8-925d-015017e9f7ad"},{"Application Name":"Azure Lab Services Portal","Application IDs":"835b2a73-6e10-4aa5-a979-21dfda45231c"},{"Application Name":"Azure Portal","Application IDs":"c44b4083-3bb0-49c1-b47d-974e53cbdf3c"},{"Application Name":"AzureSupportCenter","Application IDs":"37182072-3c9c-4f6a-a4b3-b3f91cacffce"},{"Application Name":"Bing","Application IDs":"9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7"},{"Application Name":"CPIM Service","Application IDs":"bb2a2e3a-c5e7-4f0a-88e0-8e01fd3fc1f4"},{"Application Name":"CRM Power BI Integration","Application IDs":"e64aa8bc-8eb4-40e2-898b-cf261a25954f"},{"Application Name":"Dataverse","Application IDs":"00000007-0000-0000-c000-000000000000"},{"Application Name":"Enterprise Roaming and Backup","Application IDs":"60c8bde5-3167-4f92-8fdb-059f6176dc0f"},{"Application Name":"IAM Supportability","Application IDs":"a57aca87-cbc0-4f3c-8b9e-dc095fdc8978"},{"Application Name":"IrisSelectionFrontDoor","Application IDs":"16aeb910-ce68-41d1-9ac3-9e1673ac9575"},{"Application Name":"MCAPI Authorization Prod","Application IDs":"d73f4b35-55c9-48c7-8b10-651f6f2acb2e"},{"Application Name":"Media Analysis and Transformation Service","Application IDs":"944f0bd1-117b-4b1c-af26-804ed95e767e<br>0cd196ee-71bf-4fd6-a57c-b491ffd4fb1e"},{"Application Name":"Microsoft 365 Support Service","Application IDs":"ee272b19-4411-433f-8f28-5c13cb6fd407"},{"Application Name":"Microsoft App Access Panel","Application IDs":"0000000c-0000-0000-c000-000000000000"},{"Application Name":"Microsoft Approval Management","Application IDs":"65d91a3d-ab74-42e6-8a2f-0add61688c74<br>38049638-cc2c-4cde-abe4-4479d721ed44"},{"Application Name":"Microsoft Authentication Broker","Application IDs":"29d9ed98-a469-4536-ade2-f981bc1d605e"},{"Application Name":"Microsoft Azure CLI","Application IDs":"04b07795-8ddb-461a-bbee-02f9e1bf7b46"},{"Application Name":"Microsoft Azure PowerShell","Application IDs":"1950a258-227b-4e31-a9cf-717495945fc2"},{"Application Name":"Microsoft Bing Search","Application IDs":"cf36b471-5b44-428c-9ce7-313bf84528de"},{"Application Name":"Microsoft Bing Search for Microsoft Edge","Application IDs":"2d7f3606-b07d-41d1-b9d2-0d0c9296a6e8"},{"Application Name":"Microsoft Bing Default Search Engine","Application IDs":"1786c5ed-9644-47b2-8aa0-7201292175b6"},{"Application Name":"Microsoft Defender for Cloud Apps","Application IDs":"3090ab82-f1c1-4cdf-af2c-5d7a6f3e2cc7"},{"Application Name":"Microsoft Docs","Application IDs":"18fbca16-2224-45f6-85b0-f7bf2b39b3f3"},{"Application Name":"Microsoft Dynamics ERP","Application IDs":"00000015-0000-0000-c000-000000000000"},{"Application Name":"Microsoft Edge Insider Addons Prod","Application IDs":"6253bca8-faf2-4587-8f2f-b056d80998a7"},{"Application Name":"Microsoft Exchange Online Protection","Application IDs":"00000007-0000-0ff1-ce00-000000000000"},{"Application Name":"Microsoft Forms","Application IDs":"c9a559d2-7aab-4f13-a6ed-e7e9c52aec87"},{"Application Name":"Microsoft Graph","Application IDs":"00000003-0000-0000-c000-000000000000"},{"Application Name":"Microsoft Intune Web Company Portal","Application IDs":"74bcdadc-2fdc-4bb3-8459-76d06952a0e9"},{"Application Name":"Microsoft Intune Windows Agent","Application IDs":"fc0f3af4-6835-4174-b806-f7db311fd2f3"},{"Application Name":"Microsoft Learn","Application IDs":"18fbca16-2224-45f6-85b0-f7bf2b39b3f3"},{"Application Name":"Microsoft Office","Application IDs":"d3590ed6-52b3-4102-aeff-aad2292ab01c"},{"Application Name":"Microsoft Office 365 Portal","Application IDs":"00000006-0000-0ff1-ce00-000000000000"},{"Application Name":"Microsoft Office Web Apps Service","Application IDs":"67e3df25-268a-4324-a550-0de1c7f97287"},{"Application Name":"Microsoft Online Syndication Partner Portal","Application IDs":"d176f6e7-38e5-40c9-8a78-3998aab820e7"},{"Application Name":"Microsoft password reset service","Application IDs":"93625bc8-bfe2-437a-97e0-3d0060024faa"},{"Application Name":"Microsoft Power BI","Application IDs":"871c010f-5e61-4fb1-83ac-98610a7e9110"},{"Application Name":"Microsoft Storefronts","Application IDs":"28b567f6-162c-4f54-99a0-6887f387bbcc"},{"Application Name":"Microsoft Stream Portal","Application IDs":"cf53fce8-def6-4aeb-8d30-b158e7b1cf83"},{"Application Name":"Microsoft Substrate Management","Application IDs":"98db8bd6-0cc0-4e67-9de5-f187f1cd1b41"},{"Application Name":"Microsoft Support","Application IDs":"fdf9885b-dd37-42bf-82e5-c3129ef5a302"},{"Application Name":"Microsoft Teams","Application IDs":"1fec8e78-bce4-4aaf-ab1b-5451cc387264"},{"Application Name":"Microsoft Teams Services","Application IDs":"cc15fd57-2c6c-4117-a88c-83b1d56b4bbe"},{"Application Name":"Microsoft Teams Web Client","Application IDs":"5e3ce6c0-2b1f-4285-8d4b-75ee78787346"},{"Application Name":"Microsoft Whiteboard Services","Application IDs":"95de633a-083e-42f5-b444-a4295d8e9314"},{"Application Name":"O365 Suite UX","Application IDs":"4345a7b9-9a63-4910-a426-35363201d503"},{"Application Name":"Office 365 Exchange Online","Application IDs":"00000002-0000-0ff1-ce00-000000000000"},{"Application Name":"Office 365 Management","Application IDs":"00b41c95-dab0-4487-9791-b9d2c32c80f2"},{"Application Name":"Office 365 Search Service","Application IDs":"66a88757-258c-4c72-893c-3e8bed4d6899"},{"Application Name":"Office 365 SharePoint Online","Application IDs":"00000003-0000-0ff1-ce00-000000000000"},{"Application Name":"Office Delve","Application IDs":"94c63fef-13a3-47bc-8074-75af8c65887a"},{"Application Name":"Office Online Add-in SSO","Application IDs":"93d53678-613d-4013-afc1-62e9e444a0a5"},{"Application Name":"Office Online Client AAD- Augmentation Loop","Application IDs":"2abdc806-e091-4495-9b10-b04d93c3f040"},{"Application Name":"Office Online Client AAD- Loki","Application IDs":"b23dd4db-9142-4734-867f-3577f640ad0c"},{"Application Name":"Office Online Client AAD- Maker","Application IDs":"17d5e35f-655b-4fb0-8ae6-86356e9a49f5"},{"Application Name":"Office Online Client MSA- Loki","Application IDs":"b6e69c34-5f1f-4c34-8cdf-7fea120b8670"},{"Application Name":"Office Online Core SSO","Application IDs":"243c63a3-247d-41c5-9d83-7788c43f1c43"},{"Application Name":"Office Online Search","Application IDs":"a9b49b65-0a12-430b-9540-c80b3332c127"},{"Application Name":"Office.com","Application IDs":"4b233688-031c-404b-9a80-a4f3f2351f90"},{"Application Name":"Office365 Shell WCSS-Client","Application IDs":"89bee1f7-5e6e-4d8a-9f3d-ecd601259da7"},{"Application Name":"OfficeClientService","Application IDs":"0f698dd4-f011-4d23-a33e-b36416dcb1e6"},{"Application Name":"OfficeHome","Application IDs":"4765445b-32c6-49b0-83e6-1d93765276ca"},{"Application Name":"OfficeShredderWacClient","Application IDs":"4d5c2d63-cf83-4365-853c-925fd1a64357"},{"Application Name":"OMSOctopiPROD","Application IDs":"62256cef-54c0-4cb4-bcac-4c67989bdc40"},{"Application Name":"OneDrive SyncEngine","Application IDs":"ab9b8c07-8f02-4f72-87fa-80105867a763"},{"Application Name":"OneNote","Application IDs":"2d4d3d8e-2be3-4bef-9f87-7875a61c29de"},{"Application Name":"Outlook Mobile","Application IDs":"27922004-5251-4030-b22d-91ecd9a37ea4"},{"Application Name":"Partner Customer Delegated Admin Offline Processor","Application IDs":"a3475900-ccec-4a69-98f5-a65cd5dc5306"},{"Application Name":"Password Breach Authenticator","Application IDs":"bdd48c81-3a58-4ea9-849c-ebea7f6b6360"},{"Application Name":"Power BI Service","Application IDs":"00000009-0000-0000-c000-000000000000"},{"Application Name":"SharedWithMe","Application IDs":"ffcb16e8-f789-467c-8ce9-f826a080d987"},{"Application Name":"SharePoint Online Web Client Extensibility","Application IDs":"08e18876-6177-487e-b8b5-cf950c1e598c"},{"Application Name":"Signup","Application IDs":"b4bddae8-ab25-483e-8670-df09b9f1d0ea"},{"Application Name":"Skype for Business Online","Application IDs":"00000004-0000-0ff1-ce00-000000000000"},{"Application Name":"Sway","Application IDs":"905fcf26-4eb7-48a0-9ff0-8dcc7194b5ba"},{"Application Name":"Universal Store Native Client","Application IDs":"268761a2-03f3-40df-8a8b-c3db24145b6b"},{"Application Name":"Vortex [wsfed enabled]","Application IDs":"5572c4c0-d078-44ce-b81c-6cbf8d3ed39e"},{"Application Name":"Windows Azure Active Directory","Application IDs":"00000002-0000-0000-c000-000000000000"},{"Application Name":"Windows Azure Service Management API","Application IDs":"797f4846-ba00-4fd7-ba43-dac1f8f63013"},{"Application Name":"WindowsDefenderATP Portal","Application IDs":"a3b79187-70b2-4139-83f9-6016c58cd27b"},{"Application Name":"Windows Search","Application IDs":"26a7ee05-5602-4d76-a7ba-eae8b7b67941"},{"Application Name":"Windows Spotlight","Application IDs":"1b3c667f-cde3-4090-b60b-3d2abd0117f0"},{"Application Name":"Windows Store for Business","Application IDs":"45a330b1-b1ec-4cc1-9161-9f03992aa49f"},{"Application Name":"Yammer","Application IDs":"00000005-0000-0ff1-ce00-000000000000"},{"Application Name":"Yammer Web","Application IDs":"c1c74fed-04c9-4704-80dc-9f79a2e515cb"},{"Application Name":"Yammer Web Embed","Application IDs":"e1ef36fd-b883-4dbf-97f0-9ece4b576fc6"}]' |
-            ConvertFrom-Json | Where-Object -Property 'Application IDs' -EQ $AuditlogsLogon.applicationId
+        $AppName = Get-CIPPMicrosoftFirstPartyApp -AppId "$($AuditlogsLogon.applicationId)"
         $LastSignIn = [PSCustomObject]@{
-            AppDisplayName  = if ($AppName) { $AppName.'Application Name' } else { "$($AuditlogsLogon.Workload) - $($AuditlogsLogon.ApplicationId) " }
+            AppDisplayName  = if ($AppName) { $AppName } else { "$($AuditlogsLogon.Workload) - $($AuditlogsLogon.ApplicationId) " }
             CreatedDateTime = $AuditlogsLogon.CreationTime
             Id              = $AuditlogsLogon.errorNumber
             Status          = $AuditlogsLogon.ResultStatus
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListAzureADConnectStatus.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListAzureADConnectStatus.ps1
index a892e9884d5a8..d0327d674a68b 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListAzureADConnectStatus.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListAzureADConnectStatus.ps1	
@@ -10,8 +10,23 @@ Function Invoke-ListAzureADConnectStatus {
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
     $TenantFilter = $Request.Query.TenantFilter
+    # Optional. Which section to return: 'AzureADConnectSettings' for the sync status and
+    # configuration, or 'AzureADObjectsInError' for objects that failed to sync. Omit to
+    # return both.
     $DataToReturn = $Request.Query.DataToReturn
-    Write-Host "DataToReturn: $DataToReturn"
+
+    switch ($DataToReturn) {
+        'AzureADConnectSettings' { }
+        'AzureADObjectsInError' { }
+        default {
+            if ($DataToReturn) {
+                return ([HttpResponseContext]@{
+                        StatusCode = [HttpStatusCode]::BadRequest
+                        Body       = 'DataToReturn must be AzureADConnectSettings or AzureADObjectsInError'
+                    })
+            }
+        }
+    }
 
     if (($DataToReturn -eq 'AzureADConnectSettings') -or ([string]::IsNullOrEmpty($DataToReturn)) ) {
         $ADConnectStatusGraph = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/organization' -tenantid $TenantFilter
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabelTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabelTemplate.ps1
index fa126d8aa740b..747e124ed0c24 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabelTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabelTemplate.ps1	
@@ -46,6 +46,25 @@ Function Invoke-AddSensitivityLabelTemplate {
         }
 
         $JSON = ([pscustomobject]$Ordered | ConvertTo-Json -Depth 10)
+
+        # Encryption rights granted to the source tenant's own domain would follow the template into every
+        # other tenant. Swap them for %defaultdomain% so each deploy resolves to the target tenant instead.
+        $SourceTenant = $Request.Body.tenantFilter
+        if ($SourceTenant -and $Source.PSObject.Properties['LabelActions']) {
+            $TenantInfo = Get-Tenants -TenantFilter $SourceTenant
+            $SourceDomains = [System.Collections.Generic.List[string]]::new()
+            foreach ($Domain in @($TenantInfo.defaultDomainName, $TenantInfo.initialDomainName)) {
+                if ($Domain) { $SourceDomains.Add($Domain) }
+            }
+            try {
+                $VerifiedDomains = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/domains?$select=id,isVerified' -tenantid $SourceTenant
+                foreach ($Domain in @($VerifiedDomains | Where-Object { $_.isVerified })) { $SourceDomains.Add($Domain.id) }
+            } catch {
+                Write-Information "Could not list domains for $SourceTenant, falling back to its default and initial domain: $($_.Exception.Message)"
+            }
+            $JSON = ConvertTo-CIPPSensitivityLabelDomainToken -Json $JSON -Domains $SourceDomains
+        }
+
         $Table = Get-CippTable -tablename 'templates'
         $Table.Force = $true
         Add-CIPPAzDataTableEntity @Table -Entity @{
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1
index 217ee9c22dbe5..61e780a456790 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSite.ps1	
@@ -16,7 +16,19 @@ function Invoke-AddSite {
     $SharePointObj = $Request.Body
 
     try {
-        $Result = New-CIPPSharepointSite -Headers $Headers -SiteName $SharePointObj.siteName -SiteDescription $SharePointObj.siteDescription -SiteOwner $SharePointObj.siteOwner.value -TemplateName $SharePointObj.templateName.value -SiteDesign $SharePointObj.siteDesign.value -SensitivityLabel $SharePointObj.sensitivityLabel -TenantFilter $TenantFilter
+        $SiteParams = @{
+            Headers          = $Headers
+            SiteName         = $SharePointObj.siteName
+            SiteDescription  = $SharePointObj.siteDescription
+            SiteOwner        = $SharePointObj.siteOwner.value
+            TemplateName     = $SharePointObj.templateName.value
+            SensitivityLabel = $SharePointObj.sensitivityLabel
+            IsPublic         = ($SharePointObj.isPublic -eq $true)
+            TenantFilter     = $TenantFilter
+        }
+        # Optional. Only applies to the Team and Communication templates; omitted for TeamGroup.
+        if ($SharePointObj.siteDesign.value) { $SiteParams.SiteDesign = $SharePointObj.siteDesign.value }
+        $Result = New-CIPPSharepointSite @SiteParams
         $StatusCode = [HttpStatusCode]::OK
     } catch {
         $StatusCode = [HttpStatusCode]::InternalServerError
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1
index 4be0abc117338..d1a862ed710f9 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-AddSiteBulk.ps1	
@@ -15,7 +15,19 @@ Function Invoke-AddSiteBulk {
 
     foreach ($sharePointObj in $Request.Body.bulkSites) {
         try {
-            $SharePointSite = New-CIPPSharepointSite -Headers $Headers -SiteName $sharePointObj.siteName -SiteDescription $sharePointObj.siteDescription -SiteOwner $sharePointObj.siteOwner -TemplateName $sharePointObj.templateName -SiteDesign $sharePointObj.siteDesign -SensitivityLabel $sharePointObj.sensitivityLabel -TenantFilter $Request.body.tenantFilter
+            $SiteParams = @{
+                Headers          = $Headers
+                SiteName         = $sharePointObj.siteName
+                SiteDescription  = $sharePointObj.siteDescription
+                SiteOwner        = $sharePointObj.siteOwner
+                TemplateName     = $sharePointObj.templateName
+                SensitivityLabel = $sharePointObj.sensitivityLabel
+                IsPublic         = ([string]$sharePointObj.isPublic -in @('true', '1'))
+                TenantFilter     = $Request.body.tenantFilter
+            }
+            # Optional. Only applies to the Team and Communication templates; leave blank for TeamGroup.
+            if ($sharePointObj.siteDesign) { $SiteParams.SiteDesign = $sharePointObj.siteDesign }
+            $SharePointSite = New-CIPPSharepointSite @SiteParams
             $Results.Add($SharePointSite)
         } catch {
             $Results.Add("Failed to create $($sharePointObj.siteName) Error message: $($_.Exception.Message)")
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecGetPermissionsReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecGetPermissionsReportPdf.ps1
new file mode 100644
index 0000000000000..af1c283c1e28b
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecGetPermissionsReportPdf.ps1	
@@ -0,0 +1,48 @@
+function Invoke-ExecGetPermissionsReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Sharepoint.Site.Read
+    .DESCRIPTION
+        Server-renders the SharePoint Permissions report as application/pdf bytes. Gathers the same shaped
+        data the Permissions page uses (ListSharePointPermissions, from the CIPP reporting cache), composes
+        it through the shared CIPPSharp component kit (Build-CippPermissionsReportTree) and returns the
+        finished PDF - the server-side replacement for the client react-pdf PermissionsReportButton.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A tenantFilter is required' })
+        }
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter
+
+        # The same shaped data the Permissions page reads (from the reporting cache).
+        $Raw = Get-CIPPSharePointPermissionsReport -TenantFilter $TenantFilter
+        $Report = Build-CippPermissionsReportTree -Data @{
+            TenantName   = $TenantName
+            summary      = $Raw.summary
+            assignments  = $Raw.assignments
+            skippedSites = $Raw.skippedSites
+        }
+
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName $TenantName -TenantFilter $TenantFilter -ReportName 'Permissions Report'
+        $FileName = ("Permissions_Report_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render Permissions report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecGetSharingReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecGetSharingReportPdf.ps1
new file mode 100644
index 0000000000000..892954f9b649e
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecGetSharingReportPdf.ps1	
@@ -0,0 +1,49 @@
+function Invoke-ExecGetSharingReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Sharepoint.Site.Read
+    .DESCRIPTION
+        Server-renders the SharePoint & OneDrive Sharing report as application/pdf bytes. Gathers the same
+        shaped data the Sharing page uses (ListSharePointSharing, from the CIPP reporting cache), composes
+        it through the shared CIPPSharp component kit (Build-CippSharingReportTree) and returns the finished
+        PDF - the server-side replacement for the client react-pdf SharingReportButton.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A tenantFilter is required' })
+        }
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter
+
+        # The same shaped data the Sharing page reads (from the reporting cache; no live Graph enumeration).
+        $Raw = Get-CIPPSharePointSharingReport -TenantFilter $TenantFilter
+        $Report = Build-CippSharingReportTree -Data @{
+            TenantName    = $TenantName
+            summary       = $Raw.summary
+            links         = $Raw.links
+            topRecipients = $Raw.topRecipients
+            topLibraries  = $Raw.topLibraries
+        }
+
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName $TenantName -TenantFilter $TenantFilter -ReportName 'Sharing Report'
+        $FileName = ("Sharing_Report_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render Sharing report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1
index 3a65a68860458..da17035231b01 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetSharePointMember.ps1	
@@ -5,7 +5,7 @@ function Invoke-ExecSetSharePointMember {
     .ROLE
         Sharepoint.Site.ReadWrite
     .DESCRIPTION
-        Adds or removes a user in a SharePoint site role (Owners, Members or Visitors).
+        Adds one or more users to, or removes a user from, a SharePoint site role (Owners, Members or Visitors).
         Group-connected sites manage Owners/Members through the backing M365 group via Graph;
         Visitors (and classic/communication sites entirely) are managed through the site's
         associated SharePoint role groups via the SharePoint REST API using certificate
@@ -19,115 +19,29 @@ function Invoke-ExecSetSharePointMember {
     $APIName = $Request.Params.CIPPEndpoint
     $Headers = $Request.Headers
     $TenantFilter = $Request.Body.tenantFilter
-    $UPN = $Request.Body.user.value
-    $Add = $Request.Body.Add -eq $true
 
     # Role comes from the removal picker's selected entry when present, else from the form.
-    $Role = $Request.Body.user.addedFields.Group ?? $Request.Body.Role ?? 'Members'
-    $MemberType = $Request.Body.user.addedFields.Type
-    $AssociatedGroups = @{
-        'Owners'   = 'associatedownergroup'
-        'Members'  = 'associatedmembergroup'
-        'Visitors' = 'associatedvisitorgroup'
+    $MemberParams = @{
+        TenantFilter      = $TenantFilter
+        UserPrincipalName = @($Request.Body.user.value | Where-Object { $_ })
+        Role              = @($Request.Body.user.addedFields.Group)[0] ?? $Request.Body.Role ?? 'Members'
+        Add               = $Request.Body.Add -eq $true
+        SharePointType    = $Request.Body.SharePointType
+        GroupId           = $Request.Body.GroupID
+        SiteUrl           = $Request.Body.URL
+        MemberType        = @($Request.Body.user.addedFields.Type)[0]
+        Headers           = $Headers
+        APIName           = $APIName
     }
 
     try {
-        if (-not $UPN) { throw 'No user was selected.' }
-        if (-not $AssociatedGroups.ContainsKey([string]$Role)) {
-            throw "Invalid role '$Role'. Valid roles are: $($AssociatedGroups.Keys -join ', ')."
-        }
-
-        $IsGroupSite = $Request.Body.SharePointType -eq 'Group'
-        # Owners/Members of a group-connected site live in the M365 group. Visitors are always
-        # a SharePoint role group. A removal of a directly-added user (Type 'User') on a group
-        # site targets the SharePoint role group instead of the M365 group.
-        $UseGraphGroup = $IsGroupSite -and $Role -ne 'Visitors' -and ($Add -or $MemberType -ne 'User')
-
-        if ($UseGraphGroup) {
-            if ($Request.Body.GroupID -match '^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$') {
-                $GroupId = $Request.Body.GroupID
-            } else {
-                $GroupId = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/groups?`$filter=mail eq '$($Request.Body.GroupID)' or proxyAddresses/any(x:endsWith(x,'$($Request.Body.GroupID)')) or mailNickname eq '$($Request.Body.GroupID)'" -ComplexFilter -tenantid $TenantFilter).id
-            }
-
-            if ($Role -eq 'Owners') {
-                $UserID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$UPN`?`$select=id" -tenantid $TenantFilter).id
-                if ($Add) {
-                    $OwnerBody = ConvertTo-Json -Compress -InputObject @{ '@odata.id' = "https://graph.microsoft.com/v1.0/directoryObjects/$UserID" }
-                    $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/owners/`$ref" -tenantid $TenantFilter -type POST -body $OwnerBody
-                    $Results = "Successfully added $UPN as an owner of the M365 group backing the site."
-                } else {
-                    $null = New-GraphPostRequest -uri "https://graph.microsoft.com/v1.0/groups/$GroupId/owners/$UserID/`$ref" -tenantid $TenantFilter -type DELETE -body ''
-                    $Results = "Successfully removed $UPN as an owner of the M365 group backing the site."
-                }
-                Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info
-            } else {
-                if ($Add) {
-                    $Results = Add-CIPPGroupMember -GroupType 'Team' -GroupID $GroupID -Member $UPN -TenantFilter $TenantFilter -Headers $Headers
-                } else {
-                    $UserID = (New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/users/$UPN`?`$select=id" -tenantid $TenantFilter).id
-                    $Results = Remove-CIPPGroupMember -GroupType 'Team' -GroupID $GroupID -Member $UserID -TenantFilter $TenantFilter -Headers $Headers
-                }
-            }
-            $StatusCode = [HttpStatusCode]::OK
-        } else {
-            # SharePoint role group management via REST with certificate auth.
-            $SiteUrl = $Request.Body.URL
-            if (-not $SiteUrl) { throw 'No site URL was provided for this site.' }
-
-            $RestContext = Resolve-CIPPSharePointRestContext -TenantFilter $TenantFilter -SiteUrl $SiteUrl
-            $Scope = $RestContext.Scope
-            $JsonAccept = $RestContext.Headers
-            $BaseUri = $RestContext.BaseUri
-            $RoleGroup = $AssociatedGroups[[string]$Role]
-            $RoleLabel = ([string]$Role).ToLower().TrimEnd('s')
-            $Article = if ($RoleLabel -match '^[aeiou]') { 'an' } else { 'a' }
-
-            try {
-                $EnsureBody = ConvertTo-Json -Compress -InputObject @{ logonName = "i:0#.f|membership|$UPN" }
-                $EnsuredUser = New-GraphPostRequest -uri "$BaseUri/web/ensureuser" -tenantid $TenantFilter -scope $Scope -type POST -body $EnsureBody -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true
-            } catch {
-                throw "Could not resolve $UPN on the site (ensureuser): $($_.Exception.Message)"
-            }
-            if (-not $EnsuredUser.Id) {
-                throw "Could not resolve $UPN on the site."
-            }
-
-            if ($Add) {
-                # Same shape PnP sends: an SP.User entity posted to the group's users
-                # collection, which requires the odata=verbose content type.
-                $AddBody = ConvertTo-Json -Compress -Depth 5 -InputObject @{
-                    '__metadata' = @{ 'type' = 'SP.User' }
-                    'LoginName'  = $EnsuredUser.LoginName
-                }
-                try {
-                    $null = New-GraphPostRequest -uri "$BaseUri/web/$RoleGroup/users" -tenantid $TenantFilter -scope $Scope -type POST -body $AddBody -contentType 'application/json;odata=verbose' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true
-                } catch {
-                    throw "Could not add $UPN to the site $Role group: $($_.Exception.Message)"
-                }
-                $Results = "Successfully added $UPN as $Article $RoleLabel of $SiteUrl."
-            } else {
-                try {
-                    $null = New-GraphPostRequest -uri "$BaseUri/web/$RoleGroup/users/removebyid($($EnsuredUser.Id))" -tenantid $TenantFilter -scope $Scope -type POST -body '{}' -contentType 'application/json;odata=nometadata' -AddedHeaders $JsonAccept -UseCertificate -AsApp $true
-                } catch {
-                    if ($_.Exception.Message -match 'Can not find the user') {
-                        throw "$UPN is not in the site's $Role group."
-                    }
-                    throw "Could not remove $UPN from the site $Role group: $($_.Exception.Message)"
-                }
-                $Results = "Successfully removed $UPN as $Article $RoleLabel of $SiteUrl."
-            }
-            Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Info
-            $StatusCode = [HttpStatusCode]::OK
-        }
+        $Results = Set-CIPPSharePointSiteMember @MemberParams
+        $StatusCode = [HttpStatusCode]::OK
     } catch {
-        $ErrorMessage = Get-CippException -Exception $_
-        $Results = "Failed to modify $Role for $($Request.Body.URL ?? $Request.Body.GroupID). Error: $($ErrorMessage.NormalizedError)"
-        Write-LogMessage -Headers $Headers -API $APIName -tenant $TenantFilter -message $Results -sev Error -LogData $ErrorMessage
+        $Results = $_.Exception.Message
         $StatusCode = [HttpStatusCode]::BadRequest
     }
 
-
     return ([HttpResponseContext]@{
             StatusCode = $StatusCode
             Body       = @{ 'Results' = $Results }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointPermissions.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointPermissions.ps1
index a6b7f59a4a838..938c32b37fbd4 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointPermissions.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointPermissions.ps1	
@@ -27,135 +27,7 @@ function Invoke-ListSharePointPermissions {
     param($Request, $TriggerMetadata)
 
     $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
-
-    # A readable label for a site that has no display name, taken from the last path segment of
-    # its URL: '.../sites/AllCompany' becomes 'AllCompany', '.../search' becomes 'search'.
-    function Get-CIPPSiteLabel {
-        param([string]$SiteUrl)
-        if ([string]::IsNullOrWhiteSpace($SiteUrl)) { return 'Unnamed site' }
-        try {
-            $Path = ([System.Uri]$SiteUrl).AbsolutePath.Trim('/')
-            if ($Path) { return ($Path -split '/')[-1] }
-            return 'Root site'
-        } catch {
-            return 'Unnamed site'
-        }
-    }
-
-    # --- Cached dataset from the CIPP reporting database ---
-    try {
-        $CacheRows = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'SharePointPermissions')
-    } catch {
-        $CacheRows = @()
-    }
-
-    $PermissionsSynced = $false
-    $LastDataRefresh = $null
-    try {
-        $CountRow = Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'SharePointPermissions' -CountsOnly | Select-Object -First 1
-        if ($CountRow) { $PermissionsSynced = $true }
-        if ($CountRow.Timestamp) { $LastDataRefresh = $CountRow.Timestamp }
-    } catch {}
-
-    $SiteRows = @($CacheRows | Where-Object { $_.rowType -eq 'Site' })
-    $Assignments = @($CacheRows | Where-Object { $_.rowType -eq 'Assignment' })
-
-    # --- Scan coverage ---
-    $SitesScanned = 0; $LibrariesScanned = 0; $UniquePermissionLibraries = 0
-    $SkippedSites = [System.Collections.Generic.List[object]]::new()
-    foreach ($Site in $SiteRows) {
-        $SitesScanned++
-        $LibrariesScanned += [int]($Site.librariesScanned ?? 0)
-        $UniquePermissionLibraries += [int]($Site.librariesWithUniquePermissions ?? 0)
-        if ($Site.collectionStatus -eq 'Skipped') {
-            $SkippedSites.Add([PSCustomObject]@{
-                    siteName = $Site.siteName
-                    siteUrl  = $Site.siteUrl
-                    error    = $Site.collectionError
-                })
-        }
-    }
-
-    # --- Assignment rollups ---
-    $BroadClaimGrants = 0; $ExternalGrants = 0; $DirectFullControlGrants = 0
-    $ByPermissionLevel = @{}
-    $ByPrincipalType = @{}
-    $ByBroadClaim = @{}
-    $BySiteUnique = @{}
-    $RealAssignments = 0
-    foreach ($Assignment in $Assignments) {
-        # Placeholder rows for a unique-permission library with nothing granted carry no principal.
-        if (-not $Assignment.principalId) { continue }
-        # SharePoint maintains Limited Access itself; it grants nothing on its own.
-        if ($Assignment.isSystemManaged -eq $true) { continue }
-        $RealAssignments++
-
-        $Level = [string]($Assignment.permissionLevel ?? 'Unknown')
-        $ByPermissionLevel[$Level] = [int]($ByPermissionLevel[$Level] ?? 0) + 1
-        $Type = [string]($Assignment.principalType ?? 'Other')
-        $ByPrincipalType[$Type] = [int]($ByPrincipalType[$Type] ?? 0) + 1
-
-        if ($Assignment.broadClaim) {
-            $BroadClaimGrants++
-            $Claim = [string]$Assignment.broadClaim
-            $ByBroadClaim[$Claim] = [int]($ByBroadClaim[$Claim] ?? 0) + 1
-        }
-        if ($Assignment.isGuest -eq $true) { $ExternalGrants++ }
-        # Full Control held by anything other than a SharePoint group means it was granted
-        # directly rather than through the site's Owners group, which every site has by default.
-        if ($Level -eq 'Full Control' -and $Assignment.principalType -ne 'SharePoint Group') {
-            $DirectFullControlGrants++
-        }
-    }
-
-    # Libraries that no longer inherit, counted per site for the chart.
-    foreach ($Site in $SiteRows) {
-        $Unique = [int]($Site.librariesWithUniquePermissions ?? 0)
-        if ($Unique -gt 0) {
-            $SiteName = [string]($Site.siteName ?? $Site.siteUrl)
-            if ($SiteName) { $BySiteUnique[$SiteName] = [int]($BySiteUnique[$SiteName] ?? 0) + $Unique }
-        }
-    }
-
-    $Body = [PSCustomObject]@{
-        summary                   = [PSCustomObject]@{
-            sitesScanned              = $SitesScanned
-            sitesSkipped              = $SkippedSites.Count
-            librariesScanned          = $LibrariesScanned
-            uniquePermissionLibraries = $UniquePermissionLibraries
-            totalAssignments          = $RealAssignments
-            broadClaimGrants          = $BroadClaimGrants
-            externalGrants            = $ExternalGrants
-            directFullControlGrants   = $DirectFullControlGrants
-            permissionsSynced         = $PermissionsSynced
-            lastDataRefresh           = $LastDataRefresh
-        }
-        byPermissionLevel         = @($ByPermissionLevel.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object { [PSCustomObject]@{ level = $_.Key; grants = $_.Value } })
-        byPrincipalType           = @($ByPrincipalType.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object { [PSCustomObject]@{ type = $_.Key; grants = $_.Value } })
-        byBroadClaim              = @($ByBroadClaim.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object { [PSCustomObject]@{ claim = $_.Key; grants = $_.Value } })
-        topSitesByUniqueLibraries = @($BySiteUnique.GetEnumerator() | Sort-Object -Property Value -Descending | Select-Object -First 10 | ForEach-Object { [PSCustomObject]@{ site = $_.Key; libraries = $_.Value } })
-        skippedSites              = @($SkippedSites)
-        # Display fields are derived here rather than stored, so existing cached data gains them
-        # without waiting for a re-scan.
-        #
-        # appliesTo spells out what scope means for a reader scanning the table. Every Library row
-        # is by definition a library that stopped inheriting - libraries that still inherit are not
-        # collected, because their permissions are the site's repeated.
-        #
-        # siteName falls back to a label built from the URL for the handful of system sites that
-        # have no name. The URL itself is not used: the tables render any value starting with http
-        # as a link, and a column of links where names should be is worse than a plain label.
-        assignments               = @($Assignments | ForEach-Object {
-                $AppliesTo = if ($_.scope -eq 'Library') { 'This library only' } else { 'Whole site' }
-                $_ | Add-Member -NotePropertyName 'appliesTo' -NotePropertyValue $AppliesTo -Force
-
-                $SiteName = [string]$_.siteName
-                if ([string]::IsNullOrWhiteSpace($SiteName) -or $SiteName -like 'http*') {
-                    $_ | Add-Member -NotePropertyName 'siteName' -NotePropertyValue (Get-CIPPSiteLabel -SiteUrl $_.siteUrl) -Force
-                }
-                $_
-            })
-    }
+    $Body = Get-CIPPSharePointPermissionsReport -TenantFilter $TenantFilter
 
     return ([HttpResponseContext]@{
             StatusCode = [HttpStatusCode]::OK
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointSharing.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointSharing.ps1
index 7faa7e9172fea..220821ebb9e09 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointSharing.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharePointSharing.ps1	
@@ -19,137 +19,7 @@ function Invoke-ListSharePointSharing {
     param($Request, $TriggerMetadata)
 
     $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
-
-    # Usage report values can arrive as numbers, strings or empty strings depending on the tenant.
-    function ConvertTo-SafeDouble {
-        param($Value)
-        $Parsed = [double]0
-        if ($null -ne $Value -and [double]::TryParse("$Value", [ref]$Parsed)) { return $Parsed }
-        return [double]0
-    }
-
-    # --- Cached datasets from the CIPP reporting database ---
-    $CacheTypes = @('SharePointSharingLinks', 'SharePointSiteUsage', 'OneDriveUsage')
-    $CacheData = @{}
-    $CacheSynced = @{}
-    $CacheTimestamps = [System.Collections.Generic.List[object]]::new()
-    foreach ($Type in $CacheTypes) {
-        try {
-            $CacheData[$Type] = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type $Type)
-        } catch {
-            $CacheData[$Type] = @()
-        }
-        $CacheSynced[$Type] = $false
-        try {
-            $CountRow = Get-CIPPDbItem -TenantFilter $TenantFilter -Type $Type -CountsOnly | Select-Object -First 1
-            if ($CountRow) { $CacheSynced[$Type] = $true }
-            if ($CountRow.Timestamp) { $CacheTimestamps.Add($CountRow.Timestamp) }
-        } catch {}
-    }
-    $LastDataRefresh = $CacheTimestamps | Sort-Object | Select-Object -First 1
-
-    # --- Environment summaries per workload. Teams-connected sites (rootWebTemplate 'Group')
-    #     are reported separately from the remaining SharePoint sites; OneDrive is per account. ---
-    $SharePointSites = 0; $SharePointFiles = [int64]0; $SharePointStorage = [double]0
-    $TeamsSites = 0; $TeamsFiles = [int64]0; $TeamsStorage = [double]0
-    foreach ($Site in $CacheData['SharePointSiteUsage']) {
-        $Files = [int64](ConvertTo-SafeDouble -Value $Site.fileCount)
-        $Storage = ConvertTo-SafeDouble -Value $Site.storageUsedInBytes
-        if ($Site.rootWebTemplate -eq 'Group') {
-            $TeamsSites++; $TeamsFiles += $Files; $TeamsStorage += $Storage
-        } else {
-            $SharePointSites++; $SharePointFiles += $Files; $SharePointStorage += $Storage
-        }
-    }
-
-    $OneDriveAccounts = 0; $OneDriveFiles = [int64]0; $OneDriveStorage = [double]0
-    foreach ($Account in $CacheData['OneDriveUsage']) {
-        $OneDriveAccounts++
-        $OneDriveFiles += [int64](ConvertTo-SafeDouble -Value $Account.fileCount)
-        $OneDriveStorage += ConvertTo-SafeDouble -Value $Account.storageUsedInBytes
-    }
-
-    # --- Sharing link rollups ---
-    $Links = $CacheData['SharePointSharingLinks']
-    $AnonymousLinks = 0; $ExternalLinks = 0; $InternalLinks = 0
-    $ByScope = @{}
-    $ByLinkType = @{}
-    $BySite = @{}
-    $ByLibrary = @{}
-    $ByRecipient = @{}
-    $SharedItemIds = [System.Collections.Generic.HashSet[string]]::new([System.StringComparer]::OrdinalIgnoreCase)
-    # Sprawl risk signals, derived from the same cached rows.
-    $AnonymousEditLinks = 0; $NeverExpiringAnonymousLinks = 0; $FolderShares = 0; $PasswordProtectedLinks = 0
-    foreach ($Link in $Links) {
-        switch ($Link.classification) {
-            'Anonymous' { $AnonymousLinks++ }
-            'External' { $ExternalLinks++ }
-            default { $InternalLinks++ }
-        }
-        $Scope = [string]($Link.classification ?? 'Internal')
-        $ByScope[$Scope] = [int]($ByScope[$Scope] ?? 0) + 1
-        $Type = [string]($Link.linkType ?? 'link')
-        $ByLinkType[$Type] = [int]($ByLinkType[$Type] ?? 0) + 1
-        $SiteName = [string]($Link.siteName ?? $Link.siteUrl)
-        if ($SiteName) { $BySite[$SiteName] = [int]($BySite[$SiteName] ?? 0) + 1 }
-        if ($Link.driveName) {
-            $LibraryLabel = if ($SiteName) { "$SiteName / $($Link.driveName)" } else { [string]$Link.driveName }
-            $ByLibrary[$LibraryLabel] = [int]($ByLibrary[$LibraryLabel] ?? 0) + 1
-        }
-        if ($Link.driveId -and $Link.itemId) { [void]$SharedItemIds.Add("$($Link.driveId)|$($Link.itemId)") }
-
-        # 'write' and 'owner' both mean the recipient can change the content.
-        $CanEdit = @($Link.roles) -contains 'write' -or @($Link.roles) -contains 'owner'
-        if ($Link.classification -eq 'Anonymous') {
-            if ($CanEdit) { $AnonymousEditLinks++ }
-            if (-not $Link.expirationDateTime) { $NeverExpiringAnonymousLinks++ }
-        }
-        # A share on a folder exposes everything below it, so it counts differently to a file share.
-        if ($Link.itemType -eq 'Folder' -and $Link.classification -in @('Anonymous', 'External')) { $FolderShares++ }
-        if ($Link.hasPassword -eq $true) { $PasswordProtectedLinks++ }
-
-        # Who the tenant is sharing with, counted from named external recipients only:
-        # anonymous links have no recipient and internal ones are not sprawl.
-        if ($Link.classification -eq 'External') {
-            foreach ($Recipient in @($Link.sharedWith)) {
-                if ([string]::IsNullOrWhiteSpace($Recipient)) { continue }
-                $ByRecipient[[string]$Recipient] = [int]($ByRecipient[[string]$Recipient] ?? 0) + 1
-            }
-        }
-    }
-
-    $Body = [PSCustomObject]@{
-        summary       = [PSCustomObject]@{
-            sharePointSites         = $SharePointSites
-            sharePointFiles         = $SharePointFiles
-            sharePointStorageUsedGB = [math]::Round($SharePointStorage / 1GB, 2)
-            teamsSites              = $TeamsSites
-            teamsFiles              = $TeamsFiles
-            teamsStorageUsedGB      = [math]::Round($TeamsStorage / 1GB, 2)
-            oneDriveAccounts        = $OneDriveAccounts
-            oneDriveFiles           = $OneDriveFiles
-            oneDriveStorageUsedGB   = [math]::Round($OneDriveStorage / 1GB, 2)
-            totalLinks              = @($Links).Count
-            anonymousLinks          = $AnonymousLinks
-            externalLinks           = $ExternalLinks
-            internalLinks           = $InternalLinks
-            itemsShared             = $SharedItemIds.Count
-            anonymousEditLinks      = $AnonymousEditLinks
-            neverExpiringAnonymous  = $NeverExpiringAnonymousLinks
-            folderShares            = $FolderShares
-            passwordProtectedLinks  = $PasswordProtectedLinks
-            externalRecipients      = $ByRecipient.Count
-            linksSynced             = $CacheSynced['SharePointSharingLinks']
-            usageSynced             = ($CacheSynced['SharePointSiteUsage'] -or $CacheSynced['OneDriveUsage'])
-            lastDataRefresh         = $LastDataRefresh
-        }
-        byScope       = @($ByScope.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object { [PSCustomObject]@{ scope = $_.Key; links = $_.Value } })
-        byLinkType    = @($ByLinkType.GetEnumerator() | Sort-Object -Property Value -Descending | ForEach-Object { [PSCustomObject]@{ type = $_.Key; links = $_.Value } })
-        topSites      = @($BySite.GetEnumerator() | Sort-Object -Property Value -Descending | Select-Object -First 10 | ForEach-Object { [PSCustomObject]@{ site = $_.Key; links = $_.Value } })
-        topLibraries  = @($ByLibrary.GetEnumerator() | Sort-Object -Property Value -Descending | Select-Object -First 10 | ForEach-Object { [PSCustomObject]@{ library = $_.Key; links = $_.Value } })
-        topRecipients = @($ByRecipient.GetEnumerator() | Sort-Object -Property Value -Descending | Select-Object -First 10 | ForEach-Object { [PSCustomObject]@{ recipient = $_.Key; links = $_.Value } })
-        links         = @($Links)
-    }
+    $Body = Get-CIPPSharePointSharingReport -TenantFilter $TenantFilter
 
     return ([HttpResponseContext]@{
             StatusCode = [HttpStatusCode]::OK
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1
index e4f6226c48a47..5693fc4ec0ea8 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSharepointQuota.ps1	
@@ -11,65 +11,67 @@ Function Invoke-ListSharepointQuota {
     param($Request, $TriggerMetadata)
     # Interact with query parameters or the body of the request.
     $TenantFilter = $Request.Query.tenantFilter
-    $GeoLocations = @()
+    $Live = [bool]$Request.Query.live
 
-    if ($TenantFilter -eq 'AllTenants') {
-        $UsedStoragePercentage = 'Not Supported'
-    } else {
+    if ($Live -eq $true) {
         try {
             $SharePointInfo = Get-SharePointAdminLink -Public $false -tenantFilter $TenantFilter
             $extraHeaders = @{
                 'Accept' = 'application/json'
             }
-            # StorageQuotas returns one row per geo location: on a Multi-Geo tenant this is a
-            # collection, on every other tenant a single row. Used storage is therefore the sum
-            # across geos, while TenantStorageMB is the shared tenant pool repeated identically
-            # on every row and must be taken once rather than summed.
-            # Cert-based app-only auth: SPO admin REST 401s delegated client-secret tokens on
-            # tenants where the service account lacks SharePoint admin rights, which made this
-            # endpoint silently return 'Not available'.
             $SharePointQuota = New-GraphGetRequest -extraHeaders $extraHeaders -scope "$($SharePointInfo.AdminUrl)/.default" -tenantid $TenantFilter -uri "$($SharePointInfo.AdminUrl)/_api/StorageQuotas()?api-version=1.3.2" -asapp $true -UseCertificate
-            # The API types every figure as a string. Cast each geo's used storage before summing
-            # (Measure-Object -Sum does not add strings, so this returned $null), and cast the
-            # tenant pool, so both surface as numbers instead of a null and a string.
             $GeoUsedStorageMB = (@($SharePointQuota) | ForEach-Object { [double]($_.GeoUsedStorageMB ?? 0) } | Measure-Object -Sum).Sum
             $TenantStorageRaw = @($SharePointQuota.TenantStorageMB | Where-Object { $_ }) | Select-Object -First 1
             $TenantStorageMB = if ($null -ne $TenantStorageRaw) { [double]$TenantStorageRaw } else { 0 }
-
-            # Per-geo detail so a Multi-Geo tenant can see where the used storage actually sits
-            # rather than only a tenant-wide total. The API types every figure as a string, so
-            # cast here and let callers work with numbers.
+            $GeoLocations = @()
             $GeoLocations = @(foreach ($Geo in @($SharePointQuota)) {
-                    if ($null -eq $Geo) { continue }
-                    [PSCustomObject]@{
-                        GeoLocation           = $Geo.GeoLocation
-                        GeoUsedStorageMB      = [double]($Geo.GeoUsedStorageMB ?? 0)
-                        GeoAllocatedStorageMB = [double]($Geo.GeoAllocatedStorageMB ?? 0)
-                        GeoAvailableStorageMB = [double]($Geo.GeoAvailableStorageMB ?? 0)
-                    }
-                })
+                if ($null -eq $Geo) { continue }
+                [PSCustomObject]@{
+                    GeoLocation           = $Geo.GeoLocation
+                    GeoUsedStorageMB      = [double]($Geo.GeoUsedStorageMB ?? 0)
+                    GeoAllocatedStorageMB = [double]($Geo.GeoAllocatedStorageMB ?? 0)
+                    GeoAvailableStorageMB = [double]($Geo.GeoAvailableStorageMB ?? 0)
+                }
+            })
 
             if ($TenantStorageMB) {
                 $UsedStoragePercentage = [int](($GeoUsedStorageMB / $TenantStorageMB) * 100)
             }
+
+            $SharePointQuotaDetails = @{
+                GeoUsedStorageMB = $GeoUsedStorageMB
+                TenantStorageMB  = $TenantStorageMB
+                Percentage       = $UsedStoragePercentage
+                Dashboard        = "$($UsedStoragePercentage) / 100"
+                GeoLocations     = @($GeoLocations)
+            }
         } catch {
-            $UsedStoragePercentage = 'Not available'
+            return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::InternalServerError
+                Body       = $_.Exception.Message
+            })
         }
-    }
 
-    $SharePointQuotaDetails = @{
-        GeoUsedStorageMB = $GeoUsedStorageMB
-        TenantStorageMB  = $TenantStorageMB
-        Percentage       = $UsedStoragePercentage
-        Dashboard        = "$($UsedStoragePercentage) / 100"
-        GeoLocations     = @($GeoLocations)
+    } else {
+        try {
+            $SharePointQuota = (Get-CIPPDbItem -tenantFilter $TenantFilter -Type SharePointUsageReport | Where-Object { $_.RowKey -notlike '*-Count' }).Data | ConvertFrom-Json
+            $SharePointQuotaDetails = [PSCustomObject]@{
+                GeoUsedStorageMB = $SharePointQuota.GeoUsedStorageMB
+                GeoLocations     = @($SharePointQuota.GeoLocations)
+                TenantStorageMB  = $SharePointQuota.TenantStorageMB
+                Percentage       = $SharePointQuota.Percentage
+                Dashboard        = $SharePointQuota.Dashboard
+            }
+        } catch {
+            return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::InternalServerError
+                Body       = $_.Exception.Message
+            })
+        }
     }
 
-    $StatusCode = [HttpStatusCode]::OK
-
     return ([HttpResponseContext]@{
-            StatusCode = $StatusCode
-            Body       = $SharePointQuotaDetails
-        })
-
-}
+        StatusCode = [HttpStatusCode]::OK
+        Body       = $SharePointQuotaDetails
+    })
+}
\ No newline at end of file
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1
index a32ad761e491c..648dca53f7c07 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteActivity.ps1	
@@ -13,6 +13,7 @@ function Invoke-ListSiteActivity {
 
     $APIName = 'ListSiteActivity'
     $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+    # Optional site-type filter: 'SharePoint' or 'TeamsSite'. Omit to return both.
     $Type = $Request.Query.Type ?? $Request.Body.Type
     $SiteId = $Request.Query.siteId ?? $Request.Body.siteId
 
@@ -23,11 +24,17 @@ function Invoke-ListSiteActivity {
             })
     }
 
-    if ($Type -and $Type -notin @('SharePoint', 'TeamsSite')) {
-        return ([HttpResponseContext]@{
-                StatusCode = [HttpStatusCode]::BadRequest
-                Body       = 'Type must be SharePoint or TeamsSite'
-            })
+    switch ($Type) {
+        'SharePoint' { }
+        'TeamsSite' { }
+        default {
+            if ($Type) {
+                return ([HttpResponseContext]@{
+                        StatusCode = [HttpStatusCode]::BadRequest
+                        Body       = 'Type must be SharePoint or TeamsSite'
+                    })
+            }
+        }
     }
 
     try {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1
index 725eb4f53c378..90f60d46c02a3 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSiteBrowser.ps1	
@@ -50,6 +50,7 @@ function Invoke-ListSiteBrowser {
             '^(?i)STS' { return 'Team site (classic)' }
             '(?i)Redirect' { return 'Redirect site' }
             '^(?i)APPCATALOG$' { return 'App catalog' }
+            '^(?i)TEAMCHANNEL$' { return 'Team Channel' }
             default { return $Normalized }
         }
     }
@@ -138,6 +139,25 @@ function Invoke-ListSiteBrowser {
                 }
             }
 
+            $RequestId = 0
+            $MissingSiteRequests = foreach ($Row in $AdminRows) {
+                $RowUrl = ([string]$Row.SiteUrl).TrimEnd('/')
+                $RowSiteId = ([string]$Row.SiteId).Trim('{}')
+                if ([string]::IsNullOrWhiteSpace($RowUrl) -or $GraphByWebUrl.ContainsKey($RowUrl) -or ($RowSiteId -and $GraphBySiteId.ContainsKey($RowSiteId))) { continue }
+                $SiteUri = [System.Uri]$RowUrl
+                @{
+                    id     = [string]$RequestId++
+                    method = 'GET'
+                    url    = "sites/$($SiteUri.Host):$($SiteUri.AbsolutePath)?`$select=id,createdDateTime,description,name,displayName,webUrl,siteCollection,sharepointIds"
+                }
+            }
+            if (@($MissingSiteRequests).Count -gt 0) {
+                foreach ($Response in @(New-GraphBulkRequest -tenantid $TenantFilter -Requests @($MissingSiteRequests) -asapp $true | Where-Object { $_.status -eq 200 })) {
+                    $GraphBySiteId[([string]$Response.body.sharepointIds.siteId).Trim('{}').ToLowerInvariant()] = $Response.body
+                    $GraphByWebUrl[$Response.body.webUrl.TrimEnd('/').ToLowerInvariant()] = $Response.body
+                }
+            }
+
             foreach ($Row in $AdminRows) {
                 $RowUrl = [string]$Row.SiteUrl
                 $RowTitle = [string]$Row.Title
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1
index 19c874be7152a..306d830b8c805 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1	
@@ -13,6 +13,7 @@ function Invoke-ListSites {
 
 
     $TenantFilter = $Request.Query.TenantFilter
+    # Required. Which usage set to list: SharePointSiteUsage or OneDriveUsageAccount.
     $Type = $Request.Query.Type
     # Serve from the reporting database cache instead of live Graph. Much faster, especially for AllTenants.
     $UseReportDB = $Request.Query.UseReportDB -eq $true
@@ -30,6 +31,18 @@ function Invoke-ListSites {
             })
     }
 
+    # Reject an unrecognised Type instead of silently treating it as OneDrive below.
+    switch ($Type) {
+        'SharePointSiteUsage' { }
+        'OneDriveUsageAccount' { }
+        default {
+            return ([HttpResponseContext]@{
+                    StatusCode = [HttpStatusCode]::BadRequest
+                    Body       = "Type '$Type' is invalid. Valid values: SharePointSiteUsage, OneDriveUsageAccount."
+                })
+        }
+    }
+
     if ($TenantFilter -eq 'AllTenants' -or $UseReportDB) {
         try {
             if ($Type -eq 'SharePointSiteUsage') {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecCopilotSettings.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecCopilotSettings.ps1
similarity index 99%
rename from Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecCopilotSettings.ps1
rename to Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecCopilotSettings.ps1
index 229aff09dc06b..765cb2bc2ec95 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecCopilotSettings.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecCopilotSettings.ps1	
@@ -3,7 +3,7 @@ function Invoke-ExecCopilotSettings {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Tenant.Standards.ReadWrite
+        Tenant.AI.ReadWrite
     .DESCRIPTION
         Sets a single Microsoft 365 Copilot policy setting to Enabled (1), Disabled (0) or Not configured (cleared).
     #>
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecGetShadowAIReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecGetShadowAIReportPdf.ps1
new file mode 100644
index 0000000000000..cdd72250a6f3b
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecGetShadowAIReportPdf.ps1	
@@ -0,0 +1,56 @@
+function Invoke-ExecGetShadowAIReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.AI.Read
+    .DESCRIPTION
+        Server-renders the Shadow AI report as application/pdf bytes. Gathers the same shaped data the
+        Shadow AI page uses (ListShadowAI) and composes it through the shared CIPPSharp component kit
+        (Build-CippShadowAIReportTree) - the server-side replacement for the client react-pdf
+        ShadowAIReportButton.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A tenantFilter is required' })
+        }
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter
+
+        # Optional per-section toggles from the client's section panel (POST body). Absent -> full report.
+        $SectionConfig = @{}
+        $RawCfg = $Request.Body.sectionConfig
+        if ($RawCfg -is [hashtable]) { $SectionConfig = $RawCfg }
+        elseif ($RawCfg) { foreach ($p in $RawCfg.PSObject.Properties) { $SectionConfig[$p.Name] = [bool]$p.Value } }
+
+        # The same shaped data the Shadow AI page reads (from the reporting cache).
+        $Raw = Get-CIPPShadowAIReport -TenantFilter $TenantFilter
+        $Report = Build-CippShadowAIReportTree -SectionConfig $SectionConfig -Data @{
+            TenantName    = $TenantName
+            summary       = $Raw.summary
+            detectedApps  = $Raw.detectedApps
+            consentedApps = $Raw.consentedApps
+            topTools      = $Raw.topTools
+            byRisk        = $Raw.byRisk
+        }
+
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName $TenantName -TenantFilter $TenantFilter -ReportName 'Shadow AI Report'
+        $FileName = ("Shadow_AI_Report_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render Shadow AI report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecShadowAISanction.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecShadowAISanction.ps1
similarity index 98%
rename from Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecShadowAISanction.ps1
rename to Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecShadowAISanction.ps1
index 7f75cfbe0fced..dde9c5d3a51a4 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecShadowAISanction.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ExecShadowAISanction.ps1	
@@ -3,7 +3,7 @@ function Invoke-ExecShadowAISanction {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Tenant.Standards.ReadWrite
+        Tenant.AI.ReadWrite
     .DESCRIPTION
         Marks an AI tool from the Shadow AI catalog as company sanctioned for a tenant, or removes
         that status. Sanctioned tools are stored per tenant in the ShadowAIConfig table and are
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListAgent365PackageDetail.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365PackageDetail.ps1
similarity index 97%
rename from Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListAgent365PackageDetail.ps1
rename to Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365PackageDetail.ps1
index 308cce78ff472..87be88770e2b7 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListAgent365PackageDetail.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365PackageDetail.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListAgent365PackageDetail {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Tenant.Standards.Read
+        Tenant.AI.Read
     .DESCRIPTION
         Gets the full detail for a single Microsoft Agent 365 / Copilot package by id, including the
         allowedUsersAndGroups, acquireUsersAndGroups and elementDetails that the list endpoint omits.
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListAgent365Packages.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365Packages.ps1
similarity index 98%
rename from Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListAgent365Packages.ps1
rename to Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365Packages.ps1
index 56ead8286c879..29d790c9d2a5f 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListAgent365Packages.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListAgent365Packages.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListAgent365Packages {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Tenant.Standards.Read
+        Tenant.AI.Read
     .DESCRIPTION
         Lists Microsoft Agent 365 / Copilot packages (agents and Microsoft 365 apps) in the tenant
         catalog via the Package Management API. Requires a Microsoft Agent 365 license on the tenant.
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListCopilotSettings.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotSettings.ps1
similarity index 99%
rename from Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListCopilotSettings.ps1
rename to Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotSettings.ps1
index 05456775b0e20..3d65c77b39bcf 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListCopilotSettings.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotSettings.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListCopilotSettings {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Tenant.Standards.Read
+        Tenant.AI.Read
     .DESCRIPTION
         Lists the Microsoft 365 Copilot admin policy settings for a tenant, one row per setting,
         with the current raw value and a friendly state (Enabled / Disabled / Not configured).
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListCopilotUsage.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotUsage.ps1
similarity index 99%
rename from Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListCopilotUsage.ps1
rename to Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotUsage.ps1
index eaaad1abb5585..cda0f93d3699c 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListCopilotUsage.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListCopilotUsage.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListCopilotUsage {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Tenant.Standards.Read
+        Tenant.AI.Read
     .DESCRIPTION
         Returns Microsoft 365 Copilot usage reports for a tenant, flattened into table rows.
         Type=Adoption  -> getMicrosoft365CopilotUserCountSummary (per-product enabled vs active users)
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListShadowAI.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListShadowAI.ps1
new file mode 100644
index 0000000000000..5de206247a047
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/AI/Invoke-ListShadowAI.ps1	
@@ -0,0 +1,24 @@
+function Invoke-ListShadowAI {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.AI.Read
+    .DESCRIPTION
+        Compiles a Shadow AI overview for a tenant by matching CACHED data from the CIPP reporting
+        database (DetectedApps, ServicePrincipals, OAuth2PermissionGrants) against the curated AI
+        catalog (Config/ShadowAI.json). No live Graph enumeration is performed - refresh the data by
+        syncing those caches (ExecCIPPDBCache). The only live call is a bounded, best-effort 7-day
+        sign-in lookup for the matched AI applications.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+    $Body = Get-CIPPShadowAIReport -TenantFilter $TenantFilter
+
+    return ([HttpResponseContext]@{
+            StatusCode = [HttpStatusCode]::OK
+            Body       = $Body
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-AddAlert.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-AddAlert.ps1
index fac3cedb5a371..72da0a246df9e 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-AddAlert.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-AddAlert.ps1	
@@ -36,12 +36,15 @@ function Invoke-AddAlert {
         $TenantsJson = $Tenants | ConvertTo-Json -Compress -Depth 10 | Out-String
         $excludedTenantsJson = $Request.Body.excludedTenants | ConvertTo-Json -Compress -Depth 10 | Out-String
         $Actions = $Request.Body.actions | ConvertTo-Json -Compress -Depth 10 | Out-String
+        # Which containment actions the 'becremediate' action runs (ListBECRemediationActions ids); empty = the default six.
+        $BecActions = @($Request.Body.becActions | ForEach-Object { if ($_ -and $_.PSObject.Properties['value']) { $_.value } else { $_ } } | Where-Object { $_ })
         $RowKey = $Request.Body.RowKey ? $Request.Body.RowKey : (New-Guid).ToString()
         $CompleteObject = @{
             Tenants           = [string]$TenantsJson
             excludedTenants   = [string]$excludedTenantsJson
             Conditions        = [string]$Conditions
             Actions           = [string]$Actions
+            BecActions        = [string](ConvertTo-Json -InputObject $BecActions -Compress -Depth 5)
             type              = $Request.Body.logbook.value
             RowKey            = $RowKey
             PartitionKey      = 'Webhookv2'
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1
index c00ca3409328a..061670ef647b7 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-ListAlertsQueue.ps1	
@@ -40,6 +40,7 @@ function Invoke-ListAlertsQueue {
             RawAlert        = @{
                 Conditions        = @($Conditions)
                 Actions           = @($($Task.Actions | ConvertFrom-Json -Depth 10 -ErrorAction SilentlyContinue))
+                BecActions        = @($($Task.BecActions | ConvertFrom-Json -Depth 10 -ErrorAction SilentlyContinue) | Where-Object { $_ })
                 Tenants           = @($Tenants)
                 type              = $Task.type
                 RowKey            = $Task.RowKey
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenant.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenant.ps1
index f1e53408b8749..13531e53047c9 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenant.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-EditTenant.ps1	
@@ -80,7 +80,8 @@ function Invoke-EditTenant {
         }
 
         # Remove any static groups that are no longer selected (dynamic groups are managed by the orchestrator)
-        if ($tenantGroups) {
+        # An empty selection clears static memberships; an omitted or null field leaves them unchanged.
+        if ($null -ne $tenantGroups) {
             foreach ($Group in $CurrentGroupMemberships) {
                 if ($StaticGroupIds -contains $Group.GroupId -and $tenantGroups.GroupId -notcontains $Group.GroupId) {
                     $GroupName = ($StaticGroups | Where-Object { $_.RowKey -eq $Group.GroupId }).Name
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1
index e0758ab8eb28d..f583743c2ac81 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ExecOnboardTenant.ps1	
@@ -39,6 +39,12 @@ function Invoke-ExecOnboardTenant {
                         $StandardsExcludeAllTenants = [bool]$ExistingOnboarding.StandardsExcludeAllTenants
                     }
 
+                    if ($Request.Body.PSObject.Properties.Name -contains 'tenantGroups') {
+                        $TenantGroups = [string](ConvertTo-Json -InputObject @($Request.Body.tenantGroups) -Compress)
+                    } else {
+                        $TenantGroups = [string]$ExistingOnboarding.TenantGroups
+                    }
+
                     $OnboardingSteps = [PSCustomObject]@{
                         'Step1' = @{
                             'Status'  = 'pending'
@@ -76,6 +82,7 @@ function Invoke-ExecOnboardTenant {
                         Logs                       = ''
                         Exception                  = ''
                         StandardsExcludeAllTenants = $StandardsExcludeAllTenants
+                        TenantGroups               = $TenantGroups
                     }
                     Add-CIPPAzDataTableEntity @OnboardTable -Entity $TenantOnboarding -Force -ErrorAction Stop
 
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1
index 70a461acb5c5a..6404e576495ce 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenants.ps1	
@@ -5,7 +5,7 @@ function Invoke-ListTenants {
     .ROLE
         CIPP.Core.Read
     .DESCRIPTION
-        Lists all managed tenants accessible to the current user, with support for cache clearing and tenant filtering. This is the primary endpoint for tenant enumeration.
+        Lists all managed tenants accessible to the current user, with support for cache clearing and tenant filtering. This is the primary endpoint for tenant enumeration. Pass Search for a fuzzy, case-insensitive substring lookup across displayName, defaultDomainName, initialDomainName and customerId when the exact domain is unknown.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -22,6 +22,11 @@ function Invoke-ListTenants {
 
     $IncludeOffboardingDefaults = $Request.Query.IncludeOffboardingDefaults
 
+    # Fuzzy tenant lookup: case-insensitive substring match over displayName, defaultDomainName,
+    # initialDomainName and customerId. Arbitrary verified domains are not indexed by Get-Tenants and
+    # cannot be matched here. Supports '*' wildcards. Use this when you don't know the exact domain.
+    $Search = $Request.Query.Search
+
     # Clear Cache
     if ($Request.Body.ClearCache -eq $true) {
         $Results = Remove-CIPPCache -tenantsOnly $Request.Body.TenantsOnly
@@ -50,9 +55,16 @@ function Invoke-ListTenants {
         #Get-Tenants -IncludeAll -TriggerRefresh
         return
     }
+    # Re-reads the tenant given in tenantFilter, or queues a refresh of all tenants when omitted. Returns a Results message instead of the tenant list.
     if ($Request.Query.TriggerRefresh) {
-        if ($Request.Query.TenantFilter -and $Request.Query.TenantFilter -ne 'AllTenants') {
-            Get-Tenants -TriggerRefresh -TenantFilter $Request.Query.TenantFilter
+        $TenantFilter = $Request.Query.TenantFilter
+        if ($TenantFilter -and $TenantFilter -ne 'AllTenants') {
+            $Refreshed = @(Get-Tenants -TriggerRefresh -TenantFilter $TenantFilter)
+            $Results = if ($Refreshed) {
+                "Refreshed tenant $($Refreshed[0].displayName) ($($Refreshed[0].defaultDomainName))."
+            } else {
+                "Tenant '$TenantFilter' not found."
+            }
         } else {
             $InputObject = [PSCustomObject]@{
                 Batch            = @(
@@ -64,7 +76,12 @@ function Invoke-ListTenants {
                 SkipLog          = $true
             }
             Start-CIPPOrchestrator -InputObject $InputObject
+            $Results = 'Refresh of all tenants queued. The list updates once it completes.'
         }
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::OK
+                Body       = @{ Results = $Results }
+            })
     }
     try {
         $TenantFilter = $Request.Query.tenantFilter
@@ -82,6 +99,15 @@ function Invoke-ListTenants {
             $Tenants = $Tenants | Where-Object -Property customerId -In $TenantAccess
         }
 
+        if ($Search) {
+            $Tenants = @($Tenants | Where-Object {
+                    $_.displayName -like "*$Search*" -or
+                    $_.defaultDomainName -like "*$Search*" -or
+                    $_.initialDomainName -like "*$Search*" -or
+                    $_.customerId -like "*$Search*"
+                })
+        }
+
         # If offboarding defaults are requested, fetch them
         if ($IncludeOffboardingDefaults -eq 'true' -and $Tenants) {
             $PropertiesTable = Get-CippTable -TableName 'TenantProperties'
@@ -116,7 +142,6 @@ function Invoke-ListTenants {
                     defaultDomainName = 'AllTenants'
                     displayName       = '*All Tenants'
                     domains           = 'AllTenants'
-                    GraphErrorCount   = 0
                 }
 
                 # Add offboarding defaults to AllTenants object if requested
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1
index d179814f4f3d0..70af1dc0f12db 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-SetAuthMethod.ps1	
@@ -39,7 +39,8 @@ function Invoke-SetAuthMethod {
         )
         foreach ($Setting in $OptionalSettings) {
             if ($null -ne $Request.Body.$Setting) {
-                $Params.$Setting = $Request.Body.$Setting
+                # select fields arrive as {label, value}
+                $Params.$Setting = $Request.Body.$Setting.value ?? $Request.Body.$Setting
             }
         }
         $Result = Set-CIPPAuthenticationPolicy @Params
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCACheck.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCACheck.ps1
index 68c0abd4d8e6e..cb2c27e2b175f 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCACheck.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCACheck.ps1	
@@ -5,43 +5,31 @@ function Invoke-ExecCaCheck {
     .ROLE
         Tenant.ConditionalAccess.Read
     .DESCRIPTION
-        Runs a Conditional Access "what if" evaluation, reporting which policies would apply to a sign-in with the given user, application, device platform, location, client app type and risk levels. Evaluation only - no sign-in occurs and no policy is changed.
+        Runs a Conditional Access "what if" evaluation, reporting which policies would apply to a sign-in with the given user, application, device platform, device compliance, location, client app type, authentication flow and risk levels. Evaluation only - no sign-in occurs and no policy is changed.
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
     $Tenant = $Request.Body.tenantFilter
-    $UserID = $Request.Body.userID.value
-    if ($Request.Body.IncludeApplications.value) {
-        $IncludeApplications = $Request.Body.IncludeApplications.value
-    } else {
-        $IncludeApplications = '67ad5377-2d78-4ac2-a867-6300cda00e85'
-    }
+    $UserID = $Request.Body.userID.value ?? $Request.Body.userID
     $Results = try {
-        $CAContext = @{
-            '@odata.type'         = '#microsoft.graph.applicationContext'
-            'includeApplications' = @($IncludeApplications)
-        }
-        $ConditionalAccessWhatIfDefinition = @{
-            'signInIdentity'   = @{
-                '@odata.type' = '#microsoft.graph.userSignIn'
-                'userId'      = "$UserID"
-            }
-            'signInContext'    = $CAContext
-            'signInConditions' = @{}
+        $Conditions = @{}
+        if ($Request.Body.UserRiskLevel) { $Conditions.userRiskLevel = $Request.Body.UserRiskLevel.value ?? $Request.Body.UserRiskLevel }
+        if ($Request.Body.SignInRiskLevel) { $Conditions.signInRiskLevel = $Request.Body.SignInRiskLevel.value ?? $Request.Body.SignInRiskLevel }
+        if ($Request.Body.InsiderRiskLevel) { $Conditions.insiderRiskLevel = $Request.Body.InsiderRiskLevel.value ?? $Request.Body.InsiderRiskLevel }
+        if ($Request.Body.ClientAppType) { $Conditions.clientAppType = $Request.Body.ClientAppType.value ?? $Request.Body.ClientAppType }
+        if ($Request.Body.DevicePlatform) { $Conditions.devicePlatform = $Request.Body.DevicePlatform.value ?? $Request.Body.DevicePlatform }
+        if ($Request.Body.Country) { $Conditions.country = $Request.Body.Country.value ?? $Request.Body.Country }
+        if ($Request.Body.IpAddress) { $Conditions.ipAddress = $Request.Body.IpAddress }
+        if ($Request.Body.authenticationFlow) { $Conditions.authenticationFlow = $Request.Body.authenticationFlow.value ?? $Request.Body.authenticationFlow }
+        if ($null -ne $Request.Body.DeviceCompliant) {
+            $Compliant = $Request.Body.DeviceCompliant.value ?? $Request.Body.DeviceCompliant
+            if ("$Compliant" -in @('true', 'false')) { $Conditions.deviceInfo = @{ isCompliant = [bool]::Parse("$Compliant") } }
         }
-        $whatIfConditions = $ConditionalAccessWhatIfDefinition.signInConditions
-        if ($Request.body.UserRiskLevel) { $whatIfConditions.userRiskLevel = $Request.body.UserRiskLevel.value }
-        if ($Request.body.SignInRiskLevel) { $whatIfConditions.signInRiskLevel = $Request.body.SignInRiskLevel.value }
-        if ($Request.body.ClientAppType) { $whatIfConditions.clientAppType = $Request.body.ClientAppType.value }
-        if ($Request.body.DevicePlatform) { $whatIfConditions.devicePlatform = $Request.body.DevicePlatform.value }
-        if ($Request.body.Country) { $whatIfConditions.country = $Request.body.Country.value }
-        if ($Request.body.IpAddress) { $whatIfConditions.ipAddress = $Request.body.IpAddress }
-        if ($Request.body.authenticationFlow) { $whatIfConditions.authenticationFlow = @{ transferMethod = $Request.body.authenticationFlow.value } }
 
-        $JSONBody = $ConditionalAccessWhatIfDefinition | ConvertTo-Json -Depth 10
-        Write-Host $JSONBody
-        $Request = New-GraphPOSTRequest -uri 'https://graph.microsoft.com/beta/identity/conditionalAccess/evaluate' -tenantid $tenant -type POST -body $JsonBody -AsApp $true
-        $Request
+        $Body = New-CIPPCAWhatIfRequest -UserId $UserID -IncludeApplications $Request.Body.IncludeApplications -Conditions $Conditions
+        $Evaluation = @(Invoke-CIPPCAWhatIf -TenantFilter $Tenant -Bodies @($Body))[0]
+        if ($Evaluation.Error) { throw $Evaluation.Error }
+        @{ value = @($Evaluation.Policies) }
         $StatusCode = [HttpStatusCode]::OK
     } catch {
         "Failed to execute check: $($_.Exception.Message)"
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecGetLicenseReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecGetLicenseReportPdf.ps1
new file mode 100644
index 0000000000000..21fbb1ebc1656
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ExecGetLicenseReportPdf.ps1	
@@ -0,0 +1,91 @@
+function Invoke-ExecGetLicenseReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Directory.Read
+    .DESCRIPTION
+        Server-renders the License Optimisation report as application/pdf bytes. Runs the same license
+        recommendation analysis the License Optimization page reads through ListLicenseRecommendations
+        (Get-CIPPLicenseRecommendation, with the page's currency, thresholds and recommendation switches)
+        and composes it through the shared CIPPSharp kit (Build-CippLicenseReportTree) - the server-side
+        replacement for the client react-pdf LicenseReportButton.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    # The tenant to report on. A single tenant; AllTenants is not supported.
+    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+    if ([string]::IsNullOrWhiteSpace($TenantFilter) -or $TenantFilter -eq 'AllTenants') {
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A single tenant is required for the license report.' })
+    }
+    # Currency the money figures are resolved in: a three-letter ISO code such as USD or EUR. Defaults to USD.
+    $Currency = [string]($Request.Body.currency ?? $Request.Query.currency ?? 'USD')
+    if ($Currency -notmatch '^[A-Za-z]{3}$') {
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'currency must be a three-letter ISO currency code.' })
+    }
+    $Currency = $Currency.ToUpperInvariant()
+    # Days without a sign-in after which a licensed person counts as inactive (1-365). Defaults to 90.
+    $InactiveDays = ($Request.Body.inactiveDays ?? $Request.Query.inactiveDays ?? 90) -as [int]
+    if ($InactiveDays -lt 1 -or $InactiveDays -gt 365) {
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'inactiveDays must be a whole number from 1 to 365.' })
+    }
+    # Months a seat must have been held by the same person to count as stable for a yearly commitment (1-36). Defaults to 6.
+    $TenureMonths = ($Request.Body.tenureMonths ?? $Request.Query.tenureMonths ?? 6) -as [int]
+    if ($TenureMonths -lt 1 -or $TenureMonths -gt 36) {
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'tenureMonths must be a whole number from 1 to 36.' })
+    }
+
+    # The recommendation switches, read exactly as ListLicenseRecommendations reads them so the PDF agrees
+    # with the page: missing is on, and only false/0/no/off turns a switch off.
+    $AsBool = {
+        param($Value, $Default)
+        if ($null -eq $Value -or [string]::IsNullOrWhiteSpace([string]$Value)) { return $Default }
+        return ([string]$Value) -notin @('false', '0', 'no', 'off')
+    }
+    $RecommendDowngrades = & $AsBool ($Request.Body.recommendDowngrades ?? $Request.Query.recommendDowngrades) $true
+    $RecommendUpgrades = & $AsBool ($Request.Body.recommendUpgrades ?? $Request.Query.recommendUpgrades) $true
+    $RecommendTerms = & $AsBool ($Request.Body.recommendTerms ?? $Request.Query.recommendTerms) $true
+    $ProtectSecurityFeatures = & $AsBool ($Request.Body.protectSecurityFeatures ?? $Request.Query.protectSecurityFeatures) $true
+
+    # Report pages to include. Each defaults to on; only an explicit false drops that page. The summary
+    # page is always included.
+    $Sections = @{
+        spend      = $Request.Body.sections.spend -ne $false
+        reclaim    = $Request.Body.sections.reclaim -ne $false
+        downgrades = $Request.Body.sections.downgrades -ne $false
+        upgrades   = $Request.Body.sections.upgrades -ne $false
+        terms      = $Request.Body.sections.terms -ne $false
+        method     = $Request.Body.sections.method -ne $false
+    }
+    # The branding preset to render against (the Licensing Report default from the branding settings),
+    # else the global branding.
+    $BrandingPresetId = [string]($Request.Body.brandingPresetId ?? $Request.Query.brandingPresetId)
+
+    try {
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter -BrandingPresetId $BrandingPresetId
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter $TenantFilter -Currency $Currency -InactiveDays $InactiveDays -TenureMonths $TenureMonths `
+            -RecommendDowngrades $RecommendDowngrades -RecommendUpgrades $RecommendUpgrades -RecommendTerms $RecommendTerms -ProtectSecurityFeatures $ProtectSecurityFeatures
+        $Data = @{ TenantName = $TenantName }
+        foreach ($Property in $Report.PSObject.Properties) { $Data[$Property.Name] = $Property.Value }
+
+        # Both date the report today in the instance's timezone.
+        $Tree = Build-CippLicenseReportTree -Data $Data -Sections $Sections
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Tree.Blocks -Variables $Tree.Variables -TenantName $TenantName -TenantFilter $TenantFilter `
+            -ReportName 'Licensing Report' -BrandingPresetId $BrandingPresetId
+        $FileName = ("Licensing_Report_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -tenant $TenantFilter -message "Failed to render Licensing report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListGraphReports.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListGraphReports.ps1
index cb54777b814ca..201ce003a9fba 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListGraphReports.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListGraphReports.ps1	
@@ -13,8 +13,13 @@ function Invoke-ListGraphReports {
     $APIName = $Request.Params.CIPPEndpoint
     $Headers = $Request.Headers
     $TenantFilter = $Request.Query.tenantFilter
+    # Report source: 'graph' (default) for Microsoft Graph usage reports, or 'office' for
+    # the reports.office.com service.
     $Type = $Request.Query.type ?? 'graph'
+    # The report name to fetch (e.g. 'getEmailActivityUserDetail'). Omit to enumerate the
+    # reports available for the selected Type instead of fetching one.
     $Report = $Request.Query.report
+    # Reporting window for Graph reports: 'D7', 'D30' (default), 'D90' or 'D180'.
     $Period = $Request.Query.period ?? 'D30'
 
     if (-not $TenantFilter) {
@@ -24,19 +29,27 @@ function Invoke-ListGraphReports {
         }
     }
 
-    $ValidTypes = @('graph', 'office')
-    if ($Type -notin $ValidTypes) {
-        return [HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::BadRequest
-            Body       = @{ error = "Invalid type '$Type'. Valid values: $($ValidTypes -join ', ')." }
+    switch ($Type) {
+        'graph' { }
+        'office' { }
+        default {
+            return [HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{ error = "Invalid type '$Type'. Valid values: graph, office." }
+            }
         }
     }
 
-    $ValidPeriods = @('D7', 'D30', 'D90', 'D180')
-    if ($Period -notin $ValidPeriods) {
-        return [HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::BadRequest
-            Body       = @{ error = "Invalid period '$Period'. Valid values: $($ValidPeriods -join ', ')." }
+    switch ($Period) {
+        'D7' { }
+        'D30' { }
+        'D90' { }
+        'D180' { }
+        default {
+            return [HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::BadRequest
+                Body       = @{ error = "Invalid period '$Period'. Valid values: D7, D30, D90, D180." }
+            }
         }
     }
 
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensePricing.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensePricing.ps1
index efbb7bd4814f1..4f58a160911f0 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensePricing.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensePricing.ps1	
@@ -23,7 +23,8 @@ function Invoke-ListLicensePricing {
     if ([string]::IsNullOrWhiteSpace($Currency)) { $Currency = 'USD' }
 
     try {
-        $Results = @(Get-CIPPLicensePrice -Currency $Currency)
+        # Every catalog SKU, including ones with no price in this currency yet, so each can be priced
+        $Results = @(Get-CIPPLicensePrice -Currency $Currency -IncludeUnknown)
         $Currencies = @(Get-CIPPLicensePrice -ListCurrencies)
         $StatusCode = [HttpStatusCode]::OK
     } catch {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenseRecommendations.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenseRecommendations.ps1
new file mode 100644
index 0000000000000..dfb83504711c3
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenseRecommendations.ps1	
@@ -0,0 +1,58 @@
+function Invoke-ListLicenseRecommendations {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Directory.Read
+    .DESCRIPTION
+        License recommendation report for a tenant: the waste tiers from ListLicenseOptimization
+        plus evidence-based downgrade targets (from 90-day usage reports against the license
+        catalog), consolidation and protection upgrades, and the recommended annual/monthly
+        commitment split per SKU. Feeds the License Optimization page and the client PDF.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    $Headers = $Request.Headers
+
+    # The tenant to report on
+    $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+    # Currency the money figures are resolved in (ISO code); defaults to USD
+    $Currency = $Request.Query.currency ?? $Request.Body.currency
+    if ([string]::IsNullOrWhiteSpace($Currency)) { $Currency = 'USD' }
+    # Sign-in / activity age in days past which a user counts as inactive (default 90)
+    $InactiveDays = ($Request.Query.inactiveDays ?? $Request.Body.inactiveDays) -as [int]
+    if (-not $InactiveDays -or $InactiveDays -le 0) { $InactiveDays = 90 }
+    # Months a seat must have been assigned to count as stable for an annual commitment (default 6)
+    $TenureMonths = ($Request.Query.tenureMonths ?? $Request.Body.tenureMonths) -as [int]
+    if (-not $TenureMonths -or $TenureMonths -le 0) { $TenureMonths = 6 }
+
+    # Boolean switches arrive as strings on the query string; anything but an explicit false is on
+    $AsBool = {
+        param($Value, $Default)
+        if ($null -eq $Value -or [string]::IsNullOrWhiteSpace([string]$Value)) { return $Default }
+        return ([string]$Value) -notin @('false', '0', 'no', 'off')
+    }
+    $RecommendDowngrades = & $AsBool ($Request.Query.recommendDowngrades ?? $Request.Body.recommendDowngrades) $true
+    $RecommendUpgrades = & $AsBool ($Request.Query.recommendUpgrades ?? $Request.Body.recommendUpgrades) $true
+    $RecommendTerms = & $AsBool ($Request.Query.recommendTerms ?? $Request.Body.recommendTerms) $true
+    $ProtectSecurityFeatures = & $AsBool ($Request.Query.protectSecurityFeatures ?? $Request.Body.protectSecurityFeatures) $true
+
+    try {
+        if ([string]::IsNullOrWhiteSpace($TenantFilter) -or $TenantFilter -eq 'AllTenants') { throw 'A single tenant is required for the license recommendation report.' }
+        $Results = Get-CIPPLicenseRecommendation -TenantFilter $TenantFilter -Currency $Currency -InactiveDays $InactiveDays -TenureMonths $TenureMonths `
+            -RecommendDowngrades $RecommendDowngrades -RecommendUpgrades $RecommendUpgrades -RecommendTerms $RecommendTerms -ProtectSecurityFeatures $ProtectSecurityFeatures
+        $StatusCode = [System.Net.HttpStatusCode]::OK
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        $StatusCode = [System.Net.HttpStatusCode]::InternalServerError
+        $Results = "Failed to build license recommendation report. $($ErrorMessage.NormalizedError)"
+        Write-LogMessage -API $APIName -headers $Headers -tenant $TenantFilter -message $Results -Sev 'Error' -LogData $ErrorMessage
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = [pscustomobject]@{ 'Results' = $Results }
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/SecuritySimulations/Invoke-ListCAGapAnalysis.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/SecuritySimulations/Invoke-ListCAGapAnalysis.ps1
new file mode 100644
index 0000000000000..648e2d251bc36
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/SecuritySimulations/Invoke-ListCAGapAnalysis.ps1	
@@ -0,0 +1,47 @@
+function Invoke-ListCAGapAnalysis {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.SecuritySimulations.Read
+    .DESCRIPTION
+        Conditional Access gap analysis for one tenant from the cached policies: findings, the
+        persona-by-control coverage matrix and the 1 to 10 posture score.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    try {
+        $TenantFilter = $Request.Query.tenantFilter
+        if (-not $TenantFilter -or $TenantFilter -in @('AllTenants', 'allTenants')) { throw 'Select a single tenant for the Conditional Access gap analysis.' }
+
+        $Licensed = Test-CIPPStandardLicense -StandardName 'ConditionalAccessCache' -TenantFilter $TenantFilter -Preset Entra -SkipLog
+        $Analysis = $null
+        $AnalysisError = $null
+        if ($Licensed -ne $false) {
+            try {
+                $Analysis = Get-CIPPCAGapAnalysis -TenantFilter $TenantFilter
+            } catch {
+                $AnalysisError = $_.Exception.Message
+            }
+        }
+
+        $Results = [PSCustomObject]@{
+            tenantFilter  = $TenantFilter
+            licensed      = $Licensed -ne $false
+            analysis      = $Analysis
+            analysisError = $AnalysisError
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to run the Conditional Access gap analysis: $($_.Exception.Message)" -Sev 'Error'
+        $Results = @{ Results = "Failed to run the Conditional Access gap analysis: $($_.Exception.Message)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Results
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/SecuritySimulations/Invoke-ListCASituations.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/SecuritySimulations/Invoke-ListCASituations.ps1
new file mode 100644
index 0000000000000..bd62e3082ae9a
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/SecuritySimulations/Invoke-ListCASituations.ps1	
@@ -0,0 +1,56 @@
+function Invoke-ListCASituations {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.SecuritySimulations.Read
+    .DESCRIPTION
+        Evaluates every predefined sign-in situation (admin, user and guest personas under unmanaged
+        devices, foreign locations, legacy clients, device-code flow, risk levels and more) live against the
+        tenant's Conditional Access through the What If API, and names the control missing wherever a
+        sign-in gets through. Optional adminUserId, userUserId and guestUserId pick the accounts to sign
+        in as; country picks where the foreign-country sign-ins come from.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    try {
+        $TenantFilter = $Request.Query.tenantFilter
+        if (-not $TenantFilter -or $TenantFilter -in @('AllTenants', 'allTenants')) { throw 'Select a single tenant to evaluate the sign-in situations.' }
+
+        $Overrides = @{}
+        foreach ($Pair in @(@{ persona = 'admin'; query = 'adminUserId' }, @{ persona = 'user'; query = 'userUserId' }, @{ persona = 'guest'; query = 'guestUserId' })) {
+            $Value = "$($Request.Query.($Pair.query))".Trim()
+            if ($Value) { $Overrides[$Pair.persona] = $Value }
+        }
+        $Country = "$($Request.Query.country)".Trim()
+
+        $Licensed = Test-CIPPStandardLicense -StandardName 'ConditionalAccessCache' -TenantFilter $TenantFilter -Preset Entra -SkipLog
+        $Battery = $null
+        if ($Licensed -ne $false) {
+            $Battery = Invoke-CIPPCASituationBattery -TenantFilter $TenantFilter -IdentityOverrides $Overrides -Country $Country
+        }
+
+        $Results = [PSCustomObject]@{
+            tenantFilter = $TenantFilter
+            licensed     = $Licensed -ne $false
+            identities   = $Battery.identities
+            candidates   = $Battery.candidates
+            country      = $Battery.country
+            situations   = @($Battery.situations | Where-Object { $null -ne $_ })
+            excluded     = @($Battery.excluded | Where-Object { $null -ne $_ })
+            summary      = $Battery.summary
+        }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to evaluate the sign-in situations: $($_.Exception.Message)" -Sev 'Error'
+        $Results = @{ Results = "Failed to evaluate the sign-in situations: $($_.Exception.Message)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Results
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBPATemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBPATemplate.ps1
deleted file mode 100644
index 1c7b8da46100f..0000000000000
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBPATemplate.ps1	
+++ /dev/null
@@ -1,36 +0,0 @@
-Function Invoke-AddBPATemplate {
-    <#
-    .FUNCTIONALITY
-        Entrypoint
-    .ROLE
-        Tenant.BestPracticeAnalyser.ReadWrite
-    #>
-    [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-
-    $APIName = $Request.Params.CIPPEndpoint
-    try {
-
-        $Table = Get-CippTable -tablename 'templates'
-        $Table.Force = $true
-        Add-CIPPAzDataTableEntity @Table -Entity @{
-            JSON         = "$($Request.body | ConvertTo-Json -Depth 10 -Compress)"
-            RowKey       = $Request.body.name
-            PartitionKey = 'BPATemplate'
-            GUID         = $Request.body.name
-        }
-        Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "Created BPA named $($Request.body.name)" -Sev 'Info'
-
-        $body = [pscustomobject]@{'Results' = 'Successfully added template' }
-    } catch {
-        Write-LogMessage -headers $Request.Headers -API $APINAME -tenant 'Global' -message "BPA Template Creation failed: $($_.Exception.Message)" -Sev 'Error'
-        $body = [pscustomobject]@{'Results' = "BPA Template Creation failed: $($_.Exception.Message)" }
-    }
-
-
-    return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = $body
-        })
-
-}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBaseline.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBaseline.ps1
index be5bc7ba8d642..ac863abeb8d4d 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBaseline.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBaseline.ps1	
@@ -17,11 +17,50 @@ function Invoke-AddBaseline {
 
     $APIName = $Request.Params.CIPPEndpoint
     try {
+        # Optional. Pushes the saved baseline to a GitHub template repository after the save: FullName is
+        # the repository (owner/repo), Message is the commit message. Not stored on the baseline.
+        $GitHubPush = $Request.Body.GitHub
+        if ($Request.Body.PSObject.Properties.Name -contains 'GitHub') {
+            $Request.Body.PSObject.Properties.Remove('GitHub')
+        }
+
         $User = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails
-        $Saved = New-CIPPBaseline -Baseline $Request.Body -User $User
+
+        # A synced baseline saved with no GitHub block is a local edit not yet in the repo -
+        # flag it now. When a GitHub block is sent, leave the flag alone here; it is cleared
+        # after the push succeeds below, so a failed push leaves it true.
+        $ExistingHasSource = $false
+        if ($Request.Body.GUID) {
+            $RolloutTable = Get-CIPPTable -TableName BaselineRollouts
+            $SafeGuid = ConvertTo-CIPPODataFilterValue -Value $Request.Body.GUID
+            $ExistingRollout = Get-CIPPAzDataTableEntity @RolloutTable -Filter "PartitionKey eq 'rollout' and RowKey eq '$SafeGuid'" | Select-Object -First 1
+            $ExistingHasSource = Test-CIPPRepoSource -Source $ExistingRollout.Source
+        }
+
+        if (-not $GitHubPush.FullName -and $ExistingHasSource) {
+            $Saved = New-CIPPBaseline -Baseline $Request.Body -User $User -LocalChanges:$true
+        } else {
+            $Saved = New-CIPPBaseline -Baseline $Request.Body -User $User
+        }
 
         Write-LogMessage -headers $Request.Headers -API $APIName -message "Baseline $($Request.Body.templateName) ($($Saved.GUID)) saved; $($Saved.DeltaCount) delta rows written." -Sev 'Info'
-        $Results = [pscustomobject]@{ Results = 'Successfully saved the baseline'; Metadata = @{ id = $Saved.GUID; deltas = $Saved.DeltaCount } }
+
+        $ResultsMessage = 'Successfully saved the baseline'
+        if ($GitHubPush.FullName) {
+            try {
+                $PushResult = Push-CIPPBaselineToRepo -GUID $Saved.GUID -FullName $GitHubPush.FullName -Message $GitHubPush.Message
+                if ($PushResult.state -eq 'success') {
+                    $ResultsMessage = "$ResultsMessage. Pushed to $($GitHubPush.FullName)."
+                } else {
+                    Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to push baseline $($Saved.GUID) to $($GitHubPush.FullName): $($PushResult.resultText)" -Sev 'Error'
+                    $ResultsMessage = "$ResultsMessage. Failed to push to $($GitHubPush.FullName): $($PushResult.resultText)"
+                }
+            } catch {
+                Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to push baseline $($Saved.GUID) to $($GitHubPush.FullName): $($_.Exception.Message)" -Sev 'Error'
+                $ResultsMessage = "$ResultsMessage. Failed to push to $($GitHubPush.FullName): $($_.Exception.Message)"
+            }
+        }
+        $Results = [pscustomobject]@{ Results = $ResultsMessage; Metadata = @{ id = $Saved.GUID; deltas = $Saved.DeltaCount } }
         $StatusCode = [HttpStatusCode]::OK
     } catch {
         Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to save baseline: $($_.Exception.Message)" -Sev 'Error'
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1
index 679aec62d08c7..2da4a43ee3ce7 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1	
@@ -49,6 +49,13 @@ function Invoke-AddStandardsTemplate {
         }
     }
 
+    # Optional. Pushes the saved template to a GitHub template repository after the save: FullName is
+    # the repository (owner/repo), Message is the commit message. Not stored on the template.
+    $GitHubPush = $Request.body.GitHub
+    if ($Request.body.PSObject.Properties.Name -contains 'GitHub') {
+        $Request.body.PSObject.Properties.Remove('GitHub')
+    }
+
     $GUID = $Request.body.GUID ? $request.body.GUID : (New-Guid).GUID
     #updatedBy    = $request.headers.'x-ms-client-principal'
     #updatedAt    = (Get-Date).ToUniversalTime()
@@ -56,15 +63,36 @@ function Invoke-AddStandardsTemplate {
     $request.body | Add-Member -NotePropertyName 'createdAt' -NotePropertyValue ($Request.body.createdAt ? $Request.body.createdAt : (Get-Date).ToUniversalTime()) -Force
     $Request.body | Add-Member -NotePropertyName 'updatedBy' -NotePropertyValue ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($request.headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails -Force
     $Request.body | Add-Member -NotePropertyName 'updatedAt' -NotePropertyValue (Get-Date).ToUniversalTime() -Force
+
+    # Drop standards toggled on but left with no instances (empty array) - e.g. a template standard
+    # whose last selection was removed in the editor, which leaves 'standards.<Name> = []' in the form.
+    # Persisting these produces phantom 'NOT FOUND' drift entries with no template to compare against.
+    if ($Request.body.standards) {
+        foreach ($Property in @($Request.body.standards.PSObject.Properties)) {
+            if ($Property.Value -is [array] -and $Property.Value.Count -eq 0) {
+                $Request.body.standards.PSObject.Properties.Remove($Property.Name)
+            }
+        }
+    }
+
     $JSON = (ConvertTo-Json -Compress -Depth 100 -InputObject ($Request.body))
     $Table = Get-CippTable -tablename 'templates'
-    $Table.Force = $true
-    Add-CIPPAzDataTableEntity @Table -Entity @{
+    $Entity = @{
         JSON         = "$JSON"
         RowKey       = "$GUID"
         PartitionKey = 'StandardsTemplateV2'
         GUID         = "$GUID"
     }
+    # This write replaces the row. A template imported from a template repo carries SHA and Source,
+    # which the repo sync uses to skip files that have not changed; dropping them makes the next sync
+    # treat the row as new and overwrite the edits made here with the repo copy.
+    $Existing = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq 'StandardsTemplateV2' and RowKey eq '$GUID'"
+    if ($Existing.SHA) { $Entity.SHA = $Existing.SHA }
+    if ($Existing.Source) { $Entity.Source = $Existing.Source }
+    if ($Existing.SourcePath) { $Entity.SourcePath = $Existing.SourcePath }
+    if ($Existing.ContentHash) { $Entity.ContentHash = $Existing.ContentHash }
+    $Table.Force = $true
+    Add-CIPPAzDataTableEntity @Table -Entity $Entity
 
     $AddObject = @{
         PartitionKey = 'InstanceProperties'
@@ -75,7 +103,23 @@ function Invoke-AddStandardsTemplate {
     Add-AzDataTableEntity @ConfigTable -Entity $AddObject -Force
 
     Write-LogMessage -headers $Request.Headers -API $APINAME -message "Standards Template $($Request.body.templateName) with GUID $GUID added/edited." -Sev 'Info'
-    $body = [pscustomobject]@{'Results' = 'Successfully added template'; Metadata = @{id = $GUID } }
+
+    $ResultsMessage = 'Successfully added template'
+    if ($GitHubPush.FullName) {
+        try {
+            $PushResult = Push-CIPPTemplateToRepo -GUID $GUID -FullName $GitHubPush.FullName -Message $GitHubPush.Message
+            if ($PushResult.state -eq 'success') {
+                $ResultsMessage = "$ResultsMessage. Pushed to $($GitHubPush.FullName)."
+            } else {
+                Write-LogMessage -headers $Headers -API $APIName -message "Failed to push template $GUID to $($GitHubPush.FullName): $($PushResult.resultText)" -Sev 'Error'
+                $ResultsMessage = "$ResultsMessage. Failed to push to $($GitHubPush.FullName): $($PushResult.resultText)"
+            }
+        } catch {
+            Write-LogMessage -headers $Headers -API $APIName -message "Failed to push template $GUID to $($GitHubPush.FullName): $($_.Exception.Message)" -Sev 'Error'
+            $ResultsMessage = "$ResultsMessage. Failed to push to $($GitHubPush.FullName): $($_.Exception.Message)"
+        }
+    }
+    $body = [pscustomobject]@{'Results' = $ResultsMessage; Metadata = @{id = $GUID } }
 
     return ([HttpResponseContext]@{
             StatusCode = [HttpStatusCode]::OK
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-BestPracticeAnalyser_List.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-BestPracticeAnalyser_List.ps1
deleted file mode 100644
index 53d59925e82e0..0000000000000
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-BestPracticeAnalyser_List.ps1	
+++ /dev/null
@@ -1,30 +0,0 @@
-Function Invoke-BestPracticeAnalyser_List {
-    <#
-    .FUNCTIONALITY
-        Entrypoint,AnyTenant
-    .ROLE
-        Tenant.BestPracticeAnalyser.Read
-    .DESCRIPTION
-        Returns the cached Best Practice Analyser results for every tenant. The BPA is populated by a scheduled job, so this reads the last run rather than evaluating anything; if it has never run, a single placeholder row saying so is returned.
-    #>
-    [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-    $Tenants = Get-Tenants
-    $Table = get-cipptable 'cachebpa'
-    $Results = (Get-CIPPAzDataTableEntity @Table) | ForEach-Object {
-        $_.UnusedLicenseList = @(ConvertFrom-Json -ErrorAction silentlycontinue -InputObject $_.UnusedLicenseList)
-        $_
-    }
-
-    if (!$Results) {
-        $Results = @{
-            Tenant = 'The BPA has not yet run.'
-        }
-    }
-    Write-Host ($Tenants | ConvertTo-Json)
-    return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = @(($Results | Where-Object -Property RowKey -In $Tenants.customerId))
-        })
-
-}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecBPA.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecBPA.ps1
deleted file mode 100644
index aaf763e7eaa7c..0000000000000
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecBPA.ps1	
+++ /dev/null
@@ -1,35 +0,0 @@
-function Invoke-ExecBPA {
-    <#
-        .FUNCTIONALITY
-        Entrypoint,AnyTenant
-        .ROLE
-        Tenant.BestPracticeAnalyser.ReadWrite
-    #>
-    [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-
-    $TenantFilter = $Request.Query.tenantFilter ? $Request.Query.tenantFilter.value : $Request.Body.tenantfilter.value
-
-    # AnyTenant: the orchestrator runs outside this request's scope, so restricted callers
-    # need a single in-scope tenant; Get-Tenants is narrowed to the caller's allowed tenants
-    $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList
-    if ($AllowedTenants -notcontains 'AllTenants') {
-        if (-not $TenantFilter -or $TenantFilter -eq 'AllTenants' -or -not (Get-Tenants -TenantFilter $TenantFilter)) {
-            return ([HttpResponseContext]@{
-                    StatusCode = [HttpStatusCode]::Forbidden
-                    Body       = [pscustomobject]@{'Results' = 'Access to this tenant is not allowed' }
-                })
-        }
-    }
-
-    # Start the orchestrator - it will handle queuing internally
-    Start-BPAOrchestrator -TenantFilter $TenantFilter -Force
-
-    $Results = [pscustomobject]@{'Results' = 'BPA queued for execution' }
-
-    return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = $Results
-        })
-
-}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecBaselineAddStandard.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecBaselineAddStandard.ps1
new file mode 100644
index 0000000000000..63ad6e99dcd80
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecBaselineAddStandard.ps1	
@@ -0,0 +1,111 @@
+function Invoke-ExecBaselineAddStandard {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Baselines.ReadWrite
+    .DESCRIPTION
+        Adds one standard, with its configured settings, to a stage of an existing baseline. The baseline
+        is read with Get-CIPPBaseline, the standard is appended to the stage (replacing an existing
+        single-instance copy) and the whole baseline is saved again through New-CIPPBaseline, the same
+        write path the baseline editor uses. Body: baselineId, stage (1-based, default 1), standard,
+        variables, remediateEnabled (default false), alertEnabled (default true).
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $Request.Params.CIPPEndpoint
+    try {
+        $Unwrap = {
+            param($Value)
+            if ($Value -is [array]) {
+                return @($Value | ForEach-Object {
+                        if ($_ -is [PSCustomObject] -and $null -ne $_.PSObject.Properties['value']) { [PSCustomObject]@{ label = "$($_.label ?? $_.value)"; value = $_.value } } else { $_ }
+                    })
+            }
+            if ($Value -is [PSCustomObject] -and $null -ne $Value.PSObject.Properties['value']) { return $Value.value }
+            $Value
+        }
+
+        $BaselineId = "$(& $Unwrap $Request.Body.baselineId)"
+        $Standard = "$(& $Unwrap $Request.Body.standard)"
+        $StageNumber = [int]($(& $Unwrap $Request.Body.stage) ?? 1)
+        if (-not $BaselineId -or -not $Standard) { throw 'Provide baselineId and standard.' }
+        if ($StageNumber -lt 1) { $StageNumber = 1 }
+
+        $Definition = Get-CIPPBaselineDefinition -Name $Standard | Select-Object -First 1
+        if (-not $Definition) { throw "Unknown standard '$Standard'." }
+        $Baseline = Get-CIPPBaseline -ID $BaselineId | Select-Object -First 1
+        if (-not $Baseline) { throw "Baseline '$BaselineId' was not found." }
+        $User = ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails
+
+        $Variables = [PSCustomObject]@{}
+        foreach ($Property in @(($Request.Body.variables ?? [PSCustomObject]@{}).PSObject.Properties)) {
+            $Variables | Add-Member -NotePropertyName $Property.Name -NotePropertyValue (& $Unwrap $Property.Value)
+        }
+
+        $Stages = [System.Collections.Generic.List[object]]::new()
+        foreach ($Stage in @($Baseline.stages)) {
+            $Stages.Add([PSCustomObject]@{
+                    name       = $Stage.name
+                    logic      = $Stage.logic
+                    conditions = @($Stage.conditions)
+                    standards  = [System.Collections.Generic.List[object]]@($Stage.standardsConfig | Where-Object { $_ })
+                })
+        }
+        if ($Stages.Count -eq 0) { throw 'The baseline has no stages.' }
+        if ($StageNumber -gt $Stages.Count) { $StageNumber = $Stages.Count }
+        $Target = $Stages[$StageNumber - 1]
+
+        $Multiple = $Definition.multiple -eq $true
+        $Existing = @($Target.standards | Where-Object { (("$($_.instance)") -split '#')[0] -eq $Standard })
+        $InstanceKey = $Standard
+        if ($Multiple -and $Existing.Count -gt 0) {
+            $Suffix = 2
+            while (@($Existing | Where-Object { "$($_.instance)" -eq "$Standard#$Suffix" }).Count -gt 0) { $Suffix++ }
+            $InstanceKey = "$Standard#$Suffix"
+        }
+        $Kept = [System.Collections.Generic.List[object]]::new()
+        foreach ($Config in $Target.standards) {
+            if (-not $Multiple -and (("$($Config.instance)") -split '#')[0] -eq $Standard) { continue }
+            $Kept.Add($Config)
+        }
+        $Kept.Add([PSCustomObject]@{
+                standard         = $Standard
+                instance         = $InstanceKey
+                variables        = $Variables
+                remediateEnabled = [bool]($Request.Body.remediateEnabled -eq $true)
+                alertEnabled     = [bool]($Request.Body.alertEnabled ?? $true)
+                alertOnRemediate = $false
+            })
+        $Target.standards = @($Kept)
+
+        $Payload = [PSCustomObject]@{
+            GUID                 = $Baseline.GUID
+            templateName         = $Baseline.templateName
+            description          = $Baseline.description
+            assignedTenants      = @($Baseline.assignments)
+            excludedTenants      = @($Baseline.exclusions)
+            alertEmails          = $Baseline.alertEmails
+            alertWebhookUrl      = $Baseline.alertWebhookUrl
+            disableAlerts        = [bool]$Baseline.disableAlerts
+            disableScheduledRuns = [bool]$Baseline.disableScheduledRuns
+            stages               = @($Stages)
+        }
+        $Saved = New-CIPPBaseline -Baseline $Payload -User $User
+
+        $Message = "Added $($Definition.label ?? $Standard) to stage $StageNumber of baseline '$($Baseline.templateName)'."
+        Write-LogMessage -headers $Request.Headers -API $APIName -message "$Message ($($Saved.DeltaCount) delta rows written.)" -Sev 'Info'
+        $Results = [pscustomobject]@{ Results = $Message; Metadata = @{ id = $Saved.GUID; instance = $InstanceKey } }
+        $StatusCode = [HttpStatusCode]::OK
+    } catch {
+        Write-LogMessage -headers $Request.Headers -API $APIName -message "Failed to add the standard to the baseline: $($_.Exception.Message)" -Sev 'Error'
+        $Results = [pscustomobject]@{ Results = "Failed to add the standard to the baseline: $($_.Exception.Message)" }
+        $StatusCode = [HttpStatusCode]::InternalServerError
+    }
+
+    return ([HttpResponseContext]@{
+            StatusCode = $StatusCode
+            Body       = $Results
+        })
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecGetBaselineWhatIfReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecGetBaselineWhatIfReportPdf.ps1
new file mode 100644
index 0000000000000..2c0fc4ac90bb3
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecGetBaselineWhatIfReportPdf.ps1	
@@ -0,0 +1,125 @@
+function Invoke-ExecGetBaselineWhatIfReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Baselines.Read
+    .DESCRIPTION
+        Server-renders the Security Baseline report for a tenant as application/pdf bytes: where the
+        assigned baselines stand today, what is already in place, the Conditional Access and Intune
+        policies and the settings the baseline will change (what each does, its value today, the value
+        it will be set to and why), the rollout waves still to come and the agreed exceptions - plus,
+        optionally, everything one or more simulated (not yet assigned) baselines would add. Reads the
+        same alignment, baseline and catalog data the Baselines page shows, composes it through the
+        shared CIPPSharp component kit (Build-CippBaselineWhatIfReportTree) and returns the finished
+        PDF. Nothing is changed by producing it.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        # Required. The tenant (default domain) to report on.
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A tenantFilter is required' })
+        }
+
+        # Optional. Show the "What Is Already In Place" page (deployed policies and enforced settings,
+        # with their values). A boolean; defaults to true.
+        $AlreadyAligned = $Request.Body.sectionConfig.alreadyAligned
+        # Optional. Show the "How The Rollout Works" section (the remaining waves and when they
+        # arrive). A boolean; defaults to true.
+        $RolloutStages = $Request.Body.sectionConfig.rolloutStages
+        # Only a real boolean is accepted: a string would read as true ([bool]'false' is $true).
+        if ($null -ne $AlreadyAligned -and $AlreadyAligned -isnot [bool]) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'sectionConfig.alreadyAligned must be true or false.' })
+        }
+        if ($null -ne $RolloutStages -and $RolloutStages -isnot [bool]) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'sectionConfig.rolloutStages must be true or false.' })
+        }
+
+        # Optional. The GUIDs of baselines NOT assigned to the tenant, whose additions are shown in the
+        # report as planned changes, in the order given; a repeated id counts once. Ids of assigned
+        # baselines are ignored.
+        $SimulatedTemplateIds = [System.Collections.Generic.List[string]]::new()
+        foreach ($Id in $Request.Body.simulatedTemplateIds) {
+            if (-not [string]::IsNullOrWhiteSpace([string]$Id) -and -not $SimulatedTemplateIds.Contains([string]$Id)) { $SimulatedTemplateIds.Add([string]$Id) }
+        }
+
+        # Optional. The branding preset to render with; an unknown id falls back to the default branding.
+        $BrandingPresetId = [string]($Request.Body.brandingPresetId ?? $Request.Query.brandingPresetId)
+
+        $Alignment = Get-CIPPBaselineAlignment -TenantFilter $TenantFilter
+        $Rows = @($Alignment.rows | Where-Object { $null -ne $_ })
+        $StageStates = @($Alignment.stageStates | Where-Object { $null -ne $_ })
+        # -ResolveIdentityLabels turns CA/Intune template variables into {label, value}: the label is
+        # what names a policy whose stored template is gone.
+        $Baselines = @(Get-CIPPBaseline -ResolveIdentityLabels)
+        $AssignedIds = @($StageStates.templateId)
+        $AssignedTemplates = @($Baselines | Where-Object { $AssignedIds -contains $_.GUID })
+        $SimulatedTemplates = [System.Collections.Generic.List[object]]::new()
+        foreach ($Id in $SimulatedTemplateIds) {
+            if ($AssignedIds -contains $Id) { continue }
+            $Baseline = $Baselines | Where-Object { $_.GUID -eq $Id } | Select-Object -First 1
+            if (-not $Baseline) {
+                return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = "Unknown baseline id '$Id'." })
+            }
+            $SimulatedTemplates.Add($Baseline)
+        }
+
+        # Stored CA/Intune templates keyed by template id: standards not checked yet and simulated
+        # baselines carry only the template id, so the stored template supplies the policy content.
+        # Ordinal, as the client's lookup objects are: an @{} literal would match an id of another case.
+        $CaByGuid = [System.Collections.Generic.Dictionary[string, object]]::new([System.StringComparer]::Ordinal)
+        $IntuneByGuid = [System.Collections.Generic.Dictionary[string, object]]::new([System.StringComparer]::Ordinal)
+        if (@($Rows | Where-Object { $_.status -eq 'No Data' }).Count -gt 0 -or $SimulatedTemplates.Count -gt 0) {
+            $TemplatesTable = Get-CippTable -tablename 'templates'
+            foreach ($Template in @(Get-CIPPAzDataTableEntity @TemplatesTable -Filter "PartitionKey eq 'CATemplate'")) {
+                try {
+                    $Content = $Template.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
+                    $CaByGuid["$($Template.RowKey)"] = $Content
+                    if ($Template.GUID) { $CaByGuid["$($Template.GUID)"] = $Content }
+                } catch {
+                    Write-Information "Baseline report: skipped unreadable CA template $($Template.RowKey): $($_.Exception.Message)"
+                }
+            }
+            foreach ($Template in @(Get-CIPPAzDataTableEntity @TemplatesTable -Filter "PartitionKey eq 'IntuneTemplate'")) {
+                try {
+                    # Stored Intune templates name the policy in 'Displayname'.
+                    $IntuneByGuid["$($Template.RowKey)"] = @{ displayName = ($Template.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop).Displayname }
+                } catch {
+                    Write-Information "Baseline report: skipped unreadable Intune template $($Template.RowKey): $($_.Exception.Message)"
+                }
+            }
+        }
+
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter -BrandingPresetId $BrandingPresetId
+        $Report = Build-CippBaselineWhatIfReportTree -Data @{
+            TenantName         = $TenantName
+            tenant             = @{ rows = $Rows }
+            stageStates        = $StageStates
+            assignedTemplates  = $AssignedTemplates
+            simulatedTemplates = @($SimulatedTemplates)
+            catalog            = @(Get-CIPPBaselineDefinition)
+            resolvers          = @{ caByGuid = $CaByGuid; intuneByGuid = $IntuneByGuid }
+            sectionConfig      = @{ alreadyAligned = ($AlreadyAligned ?? $true); rolloutStages = ($RolloutStages ?? $true) }
+        }
+
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName $TenantName -TenantFilter $TenantFilter `
+            -ReportName 'Security Baseline Report' -BrandingPresetId $BrandingPresetId
+        $FileName = ("Baseline_Report_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render the Security Baseline report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecGetExecutiveReportPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecGetExecutiveReportPdf.ps1
new file mode 100644
index 0000000000000..e5eb3bfb09106
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecGetExecutiveReportPdf.ps1	
@@ -0,0 +1,198 @@
+function Invoke-ExecGetExecutiveReportPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        Tenant.Standards.Read
+    .DESCRIPTION
+        Server-renders the Executive Summary report as application/pdf bytes. Every figure is read from the
+        nightly Reporting DB cache via New-CIPPDbRequest (Users/Guests/Roles for the environment overview,
+        LicenseOverview, ManagedDevices, ConditionalAccessPolicies and SecureScore) plus the standards
+        comparison from the CippStandardsReports table resolved against the standards catalog - the same
+        cached data the rest of CIPP reports from, with no live Graph or cross-endpoint HTTP calls. The
+        shaped data is composed through the shared CIPPSharp component kit (Build-CippExecutiveReportTree),
+        the server-side replacement for the client react-pdf ExecutiveReportButton. Each source is gathered
+        defensively: a source with no cached data simply drops its section.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
+        if ([string]::IsNullOrWhiteSpace($TenantFilter)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A tenantFilter is required' })
+        }
+
+        # The branding preset a caller picked for this render, else the global branding settings.
+        $BrandingPresetId = [string]($Request.Body.brandingPresetId ?? $Request.Query.brandingPresetId)
+        $TenantName = Get-CippReportTenantName -TenantFilter $TenantFilter -BrandingPresetId $BrandingPresetId
+
+        # GA directory role template id, used to pull the Global Administrator count from the Roles cache.
+        $GaTemplateId = '62e90394-69f5-4237-9190-012177145e10'
+
+        # -- User stats (Users / Guests cache + the cached privileged-role getter for GAs) --
+        $UserStats = @{ licensedUsers = 0; unlicensedUsers = 0; guests = 0; globalAdmins = 0; permanentGlobalAdmins = 0; eligibleGlobalAdmins = 0; pimCapable = $false }
+        try {
+            $Users = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Users' -Fields 'assignedLicenses')
+            $LicUsers = @($Users | Where-Object { @($_.assignedLicenses).Count -gt 0 }).Count
+            $GuestCount = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Guests' -Fields 'id').Count
+            # Get-CippDbRoleMembers merges cached PIM (Active/Eligible) + direct role membership for the role.
+            $GaMembers = @(Get-CippDbRoleMembers -TenantFilter $TenantFilter -RoleTemplateId $GaTemplateId)
+            $EligibleGas = @($GaMembers | Where-Object { $_.AssignmentType -eq 'Eligible' }).Count
+            $PimActive = @($GaMembers | Where-Object { $_.AssignmentType -in @('Active', 'Eligible') }).Count
+            $UserStats = @{
+                licensedUsers         = $LicUsers
+                unlicensedUsers       = [Math]::Max(0, $Users.Count - $LicUsers)
+                guests                = $GuestCount
+                globalAdmins          = $GaMembers.Count
+                permanentGlobalAdmins = ($GaMembers.Count - $EligibleGas)
+                eligibleGlobalAdmins  = $EligibleGas
+                # PIM is in use for GA when any assignment is a PIM Active/Eligible one (not plain Direct).
+                pimCapable            = ($PimActive -gt 0)
+            }
+        } catch { Write-Information "Executive report: user stats unavailable - $($_.Exception.Message)" }
+
+        # -- Licences (LicenseOverview cache) --
+        $Licenses = @()
+        try {
+            $Licenses = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'LicenseOverview' | ForEach-Object {
+                    @{ name = ($_.License ?? 'N/A'); used = "$($_.CountUsed ?? 0)"; available = "$($_.CountAvailable ?? 0)"; total = "$($_.TotalLicenses ?? 0)" }
+                })
+        } catch { Write-Information "Executive report: licences unavailable - $($_.Exception.Message)" }
+
+        # -- Managed devices (ManagedDevices cache) --
+        $Devices = @()
+        try {
+            $Devices = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'ManagedDevices' | ForEach-Object {
+                    $d = $_
+                    $model = [string]$d.model
+                    $mfr = [string]$d.manufacturer
+                    $isCloudPc = ($d.isCloudPC -eq $true) -or ($d.deviceType -eq 'cloudPC') -or ($d.chassisType -eq 'cloudPC') -or ($model.ToLower().StartsWith('cloud pc') -and $mfr.ToLower() -eq 'microsoft corporation')
+                    $compState = [string]$d.complianceState
+                    @{
+                        name       = ($d.deviceName ?? 'N/A')
+                        os         = ($d.operatingSystem ?? 'N/A')
+                        compliance = $(if ([string]::IsNullOrWhiteSpace($compState)) { 'Unknown' } else { $compState })
+                        compliant  = ($compState.ToLower() -eq 'compliant')
+                        lastSync   = $(if ($d.lastSyncDateTime) { try { ([datetime]$d.lastSyncDateTime).ToString('MMM d, yyyy') } catch { [string]$d.lastSyncDateTime } } else { 'N/A' })
+                        encrypted  = (($d.isEncrypted -eq $true) -or $isCloudPc)
+                    }
+                })
+        } catch { Write-Information "Executive report: managed devices unavailable - $($_.Exception.Message)" }
+
+        # -- Conditional Access policies (ConditionalAccessPolicies cache, raw Graph shape) --
+        # 'controls' is the builtInControls array (drives the tree's MFA count via -contains 'mfa');
+        # 'controlsText' is the human label; 'applications' summarises includeApplications.
+        $CAPolicies = @()
+        try {
+            $ControlLabels = [ordered]@{ mfa = 'MFA'; block = 'Block'; compliantDevice = 'Compliant Device' }
+            $CAPolicies = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'ConditionalAccessPolicies' | Where-Object { $_.displayName } | ForEach-Object {
+                    $p = $_
+                    $bic = @($p.grantControls.builtInControls)
+                    $apps = @($p.conditions.applications.includeApplications)
+                    $labels = @(foreach ($k in $ControlLabels.Keys) { if ($bic -contains $k) { $ControlLabels[$k] } })
+                    @{
+                        name         = ($p.displayName ?? 'N/A')
+                        state        = ([string]$p.state)
+                        controls     = $bic
+                        controlsText = $(if ($labels.Count -gt 0) { $labels -join ', ' } else { 'Custom' })
+                        applications = $(if ($apps -contains 'All') { 'All' } elseif ($apps.Count -gt 0) { "$($apps.Count) app$(if ($apps.Count -ne 1) { 's' })" } else { 'None' })
+                    }
+                })
+        } catch { Write-Information "Executive report: conditional access unavailable - $($_.Exception.Message)" }
+
+        # -- Microsoft Secure Score (SecureScore cache, one record per day) --
+        $SecureScore = $null
+        try {
+            $Scores = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'SecureScore' | Sort-Object -Property @{ Expression = { [datetime]$_.createdDateTime } } -Descending)
+            if ($Scores.Count -gt 0) {
+                $Latest = $Scores[0]
+                $Cur = [double]($Latest.currentScore ?? 0)
+                $Max = [double]($Latest.maxScore ?? 0)
+                $Acs = @($Latest.averageComparativeScores)
+                $VsAll = ($Acs | Where-Object { $_.basis -eq 'AllTenants' } | Select-Object -First 1).averageScore
+                $VsSim = ($Acs | Where-Object { $_.basis -eq 'TotalSeats' } | Select-Object -First 1).averageScore
+                # Trend: the 7 most recent points, drawn oldest-first.
+                $Trend = @($Scores | Select-Object -First 7 | Sort-Object -Property @{ Expression = { [datetime]$_.createdDateTime } } | ForEach-Object {
+                        @{ label = ([datetime]$_.createdDateTime).ToString('MMM d'); value = [math]::Round([double]($_.currentScore ?? 0), 2) }
+                    })
+                $SecureScore = @{
+                    currentScore           = [math]::Round($Cur, 2)
+                    maxScore               = $Max
+                    percentageCurrent      = $(if ($Max -gt 0) { [math]::Round(($Cur / $Max) * 100) } else { 0 })
+                    percentageVsSimilar    = $(if ($null -ne $VsSim) { [math]::Round([double]$VsSim) } else { $null })
+                    percentageVsAllTenants = $(if ($null -ne $VsAll) { [math]::Round([double]$VsAll) } else { $null })
+                    trend                  = $Trend
+                }
+            }
+        } catch { Write-Information "Executive report: secure score unavailable - $($_.Exception.Message)" }
+
+        # -- Security standards (CippStandardsReports table + the standards catalog) --
+        $SecurityControls = @()
+        try {
+            $StdTable = Get-CIPPTable -TableName 'CippStandardsReports'
+            $StdRows = @(Get-CIPPAzDataTableEntity @StdTable -Filter "PartitionKey eq '$TenantFilter'")
+            if ($StdRows.Count -gt 0) {
+                $TenantStd = [ordered]@{ tenantFilter = $TenantFilter }
+                foreach ($Row in $StdRows) {
+                    $FieldName = [string]$Row.RowKey
+                    # Quarantine template rows hex-encode the display name in the key; decode it as the page does.
+                    if ($FieldName -match '^(standards\.QuarantineTemplate\.)([0-9a-fA-F]+)$') {
+                        $Prefix = $Matches[1]; $Hex = $Matches[2]
+                        $Chars = for ($i = 0; $i -lt $Hex.Length; $i += 2) { [char][Convert]::ToInt32($Hex.Substring($i, 2), 16) }
+                        $FieldName = "$Prefix$(-join $Chars)"
+                    }
+                    $Cv = if (-not [string]::IsNullOrWhiteSpace([string]$Row.CurrentValue) -and (Test-Json -Json ([string]$Row.CurrentValue) -ErrorAction SilentlyContinue)) { $Row.CurrentValue | ConvertFrom-Json -ErrorAction SilentlyContinue } else { $Row.CurrentValue }
+                    $Ev = if (-not [string]::IsNullOrWhiteSpace([string]$Row.ExpectedValue) -and (Test-Json -Json ([string]$Row.ExpectedValue) -ErrorAction SilentlyContinue)) { $Row.ExpectedValue | ConvertFrom-Json -ErrorAction SilentlyContinue } else { $Row.ExpectedValue }
+                    $Val = $Row.Value
+                    if ($Val -is [string] -and -not [string]::IsNullOrWhiteSpace($Val) -and (Test-Json -Json $Val -ErrorAction SilentlyContinue)) { $Val = $Val | ConvertFrom-Json -ErrorAction SilentlyContinue }
+                    $TenantStd[$FieldName] = @{ Value = $Val; CurrentValue = $Cv; ExpectedValue = $Ev }
+                }
+                $Catalog = @()
+                try {
+                    $CatPath = Join-Path $env:CIPPRootPath 'Config\standards.json'
+                    if (Test-Path $CatPath) { $Catalog = @(Get-Content $CatPath -Raw | ConvertFrom-Json -Depth 20) }
+                } catch { $Catalog = @() }
+                $SecurityControls = @(Convert-CippExecStandardsToControls -Compare @([pscustomobject]$TenantStd) -Catalog $Catalog)
+            }
+        } catch { Write-Information "Executive report: standards unavailable - $($_.Exception.Message)" }
+
+        $Data = @{
+            TenantName       = $TenantName
+            UserStats        = $UserStats
+            SecureScore      = $SecureScore
+            Licenses         = $Licenses
+            Devices          = $Devices
+            CAPolicies       = $CAPolicies
+            SecurityControls = $SecurityControls
+        }
+
+        # Optional per-section toggles from the client's section panel (POST body). Absent -> full report.
+        $SectionConfig = @{}
+        $RawCfg = $Request.Body.sectionConfig
+        if ($RawCfg -is [hashtable]) { $SectionConfig = $RawCfg }
+        elseif ($RawCfg) { foreach ($p in $RawCfg.PSObject.Properties) { $SectionConfig[$p.Name] = [bool]$p.Value } }
+
+        $Report = Build-CippExecutiveReportTree -Data $Data -SectionConfig $SectionConfig
+
+        # Branding: a named preset if the client selected one (the report's Branding dropdown), else
+        # the tenant/global default.
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName $TenantName -TenantFilter $TenantFilter `
+            -ReportName 'Executive Summary' -BrandingPresetId $BrandingPresetId
+
+        $FileName = ("Executive_Report_$TenantFilter" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$FileName`"" }
+                Body        = $Bytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to render Executive report: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListBPA.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListBPA.ps1
deleted file mode 100644
index 97e6a98e08ba6..0000000000000
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListBPA.ps1	
+++ /dev/null
@@ -1,103 +0,0 @@
-Function Invoke-ListBPA {
-    <#
-    .FUNCTIONALITY
-        Entrypoint
-    .ROLE
-        Tenant.BestPracticeAnalyser.Read
-    .DESCRIPTION
-        Lists Best Practice Analyser (BPA) report results for tenants, based on a selected BPA template.
-    #>
-    [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-    # Interact with query parameters or the body of the request.
-    $TenantFilter = $Request.Query.tenantFilter
-    $Table = Get-CippTable 'cachebpav2'
-    $name = $Request.Query.Report
-    if ($null -eq $name) { $name = 'CIPP Best Practices v1.5 - Table view' }
-
-    # Get all possible JSON files for reports, find the correct one, select the Columns
-    $JSONFields = @()
-    $BPATemplateTable = Get-CippTable -tablename 'templates'
-    $Filter = "PartitionKey eq 'BPATemplate'"
-    $Templates = (Get-CIPPAzDataTableEntity @BPATemplateTable -Filter $Filter).JSON | ConvertFrom-Json
-
-    $Templates | ForEach-Object {
-        $Template = $_
-        if ($Template.Name -eq $NAME) {
-            $JSONFields = $Template.Fields | Where-Object { $_.StoreAs -eq 'JSON' } | ForEach-Object { $_.name }
-            $Columns = $Template.fields.FrontendFields | Where-Object -Property name -NE $null
-            $Style = $Template.Style
-        }
-    }
-
-
-    if ($TenantFilter -ne 'AllTenants' -and $Style -eq 'Tenant') {
-        $CustomerId = (Get-Tenants -TenantFilter $TenantFilter).customerId
-        $mergedObject = New-Object pscustomobject
-        $Data = (Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '$CustomerId'") | ForEach-Object {
-            $row = $_
-            $JSONFields | ForEach-Object {
-                $jsonContent = $row.$_
-                if (![string]::IsNullOrEmpty($jsonContent) -and $jsonContent -ne 'FAILED') {
-                    try {
-                        $row.$_ = $jsonContent | ConvertFrom-Json -Depth 15
-                    } catch {
-                    }
-                }
-            }
-            $row.PSObject.Properties | ForEach-Object {
-                Write-Host "Adding $($_.Name) to mergedObject"
-                $mergedObject | Add-Member -NotePropertyName $_.Name -NotePropertyValue $_.Value -Force
-            }
-        }
-
-        $Data = $mergedObject
-    } else {
-        $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList
-        $Tenants = Get-Tenants -IncludeErrors
-        if ($AllowedTenants -notcontains 'AllTenants') {
-            $Tenants = $Tenants | Where-Object -Property customerId -In $AllowedTenants
-        }
-        Write-Information ($tenants.defaultDomainName | ConvertTo-Json)
-        $Data = (Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$NAME'") | ForEach-Object {
-            $row = $_
-            $JSONFields | ForEach-Object {
-                $jsonContent = $row.$_
-                if (![string]::IsNullOrEmpty($jsonContent) -and $jsonContent -ne 'FAILED') {
-                    try {
-                        $row.$_ = $jsonContent | ConvertFrom-Json -Depth 15
-                    } catch {
-                    }
-                }
-            }
-            $row | Where-Object -Property PartitionKey -In $Tenants.customerId
-        }
-
-
-    }
-
-    $Results = [PSCustomObject]@{
-        Data    = @($Data)
-        Columns = @($Columns)
-        Keys    = $Data | ForEach-Object {
-            $_.PSObject.Properties |
-                Where-Object { $_.Name -ne 'PartitionKey' -and $_.Name -ne 'RowKey' -and $_.Name -ne 'Timestamp' } |
-                ForEach-Object { $_.Name }
-            } | Select-Object -Unique
-        Style   = $Style
-    }
-
-    if (!$Results) {
-        $Results = @{
-            Columns = @( value = 'Results'; name = 'Results')
-            Data    = @(@{ Results = 'The BPA has not yet run.' })
-            Keys    = @()
-        }
-    }
-
-    return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = (ConvertTo-Json -Depth 15 -InputObject $Results)
-        })
-
-}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListBPATemplates.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListBPATemplates.ps1
deleted file mode 100644
index dcf1ee8ffd559..0000000000000
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListBPATemplates.ps1	
+++ /dev/null
@@ -1,50 +0,0 @@
-Function Invoke-ListBPATemplates {
-    <#
-    .FUNCTIONALITY
-        Entrypoint,AnyTenant
-    .ROLE
-        Tenant.BestPracticeAnalyser.Read
-    .DESCRIPTION
-        Lists available Best Practice Analyser (BPA) templates that define which checks to run.
-    #>
-    [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-    $Table = Get-CippTable -tablename 'templates'
-
-    $Templates = Get-ChildItem (Join-Path $env:CIPPRootPath 'Config\*.BPATemplate.json') | ForEach-Object {
-        $TemplateJson = Get-Content $_ | ConvertFrom-Json | ConvertTo-Json -Compress -Depth 10
-        $Entity = @{
-            JSON         = "$TemplateJson"
-            RowKey       = "$($_.name)"
-            PartitionKey = 'BPATemplate'
-            GUID         = "$($_.name)"
-        }
-        Add-CIPPAzDataTableEntity @Table -Entity $Entity -Force
-    }
-
-    $Filter = "PartitionKey eq 'BPATemplate'"
-    $Templates = Get-CIPPAzDataTableEntity @Table -Filter $Filter
-
-    if ($Request.Query.RawJson) {
-        foreach ($Template in $Templates) {
-            $Template.JSON = $Template.JSON -replace '"parameters":', '"Parameters":'
-        }
-        $Templates = $Templates.JSON | ConvertFrom-Json | Sort-Object Name
-    } else {
-        $Templates = $Templates | ForEach-Object {
-            $TemplateJson = $_.JSON -replace '"parameters":', '"Parameters":'
-            $Template = $TemplateJson | ConvertFrom-Json
-            @{
-                GUID  = $_.GUID
-                Data  = $Template.fields
-                Name  = $Template.Name
-                Style = $Template.Style
-            }
-        } | Sort-Object Name
-    }
-    return ([HttpResponseContext]@{
-            StatusCode = [HttpStatusCode]::OK
-            Body       = ($Templates | ConvertTo-Json -Depth 10)
-        })
-
-}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1
index 2767a8d4c5cab..e7486b48496f7 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListStandardsCompare {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        Tenant.BestPracticeAnalyser.Read
+        Tenant.Standards.Read
     .DESCRIPTION
         Compares current tenant configuration against applied standards, showing compliance status and drift for each standard.
     #>
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveBPATemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveBPATemplate.ps1
deleted file mode 100644
index d655fd884bc6d..0000000000000
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-RemoveBPATemplate.ps1	
+++ /dev/null
@@ -1,40 +0,0 @@
-function Invoke-RemoveBPATemplate {
-    <#
-    .FUNCTIONALITY
-        Entrypoint
-    .ROLE
-        Tenant.Standards.ReadWrite
-    #>
-    [CmdletBinding()]
-    param($Request, $TriggerMetadata)
-
-    $APIName = $Request.Params.CIPPEndpoint
-    $Headers = $Request.Headers
-
-
-    $ID = $Request.Query.TemplateName ?? $Request.Body.TemplateName
-    try {
-        $Table = Get-CippTable -tablename 'templates'
-
-        $SafeID = ConvertTo-CIPPODataFilterValue -Value $ID -Type String
-        $Filter = "PartitionKey eq 'BPATemplate' and RowKey eq '$SafeID'"
-        $ClearRow = Get-CIPPAzDataTableEntity @Table -Filter $Filter -Property PartitionKey, RowKey
-        Remove-CIPPAzDataTableEntity -Force @Table -Entity $ClearRow
-        $Result = "Removed BPA Template with ID $ID"
-        Write-LogMessage -Headers $Headers -API $APINAME -message $Result -Sev 'Info'
-        $StatusCode = [HttpStatusCode]::OK
-    } catch {
-        $ErrorMessage = Get-CippException -Exception $_
-        $Result = "Failed to remove BPA template with ID $ID. $($ErrorMessage.NormalizedError)"
-        Write-LogMessage -Headers $Headers -API $APINAME -message $Result -Sev 'Error' -LogData $ErrorMessage
-        $StatusCode = [HttpStatusCode]::InternalServerError
-    }
-
-
-    return ([HttpResponseContext]@{
-            StatusCode = $StatusCode
-            Body       = @{'Results' = $Result }
-        })
-
-
-}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1
index 5cc6f94bdc0d0..4fd84eba12415 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1	
@@ -13,9 +13,15 @@ function Invoke-listStandardTemplates {
     $ID = $Request.Query.id
     $Table = Get-CippTable -tablename 'templates'
     $Filter = "PartitionKey eq 'StandardsTemplateV2'"
+    $RepoTable = Get-CippTable -tablename 'CommunityRepos'
+    $Repos = @(Get-CIPPAzDataTableEntity @RepoTable -Filter "PartitionKey eq 'CommunityRepos'")
     $Templates = (Get-CIPPAzDataTableEntity @Table -Filter $Filter) | ForEach-Object {
         $RowKey = $_.RowKey
+        $RowSHA = $_.SHA
+        $RowSource = $_.Source
+        $RowContentHash = $_.ContentHash
         $JSON = $_.JSON -replace '"Action":', '"action":'
+        $EffectiveJSON = $JSON
         try {
             $Data = $JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
         } catch {
@@ -26,13 +32,20 @@ function Invoke-listStandardTemplates {
                 return
             }
             $Data = $RepairedJSON | ConvertFrom-Json -Depth 100
+            $EffectiveJSON = $RepairedJSON
             try {
-                $null = Add-CIPPAzDataTableEntity @Table -Entity @{
+                # A template imported from a repo carries SHA and Source; this write replaces the
+                # row, so both must carry across or the next repo sync treats it as new.
+                $RepairedEntity = @{
                     JSON         = "$RepairedJSON"
                     RowKey       = "$RowKey"
                     PartitionKey = 'StandardsTemplateV2'
                     GUID         = "$RowKey"
-                } -Force
+                }
+                if ($RowSHA) { $RepairedEntity.SHA = $RowSHA }
+                if ($RowSource) { $RepairedEntity.Source = $RowSource }
+                if ($RowContentHash) { $RepairedEntity.ContentHash = $RowContentHash }
+                $null = Add-CIPPAzDataTableEntity @Table -Entity $RepairedEntity -Force
                 Write-LogMessage -headers $Request.Headers -API 'Standards' -message "Standards template '$($RowKey)' contained corrupt data (case-duplicate keys) and was automatically repaired and re-saved." -Sev 'Warning'
             } catch {
                 Write-LogMessage -headers $Request.Headers -API 'Standards' -message "Standards template '$($RowKey)' was repaired but could not be re-saved, so it was omitted from the response: $($_.Exception.Message)" -Sev 'Error'
@@ -40,10 +53,19 @@ function Invoke-listStandardTemplates {
             }
         }
         if ($Data) {
+            # $null means legacy synced row (no Source/ContentHash to compare); true/false compares
+            # the live content hash against the one stamped at the last push/import.
+            $IsRepoSource = Test-CIPPRepoSource -Source $_.Source
+            $HasLocalChanges = $null
+            if ($RowSource -and $RowContentHash) {
+                $HasLocalChanges = (Get-CIPPTemplateContentHash -JSON $EffectiveJSON) -ne $RowContentHash
+            }
             $DataProps = [ordered]@{
-                GUID     = $_.GUID
-                source   = $_.Source
-                isSynced = (![string]::IsNullOrEmpty($_.SHA))
+                GUID            = $_.GUID
+                source          = $(if ($IsRepoSource) { $_.Source } else { $null })
+                isSynced        = ($IsRepoSource -and ![string]::IsNullOrEmpty($_.SHA))
+                sourceUrl       = $(if ($IsRepoSource) { Get-CIPPTemplateSourceUrl -Source $_.Source -SourcePath $_.SourcePath -Repos $Repos } else { $null })
+                hasLocalChanges = $(if ($IsRepoSource) { $HasLocalChanges } else { $null })
             }
 
             if (!$Data.excludedTenants) {
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1
index 6c6c78700dd2c..ca202816159d8 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTestResultsTenants.ps1	
@@ -26,7 +26,7 @@ function Invoke-ListTestResultsTenants {
         $TenantFilterRaw = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
         # One or more test IDs (the result row's RowKey), e.g. 'CustomScript-<guid>'.
         $TestIdRaw = $Request.Query.testId ?? $Request.Body.testId
-        # Narrow the scan to these statuses: Passed, Failed, Investigate, Skipped, Informational.
+        # Narrow the scan to these statuses: Passed, Failed, Investigate, Skipped, Informational and Unlicensed.
         $StatusRaw = $Request.Query.status ?? $Request.Body.status
         # Restrict to a single test type: Identity, Devices or Custom.
         $TestType = $Request.Query.testType ?? $Request.Body.testType
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1
index 77408930154e9..7427329e72288 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Tests/Invoke-ListTests.ps1	
@@ -17,6 +17,9 @@ function Invoke-ListTests {
     try {
         $TenantFilter = $Request.Query.tenantFilter ?? $Request.Body.tenantFilter
         $ReportId = $Request.Query.reportId ?? $Request.Body.reportId
+        # When true, return only the aggregated TestCounts (per-type pass/fail/etc totals) and skip
+        # the per-result markdown/metadata enrichment and the SecureScore/MFAState/License DB reads.
+        $SummaryOnly = ($Request.Query.summaryOnly -eq $true) -or ($Request.Body.summaryOnly -eq $true)
 
         if (-not $TenantFilter) {
             throw 'TenantFilter parameter is required'
@@ -138,67 +141,69 @@ function Invoke-ListTests {
         $DeviceResults = $TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Devices' }
         $CustomResultsForCounts = $TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Custom' }
 
-        # Build lookup of custom script metadata (latest version per ScriptGuid)
-        $CustomScriptMetadataLookup = @{}
-        $CustomResults = @($TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Custom' })
-        if ($CustomResults.Count -gt 0) {
-            $CustomScriptsTable = Get-CippTable -tablename 'CustomPowershellScripts'
-            $CustomScripts = @(Get-CIPPAzDataTableEntity @CustomScriptsTable -Filter "PartitionKey eq 'CustomScript'")
-
-            if ($CustomScripts.Count -gt 0) {
-                $LatestCustomScripts = $CustomScripts |
-                    Group-Object -Property ScriptGuid |
-                    ForEach-Object {
-                        $_.Group | Sort-Object -Property Version -Descending | Select-Object -First 1
-                    }
+        if (-not $SummaryOnly) {
+            # Build lookup of custom script metadata (latest version per ScriptGuid)
+            $CustomScriptMetadataLookup = @{}
+            $CustomResults = @($TestResultsData.TestResults | Where-Object { $_.TestType -eq 'Custom' })
+            if ($CustomResults.Count -gt 0) {
+                $CustomScriptsTable = Get-CippTable -tablename 'CustomPowershellScripts'
+                $CustomScripts = @(Get-CIPPAzDataTableEntity @CustomScriptsTable -Filter "PartitionKey eq 'CustomScript'")
+
+                if ($CustomScripts.Count -gt 0) {
+                    $LatestCustomScripts = $CustomScripts |
+                        Group-Object -Property ScriptGuid |
+                        ForEach-Object {
+                            $_.Group | Sort-Object -Property Version -Descending | Select-Object -First 1
+                        }
 
-                foreach ($Script in @($LatestCustomScripts)) {
-                    if (-not [string]::IsNullOrWhiteSpace($Script.ScriptGuid)) {
-                        $CustomScriptMetadataLookup[$Script.ScriptGuid] = [PSCustomObject]@{
-                            Description      = $Script.Description ?? ''
-                            ReturnType       = $Script.ReturnType ?? 'JSON'
-                            MarkdownTemplate = $Script.MarkdownTemplate ?? ''
+                    foreach ($Script in @($LatestCustomScripts)) {
+                        if (-not [string]::IsNullOrWhiteSpace($Script.ScriptGuid)) {
+                            $CustomScriptMetadataLookup[$Script.ScriptGuid] = [PSCustomObject]@{
+                                Description      = $Script.Description ?? ''
+                                ReturnType       = $Script.ReturnType ?? 'JSON'
+                                MarkdownTemplate = $Script.MarkdownTemplate ?? ''
+                            }
                         }
                     }
                 }
             }
-        }
 
-        # Add descriptions from markdown files to each test result
-        $MdFileLookup = [System.Collections.Generic.Dictionary[string, string]]::new([System.StringComparer]::OrdinalIgnoreCase)
-        foreach ($MdPath in [System.IO.Directory]::EnumerateFiles($TestsRootPath, '*.md', [System.IO.SearchOption]::AllDirectories)) {
-            $MdKey = [System.IO.Path]::GetFileNameWithoutExtension($MdPath)
-            if (-not $MdFileLookup.ContainsKey($MdKey)) {
-                $MdFileLookup[$MdKey] = $MdPath
+            # Add descriptions from markdown files to each test result
+            $MdFileLookup = [System.Collections.Generic.Dictionary[string, string]]::new([System.StringComparer]::OrdinalIgnoreCase)
+            foreach ($MdPath in [System.IO.Directory]::EnumerateFiles($TestsRootPath, '*.md', [System.IO.SearchOption]::AllDirectories)) {
+                $MdKey = [System.IO.Path]::GetFileNameWithoutExtension($MdPath)
+                if (-not $MdFileLookup.ContainsKey($MdKey)) {
+                    $MdFileLookup[$MdKey] = $MdPath
+                }
             }
-        }
 
-        foreach ($TestResult in $TestResultsData.TestResults) {
-            $MdFile = $null
-            [void]$MdFileLookup.TryGetValue(('Invoke-CippTest{0}' -f $TestResult.RowKey), [ref]$MdFile)
-
-            if ($MdFile) {
-                try {
-                    $MdContent = [System.IO.File]::ReadAllText($MdFile)
-                    if ($MdContent) {
-                        $Description = ($MdContent -split '<!--- Results --->')[0].Trim()
-                        $Description = ($Description -split '%TestResult%')[0].Trim()
-                        $TestResult | Add-Member -NotePropertyName 'Description' -NotePropertyValue $Description -Force
+            foreach ($TestResult in $TestResultsData.TestResults) {
+                $MdFile = $null
+                [void]$MdFileLookup.TryGetValue(('Invoke-CippTest{0}' -f $TestResult.RowKey), [ref]$MdFile)
+
+                if ($MdFile) {
+                    try {
+                        $MdContent = [System.IO.File]::ReadAllText($MdFile)
+                        if ($MdContent) {
+                            $Description = ($MdContent -split '<!--- Results --->')[0].Trim()
+                            $Description = ($Description -split '%TestResult%')[0].Trim()
+                            $TestResult | Add-Member -NotePropertyName 'Description' -NotePropertyValue $Description -Force
+                        }
+                    } catch {
+                        #Test
                     }
-                } catch {
-                    #Test
                 }
-            }
 
-            if ($TestResult.TestType -eq 'Custom') {
-                $ScriptGuid = ($TestResult.RowKey -replace '^CustomScript-', '')
-                if (-not [string]::IsNullOrWhiteSpace($ScriptGuid) -and $CustomScriptMetadataLookup.ContainsKey($ScriptGuid)) {
-                    $CustomMetadata = $CustomScriptMetadataLookup[$ScriptGuid]
-                    $TestResult | Add-Member -NotePropertyMembers ([ordered]@{
-                            Description      = ($CustomMetadata.Description)
-                            ReturnType       = ($CustomMetadata.ReturnType)
-                            MarkdownTemplate = ($CustomMetadata.MarkdownTemplate)
-                        }) -Force
+                if ($TestResult.TestType -eq 'Custom') {
+                    $ScriptGuid = ($TestResult.RowKey -replace '^CustomScript-', '')
+                    if (-not [string]::IsNullOrWhiteSpace($ScriptGuid) -and $CustomScriptMetadataLookup.ContainsKey($ScriptGuid)) {
+                        $CustomMetadata = $CustomScriptMetadataLookup[$ScriptGuid]
+                        $TestResult | Add-Member -NotePropertyMembers ([ordered]@{
+                                Description      = ($CustomMetadata.Description)
+                                ReturnType       = ($CustomMetadata.ReturnType)
+                                MarkdownTemplate = ($CustomMetadata.MarkdownTemplate)
+                            }) -Force
+                    }
                 }
             }
         }
@@ -209,7 +214,7 @@ function Invoke-ListTests {
                 Failed         = @($IdentityResults | Where-Object { $_.Status -in @('Failed', 'Active', 'Postponed') }).Count
                 NeedsAttention = @($IdentityResults | Where-Object { $_.Status -eq 'Investigate' }).Count
                 Skipped        = @($IdentityResults | Where-Object { $_.Status -eq 'Skipped' }).Count
-                Informational  = @($IdentityResults | Where-Object { $_.Status -eq 'Informational' }).Count
+                Informational  = @($IdentityResults | Where-Object { $_.Status -in @('Informational', 'Unlicensed') }).Count
                 Total          = $IdentityTotal
             }
             Devices  = @{
@@ -217,7 +222,7 @@ function Invoke-ListTests {
                 Failed         = @($DeviceResults | Where-Object { $_.Status -in @('Failed', 'Active', 'Postponed') }).Count
                 NeedsAttention = @($DeviceResults | Where-Object { $_.Status -eq 'Investigate' }).Count
                 Skipped        = @($DeviceResults | Where-Object { $_.Status -eq 'Skipped' }).Count
-                Informational  = @($DeviceResults | Where-Object { $_.Status -eq 'Informational' }).Count
+                Informational  = @($DeviceResults | Where-Object { $_.Status -in @('Informational', 'Unlicensed') }).Count
                 Total          = $DevicesTotal
             }
             Custom   = @{
@@ -225,29 +230,39 @@ function Invoke-ListTests {
                 Failed         = @($CustomResultsForCounts | Where-Object { $_.Status -eq 'Failed' }).Count
                 NeedsAttention = @($CustomResultsForCounts | Where-Object { $_.Status -eq 'Investigate' }).Count
                 Skipped        = @($CustomResultsForCounts | Where-Object { $_.Status -eq 'Skipped' }).Count
-                Informational  = @($CustomResultsForCounts | Where-Object { $_.Status -eq 'Informational' }).Count
+                Informational  = @($CustomResultsForCounts | Where-Object { $_.Status -in @('Informational', 'Unlicensed') }).Count
                 Total          = $CustomTotal
             }
         }
 
-        $TestResultsData | Add-Member -NotePropertyName 'TestCounts' -NotePropertyValue $TestCounts -Force
+        if ($SummaryOnly) {
+            # Return only the aggregated counts; skip the SecureScore/MFAState/License DB reads
+            # and the full per-result payload.
+            $StatusCode = [HttpStatusCode]::OK
+            $Body = [PSCustomObject]@{
+                TenantFilter = $TenantFilter
+                TestCounts   = $TestCounts
+            }
+        } else {
+            $TestResultsData | Add-Member -NotePropertyName 'TestCounts' -NotePropertyValue $TestCounts -Force
 
-        $SecureScoreData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'SecureScore'
-        if ($SecureScoreData) {
-            $TestResultsData | Add-Member -NotePropertyName 'SecureScore' -NotePropertyValue @($SecureScoreData) -Force
-        }
-        $MFAStateData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'MFAState'
-        if ($MFAStateData) {
-            $TestResultsData | Add-Member -NotePropertyName 'MFAState' -NotePropertyValue @($MFAStateData) -Force
-        }
+            $SecureScoreData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'SecureScore'
+            if ($SecureScoreData) {
+                $TestResultsData | Add-Member -NotePropertyName 'SecureScore' -NotePropertyValue @($SecureScoreData) -Force
+            }
+            $MFAStateData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'MFAState'
+            if ($MFAStateData) {
+                $TestResultsData | Add-Member -NotePropertyName 'MFAState' -NotePropertyValue @($MFAStateData) -Force
+            }
 
-        $LicenseData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'LicenseOverview'
-        if ($LicenseData) {
-            $TestResultsData | Add-Member -NotePropertyName 'LicenseData' -NotePropertyValue @($LicenseData) -Force
-        }
+            $LicenseData = New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'LicenseOverview'
+            if ($LicenseData) {
+                $TestResultsData | Add-Member -NotePropertyName 'LicenseData' -NotePropertyValue @($LicenseData) -Force
+            }
 
-        $StatusCode = [HttpStatusCode]::OK
-        $Body = $TestResultsData
+            $StatusCode = [HttpStatusCode]::OK
+            $Body = $TestResultsData
+        }
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ExecBreachSearch.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ExecBreachSearch.ps1
index 753be3e42a7b5..92c2a719a2b98 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ExecBreachSearch.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ExecBreachSearch.ps1	
@@ -3,7 +3,7 @@ function Invoke-ExecBreachSearch {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        CIPP.Core.Read
+        CIPP.BreachLookup.Read
     .DESCRIPTION
         Queues a breach search for a tenant against Have I Been Pwned. The search runs as a background job and can take up to 24 hours; this returns as soon as it is queued, not with the results. Read the results with ListBreachesTenant.
     #>
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesAccount.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesAccount.ps1
index aa147520f492f..423dfa28decbe 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesAccount.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesAccount.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListBreachesAccount {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        CIPP.Core.Read
+        CIPP.BreachLookup.Read
     .DESCRIPTION
         Checks an email account or domain against the Have I Been Pwned (HIBP) breach database.
     #>
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesTenant.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesTenant.ps1
index ed8619691093b..e32eee7ac4e88 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesTenant.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Breach-Lookup/Invoke-ListBreachesTenant.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListBreachesTenant {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        CIPP.Core.Read
+        CIPP.BreachLookup.Read
     .DESCRIPTION
         Lists cached data breach results for user accounts in a tenant from the CIPP breach monitoring cache.
     #>
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1
index 16802f16f4431..9555b800f2bb3 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ExecCommunityRepo.ps1	
@@ -7,7 +7,7 @@ function Invoke-ExecCommunityRepo {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        CIPP.Core.ReadWrite
+        CIPP.TemplateLibrary.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -139,36 +139,8 @@ function Invoke-ExecCommunityRepo {
             }
         }
         'UploadTemplate' {
-            $GUID = $Request.Body.GUID
-            $TemplateTable = Get-CIPPTable -TableName templates
-            $TemplateEntity = Get-CIPPAzDataTableEntity @TemplateTable -Filter "RowKey eq '$($GUID)' or OriginalEntityId eq '$($GUID)'" | Select-Object -ExcludeProperty ETag, Timestamp
             $Branch = $RepoEntity.UploadBranch ?? $RepoEntity.DefaultBranch
-            if ($TemplateEntity) {
-                $Template = $TemplateEntity.JSON | ConvertFrom-Json -Depth 100 -ErrorAction Stop
-                $DisplayName = $Template.Displayname ?? $Template.templateName ?? $Template.name
-                if ($Template.tenantFilter) {
-                    $Template.tenantFilter = @(@{ label = 'Template Tenant'; value = 'Template Tenant' })
-                }
-                if ($Template.excludedTenants) {
-                    $Template.excludedTenants = @()
-                }
-                $TemplateEntity.JSON = $Template | ConvertTo-Json -Compress -Depth 100
-
-                $Basename = $DisplayName -replace '\s', '_' -replace '[^\w\d_]', ''
-                $Path = '{0}/{1}.json' -f $TemplateEntity.PartitionKey, $Basename
-                # Pretty-printed, not compressed: repo files are hand-edited on GitHub.
-                $Results = Push-GitHubContent -FullName $Request.Body.FullName -Path $Path -Content ($TemplateEntity | ConvertTo-Json -Depth 100) -Message $Request.Body.Message -Branch $Branch
-
-                $Results = @{
-                    resultText = "Template '$($DisplayName)' uploaded"
-                    state      = 'success'
-                }
-            } else {
-                $Results = @{
-                    resultText = "Template '$($GUID)' not found"
-                    state      = 'error'
-                }
-            }
+            $Results = Push-CIPPTemplateToRepo -GUID $Request.Body.GUID -FullName $Request.Body.FullName -Message $Request.Body.Message -Branch $Branch
         }
         'UploadBaseline' {
             # A baseline is not a templates-table row: Export-CIPPBaselineTemplate
@@ -176,31 +148,8 @@ function Invoke-ExecCommunityRepo {
             # template file per referenced CA/Intune template (packages expanded to
             # their current members). Related templates are separate files, exactly the
             # shape UploadTemplate writes, so they import through the untouched path.
-            $GUID = $Request.Body.GUID
             $Branch = $RepoEntity.UploadBranch ?? $RepoEntity.DefaultBranch
-            $Export = Export-CIPPBaselineTemplate -GUID $GUID
-            if ($Export) {
-                $Message = $Request.Body.Message
-                foreach ($TemplateEntity in $Export.Templates) {
-                    $TemplateJson = $(try { $TemplateEntity.JSON | ConvertFrom-Json -Depth 100 } catch { $null })
-                    $DisplayName = "$($TemplateJson.Displayname ?? $TemplateJson.displayName ?? $TemplateJson.name ?? $TemplateEntity.RowKey)"
-                    $Basename = $DisplayName -replace '\s', '_' -replace '[^\w\d_]', ''
-                    $Path = '{0}/{1}.json' -f $TemplateEntity.PartitionKey, $Basename
-                    $null = Push-GitHubContent -FullName $Request.Body.FullName -Path $Path -Content ($TemplateEntity | ConvertTo-Json -Depth 100) -Message $Message -Branch $Branch
-                }
-                $BaselineBasename = "$($Export.Baseline.templateName)" -replace '\s', '_' -replace '[^\w\d_]', ''
-                $BaselinePath = 'BaselineTemplate/{0}.json' -f $BaselineBasename
-                $null = Push-GitHubContent -FullName $Request.Body.FullName -Path $BaselinePath -Content ($Export.Baseline | ConvertTo-Json -Depth 100) -Message $Message -Branch $Branch
-                $Results = @{
-                    resultText = "Baseline '$($Export.Baseline.templateName)' uploaded with $(@($Export.Templates).Count) related template$(if (@($Export.Templates).Count -eq 1) { '' } else { 's' })"
-                    state      = 'success'
-                }
-            } else {
-                $Results = @{
-                    resultText = "Baseline '$($GUID)' not found"
-                    state      = 'error'
-                }
-            }
+            $Results = Push-CIPPBaselineToRepo -GUID $Request.Body.GUID -FullName $Request.Body.FullName -Message $Request.Body.Message -Branch $Branch
         }
         'SetBranch' {
             if (!$RepoEntity) {
@@ -238,7 +187,7 @@ function Invoke-ExecCommunityRepo {
                     # related-items pattern as CA named locations), then creates the
                     # baseline itself. Never a templates-table write.
                     $User = $(try { ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Request.Headers.'x-ms-client-principal')) | ConvertFrom-Json).userDetails } catch { $null })
-                    $ImportResult = Import-CIPPBaselineTemplate -Baseline $Content -FullName $FullName -Branch $Branch -SHA $Template.sha -User $User -Force:$Force
+                    $ImportResult = Import-CIPPBaselineTemplate -Baseline $Content -FullName $FullName -Branch $Branch -SHA $Template.sha -Path $Path -User $User -Force:$Force
                     $Results = @{
                         resultText = $ImportResult ?? 'Baseline imported'
                         state      = 'success'
@@ -258,7 +207,7 @@ function Invoke-ExecCommunityRepo {
                             (Get-GitHubFileContents -FullName $FullName -Branch $Branch -Path $Location.path).content | ConvertFrom-Json
                         }
                     }
-                    $ImportResult = Import-CommunityTemplate -Template $Content -SHA $Template.sha -MigrationTable $MigrationTable -LocationData $LocationData -Source $FullName -Force:$Force
+                    $ImportResult = Import-CommunityTemplate -Template $Content -SHA $Template.sha -MigrationTable $MigrationTable -LocationData $LocationData -Source $FullName -Path $Path -Force:$Force
 
                     $Results = @{
                         resultText = $ImportResult ?? 'Template imported'
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1
index 31ec0dac5c756..a9fecda7b4b7b 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepoTemplates.ps1	
@@ -9,7 +9,7 @@ function Invoke-ListCommunityRepoTemplates {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        CIPP.Core.Read
+        CIPP.TemplateLibrary.Read
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -89,7 +89,7 @@ function Invoke-ListCommunityRepoTemplates {
     # writes {PartitionKey}/{Name}.json), so these folder names reliably identify the type.
     $KnownPartitionKeys = @(
         'IntuneTemplate', 'CATemplate', 'StandardsTemplate', 'StandardsTemplateV2', 'GroupTemplate',
-        'AppApprovalTemplate', 'ReportBuilderTemplate', 'BPATemplate', 'TransportTemplate',
+        'AppApprovalTemplate', 'ReportBuilderTemplate', 'TransportTemplate',
         'ExConnectorTemplate', 'AppTemplate', 'ContactTemplate', 'JITAdminTemplate',
         'UserDefaultTemplate', 'AssignmentFilterTemplate', 'IntuneReusableSettingTemplate',
         'SharePointTemplate', 'DlpCompliancePolicyTemplate', 'RetentionCompliancePolicyTemplate',
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1
index 70e8aa932e901..0284a2c8a7ac0 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/GitHub/Invoke-ListCommunityRepos.ps1	
@@ -7,7 +7,7 @@ function Invoke-ListCommunityRepos {
     .FUNCTIONALITY
         Entrypoint,AnyTenant
     .ROLE
-        CIPP.Core.Read
+        CIPP.TemplateLibrary.Read
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1
index 50a73242f55f5..858ab00a5cd30 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGenerateReportBuilderReport.ps1	
@@ -3,7 +3,7 @@ function Invoke-ExecGenerateReportBuilderReport {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        CIPP.Core.ReadWrite
+        CIPP.ReportBuilder.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
@@ -23,6 +23,11 @@ function Invoke-ExecGenerateReportBuilderReport {
             $ExistingEntity = Get-CIPPAzDataTableEntity @ReportTable -Filter "RowKey eq '$($Body.ReportGUID)'"
             if ($ExistingEntity) {
                 Remove-CIPPAzDataTableEntity @ReportTable -Entity $ExistingEntity
+                # The rendered PDF sits in its own table; a large one is split across part rows, so fetch
+                # the raw head + part rows (keys only, no split markers) and hand them all to the remover.
+                $PdfTable = Get-CippTable -tablename 'ReportBuilderPdfs'
+                $PdfRows = @(Get-CIPPAzDataTableEntity @PdfTable -Filter "RowKey eq '$($Body.ReportGUID)' or OriginalEntityId eq '$($Body.ReportGUID)'" -Property PartitionKey, RowKey)
+                if ($PdfRows.Count -gt 0) { Remove-CIPPAzDataTableEntity @PdfTable -Entity $PdfRows }
                 Write-LogMessage -headers $Headers -API $APIName -message "Deleted generated report '$($Body.ReportGUID)'" -Sev 'Info'
                 $Result = @{ Results = 'Successfully deleted generated report' }
             } else {
@@ -53,8 +58,12 @@ function Invoke-ExecGenerateReportBuilderReport {
             $GenerateResult = Push-ExecGenerateReportBuilderReport @GenerateParams
             Write-LogMessage -headers $Headers -API $APIName -tenant $TenantFilter -message "Generated report builder report '$TemplateName'" -Sev 'Info'
 
+            # Push-* returns either the plain result string, or an envelope carrying base64 email
+            # attachments for the scheduled path. The interactive HTTP response only needs the message -
+            # the finished PDF is fetched from ExecGetReportBuilderPdf, not echoed here as base64.
+            $ResultText = if ($GenerateResult -is [System.Collections.IDictionary] -and $GenerateResult['Results']) { $GenerateResult['Results'] } else { $GenerateResult }
             $Result = @{
-                Results = $GenerateResult
+                Results = $ResultText
             }
             $StatusCode = [HttpStatusCode]::OK
 
@@ -68,6 +77,6 @@ function Invoke-ExecGenerateReportBuilderReport {
 
     return ([HttpResponseContext]@{
             StatusCode = $StatusCode
-            Body       = ConvertTo-Json -InputObject $Result -Depth 20
+            Body       = $Result
         })
 }
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGetReportBuilderPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGetReportBuilderPdf.ps1
new file mode 100644
index 0000000000000..44db9c6974056
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecGetReportBuilderPdf.ps1	
@@ -0,0 +1,95 @@
+function Invoke-ExecGetReportBuilderPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint,AnyTenant
+    .ROLE
+        CIPP.ReportBuilder.Read
+    .DESCRIPTION
+        Returns the server-rendered PDF for a generated Report Builder report as application/pdf bytes.
+        Backs both the in-app preview (shown in an iframe) and the download button on the view page.
+        A report generated before server-side rendering (or whose render failed) is rendered from its
+        stored blocks on first request and cached. 404 when the report does not exist, and also when
+        the report belongs to a tenant the caller cannot access.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    Write-LogMessage -Headers $Request.Headers -API $APIName -message 'Accessed this API' -Sev 'Debug'
+
+    try {
+        # The generated report's GUID.
+        $ReportGUID = $Request.Query.id ?? $Request.Query.ReportGUID
+        if ([string]::IsNullOrEmpty($ReportGUID)) {
+            return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::BadRequest; Body = 'A report id is required' })
+        }
+        $ReportGUID = ConvertTo-CIPPODataFilterValue -Value $ReportGUID -Type 'Guid'
+
+        # The PDF lives in its own table (keyed by the report GUID) so listing reports never pulls the
+        # base64. No -Property projection: the merge-aware read reassembles a PDF split across part rows.
+        $Table = Get-CippTable -tablename 'ReportBuilderPdfs'
+        $Row = Get-CIPPAzDataTableEntity @Table -Filter "RowKey eq '$ReportGUID'" | Select-Object -First 1
+        $Report = $null
+        if ([string]::IsNullOrEmpty($Row.Pdf)) {
+            # Reports generated before server-side rendering (or whose render failed) have no PDF row,
+            # but their report row holds the finished blocks - render those as stored, never re-enriched,
+            # so the PDF shows the data the report was generated with.
+            $ReportTable = Get-CippTable -tablename 'ReportBuilderReports'
+            $Report = Get-CIPPAzDataTableEntity @ReportTable -Filter "RowKey eq '$ReportGUID'" | Select-Object -First 1
+            if ([string]::IsNullOrEmpty($Report.Blocks)) {
+                return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::NotFound; Body = 'This report has no rendered PDF. Regenerate it to produce one.' })
+            }
+            $Row = [PSCustomObject]@{ PartitionKey = $Report.PartitionKey }
+        }
+
+        # The request carries only the report id, so the framework has no tenant to check (AnyTenant).
+        # The row is partitioned by the tenant it was generated for; a restricted caller only gets PDFs
+        # of tenants they can access, and the same 404 otherwise so ids of other tenants' reports leak nothing.
+        $AllowedTenants = Test-CIPPAccess -Request $Request -TenantList
+        if ($AllowedTenants -notcontains 'AllTenants') {
+            $AllowedDomains = @(Get-Tenants -IncludeErrors | Where-Object { $_.customerId -in $AllowedTenants } | ForEach-Object { [string]$_.defaultDomainName })
+            if ([string]$Row.PartitionKey -notin $AllowedDomains) {
+                return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::NotFound; Body = 'This report has no rendered PDF. Regenerate it to produce one.' })
+            }
+        }
+
+        if ($Report) {
+            $Settings = if ($Report.Settings) { try { ConvertFrom-Json -InputObject $Report.Settings } catch { $null } }
+            $PresetId = [string]$Settings.brandingPresetId
+            $GeneratedAt = [DateTimeOffset]::MinValue
+            $RenderParams = @{
+                Blocks           = $Report.Blocks
+                BrandingPresetId = $PresetId
+                TenantName       = Get-CippReportTenantName -TenantFilter $Report.PartitionKey -BrandingPresetId $PresetId
+                TenantFilter     = $Report.PartitionKey
+                ReportName       = $Report.TemplateName ?? 'Report'
+                PageSize         = if ($Settings.size) { [string]$Settings.size } else { 'A4' }
+                Landscape        = "$($Settings.orientation)" -eq 'landscape'
+            }
+            # The cover carries the date the report was generated, not the date it was first viewed.
+            if ([DateTimeOffset]::TryParse([string]$Report.GeneratedAt, [ref]$GeneratedAt)) {
+                $RenderParams.GeneratedOn = $GeneratedAt.ToString('MMMM d, yyyy', [cultureinfo]'en-US')
+            }
+            $PdfBytes = ConvertTo-CippReportPdf @RenderParams
+            $Row = @{
+                PartitionKey = $Report.PartitionKey
+                RowKey       = [string]$ReportGUID
+                FileName     = ("$($Report.TemplateName ?? 'Report')_$($Report.PartitionKey)" -replace '[^a-zA-Z0-9_\-]', '_') + '.pdf'
+                Pdf          = [Convert]::ToBase64String($PdfBytes)
+            }
+            # Cache it so the report renders once; a failed write only costs a re-render next time.
+            try { Add-CIPPAzDataTableEntity @Table -Force -Entity $Row } catch { Write-LogMessage -Headers $Request.Headers -API $APIName -message "Could not store rendered PDF for report $($ReportGUID): $($_.Exception.Message)" -Sev 'Warning' }
+        }
+
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Headers     = @{ 'Content-Disposition' = "inline; filename=`"$($Row.FileName ?? "Report_$ReportGUID.pdf")`"" }
+                Body        = [Convert]::FromBase64String($Row.Pdf)
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -Headers $Request.Headers -API $APIName -message "Failed to fetch report PDF: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{ StatusCode = [HttpStatusCode]::InternalServerError; Body = "Error: $($ErrorMessage.NormalizedError)" })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecPreviewReportBuilderPdf.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecPreviewReportBuilderPdf.ps1
new file mode 100644
index 0000000000000..f10ef3b94c41e
--- /dev/null
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecPreviewReportBuilderPdf.ps1	
@@ -0,0 +1,57 @@
+function Invoke-ExecPreviewReportBuilderPdf {
+    <#
+    .FUNCTIONALITY
+        Entrypoint
+    .ROLE
+        CIPP.ReportBuilder.ReadWrite
+    .DESCRIPTION
+        Renders the current (unsaved) Report Builder state to a PDF and returns it as application/pdf
+        bytes without persisting a generated-report row. Powers the builder's live preview and download.
+    #>
+    [CmdletBinding()]
+    param($Request, $TriggerMetadata)
+
+    $APIName = $TriggerMetadata.FunctionName
+    $Headers = $Request.Headers
+
+    try {
+        $Body = $Request.Body
+        $TenantFilter = $Body.TenantFilter ?? $Request.Query.TenantFilter
+        if ([string]::IsNullOrEmpty($TenantFilter)) { throw 'TenantFilter is required' }
+
+        $GenerateParams = @{
+            TenantFilter = $TenantFilter
+            TemplateName = $Body.TemplateName ?? 'Report'
+            PreviewOnly  = $true
+        }
+        if ($Body.Blocks) {
+            $GenerateParams.Blocks = if ($Body.Blocks -is [string]) { $Body.Blocks } else { ConvertTo-Json -InputObject @($Body.Blocks) -Depth 20 -Compress }
+        }
+        if ($Body.TemplateGUID) { $GenerateParams.TemplateGUID = $Body.TemplateGUID }
+        if ($Body.Settings) {
+            $GenerateParams.Settings = if ($Body.Settings -is [string]) { $Body.Settings } else { ConvertTo-Json -InputObject $Body.Settings -Depth 10 -Compress }
+        }
+
+        $Preview = Push-ExecGenerateReportBuilderReport @GenerateParams
+
+        if (-not $Preview.PdfBytes) {
+            return ([HttpResponseContext]@{
+                    StatusCode = [HttpStatusCode]::InternalServerError
+                    Body       = 'Failed to render the report preview.'
+                })
+        }
+
+        return ([HttpResponseContext]@{
+                StatusCode  = [HttpStatusCode]::OK
+                ContentType = 'application/pdf'
+                Body        = $Preview.PdfBytes
+            })
+    } catch {
+        $ErrorMessage = Get-CippException -Exception $_
+        Write-LogMessage -headers $Headers -API $APIName -message "Report preview error: $($ErrorMessage.NormalizedError)" -Sev 'Error' -LogData $ErrorMessage
+        return ([HttpResponseContext]@{
+                StatusCode = [HttpStatusCode]::InternalServerError
+                Body       = "Error: $($ErrorMessage.NormalizedError)"
+            })
+    }
+}
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1
index b6fb94f73e858..d26a7170c9a41 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ExecReportBuilderTemplate.ps1	
@@ -3,7 +3,7 @@ function Invoke-ExecReportBuilderTemplate {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        CIPP.Core.ReadWrite
+        CIPP.ReportBuilder.ReadWrite
     #>
     [CmdletBinding()]
     param($Request, $TriggerMetadata)
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1
index ccd854f23e1f4..a49f2bb4d91f3 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListGeneratedReports.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListGeneratedReports {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        CIPP.Core.Read
+        CIPP.ReportBuilder.Read
     .DESCRIPTION
         Lists generated reports from the CIPP Report Builder, filterable by tenant or report GUID.
     #>
diff --git a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1 b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1
index 20977c379a228..ae8955edce068 100644
--- a/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1	
+++ b/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Report-Builder/Invoke-ListReportBuilderTemplates.ps1	
@@ -3,7 +3,7 @@ function Invoke-ListReportBuilderTemplates {
     .FUNCTIONALITY
         Entrypoint
     .ROLE
-        CIPP.Core.Read
+        CIPP.ReportBuilder.Read
     .DESCRIPTION
         Lists saved Report Builder templates that define custom report configurations with data blocks and formatting.
     #>
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
index 4bb1a85b9e36d..73e5730b469d0 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1
@@ -103,7 +103,6 @@ function Invoke-CIPPStandardActivityBasedTimeout {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.ActivityBasedTimeout' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ActivityBasedTimeout' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
index 647323917e743..9e09ff3428201 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1
@@ -196,8 +196,6 @@ function Invoke-CIPPStandardAddDKIM {
     }
 
     if ($Settings.report -eq $true) {
-        $DKIMState = if ($null -eq $NewDomains -and $null -eq $SetDomains) { $true } else { $SetDomains, $NewDomains }
         Set-CIPPStandardsCompareField -FieldName 'standards.AddDKIM' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'DKIM' -FieldValue $DKIMState -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1
index 8c3ef3c619c99..9503a9e903f8c 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1
@@ -100,6 +100,5 @@ function Invoke-CIPPStandardAddDMARCToMOERA {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AddDMARCToMOERA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AddDMARCToMOERA' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAdminSSPR.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAdminSSPR.ps1
index a7939b9d6d496..5b1d44875e6ba 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAdminSSPR.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAdminSSPR.ps1
@@ -107,6 +107,5 @@
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AdminSSPR' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AdminSSPR' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1
index 1028725f29dd0..7dc3ef6701a08 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1
@@ -69,6 +69,5 @@ function Invoke-CIPPStandardAnonReportDisable {
     }
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AnonReportDisable' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'AnonReport' -FieldValue $CurrentInfo.displayConcealedNames -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
index 968b9b5e38085..9db1c34f31df6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1
@@ -320,7 +320,6 @@ function Invoke-CIPPStandardAntiPhishPolicy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AntiPhishPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AntiPhishPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1
index e6de258ac65a9..9e3a71884d5e6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1
@@ -70,7 +70,6 @@ function Invoke-CIPPStandardAntiSpamSafeList {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AntiSpamSafeList' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AntiSpamSafeList' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 
     if ($Settings.remediate -eq $true) {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1
index 828d5c9103017..947611abfed33 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1
@@ -297,9 +297,7 @@ function Invoke-CIPPStandardAppDeploy {
     }
 
     if ($Settings.report -eq $true) {
-        $StateIsCorrect = $MissingApps.Count -eq 0 ? $true : @{ 'Missing Apps' = $MissingApps -join ',' }
         Set-CIPPStandardsCompareField -FieldName 'standards.AppDeploy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'AppDeploy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppManagementPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppManagementPolicy.ps1
index a6865d3f70db2..247ada03a96bf 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppManagementPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppManagementPolicy.ps1
@@ -193,6 +193,5 @@ function Invoke-CIPPStandardAppManagementPolicy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AppManagementPolicy' -CurrentValue $CurrentValue -ExpectedValue $desiredState -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AppManagementPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
index e89461cf14303..4f45ebba2f1fc 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1
@@ -105,7 +105,6 @@ function Invoke-CIPPStandardAtpPolicyForO365 {
     if ($Settings.report -eq $true) {
         $state = $StateIsCorrect -eq $true ? $true : $CurrentState
         Set-CIPPStandardsCompareField -FieldName 'standards.AtpPolicyForO365' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'AtpPolicyForO365' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
index 81e089878460b..ab3781aa66da4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1
@@ -97,6 +97,5 @@ function Invoke-CIPPStandardAuditLog {
     if ($Settings.report -eq $true) {
         $state = $AuditLogEnabled -eq $true ? $true : $AuditLogEnabled
         Set-CIPPStandardsCompareField -FieldName 'standards.AuditLog' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AuditLog' -FieldValue $AuditLogEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1
index aaa3d82a052b6..0e0cfb1a187d4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1
@@ -74,9 +74,7 @@ function Invoke-CIPPStandardAuthMethodsPolicyMigration {
     }
 
     if ($Settings.report -eq $true) {
-        $migrationComplete = $CurrentInfo.policyMigrationState -eq 'migrationComplete' -or $null -eq $CurrentInfo.policyMigrationState
         Set-CIPPStandardsCompareField -FieldName 'standards.AuthMethodsPolicyMigration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'AuthMethodsPolicyMigration' -FieldValue $migrationComplete -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1
index 939ceb891e61d..3da179ab6ba07 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1
@@ -98,8 +98,6 @@ function Invoke-CIPPStandardAuthMethodsSettings {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AuthMethodsSettings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'ReportSuspiciousActivity' -FieldValue $CurrentPolicy.reportSuspiciousActivitySettings.state -StoreAs string -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'SystemCredential' -FieldValue $CurrentPolicy.systemCredentialPreferences.state -StoreAs string -Tenant $tenant
     }
 
     if ($Settings.alert -eq $true) {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1
index f16f32e0c1d37..a7f36107c29b1 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1
@@ -461,7 +461,5 @@ function Invoke-CIPPStandardAuthenticationMethods {
             $ExpectedValue[$Result.Method.Key] = $Result.ExpectedConfig
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.AuthenticationMethods' -CurrentValue ([PSCustomObject]$CurrentValue) -ExpectedValue ([PSCustomObject]$ExpectedValue) -TenantFilter $Tenant
-        $AllCompliant = -not ($ComplianceResults | Where-Object { -not $_.IsCompliant })
-        Add-CIPPBPAField -FieldName 'AuthenticationMethods' -FieldValue ([bool]$AllCompliant) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1
index 6acdb097014fe..a85aec4a19428 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardAutoAddProxy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AutoAddProxy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AutoAddProxy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
     if ($Settings.alert -eq $true) {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1
index 55830e0b51796..1710f014c4f6d 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchive.ps1
@@ -94,7 +94,6 @@ function Invoke-CIPPStandardAutoArchive {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'AutoArchive' -FieldValue $CorrectState -StoreAs bool -Tenant $Tenant
 
         if ($CorrectState) {
             $FieldValue = $true
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1
index 662d28b3d0b80..5feec15465bd3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoArchiveMailbox.ps1
@@ -94,6 +94,5 @@ function Invoke-CIPPStandardAutoArchiveMailbox {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AutoArchiveMailbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AutoArchiveMailbox' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
index 111b785dc0da3..7ecb1416b58b9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoExpandArchive.ps1
@@ -84,6 +84,5 @@ function Invoke-CIPPStandardAutoExpandArchive {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AutoExpandArchive' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'AutoExpandingArchive' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1
index e5057e045ed30..f1505544a8f1b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1
@@ -240,7 +240,4 @@ function Invoke-CIPPStandardAutopatchGroup {
         }
     }
 
-    if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'AutopatchGroup' -FieldValue ([bool]$ExistingGroup) -StoreAs bool -Tenant $Tenant
-    }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1
index f8f1e723eef5d..2ae7b6a5ba7fd 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotProfile.ps1
@@ -155,7 +155,6 @@ function Invoke-CIPPStandardAutopilotProfile {
     # Report
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AutopilotProfile' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AutopilotProfile' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
     # Alert
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1
index 50caf5842fa08..92827e9f7cf83 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopilotStatusPage.ps1
@@ -128,7 +128,6 @@ function Invoke-CIPPStandardAutopilotStatusPage {
     # Report
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.AutopilotStatusPage' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AutopilotStatusPage' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 
     # Alert
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1
index afd1fe176ddd6..c23a14d715ab9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBitLockerKeysForOwnedDevice.ps1
@@ -102,6 +102,5 @@ function Invoke-CIPPStandardBitLockerKeysForOwnedDevice {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.BitLockerKeysForOwnedDevice' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'BitLockerKeysForOwnedDevice' -FieldValue $CurrentValue -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1
index 85a0036c34a3f..9d01ba66c8ff4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBookings.ps1
@@ -74,7 +74,6 @@ function Invoke-CIPPStandardBookings {
         Set-CIPPStandardsCompareField -FieldName 'standards.Bookings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
         # Default is not set, not set means it's enabled
         if ($null -eq $CurrentState ) { $CurrentState = $true }
-        Add-CIPPBPAField -FieldName 'BookingsState' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 
     if ($Settings.remediate -eq $true) {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1
index 38986f49dd7d6..89b00ce1a4b49 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1
@@ -164,6 +164,5 @@ function Invoke-CIPPStandardBranding {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.Branding' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'Branding' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
index 0d2b67f55a5a4..5f4bc419a0ff9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCloudMessageRecall.ps1
@@ -74,7 +74,6 @@ function Invoke-CIPPStandardCloudMessageRecall {
         # Default is not set, not set means it's enabled
         if ($null -eq $CurrentState ) { $CurrentState = $true }
         Set-CIPPStandardsCompareField -FieldName 'standards.CloudMessageRecall' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'MessageRecall' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 
 
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1
index 90a8c9f714569..afc251847139b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCollaborationDomainRestriction.ps1
@@ -148,6 +148,5 @@ function Invoke-CIPPStandardCollaborationDomainRestriction {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.CollaborationDomainRestriction' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'CollaborationDomainRestriction' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardColleagueImpersonationAlert.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardColleagueImpersonationAlert.ps1
index 9e6ee7bf0ae41..7d16d1b0141aa 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardColleagueImpersonationAlert.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardColleagueImpersonationAlert.ps1
@@ -291,6 +291,5 @@ function Invoke-CIPPStandardColleagueImpersonationAlert {
             '(U-Z) Colleague Impersonation Alert' = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.ColleagueImpersonationAlert' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ColleagueImpersonationAlert' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1
index 79a7326274e46..ee73f5e544c6e 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1
@@ -184,9 +184,9 @@ function Invoke-CIPPStandardConditionalAccessTemplate {
                 return
             }
 
-            if ($Settings.state -and $Settings.state -ne 'donotchange' -and $CompareObj.state -eq $Settings.state) {
-                Write-Information "Policy is in the deployed state '$($CompareObj.state)'; not comparing against template state '$($Policy.state)'"
-                $Policy | Add-Member -NotePropertyName 'state' -NotePropertyValue $CompareObj.state -Force
+            # Override the template's state with the standard's state for drift comparison
+            if ($Settings.state -and $Settings.state -ne 'donotchange') {
+                $Policy | Add-Member -NotePropertyName 'state' -NotePropertyValue $Settings.state -Force
             }
 
             try {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotLimitedMode.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotLimitedMode.ps1
index 13ffd28510406..4779ab0480a48 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotLimitedMode.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotLimitedMode.ps1
@@ -129,6 +129,5 @@ function Invoke-CIPPStandardCopilotLimitedMode {
             groupId           = if ($DesiredEnabled) { $ResolvedGroupId } else { $null }
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.CopilotLimitedMode' -CurrentValue ([PSCustomObject]$CurrentValue) -ExpectedValue ([PSCustomObject]$ExpectedValue) -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'CopilotLimitedMode' -FieldValue ([bool]$StateIsCorrect) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotSettings.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotSettings.ps1
index 9b4795886e82d..310bf245c8299 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotSettings.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCopilotSettings.ps1
@@ -141,7 +141,5 @@ function Invoke-CIPPStandardCopilotSettings {
             $ExpectedState[$Result.Key] = $Result.Desired
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.CopilotSettings' -CurrentValue ([PSCustomObject]$CurrentState) -ExpectedValue ([PSCustomObject]$ExpectedState) -TenantFilter $Tenant
-        $AllCompliant = -not ($ComplianceResults | Where-Object { -not $_.IsCompliant })
-        Add-CIPPBPAField -FieldName 'CopilotSettings' -FieldValue ([bool]$AllCompliant) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1
index 427bff2824810..a1ca3f72d4571 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardCustomBannedPasswordList.ps1
@@ -248,7 +248,6 @@ function Invoke-CIPPStandardCustomBannedPasswordList {
             }
         }
 
-        Add-CIPPBPAField -FieldName 'CustomBannedPasswordList' -CurrentValue $BannedPasswordState -ExpectedValue $ExpectedValue -StoreAs json -Tenant $tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.CustomBannedPasswordList' -FieldValue $BannedPasswordState.Compliant -Tenant $tenant
     }
 
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1
index 2d3c9052d4855..7646077895192 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultPlatformRestrictions.ps1
@@ -217,6 +217,5 @@ function Invoke-CIPPStandardDefaultPlatformRestrictions {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DefaultPlatformRestrictions' -CurrentValue $CompareField -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DefaultPlatformRestrictions' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1
index 7a82cb1e947a8..ad4b641eab885 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefaultSharingLink.ps1
@@ -137,7 +137,6 @@ function Invoke-CIPPStandardDefaultSharingLink {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'DefaultSharingLink' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
         if ($StateIsCorrect) {
             $FieldValue = $true
         } else {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderASRPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderASRPolicy.ps1
index c5877f3cb961a..8672858f82cdb 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderASRPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderASRPolicy.ps1
@@ -211,6 +211,5 @@ function Invoke-CIPPStandardDefenderASRPolicy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DefenderASRPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DefenderASRPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderAVPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderAVPolicy.ps1
index 4901c51f8c37c..c09e218d5d5ac 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderAVPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderAVPolicy.ps1
@@ -316,6 +316,5 @@ function Invoke-CIPPStandardDefenderAVPolicy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DefenderAVPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DefenderAVPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1
index c5f73aab4236b..ed03d415fd8f0 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1
@@ -186,6 +186,5 @@ function Invoke-CIPPStandardDefenderCompliancePolicy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DefenderCompliancePolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DefenderCompliancePolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderEDRPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderEDRPolicy.ps1
index 01c756b9fea81..ead3429d1dff9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderEDRPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderEDRPolicy.ps1
@@ -130,6 +130,5 @@ function Invoke-CIPPStandardDefenderEDRPolicy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DefenderEDRPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DefenderEDRPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderExclusionPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderExclusionPolicy.ps1
index 34a7010aaba48..dc2b4bf2fad07 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderExclusionPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderExclusionPolicy.ps1
@@ -155,6 +155,5 @@ function Invoke-CIPPStandardDefenderExclusionPolicy {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DefenderExclusionPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DefenderExclusionPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
index 35b7259a707e5..5c881d748eb2c 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDelegateSentItems.ps1
@@ -103,8 +103,6 @@ function Invoke-CIPPStandardDelegateSentItems {
     }
 
     if ($Settings.report -eq $true) {
-        $Filtered = $Mailboxes | Select-Object -Property UPN, MessageCopyForSendOnBehalfEnabled, MessageCopyForSentAsEnabled
         Set-CIPPStandardsCompareField -FieldName 'standards.DelegateSentItems' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DelegateSentItems' -FieldValue $Filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
index bf21fb3ff6376..672445e29e7db 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeletedUserRentention.ps1
@@ -64,7 +64,6 @@ function Invoke-CIPPStandardDeletedUserRentention {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DeletedUserRentention' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DeletedUserRentention' -FieldValue $CurrentInfo.deletedUserPersonalSiteRetentionPeriodInDays -StoreAs string -Tenant $Tenant
     }
 
     # Get days value using null-coalescing operator
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1
index aaa3a2b7858a3..9db33b2bdae12 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1
@@ -469,7 +469,6 @@ exit 0
         }
 
         if ($Settings.report -eq $true) {
-            $StateIsCorrect = $AppExists
             $ExpectedValue = [PSCustomObject]@{
                 AppDeployed = $true
             }
@@ -477,7 +476,6 @@ exit 0
                 AppDeployed = [bool]$AppExists
             }
             Set-CIPPStandardsCompareField -FieldName 'standards.DeployCheckChromeExtension' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-            Add-CIPPBPAField -FieldName 'DeployCheckChromeExtension' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
         }
 
     } catch {
@@ -490,7 +488,6 @@ exit 0
 
         if ($Settings.report -eq $true) {
             Set-CIPPStandardsCompareField -FieldName 'standards.DeployCheckChromeExtension' -FieldValue @{ 'Error' = $ErrorMessage } -TenantFilter $Tenant
-            Add-CIPPBPAField -FieldName 'DeployCheckChromeExtension' -FieldValue $false -StoreAs bool -Tenant $Tenant
         }
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1
index f861da92045e9..a891f21fdfb15 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployMailContact.ps1
@@ -135,7 +135,6 @@ function Invoke-CIPPStandardDeployMailContact {
             FirstName            = $ExistingContactLookup.givenName ?? ''
             LastName             = $ExistingContactLookup.surname ?? ''
         }
-        Add-CIPPBPAField -FieldName 'DeployMailContact' -FieldValue $ContactData -StoreAs json -Tenant $Tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.DeployMailContact' -CurrentValue $CurrentValue -ExpectedValue $ContactData -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1
index 1febdcda205bf..f7d1a34c1ff1b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1
@@ -21,7 +21,7 @@ function Invoke-CIPPStandardDevicePrepProfile {
             {"type":"textField","name":"standards.DevicePrepProfile.ProfileDescription","label":"Profile Description","required":false}
             {"type":"select","multiple":false,"name":"standards.DevicePrepProfile.DeploymentType","label":"Deployment Type","options":[{"label":"Single user","value":"0"},{"label":"Shared","value":"1"}]}
             {"type":"select","multiple":false,"name":"standards.DevicePrepProfile.JoinType","label":"Join Type","options":[{"label":"Microsoft Entra join","value":"0"},{"label":"Microsoft Entra hybrid join","value":"1"}]}
-            {"type":"select","multiple":false,"name":"standards.DevicePrepProfile.AccountType","label":"Account Type","options":[{"label":"Standard user","value":"0"},{"label":"Administrator","value":"1"}]}
+            {"type":"select","multiple":false,"name":"standards.DevicePrepProfile.AccountType","label":"Account Type","options":[{"label":"Standard user","value":"1"},{"label":"Administrator","value":"0"}]}
             {"type":"number","name":"standards.DevicePrepProfile.Timeout","label":"Timeout (minutes)","defaultValue":60}
             {"type":"textField","name":"standards.DevicePrepProfile.CustomErrorMessage","label":"Custom Error Message","required":false}
             {"type":"switch","name":"standards.DevicePrepProfile.AllowSkip","label":"Allow users to skip setup after failure","defaultValue":false}
@@ -65,7 +65,7 @@ function Invoke-CIPPStandardDevicePrepProfile {
     $DeploymentMode = '0' # Device Prep only supports self-deploying mode
     $DeploymentType = $Settings.DeploymentType.value ?? $Settings.DeploymentType ?? '0'
     $JoinType = $Settings.JoinType.value ?? $Settings.JoinType ?? '0'
-    $AccountType = $Settings.AccountType.value ?? $Settings.AccountType ?? '0'
+    $AccountType = $Settings.AccountType.value ?? $Settings.AccountType ?? '1' # 1 = Standard user, 0 = Administrator
     $Timeout = [int]($Settings.Timeout ?? 60)
     $CustomErrorMessage = $Settings.CustomErrorMessage ?? "Contact your organization`u{2019}s support person for help."
     $AllowSkip = if ($Settings.AllowSkip -eq $true) { '1' } else { '0' }
@@ -288,7 +288,6 @@ function Invoke-CIPPStandardDevicePrepProfile {
     $SimpleSettingMap = @{
         'enrollment_autopilot_dpp_timeout'                = 'Timeout'
         'enrollment_autopilot_dpp_customerrormessage'     = 'CustomErrorMessage'
-        'enrollment_autopilot_dpp_devicesecuritygroupids' = 'DeviceGroupId'
     }
 
     # Check existing policies
@@ -324,6 +323,14 @@ function Invoke-CIPPStandardDevicePrepProfile {
         }
     }
 
+    # Intune enrols devices through the membership target action, not the settings string the
+    # portal displays, so the applied group is read back through the helper rather than parsed
+    # out of the policy body.
+    $MembershipTarget = $null
+    if ($PolicyExists) {
+        $MembershipTarget = Get-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId $ExistingPolicy.id -TenantFilter $Tenant
+    }
+
     # Read the assignment state alongside the settings. A profile whose settings match but whose
     # assignment is missing is half-deployed - nobody gets it - and without this read that state
     # is invisible, so no run could ever detect or repair it.
@@ -351,7 +358,6 @@ function Invoke-CIPPStandardDevicePrepProfile {
         CustomErrorMessage = [string]($CurrentParsed.CustomErrorMessage ?? '')
         AllowSkip          = [string]($CurrentParsed.AllowSkip ?? '')
         AllowDiagnostics   = [string]($CurrentParsed.AllowDiagnostics ?? '')
-        DeviceGroupId      = [string]($CurrentParsed.DeviceGroupId ?? '')
     }
 
     $ExpectedValue = [PSCustomObject]@{
@@ -364,7 +370,15 @@ function Invoke-CIPPStandardDevicePrepProfile {
         CustomErrorMessage = $CustomErrorMessage
         AllowSkip          = $AllowSkip
         AllowDiagnostics   = $AllowDiagnostics
-        DeviceGroupId      = $DeviceGroupId
+    }
+
+    # An expected group that resolved to nothing - not configured, missing and not creatable, or
+    # a failed lookup - is a deviation nothing in CIPP could clear, so the dimension stays out.
+    $MembershipMatches = $null
+    if ($PolicyExists -and -not [string]::IsNullOrWhiteSpace($DeviceGroupId)) {
+        $MembershipMatches = ([string]$MembershipTarget.GroupId -eq [string]$DeviceGroupId)
+        $CurrentValue | Add-Member -NotePropertyName 'DeviceGroupId' -NotePropertyValue ([string]$MembershipTarget.GroupId)
+        $ExpectedValue | Add-Member -NotePropertyName 'DeviceGroupId' -NotePropertyValue ([string]$DeviceGroupId)
     }
 
     # A failed assignment lookup is unknown, not a deviation: leave the dimension out of the
@@ -395,9 +409,10 @@ function Invoke-CIPPStandardDevicePrepProfile {
         }
         if ($SettingsAreCorrect -and [int]$CurrentValue.Timeout -ne $ExpectedValue.Timeout) { $SettingsAreCorrect = $false }
         if ($SettingsAreCorrect -and $CurrentValue.CustomErrorMessage -ne $ExpectedValue.CustomErrorMessage) { $SettingsAreCorrect = $false }
-        if ($SettingsAreCorrect -and $CurrentValue.DeviceGroupId -ne $ExpectedValue.DeviceGroupId) { $SettingsAreCorrect = $false }
     }
-    $StateIsCorrect = $SettingsAreCorrect -and $AssignmentsMatch -ne $false
+    # The membership target stays out of the settings verdict: it is a separate action on the
+    # existing policy, so recreating the profile over it would destroy more than it repairs.
+    $StateIsCorrect = $SettingsAreCorrect -and $AssignmentsMatch -ne $false -and $MembershipMatches -ne $false
 
     # Remediate
     if ($Settings.remediate -eq $true) {
@@ -407,10 +422,14 @@ function Invoke-CIPPStandardDevicePrepProfile {
             # Only the assignment differs. Repair it in place - recreating the profile would sever
             # the enrollment-time device group linkage over a delta the /assign endpoint can fix.
             try {
-                if ($AssignmentBody) {
+                if ($AssignmentBody -and $AssignmentsMatch -eq $false) {
                     $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($ExistingPolicy.id)')/assign" -tenantid $Tenant -body $AssignmentBody -type POST
                     Write-LogMessage -API 'Standards' -tenant $Tenant -message "DevicePrepProfile: Repaired assignment for profile '$ProfileName' ($(@($AssignmentDetail.Reasons) -join '; '))" -sev Info
                 }
+                if ($MembershipMatches -eq $false -and -not [string]::IsNullOrWhiteSpace($DeviceGroupId)) {
+                    $null = Set-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId $ExistingPolicy.id -GroupId $DeviceGroupId -TenantFilter $Tenant
+                    Write-LogMessage -API 'Standards' -tenant $Tenant -message "DevicePrepProfile: Applied the enrollment time device membership target for profile '$ProfileName'" -sev Info
+                }
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
                 Write-LogMessage -API 'Standards' -tenant $Tenant -message "DevicePrepProfile: Failed to repair assignment for profile '$ProfileName': $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
@@ -420,6 +439,8 @@ function Invoke-CIPPStandardDevicePrepProfile {
                 # Delete drifted policy before recreating
                 if ($PolicyExists) {
                     $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($ExistingPolicy.id)')" -tenantid $Tenant -type DELETE
+                    # The recreated profile gets a new id, so the old marker must not survive it.
+                    Remove-CIPPEnrollmentTimeDeviceMembershipMarker -PolicyId $ExistingPolicy.id -TenantFilter $Tenant
                     Write-LogMessage -API 'Standards' -tenant $Tenant -message "DevicePrepProfile: Deleted existing profile '$ProfileName' for recreation" -sev Info
                 }
 
@@ -431,6 +452,11 @@ function Invoke-CIPPStandardDevicePrepProfile {
                     $null = New-GraphPOSTRequest -uri "https://graph.microsoft.com/beta/deviceManagement/configurationPolicies('$($NewPolicy.id)')/assign" -tenantid $Tenant -body $AssignmentBody -type POST
                 }
 
+                # The settings string alone leaves the profile with no group applied.
+                if ($NewPolicy.id -and -not [string]::IsNullOrWhiteSpace($DeviceGroupId)) {
+                    $null = Set-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId $NewPolicy.id -GroupId $DeviceGroupId -TenantFilter $Tenant
+                }
+
                 Write-LogMessage -API 'Standards' -tenant $Tenant -message "DevicePrepProfile: Successfully deployed profile '$ProfileName'" -sev Info
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
@@ -452,6 +478,5 @@ function Invoke-CIPPStandardDevicePrepProfile {
     # Report
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.DevicePrepProfile' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DevicePrepProfile' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1
index 45e9517e989bc..8f8c2904dbb14 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAddShortcutsToOneDrive.ps1
@@ -80,7 +80,6 @@ function Invoke-CIPPStandardDisableAddShortcutsToOneDrive {
             $FieldValue = $CurrentState | Select-Object -Property DisableAddToOneDrive
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableAddShortcutsToOneDrive' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'OneDriveAddShortcutButtonDisabled' -FieldValue $CurrentState.DisableAddToOneDrive -StoreAs bool -Tenant $Tenant
     }
 
     if ($Settings.remediate -eq $true) {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
index 1bb71fa818d14..bfff0c85dc00a 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAdditionalStorageProviders.ps1
@@ -91,8 +91,6 @@ function Invoke-CIPPStandardDisableAdditionalStorageProviders {
     }
 
     if ($Settings.report -eq $true) {
-        $State = $AdditionalStorageProvidersState.AdditionalStorageProvidersAvailable ? $false : $true
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableAdditionalStorageProviders' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AdditionalStorageProvidersAvailable' -FieldValue $State -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1
index bea84f83875af..453358da2e34b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableAppCreation.ps1
@@ -81,8 +81,6 @@ function Invoke-CIPPStandardDisableAppCreation {
     }
 
     if ($Settings.report -eq $true) {
-        $State = -not $CurrentInfo.defaultUserRolePermissions.allowedToCreateApps
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableAppCreation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'UserAppCreationDisabled' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
index 70637854ca19a..64967c1d9e9d9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1
@@ -134,12 +134,6 @@ function Invoke-CIPPStandardDisableBasicAuthSMTP {
 
             Set-CIPPStandardsCompareField -FieldName 'standards.DisableBasicAuthSMTP' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
 
-            if ($CurrentInfo.SmtpClientAuthenticationDisabled -and $SMTPusers.Count -eq 0) {
-                Add-CIPPBPAField -FieldName 'DisableBasicAuthSMTP' -FieldValue $CurrentInfo.SmtpClientAuthenticationDisabled -StoreAs bool -Tenant $tenant
-            } else {
-                $Logs = $LogMessage | Select-Object @{n = 'Message'; e = { $_ } }
-                Add-CIPPBPAField -FieldName 'DisableBasicAuthSMTP' -FieldValue $Logs -StoreAs json -Tenant $tenant
-            }
         }
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1
index 27d90969379c2..224e30efd7b8e 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEWS.ps1
@@ -85,6 +85,5 @@ function Invoke-CIPPStandardDisableEWS {
             DisableEWS = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableEWS' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableEWS' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1
index 30241c7d681ae..e26cacff1a8b4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEmail.ps1
@@ -73,6 +73,5 @@ function Invoke-CIPPStandardDisableEmail {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableEmail' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableEmail' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
index 5eadc8d557618..5d22276099854 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableEntraPortal.ps1
@@ -39,7 +39,6 @@ function Invoke-CIPPStandardDisableEntraPortal {
 
     if ($Settings.report -eq $true) {
         set-CIPPStandardsCompareField -FieldName 'standards.DisableEntraPortal' -FieldValue $CurrentInfo.isSoftwareOathEnabled -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableEntraPortal' -FieldValue $CurrentInfo.isSoftwareOathEnabled -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1
index 290032a1ff153..baa895ff58dd8 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1
@@ -137,6 +137,5 @@ function Invoke-CIPPStandardDisableExchangeOnlinePowerShell {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableExchangeOnlinePowerShell' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ExchangeOnlinePowerShellDisabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
index dc3ecc0b6e284..7894750bcf70d 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExternalCalendarSharing.ps1
@@ -104,6 +104,5 @@ function Invoke-CIPPStandardDisableExternalCalendarSharing {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableExternalCalendarSharing' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ExternalCalendarSharingDisabled' -FieldValue $CurrentStatus -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1
index cda1992a2c62f..c8d8f9fd8e44b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuestDirectory.ps1
@@ -84,6 +84,5 @@ function Invoke-CIPPStandardDisableGuestDirectory {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableGuestDirectory' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableGuestDirectory' -FieldValue $CurrentStatus -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1
index 7236c0c4df80a..958db835e26d1 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1
@@ -295,6 +295,5 @@ function Invoke-CIPPStandardDisableGuests {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableGuests' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableGuests' -FieldValue $Filtered -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableInactiveUsers.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableInactiveUsers.ps1
index 19a1e9fd792c2..a90826a762b72 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableInactiveUsers.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableInactiveUsers.ps1
@@ -187,6 +187,5 @@ function Invoke-CIPPStandardDisableInactiveUsers {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableInactiveUsers' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableInactiveUsers' -FieldValue $Filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1
index 0ddfa0f5682a3..f6b954985cb48 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableM365GroupUsers.ps1
@@ -208,7 +208,6 @@ function Invoke-CIPPStandardDisableM365GroupUsers {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableM365GroupUsers' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableM365GroupUsers' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
index 6038fd1707707..176c2cbb6ac93 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableOutlookAddins.ps1
@@ -111,6 +111,5 @@ function Invoke-CIPPStandardDisableOutlookAddins {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableOutlookAddins' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisabledOutlookAddins' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1
index 21291622be033..ac15f88c71a39 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableQRCodePin.ps1
@@ -74,6 +74,5 @@ function Invoke-CIPPStandardDisableQRCodePin {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableQRCodePin' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableQRCodePin' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1
index 3822b3087fa9a..83e70bcdc42d7 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableReshare.ps1
@@ -95,6 +95,5 @@ function Invoke-CIPPStandardDisableReshare {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableReshare' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableReshare' -FieldValue $CurrentInfo.isResharingByExternalUsersEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1
index 041c7e215e252..45a2e3418de75 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableResourceMailbox.ps1
@@ -130,6 +130,5 @@ function Invoke-CIPPStandardDisableResourceMailbox {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableResourceMailbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableResourceMailbox' -FieldValue $ResourceMailboxList -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1
index 0b3b7edd89ca9..860ad448cd4bb 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSMS.ps1
@@ -77,6 +77,5 @@ function Invoke-CIPPStandardDisableSMS {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableSMS' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableSMS' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1
index 7dc1367ebf286..e158383785141 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSecurityGroupUsers.ps1
@@ -77,6 +77,5 @@ function Invoke-CIPPStandardDisableSecurityGroupUsers {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableSecurityGroupUsers' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'DisableSecurityGroupUsers' -FieldValue $CurrentInfo.defaultUserRolePermissions.allowedToCreateSecurityGroups -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
index ceab1d61e41fa..8ed1c4364c2b8 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSelfServiceLicenses.ps1
@@ -206,8 +206,6 @@ function Invoke-CIPPStandardDisableSelfServiceLicenses {
 
     if ($Settings.report -eq $true) {
 
-        $StateIsCorrect = !(Compare-Object -ReferenceObject $ExpectedValues -DifferenceObject $CurrentValues -Property productName, productId, policyValue)
-
         $ExpectedValuesHash = @{}
         foreach ($Item in $ExpectedValues) {
             $ExpectedValuesHash[$Item.productName] = [PSCustomObject]@{
@@ -227,6 +225,5 @@ function Invoke-CIPPStandardDisableSelfServiceLicenses {
         $CurrentValue = [PSCustomObject]$CurrentValuesHash
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableSelfServiceLicenses' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableSelfServiceLicenses' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1
index 2a14009825a02..afe654b1ab3af 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharePointLegacyAuth.ps1
@@ -95,6 +95,5 @@ function Invoke-CIPPStandardDisableSharePointLegacyAuth {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableSharePointLegacyAuth' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'SharePointLegacyAuthEnabled' -FieldValue $CurrentInfo.isLegacyAuthProtocolsEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
index 2eb5ae184ff72..90b0f39215cc9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableSharedMailbox.ps1
@@ -57,11 +57,8 @@ function Invoke-CIPPStandardDisableSharedMailbox {
     }
 
     try {
-        # (A -or B) -and C: same meaning as before, parentheses for readability.
-        $SharedMailboxList = @(New-GraphGetRequest -uri "https://outlook.office365.com/adminapi/beta/$($Tenant)/Mailbox" -Tenantid $Tenant -scope ExchangeOnline | Where-Object {
-                ($_.RecipientTypeDetails -eq 'SharedMailbox' -or $_.RecipientTypeDetails -eq 'SchedulingMailbox') -and
-                $_.UserPrincipalName -in $UserList.UserPrincipalName
-            })
+        $SharedMailboxList = @(New-ExoRequest -tenantid $Tenant -cmdlet 'Get-Mailbox' -cmdParams @{ Filter = "RecipientTypeDetails -eq 'SharedMailbox' -or RecipientTypeDetails -eq 'SchedulingMailbox'" } -Select 'UserPrincipalName,DisplayName,RecipientTypeDetails,ExternalDirectoryObjectId' |
+                Where-Object { $_.ExternalDirectoryObjectId -in $UserList.id })
     } catch {
         $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
         Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the DisableSharedMailbox state for $Tenant, could not list mailboxes from Exchange. Error: $ErrorMessage" -Sev Error
@@ -76,7 +73,7 @@ function Invoke-CIPPStandardDisableSharedMailbox {
                 @{
                     id        = $int++
                     method    = 'PATCH'
-                    url       = "users/$($Mailbox.ObjectKey)"
+                    url       = "users/$($Mailbox.ExternalDirectoryObjectId)"
                     body      = @{ accountEnabled = $false }
                     'headers' = @{
                         'Content-Type' = 'application/json'
@@ -93,17 +90,17 @@ function Invoke-CIPPStandardDisableSharedMailbox {
                     $Mailbox = $SharedMailboxList[$i]
 
                     if ($result.status -eq 200 -or $result.status -eq 204) {
-                        Write-LogMessage -API 'Standards' -tenant $Tenant -message "Entra account for shared mailbox $($Mailbox.DisplayName) ($($Mailbox.ObjectKey)) disabled." -sev Info
-                        $null = $DisabledKeys.Add("$($Mailbox.ObjectKey)")
+                        Write-LogMessage -API 'Standards' -tenant $Tenant -message "Entra account for shared mailbox $($Mailbox.DisplayName) ($($Mailbox.ExternalDirectoryObjectId)) disabled." -sev Info
+                        $null = $DisabledKeys.Add("$($Mailbox.ExternalDirectoryObjectId)")
                         $UpdateDB = $true
                     } else {
                         $errorMsg = if ($result.body.error.message) { $result.body.error.message } else { "Unknown error (Status: $($result.status))" }
-                        Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to disable Entra account for shared mailbox $($Mailbox.DisplayName) ($($Mailbox.ObjectKey)): $errorMsg" -sev Error
+                        Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to disable Entra account for shared mailbox $($Mailbox.DisplayName) ($($Mailbox.ExternalDirectoryObjectId)): $errorMsg" -sev Error
                     }
                 }
 
                 # Report what is left after remediation, not what was found.
-                $SharedMailboxList = @($SharedMailboxList | Where-Object { -not $DisabledKeys.Contains("$($_.ObjectKey)") })
+                $SharedMailboxList = @($SharedMailboxList | Where-Object { -not $DisabledKeys.Contains("$($_.ExternalDirectoryObjectId)") })
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
                 Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to process bulk disable shared mailboxes request: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
@@ -143,6 +140,5 @@ function Invoke-CIPPStandardDisableSharedMailbox {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableSharedMailbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'DisableSharedMailbox' -FieldValue $SharedMailboxList -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
index 66b8ef6c8cacb..73873c6c43bb6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTNEF.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardDisableTNEF {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableTNEF' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'TNEFDisabled' -FieldValue $State -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1
index 99ce9abd77e0f..c9eb296ee4e66 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableTenantCreation.ps1
@@ -84,6 +84,5 @@ function Invoke-CIPPStandardDisableTenantCreation {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableTenantCreation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableTenantCreation' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
index 979bef30ca9e3..f251bad1c70fd 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableUserSiteCreate.ps1
@@ -90,7 +90,5 @@ function Invoke-CIPPStandardDisableUserSiteCreate {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableUserSiteCreate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableUserSiteCreate' -FieldValue $CurrentInfo.isSiteCreationEnabled -StoreAs bool -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'DisableUserSiteCreateUI' -FieldValue $CurrentInfo.isSiteCreationUIEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
index 6cf276f3ce92a..82bcae8df20cf 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1
@@ -73,7 +73,6 @@ function Invoke-CIPPStandardDisableViva {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableViva' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableViva' -FieldValue $CurrentSetting.isEnabledInOrganization -StoreAs bool -Tenant $Tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1
index 25ac0a40ff8e3..4affebd6fd435 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableVoice.ps1
@@ -76,6 +76,5 @@ function Invoke-CIPPStandardDisableVoice {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DisableVoice' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DisableVoice' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1
index 66a2c5e1db846..cb26d483bbd6a 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisablex509Certificate.ps1
@@ -71,7 +71,6 @@ function Invoke-CIPPStandardDisablex509Certificate {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.Disablex509Certificate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'Disablex509Certificate' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1
index 08587a91f1cd8..8fed4a603d2ae 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1
@@ -97,6 +97,5 @@ function Invoke-CIPPStandardDlpCompliancePolicyTemplate {
         $ExpectedValue = @{ NonCompliantPolicies = @() }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.DlpCompliancePolicyTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'DlpCompliancePolicyTemplate' -FieldValue ($NonCompliant.Count -eq 0) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1
index 4419a28bf8a0f..fa9a46472c83b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1
@@ -83,7 +83,6 @@ function Invoke-CIPPStandardDlpViaDcsEnabled {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'DlpViaDcsEnabled' -FieldValue $CurrentInfo -StoreAs bool -Tenant $Tenant
         $CurrentValue = @{ DlpViaDcsEnabled = $CurrentInfo }
         $ExpectedValue = @{ DlpViaDcsEnabled = $WantedState }
         Set-CIPPStandardsCompareField -FieldName 'standards.DlpViaDcsEnabled' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1
index 5185aa7034ada..67895f26d8039 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODirectSend.ps1
@@ -89,6 +89,5 @@ function Invoke-CIPPStandardEXODirectSend {
             RejectDirectSend = $CurrentConfig
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.EXODirectSend' -CurrentValue $CurrentState -ExpectedValue $ExpectedState -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'EXODirectSend' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1
index 17e24bef96965..2ed3f98f4ff19 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXODisableAutoForwarding.ps1
@@ -90,6 +90,5 @@ function Invoke-CIPPStandardEXODisableAutoForwarding {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EXODisableAutoForwarding' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'AutoForwardingDisabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1
index aa9380da7d0f0..ddc2120fdebf6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEXOOutboundSpamLimits.ps1
@@ -138,6 +138,5 @@ function Invoke-CIPPStandardEXOOutboundSpamLimits {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EXOOutboundSpamLimits' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'OutboundSpamLimitsConfigured' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1
index 23029c3df6ebe..6acf0089571ba 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1
@@ -121,6 +121,5 @@
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.EmailAsAlternateLoginId' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EmailAsAlternateLoginId' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1
index f8bb298818030..a17cad6f82d7a 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1
@@ -88,6 +88,5 @@ function Invoke-CIPPStandardEmptyFilterIPAllowList {
             IPAllowList      = ''
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.EmptyFilterIPAllowList' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EmptyFilterIPAllowList' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1
index 72cc357d310f8..c50dc9eb170b3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1
@@ -60,40 +60,43 @@ function Invoke-CIPPStandardEnableAppConsentRequests {
         return
     }
 
-    if ($Settings.remediate -eq $true) {
-        try {
-            # Get current state
-
-            # Change state to enabled with default settings
-            $CurrentInfo.isEnabled = 'true'
-            $CurrentInfo.notifyReviewers = 'true'
-            $CurrentInfo.remindersEnabled = 'true'
-            $CurrentInfo.requestDurationInDays = 30
-
-            # Roles from standards table
-            $RolesToAdd = $Settings.ReviewerRoles.value
-            $RoleNames = $Settings.ReviewerRoles.label -join ', '
-
-            # Set default if no roles are selected
-            if (!$RolesToAdd) {
-                $RolesToAdd = @('62e90394-69f5-4237-9190-012177145e10')
-                $RoleNames = '(Default) Global Administrator'
-            }
+    # Roles from standards table, defaulting to Global Administrator when none are selected
+    $RolesToAdd = $Settings.ReviewerRoles.value
+    $RoleNames = $Settings.ReviewerRoles.label -join ', '
+    if (!$RolesToAdd) {
+        $RolesToAdd = @('62e90394-69f5-4237-9190-012177145e10')
+        $RoleNames = '(Default) Global Administrator'
+    }
 
-            # Users from standards table, matched on display name so the reviewer account
-            # can be created any way (invited guest, B2B, manual) regardless of which mail
-            # attribute ended up populated
-            $ReviewerUserNames = @(($Settings.ReviewerUsers.value ?? $Settings.ReviewerUsers) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
-            $ReviewerUsers = [System.Collections.Generic.List[object]]::new()
+    # Users from standards table, matched on display name so the reviewer account
+    # can be created any way (invited guest, B2B, manual) regardless of which mail
+    # attribute ended up populated
+    $ReviewerUserNames = @(($Settings.ReviewerUsers.value ?? $Settings.ReviewerUsers) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+    $ReviewerUsers = [System.Collections.Generic.List[object]]::new()
+    if ($Settings.remediate -eq $true -or $Settings.report -eq $true) {
+        try {
             foreach ($Name in $ReviewerUserNames) {
                 $UserFilter = [System.Uri]::EscapeDataString("displayName eq '$($Name -replace "'", "''")'")
-                $MatchedUsers = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$select=id,displayName&`$filter=$UserFilter" -tenantid $Tenant)
-                if ($MatchedUsers.Count -eq 0) {
+                $MatchedUsers = @(New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$select=id,displayName,userPrincipalName&`$filter=$UserFilter" -tenantid $Tenant)
+                if ($MatchedUsers.Count -eq 0 -and $Settings.remediate -eq $true) {
                     Write-LogMessage -API 'Standards' -tenant $Tenant -message "EnableAppConsentRequests: No user found with display name '$Name', not added as reviewer" -sev Warning
-                    continue
                 }
                 foreach ($User in $MatchedUsers) { $ReviewerUsers.Add($User) }
             }
+        } catch {
+            $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+            Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not look up the EnableAppConsentRequests reviewer users for $Tenant. Error: $ErrorMessage" -Sev Error
+            return
+        }
+    }
+
+    if ($Settings.remediate -eq $true) {
+        try {
+            # Change state to enabled with default settings
+            $CurrentInfo.isEnabled = 'true'
+            $CurrentInfo.notifyReviewers = 'true'
+            $CurrentInfo.remindersEnabled = 'true'
+            $CurrentInfo.requestDurationInDays = 30
 
             $NewReviewers = [System.Collections.Generic.List[object]]::new()
             foreach ($Role in $RolesToAdd) {
@@ -154,23 +157,33 @@ function Invoke-CIPPStandardEnableAppConsentRequests {
         }
     }
     if ($Settings.report -eq $true) {
-        # Set default if no roles are selected, matches remediation logic
-        $RolesToAdd = $Settings.ReviewerRoles.value
-        if (!$RolesToAdd -or $RolesToAdd.Count -eq 0) {
-            $RolesToAdd = @('62e90394-69f5-4237-9190-012177145e10')
-        }
-        $ReviewerUserNames = @(($Settings.ReviewerUsers.value ?? $Settings.ReviewerUsers) | Where-Object { -not [string]::IsNullOrWhiteSpace($_) })
+        # Grade that each configured role and user is PRESENT among the reviewers, not the reviewer
+        # count: remediation deliberately keeps reviewers added by hand, so a count never converges.
+        # A user name that matches no account in the tenant is graded missing.
+        $ReviewerQueries = @(@($CurrentInfo.reviewers) | ForEach-Object { "$($_.query)" })
+        $RoleLabels = @{ '62e90394-69f5-4237-9190-012177145e10' = 'Global Administrator' }
+        foreach ($Role in @($Settings.ReviewerRoles)) { if ($Role.value) { $RoleLabels[$Role.value] = $Role.label ?? $Role.value } }
+        $MissingRoles = @($RolesToAdd | Where-Object { $RoleId = $_; -not ($ReviewerQueries | Where-Object { $_ -match [regex]::Escape($RoleId) }) } | ForEach-Object { $RoleLabels[$_] ?? $_ })
+        $MissingUsers = @($ReviewerUserNames | Where-Object {
+                $Name = $_
+                $Covered = @($ReviewerUsers | Where-Object { $_.displayName -eq $Name }) | Where-Object {
+                    $User = $_
+                    $ReviewerQueries | Where-Object { $_ -match [regex]::Escape("$($User.id)") -or (-not [string]::IsNullOrWhiteSpace($User.userPrincipalName) -and $_ -match [regex]::Escape("$($User.userPrincipalName)")) }
+                }
+                -not $Covered
+            })
 
         $CurrentValue = [PSCustomObject]@{
             EnableAppConsentRequests = [bool]$CurrentInfo.isEnabled
-            ReviewerCount            = $CurrentInfo.reviewers.count
+            MissingReviewerRoles     = @($MissingRoles)
+            MissingReviewerUsers     = @($MissingUsers)
         }
         $ExpectedValue = [PSCustomObject]@{
             EnableAppConsentRequests = $true
-            ReviewerCount            = $RolesToAdd.Count + $ReviewerUserNames.Count
+            MissingReviewerRoles     = @()
+            MissingReviewerUsers     = @()
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableAppConsentRequests' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EnableAppConsentAdminRequests' -FieldValue $CurrentInfo.isEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
index e5455506feb56..905f615e95d83 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableCustomerLockbox.ps1
@@ -90,6 +90,5 @@ function Invoke-CIPPStandardEnableCustomerLockbox {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableCustomerLockbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'CustomerLockboxEnabled' -FieldValue $CustomerLockboxStatus -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1
index 140b4b6693e07..c0b00f651030b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1
@@ -117,6 +117,5 @@ function Invoke-CIPPStandardEnableExchangeCloudManagement {
         $filtered = $MailboxesToUpdate | Select-Object -Property UserPrincipalName, IsExchangeCloudManaged, RecipientTypeDetails, ExternalDirectoryObjectId
         $stateReport = if ($StateIsCorrect -eq $true) { $true } else { $filtered }
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableExchangeCloudManagement' -FieldValue $stateReport -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EnableExchangeCloudManagement' -FieldValue $filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1
index 09448f16232ef..50d04ba9841de 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableFIDO2.ps1
@@ -85,6 +85,5 @@ function Invoke-CIPPStandardEnableFIDO2 {
             EnableFIDO2 = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableFIDO2' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EnableFIDO2' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1
index a2df0cefad8cf..183fb9d3b7fe3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableHardwareOAuth.ps1
@@ -73,6 +73,5 @@ function Invoke-CIPPStandardEnableHardwareOAuth {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableHardwareOAuth' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EnableHardwareOAuth' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1
index ca507e5c4adab..890813f840b49 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableLitigationHold.ps1
@@ -109,6 +109,5 @@ function Invoke-CIPPStandardEnableLitigationHold {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableLitigationHold' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'EnableLitHold' -FieldValue $filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
index 8b7e8b2c958a7..63309d9c0bcb2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailTips.ps1
@@ -91,7 +91,6 @@ function Invoke-CIPPStandardEnableMailTips {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableMailTips' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'MailTipsEnabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
index 3d0f4dade4237..c0df6094d1c3c 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableMailboxAuditing.ps1
@@ -133,7 +133,6 @@ function Invoke-CIPPStandardEnableMailboxAuditing {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableMailboxAuditing' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'MailboxAuditingEnabled' -FieldValue $AuditState -StoreAs bool -Tenant $Tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1
index 81c7b14e6b357..8e4f3784d185b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableNamePronunciation.ps1
@@ -74,6 +74,5 @@ function Invoke-CIPPStandardEnableNamePronunciation {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableNamePronunciation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'NamePronunciationEnabled' -FieldValue $CurrentState.isEnabledInOrganization -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
index be62e135c6dd3..99bb9c9bbfe58 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableOnlineArchiving.ps1
@@ -102,6 +102,5 @@ function Invoke-CIPPStandardEnableOnlineArchiving {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnableOnlineArchiving' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EnableOnlineArchiving' -FieldValue $filtered -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
index ea02be892d090..e9101f395ae12 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnablePronouns.ps1
@@ -75,6 +75,5 @@ function Invoke-CIPPStandardEnablePronouns {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.EnablePronouns' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'PronounsEnabled' -FieldValue $CurrentState.isEnabledInOrganization -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1
index 18a682fbe48b6..a5fcba87c080f 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1
@@ -120,6 +120,5 @@ function Invoke-CIPPStandardEnforcePrivateGroups {
             PublicGroups     = ''
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.EnforcePrivateGroups' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'EnforcePrivateGroups' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1
index 5656ab3f1bd54..0cca444ddd9f1 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExchangeConnectorTemplate.ps1
@@ -123,6 +123,5 @@ function Invoke-CIPPStandardExchangeConnectorTemplate {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.ExchangeConnectorTemplates' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ExchangeConnectorTemplatesDeployed' -FieldValue ($DeployedConnectors.Identity) -StoreAs StringArray -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1
index 04bf7499b5e73..e3f87a6861621 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExcludedfileExt.ps1
@@ -100,6 +100,5 @@ function Invoke-CIPPStandardExcludedfileExt {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.ExcludedfileExt' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ExcludedfileExt' -FieldValue $CurrentInfo.excludedFileExtensionsForSyncApp -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalComplianceTrusted.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalComplianceTrusted.ps1
index 9f3f8d50348e2..e31824ff1a3a0 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalComplianceTrusted.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalComplianceTrusted.ps1
@@ -82,7 +82,6 @@ function Invoke-CIPPStandardExternalComplianceTrusted {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.ExternalComplianceTrusted' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ExternalComplianceTrusted' -FieldValue $ExternalComplianceTrusted.inboundTrust.isCompliantDeviceAccepted -StoreAs bool -Tenant $Tenant
     }
 
     if ($Settings.alert -eq $true) {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
index d87b9e22c26ff..63ec92e4a974f 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1
@@ -87,7 +87,6 @@ function Invoke-CIPPStandardExternalMFATrusted {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.ExternalMFATrusted' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ExternalMFATrusted' -FieldValue $ExternalMFATrusted.inboundTrust.isMfaAccepted -StoreAs bool -Tenant $Tenant
     }
 
     if ($Settings.alert -eq $true) {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1
index 6604da3920db0..8cea7ca956a0e 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1
@@ -164,6 +164,5 @@ function Invoke-CIPPStandardFIDO2PasskeyProfiles {
             AAGUIDs                = $AAGUIDs -join ', '
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.FIDO2PasskeyProfiles' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'FIDO2PasskeyProfiles' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
index 823750b3ef0e8..7b212193d9770 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFocusedInbox.ps1
@@ -94,6 +94,5 @@ function Invoke-CIPPStandardFocusedInbox {
             FocusedInboxOn = $WantedState
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.FocusedInbox' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'FocusedInboxCorrectState' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1
index af825a9ba30b1..8067a69523569 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFormsPhishingProtection.ps1
@@ -88,6 +88,5 @@ function Invoke-CIPPStandardFormsPhishingProtection {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.FormsPhishingProtection' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'FormsPhishingProtection' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
index de4176e64cf1a..4e4ab96bb63c2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineNotifications.ps1
@@ -111,6 +111,5 @@ function Invoke-CIPPStandardGlobalQuarantineNotifications {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.GlobalQuarantineNotifications' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'GlobalQuarantineNotificationsSet' -FieldValue [string]$CurrentState.EndUserSpamNotificationFrequency -StoreAs string -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1
index 2785b1fe94430..912e917221c52 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGlobalQuarantineSettings.ps1
@@ -136,6 +136,5 @@ function Invoke-CIPPStandardGlobalQuarantineSettings {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.GlobalQuarantineSettings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'GlobalQuarantineSettingsConfigured' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1
index a529f2bb85018..61100197ea65e 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardGuestInvite.ps1
@@ -95,6 +95,5 @@ function Invoke-CIPPStandardGuestInvite {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.GuestInvite' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'GuestInvite' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1
index 92210a6de1849..4071ccd04bc96 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1
@@ -149,8 +149,6 @@ function Invoke-CIPPStandardIntuneAppTemplateDeploy {
     }
 
     if ($Settings.report -eq $true) {
-        $StateIsCorrect = $MissingApps.Count -eq 0
         Set-CIPPStandardsCompareField -FieldName 'standards.IntuneAppTemplateDeploy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'IntuneAppTemplateDeploy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1
index ebd612ffac704..45fa04f16a9c2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1
@@ -107,6 +107,5 @@ function Invoke-CIPPStandardIntuneComplianceSettings {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.IntuneComplianceSettings' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'IntuneComplianceSettings' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
index 605cf571ccb19..9141dc54f5c8d 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1
@@ -99,6 +99,20 @@ function Invoke-CIPPStandardIntuneTemplate {
     # that only ever existed in the template.
     $RawJSON = Get-CIPPTextReplacement -Text $rawJsonFromTemplate -TenantFilter $Tenant -EscapeForJson
 
+    # The Displayname and Description columns carry the same %variables%. For column-named types
+    # (Device, deviceCompliancePolicies, ...) Set-CIPPIntunePolicy both searches for the existing
+    # policy by this name and forces it onto the policy it creates, so leaving it raw makes the
+    # lookup hunt for a name the tenant never had while remediation keeps creating the resolved-name
+    # policy - a fresh duplicate on every run. Resolve them once here, as plain text rather than
+    # JSON-escaped (these fill bare string slots, not a serialized payload), so the lookup, the
+    # compare identity and the created name all agree. Names without a variable are left untouched.
+    if ($displayname -match '%') {
+        $displayname = Get-CIPPTextReplacement -Text $displayname -TenantFilter $Tenant
+    }
+    if ($description -match '%') {
+        $description = Get-CIPPTextReplacement -Text $description -TenantFilter $Tenant
+    }
+
     # Catalog and the Windows update profile types are deployed under the name in their payload
     # rather than the template's Displayname, so find them under the name they were created with.
     $PolicyName = Get-CIPPIntunePolicyName -TemplateType $TemplateType -RawJSON $RawJSON -DisplayName $displayname
@@ -160,6 +174,17 @@ function Invoke-CIPPStandardIntuneTemplate {
                 }
             }
 
+            if ($TemplateType -eq 'Admin') {
+                # Compare against the binds deployment would write: settings from an imported ADMX
+                # file have a different definition id in every tenant, so the stored binds only ever
+                # match the tenant the template was captured from.
+                try {
+                    $JSONTemplate = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (ConvertTo-Json -InputObject $JSONTemplate -Depth 100 -Compress) -TenantFilter $Tenant -DisplayName $PolicyName | ConvertFrom-Json
+                } catch {
+                    Write-Information "[IntuneTemplate][$Tenant] Could not resolve the administrative template settings for '$PolicyName' in this tenant, comparing against the stored template: $($_.Exception.Message)"
+                }
+            }
+
             $Compare = Compare-CIPPIntuneObject -ReferenceObject $JSONTemplate -DifferenceObject $JSONExistingPolicy -compareType $TemplateType -ErrorAction SilentlyContinue
         } catch {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to compare Intune Template $displayname against the existing policy: $($_.Exception.Message)" -sev 'Error'
@@ -332,7 +357,6 @@ function Invoke-CIPPStandardIntuneTemplate {
             }
         }
         Set-CIPPStandardsCompareField -FieldName "standards.IntuneTemplate.$id" -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        #Add-CIPPBPAField -FieldName "policy-$id" -FieldValue $Compare -StoreAs bool -Tenant $tenant
     }
 
     $sw.Stop()
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1
index 1d1c051587501..b82b044760060 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneWindowsDiagnostic.ps1
@@ -103,6 +103,5 @@ Function Invoke-CIPPStandardIntuneWindowsDiagnostic {
             hasValidWindowsLicense                           = $Settings.hasValidWindowsLicense
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.IntuneWindowsDiagnostic' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'IntuneWindowsDiagnostic' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1
index b7fea93ce0509..63d223d5e9fd9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardLegacyEmailReportAddins.ps1
@@ -155,6 +155,5 @@ function Invoke-CIPPStandardLegacyEmailReportAddins {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.LegacyEmailReportAddins' -Tenant $Tenant -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue
-        Add-CIPPBPAField -FieldName 'LegacyEmailReportAddins' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1
index db17a2f05cc08..ecc6d03391376 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMEnrollmentDuringRegistration.ps1
@@ -95,6 +95,5 @@ function Invoke-CIPPStandardMDMEnrollmentDuringRegistration {
             isMdmEnrollmentDuringRegistrationDisabled = $DesiredState
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.MDMEnrollmentDuringRegistration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'MDMEnrollmentDuringRegistration' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
index 5b28217010e33..e129ba20ae6f5 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMDMScope.ps1
@@ -157,7 +157,6 @@ function Invoke-CIPPStandardMDMScope {
             customGroup = $Settings.customGroup ?? ''
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.MDMScope' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'MDMScope' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
index e2bea7df24a79..e9f4b0980915b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailContacts.ps1
@@ -118,6 +118,5 @@ function Invoke-CIPPStandardMailContacts {
             contactEmail                = if ([string]::IsNullOrWhiteSpace($Contacts.GeneralContact)) { $CurrentValue.contactEmail } else { $Contacts.GeneralContact }
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.MailContacts' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'MailContacts' -FieldValue $CurrentInfo -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1
index f60b86449f21e..d088a397a9bd7 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMailboxRecipientLimits.ps1
@@ -256,12 +256,6 @@ function Invoke-CIPPStandardMailboxRecipientLimits {
 
     # Report
     if ($Settings.report -eq $true) {
-        $ReportData = @{
-            MailboxesToUpdate       = $MailboxesToUpdate
-            MailboxesWithPlanIssues = $MailboxesWithPlanIssues
-        }
-        Add-CIPPBPAField -FieldName 'MailboxRecipientLimits' -FieldValue $ReportData -StoreAs json -Tenant $Tenant
-
         $CurrentValue = @{
             MailboxesToUpdate       = @($MailboxesToUpdate)
             MailboxesWithPlanIssues = @($MailboxesWithPlanIssues)
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
index 2fe663123420d..f4d34222e46d3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMalwareFilterPolicy.ps1
@@ -255,7 +255,6 @@ function Invoke-CIPPStandardMalwareFilterPolicy {
 	}
 
         Set-CIPPStandardsCompareField -FieldName 'standards.MalwareFilterPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'MalwareFilterPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageEncryption.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageEncryption.ps1
index aa5297fab9c22..f134f30440edb 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageEncryption.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageEncryption.ps1
@@ -7,8 +7,8 @@ function Invoke-CIPPStandardMessageEncryption {
     .SYNOPSIS
         (Label) Enable Purview Message Encryption
     .DESCRIPTION
-        (Helptext) Enables Microsoft Purview Message Encryption by turning on Azure RMS licensing for Exchange Online, and turns on simplified client access so the Encrypt button appears in Outlook on the web and the new Outlook. Skipped with a warning when the tenant still points at an on-premises AD RMS cluster, because AD RMS has to be migrated to Azure RMS first. This standard only turns the feature on: branding, one-time passcodes, and social ID sign-in for encrypted messages are configured in the [Configure Encrypted Message Branding (OME)](https://standards.cipp.app/standards/omebranding) standard. [Read more](https://learn.microsoft.com/en-us/purview/set-up-new-message-encryption-capabilities)
-        (DocsDescription) Sets AzureRMSLicensingEnabled to true, the prerequisite for Microsoft Purview Message Encryption, and SimplifiedClientAccessEnabled to true so the Encrypt button appears when composing mail in Outlook on the web and the new Outlook. Reports the IRM licensing state per tenant, including the licensing location, so you can see at a glance which tenants have message encryption available. Remediation is deliberately skipped for tenants with an on-premises AD RMS licensing location, as Purview Message Encryption is not compatible with AD RMS and those tenants need to be migrated to Azure RMS first.
+        (Helptext) Enables Microsoft Purview Message Encryption by turning on Azure RMS licensing for Exchange Online, and turns on simplified client access so the Encrypt button appears in Outlook on the web and the new Outlook. Skipped with a warning when the tenant still points at an on-premises AD RMS cluster, because AD RMS has to be migrated to Azure RMS first. The optional settings below default to "Do not change", which leaves the tenant's current value alone and out of the drift check. This standard only turns the feature on: branding, one-time passcodes, and social ID sign-in for encrypted messages are configured in the [Configure Encrypted Message Branding (OME)](https://standards.cipp.app/standards/omebranding) standard. [Read more](https://learn.microsoft.com/en-us/purview/set-up-new-message-encryption-capabilities)
+        (DocsDescription) Sets AzureRMSLicensingEnabled to true, the prerequisite for Microsoft Purview Message Encryption, and SimplifiedClientAccessEnabled to true so the Encrypt button appears when composing mail in Outlook on the web and the new Outlook. Optionally also enforces EnablePdfEncryption, DecryptAttachmentForEncryptOnly, SimplifiedClientAccessDoNotForwardDisabled, SimplifiedClientAccessEncryptOnlyDisabled and TransportDecryptionSetting; each of these is left untouched unless the template picks a value. Reports the IRM licensing state per tenant, including the licensing location, so you can see at a glance which tenants have message encryption available. Remediation is deliberately skipped for tenants with an on-premises AD RMS licensing location, as Purview Message Encryption is not compatible with AD RMS and those tenants need to be migrated to Azure RMS first.
     .NOTES
         CAT
             Exchange Standards
@@ -16,12 +16,17 @@ function Invoke-CIPPStandardMessageEncryption {
         EXECUTIVETEXT
             Turns on the built-in encryption that lets staff send protected email to anyone, including recipients outside the organization. Uses licensing the organization already owns, removing the need for a separate secure-email product.
         ADDEDCOMPONENT
+            {"type":"radio","name":"standards.MessageEncryption.EnablePdfEncryption","label":"Encrypt PDF attachments","required":false,"defaultValue":"donotchange","helperText":"Applies Encrypt-only and Do Not Forward protection to PDF attachments as well as the message body.","options":[{"value":"donotchange","label":"Do not change"},{"value":"true","label":"Enable"},{"value":"false","label":"Disable"}]}
+            {"type":"radio","name":"standards.MessageEncryption.DecryptAttachmentForEncryptOnly","label":"Let recipients save Encrypt-only attachments unprotected","required":false,"defaultValue":"donotchange","helperText":"When enabled, attachments on Encrypt-only mail are decrypted when the recipient downloads them.","options":[{"value":"donotchange","label":"Do not change"},{"value":"true","label":"Enable"},{"value":"false","label":"Disable"}]}
+            {"type":"radio","name":"standards.MessageEncryption.SimplifiedClientAccessDoNotForwardDisabled","label":"Do Not Forward option in the Outlook Encrypt menu","required":false,"defaultValue":"donotchange","options":[{"value":"donotchange","label":"Do not change"},{"value":"true","label":"Hide"},{"value":"false","label":"Show"}]}
+            {"type":"radio","name":"standards.MessageEncryption.SimplifiedClientAccessEncryptOnlyDisabled","label":"Encrypt-only option in the Outlook Encrypt menu","required":false,"defaultValue":"donotchange","options":[{"value":"donotchange","label":"Do not change"},{"value":"true","label":"Hide"},{"value":"false","label":"Show"}]}
+            {"type":"radio","name":"standards.MessageEncryption.TransportDecryptionSetting","label":"Transport decryption","required":false,"defaultValue":"donotchange","helperText":"Disabled leaves protected mail encrypted in transit, Optional decrypts it where possible and delivers either way, Mandatory rejects mail it cannot decrypt.","options":[{"value":"donotchange","label":"Do not change"},{"value":"Disabled","label":"Disabled"},{"value":"Optional","label":"Optional"},{"value":"Mandatory","label":"Mandatory"}]}
         IMPACT
             Low Impact
         ADDEDDATE
             2026-08-04
         POWERSHELLEQUIVALENT
-            Set-IRMConfiguration -AzureRMSLicensingEnabled \$true -SimplifiedClientAccessEnabled \$true
+            Set-IRMConfiguration -AzureRMSLicensingEnabled \$true -SimplifiedClientAccessEnabled \$true [-EnablePdfEncryption ...] [-DecryptAttachmentForEncryptOnly ...] [-SimplifiedClientAccessDoNotForwardDisabled ...] [-SimplifiedClientAccessEncryptOnlyDisabled ...] [-TransportDecryptionSetting ...]
         RECOMMENDEDBY
         REQUIREDCAPABILITIES
             "EXCHANGE_S_STANDARD"
@@ -56,9 +61,28 @@ function Invoke-CIPPStandardMessageEncryption {
     # ponytail: URL-shape heuristic, the only signal Get-IRMConfiguration gives us. Get-AipServiceConfiguration would confirm it, but that needs the AIPService module which CIPP does not ship.
     $LicensingLocation = @($CurrentState.LicensingLocation | Where-Object { $_ })
     $AdRmsDetected = @($LicensingLocation | Where-Object { $_ -notmatch 'aadrm\.|azurerms|\.microsoft\.(com|us)' }).Count -gt 0
-    # SimplifiedClientAccessEnabled is what makes the Encrypt button show up in Outlook on the web
-    # and the new Outlook; without it the feature is on but users have no way to reach it.
-    $StateIsCorrect = $CurrentState.AzureRMSLicensingEnabled -eq $true -and $CurrentState.SimplifiedClientAccessEnabled -eq $true -and $AdRmsDetected -eq $false
+
+    # AzureRMSLicensingEnabled is the feature itself; SimplifiedClientAccessEnabled is what makes the
+    # Encrypt button show up in Outlook on the web and the new Outlook, without it the feature is on
+    # but users have no way to reach it. The rest are optional radios: 'donotchange' (or a template
+    # saved before the radios existed) leaves the tenant's current value alone and out of the compare.
+    # Only known values pass, the template is user-editable JSON.
+    $DesiredState = @{ AzureRMSLicensingEnabled = $true; SimplifiedClientAccessEnabled = $true }
+    foreach ($Name in 'EnablePdfEncryption', 'DecryptAttachmentForEncryptOnly', 'SimplifiedClientAccessDoNotForwardDisabled', 'SimplifiedClientAccessEncryptOnlyDisabled') {
+        if ($Settings.$Name -in 'true', 'false') { $DesiredState[$Name] = [System.Convert]::ToBoolean($Settings.$Name) }
+    }
+    if ($Settings.TransportDecryptionSetting -in 'Disabled', 'Optional', 'Mandatory') {
+        $DesiredState.TransportDecryptionSetting = $Settings.TransportDecryptionSetting
+    }
+    $Drift = @($DesiredState.Keys | Where-Object { $CurrentState.$_ -ne $DesiredState[$_] } | Sort-Object)
+    $StateIsCorrect = $Drift.Count -eq 0 -and $AdRmsDetected -eq $false
+
+    $ReportCurrent = @{ LicensingLocation = $LicensingLocation; AdRmsDetected = $AdRmsDetected }
+    $ReportExpected = @{ LicensingLocation = $LicensingLocation; AdRmsDetected = $false }
+    foreach ($Name in $DesiredState.Keys) {
+        $ReportCurrent[$Name] = $CurrentState.$Name
+        $ReportExpected[$Name] = $DesiredState[$Name]
+    }
 
     if ($Settings.remediate -eq $true) {
         if ($AdRmsDetected) {
@@ -67,8 +91,8 @@ function Invoke-CIPPStandardMessageEncryption {
             Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Purview Message Encryption and the Outlook Encrypt button are already enabled.' -sev Info
         } else {
             try {
-                $null = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-IRMConfiguration' -cmdParams @{ AzureRMSLicensingEnabled = $true; SimplifiedClientAccessEnabled = $true }
-                Write-LogMessage -API 'Standards' -tenant $Tenant -message 'Enabled Purview Message Encryption and the Outlook Encrypt button.' -sev Info
+                $null = New-ExoRequest -tenantid $Tenant -cmdlet 'Set-IRMConfiguration' -cmdParams $DesiredState
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "Enabled Purview Message Encryption and applied the IRM settings $(($DesiredState.Keys | Sort-Object) -join ', ')." -sev Info
             } catch {
                 $ErrorMessage = Get-CippException -Exception $_
                 Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to enable Purview Message Encryption. Error: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
@@ -82,36 +106,19 @@ function Invoke-CIPPStandardMessageEncryption {
         } else {
             $Message = if ($AdRmsDetected) {
                 'Purview Message Encryption cannot be used, the tenant still uses an on-premises AD RMS licensing location.'
-            } elseif ($CurrentState.AzureRMSLicensingEnabled -eq $true) {
+            } elseif ($CurrentState.AzureRMSLicensingEnabled -ne $true) {
+                'Purview Message Encryption is not enabled.'
+            } elseif ($CurrentState.SimplifiedClientAccessEnabled -ne $true) {
                 'Purview Message Encryption is enabled, but the Encrypt button in Outlook (simplified client access) is not.'
             } else {
-                'Purview Message Encryption is not enabled.'
-            }
-            $Object = [PSCustomObject]@{
-                AzureRMSLicensingEnabled      = $CurrentState.AzureRMSLicensingEnabled
-                SimplifiedClientAccessEnabled = $CurrentState.SimplifiedClientAccessEnabled
-                LicensingLocation             = $LicensingLocation
-                AdRmsDetected                 = $AdRmsDetected
+                "Purview Message Encryption is enabled, but these settings do not match the standard: $($Drift -join ', ')."
             }
-            Write-StandardsAlert -message $Message -object $Object -tenant $Tenant -standardName 'MessageEncryption' -standardId $Settings.standardId
+            Write-StandardsAlert -message $Message -object ([PSCustomObject]$ReportCurrent) -tenant $Tenant -standardName 'MessageEncryption' -standardId $Settings.standardId
             Write-LogMessage -API 'Standards' -tenant $Tenant -message $Message -sev Info
         }
     }
 
     if ($Settings.report -eq $true) {
-        $ReportCurrent = [PSCustomObject]@{
-            AzureRMSLicensingEnabled      = $CurrentState.AzureRMSLicensingEnabled
-            SimplifiedClientAccessEnabled = $CurrentState.SimplifiedClientAccessEnabled
-            LicensingLocation             = $LicensingLocation
-            AdRmsDetected                 = $AdRmsDetected
-        }
-        $ReportExpected = [PSCustomObject]@{
-            AzureRMSLicensingEnabled      = $true
-            SimplifiedClientAccessEnabled = $true
-            LicensingLocation             = $LicensingLocation
-            AdRmsDetected                 = $false
-        }
-        Set-CIPPStandardsCompareField -FieldName 'standards.MessageEncryption' -CurrentValue $ReportCurrent -ExpectedValue $ReportExpected -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'messageEncryptionEnabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
+        Set-CIPPStandardsCompareField -FieldName 'standards.MessageEncryption' -CurrentValue ([PSCustomObject]$ReportCurrent) -ExpectedValue ([PSCustomObject]$ReportExpected) -TenantFilter $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1
index 4390c14ef3925..03bd5dbf860b3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1
@@ -80,6 +80,5 @@ function Invoke-CIPPStandardMessageExpiration {
             MessageExpiration = '12:00:00'
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.MessageExpiration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'messageExpiration' -FieldValue $MessageExpiration -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMigrateOneDriveShortcuts.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMigrateOneDriveShortcuts.ps1
index 65c1c43719b8d..72001c6774e6b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMigrateOneDriveShortcuts.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMigrateOneDriveShortcuts.ps1
@@ -111,6 +111,5 @@ function Invoke-CIPPStandardMigrateOneDriveShortcuts {
             UsersWithRootShortcuts = @()
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.MigrateOneDriveShortcuts' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'MigrateOneDriveShortcuts' -FieldValue $FieldValue -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
index 4b15c56be6daa..feccce2f58a50 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardNudgeMFA.ps1
@@ -204,6 +204,5 @@ function Invoke-CIPPStandardNudgeMFA {
             excludeTargets                         = $DesiredExcludeTargets
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.NudgeMFA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'NudgeMFA' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1
index 89d81c020bbe6..72de963e64cea 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOWAAttachmentRestrictions.ps1
@@ -136,6 +136,5 @@ function Invoke-CIPPStandardOWAAttachmentRestrictions {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.OWAAttachmentRestrictions' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'OWAAttachmentRestrictions' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
index c9bc356ccec04..21f818a04410f 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsent.ps1
@@ -222,7 +222,6 @@ function Invoke-CIPPStandardOauthConsent {
 
         $StateIsCorrect = ($State.permissionGrantPolicyIdsAssignedToDefaultUserRole -eq 'ManagePermissionGrantsForSelf.cipp-consent-policy') -and $IncludesAreConfigured
 
-        Add-CIPPBPAField -FieldName 'OauthConsent' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
         $CurrentValue = @{
             permissionGrantPolicyIdsAssignedToDefaultUserRole = $State.permissionGrantPolicyIdsAssignedToDefaultUserRole
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1
index 186f02face965..d9340b2e6380e 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOauthConsentLowSec.ps1
@@ -121,7 +121,6 @@ function Invoke-CIPPStandardOauthConsentLowSec {
         $ExpectedValue = @{
             permissionGrantPolicyIdsAssignedToDefaultUserRole = @('ManagePermissionGrantsForSelf.microsoft-user-default-low')
         }
-        Add-CIPPBPAField -FieldName 'OauthConsentLowSec' -FieldValue $State.permissionGrantPolicyIdsAssignedToDefaultUserRole -StoreAs bool -Tenant $tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.OauthConsentLowSec' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.ps1
index ce5e8eae86efc..c309f3666b0c9 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.ps1
@@ -151,6 +151,5 @@ function Invoke-CIPPStandardOneDriveLicensedQuota {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.OneDriveLicensedQuota' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'OneDriveLicensedQuota' -FieldValue @($BelowQuota) -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1
index 42cbee0630acc..fcf98050bda72 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardOutBoundSpamAlert.ps1
@@ -111,7 +111,6 @@ function Invoke-CIPPStandardOutBoundSpamAlert {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'OutboundSpamAlert' -FieldValue $CurrentInfo.NotifyOutboundSpam -StoreAs bool -Tenant $tenant
         $CurrentValue = @{
             NotifyOutboundSpam           = $CurrentInfo.NotifyOutboundSpam
             NotifyOutboundSpamRecipients = $CurrentNotifyRecipients
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
index ca9a6d3f32b62..61fe903d73c73 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWcompanionAppAllowedState.ps1
@@ -94,7 +94,6 @@ function Invoke-CIPPStandardPWcompanionAppAllowedState {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'companionAppAllowedState' -FieldValue $AuthStateCorrect -StoreAs bool -Tenant $Tenant
         if ($AuthStateCorrect -eq $true) {
             $FieldValue = $true
         } else {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
index 037e6a7334d35..26f7b65f2d4c6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1
@@ -82,7 +82,6 @@ function Invoke-CIPPStandardPWdisplayAppInformationRequiredState {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'PWdisplayAppInformationRequiredState' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
         $CurrentValue = @{
             state                              = $CurrentState.state
             displayAppInformationRequiredState = $CurrentState.featureSettings.displayAppInformationRequiredState.state
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
index e3dd647780875..ac7622a0df458 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPasswordExpireDisabled.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardPasswordExpireDisabled {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'PasswordExpireDisabled' -FieldValue $DomainsWithoutPassExpire -StoreAs json -Tenant $tenant
 
         $CurrentValue = @{
             DomainsWithoutPassExpire = @($DomainsWithoutPassExpire)
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
index cf84179753e87..5a51ec7a3f430 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPerUserMFA.ps1
@@ -97,6 +97,5 @@ function Invoke-CIPPStandardPerUserMFA {
             UsersWithoutMFA = @()
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.PerUserMFA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'LegacyMFAUsers' -FieldValue $UsersWithoutMFA -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1
index 6ef1dc2fccf95..09def9619a41f 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1
@@ -133,7 +133,6 @@ function Invoke-CIPPStandardPhishProtection {
         $ExpectedValue = @{
             PhishingCSSEnabled = $true
         }
-        Add-CIPPBPAField -FieldName 'PhishProtection' -FieldValue $authState -StoreAs bool -Tenant $tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.PhishProtection' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1
index 2725af0a918ad..9858fd6e0d8f2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishSimSpoofIntelligence.ps1
@@ -132,6 +132,5 @@ function Invoke-CIPPStandardPhishSimSpoofIntelligence {
             IsCompliant    = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.PhishSimSpoofIntelligence' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'PhishSimSpoofIntelligence' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1
index 2cd2995112112..1419e7707d98e 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishingSimulations.ps1
@@ -213,7 +213,6 @@ function Invoke-CIPPStandardPhishingSimulations {
             PhishingSimUrls = @($Settings.PhishingSimUrls.value)
             IsCompliant     = $true
         }
-        Add-CIPPBPAField -FieldName 'PhishingSimulations' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.PhishingSimulations' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPlannerBlockTaskDelete.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPlannerBlockTaskDelete.ps1
new file mode 100644
index 0000000000000..320b9d68c2f70
--- /dev/null
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPlannerBlockTaskDelete.ps1
@@ -0,0 +1,200 @@
+function Invoke-CIPPStandardPlannerBlockTaskDelete {
+    <#
+    .FUNCTIONALITY
+        Internal
+    .COMPONENT
+        (APIName) PlannerBlockTaskDelete
+    .SYNOPSIS
+        (Label) Block Planner users from deleting tasks they did not create
+    .DESCRIPTION
+        (Helptext) Sets the Planner user policy that blocks each in-scope member from deleting Planner tasks they did not create. Applies across all basic Planner plans for that user (not a single board). Only enabled members with an enabled Microsoft Planner (PROJECTWORKMANAGEMENT) service plan are touched. Optionally limit the sweep to members of named groups or skip members of named groups. The remediate wash is limited to once per 24 hours per tenant because there is no list API and every user needs its own write. Alert and report still run every time. May also prevent those users from deleting plans. Requires CIPP-SAM consent for ProjectWorkManagement OrgSettings-Planner permissions.
+        (DocsDescription) Uses the Planner tenant admin UserPolicy API (tasks.office.com) to set blockDeleteTasksNotCreatedBySelf to true for each in-scope enabled member account that has an enabled PROJECTWORKMANAGEMENT (Microsoft Planner) service plan in the user cache. Guest accounts, disabled accounts, and members without that plan are ignored. Group names are resolved per tenant by display name and expanded to their transitive user members: include groups restrict the sweep to those members, exclude groups remove them from it. A configured group that does not exist in a tenant, or a failed membership lookup, skips the run rather than sweeping the wrong accounts. When no include group is named, every Planner-licensed enabled member account is in scope. Remediate is an idempotent PUT per candidate with no preflight GET; a 24-hour rerun guard (Test-CIPPRerun) skips repeating that write sweep for the same settings, while alert and report still GET live state each run. The policy is per user and applies to all basic plans that user can access; it is not board-scoped. Known side effect: the same policy can also block plan deletion. Requires application permissions OrgSettings-Planner.ReadWrite.All on ProjectWorkManagement (tasks.office.com), consented via CIPP-SAM repair and CPV refresh.
+    .NOTES
+        CAT
+            Teams Standards
+        TAG
+        EXECUTIVETEXT
+            Stops employees from deleting Planner tasks they did not create, reducing accidental loss on boards used as shared work queues. Can be limited to a department security group so only those staff are locked down.
+        ADDEDCOMPONENT
+            {"type":"autoComplete","multiple":true,"creatable":true,"required":false,"name":"standards.PlannerBlockTaskDelete.includeGroups","label":"Only apply to members of these groups (display names; blank = all Planner-licensed enabled members)"}
+            {"type":"autoComplete","multiple":true,"creatable":true,"required":false,"name":"standards.PlannerBlockTaskDelete.excludeGroups","label":"Skip members of these groups (display names)"}
+        IMPACT
+            Medium Impact
+        ADDEDDATE
+            2026-09-16
+        POWERSHELLEQUIVALENT
+            Set-PlannerUserPolicy -UserAadIdOrPrincipalName user@domain.com -BlockDeleteTasksNotCreatedBySelf \$true
+        RECOMMENDEDBY
+        REQUIREDCAPABILITIES
+            "PROJECTWORKMANAGEMENT"
+        UPDATECOMMENTBLOCK
+            Run the tools\Update-StandardsComments.ps1 script to update this comment block
+    .LINK
+        https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards
+    #>
+
+    param($Tenant, $Settings)
+
+    $TestResult = Test-CIPPStandardLicense -StandardName 'PlannerBlockTaskDelete' -TenantFilter $Tenant -RequiredCapabilities @('PROJECTWORKMANAGEMENT')
+    if ($TestResult -eq $false) {
+        return $true
+    }
+
+    $TasksScope = 'https://tasks.office.com/.default'
+    # Microsoft Planner service plan (PROJECTWORKMANAGEMENT) - only users with this enabled need UserPolicy.
+    $PlannerPlanId = 'b737dad2-2f6c-4c65-90e3-ca563267e8b9'
+
+    $ToNames = {
+        param($Value)
+        @(@($Value) | ForEach-Object {
+                if ($_ -is [string]) { $_ } else { "$($_.value ?? $_.label)" }
+            } | ForEach-Object { $_.Trim() } | Where-Object { $_ } | Select-Object -Unique)
+    }
+    $IncludeNames = & $ToNames $Settings.includeGroups
+    $ExcludeNames = & $ToNames $Settings.excludeGroups
+
+    try {
+        $AllUsers = @(New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users' | Where-Object { $_ })
+    } catch {
+        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+        Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get users for PlannerBlockTaskDelete in $Tenant. Error: $ErrorMessage" -Sev Error
+        return
+    }
+
+    # Group scoping: names resolve live by display name (a template applies to many tenants,
+    # so an id would only ever match one) and expand to TRANSITIVE user members. An
+    # unresolved name or a failed lookup aborts the run - sweeping with half a scope is wrong.
+    $IncludedIds = @{}
+    $ExcludedIds = @{}
+    if ($IncludeNames.Count -gt 0 -or $ExcludeNames.Count -gt 0) {
+        try {
+            $MemberRequests = [System.Collections.Generic.List[hashtable]]::new()
+            foreach ($Scope in @(@{ Prefix = 'include'; Names = $IncludeNames }, @{ Prefix = 'exclude'; Names = $ExcludeNames })) {
+                foreach ($Name in $Scope.Names) {
+                    $EscapedName = $Name -replace "'", "''"
+                    $GroupFilter = [System.Uri]::EscapeDataString("displayName eq '$EscapedName'")
+                    $Groups = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups?`$filter=$GroupFilter&`$select=id,displayName" -tenantid $Tenant | Where-Object { $_.id })
+                    if ($Groups.Count -eq 0) { throw "the group '$Name' does not exist in this tenant" }
+                    foreach ($Group in $Groups) {
+                        $MemberRequests.Add(@{ id = "$($Scope.Prefix)-$($Group.id)"; method = 'GET'; url = "groups/$($Group.id)/transitiveMembers/microsoft.graph.user?`$select=id&`$top=999" })
+                    }
+                }
+            }
+            $Responses = @(New-GraphBulkRequest -tenantid $Tenant -Requests @($MemberRequests) -asapp $true -Version 'v1.0')
+            foreach ($Response in $Responses) {
+                if ([int]$Response.status -lt 200 -or [int]$Response.status -gt 299) {
+                    throw "membership lookup for $($Response.id) returned $($Response.status) $($Response.body.error.message)"
+                }
+                $Bucket = if ("$($Response.id)".StartsWith('include-')) { $IncludedIds } else { $ExcludedIds }
+                foreach ($MemberId in @($Response.body.value.id | Where-Object { $_ })) { $Bucket["$MemberId"] = $true }
+            }
+        } catch {
+            $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+            Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "PlannerBlockTaskDelete: could not resolve the configured groups, refusing to run with a partial scope. Error: $ErrorMessage" -Sev Error
+            return
+        }
+    }
+
+    $Candidates = @($AllUsers | Where-Object {
+            $_.userType -eq 'Member' -and $_.accountEnabled -eq $true -and $_.id -and $_.userPrincipalName -and
+            ($_.assignedPlans | Where-Object { $_.capabilityStatus -eq 'Enabled' -and $_.servicePlanId -eq $PlannerPlanId })
+        })
+    if ($IncludeNames.Count -gt 0) { $Candidates = @($Candidates | Where-Object { $IncludedIds.ContainsKey("$($_.id)") }) }
+    if ($ExcludeNames.Count -gt 0) { $Candidates = @($Candidates | Where-Object { -not $ExcludedIds.ContainsKey("$($_.id)") }) }
+
+    # Remediate is idempotent PUT-all: no preflight GET (UserPolicy has no list/bulk API).
+    # 24h guard (same pattern as SPGuestPeoplePicker) - alert/report below still run every time.
+    if ($Settings.remediate -eq $true) {
+        if ($Candidates.Count -eq 0) {
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message 'PlannerBlockTaskDelete: no in-scope Planner-licensed member users to update.' -sev Info
+        } elseif (Test-CIPPRerun -Tenant $Tenant -API 'PlannerBlockTaskDelete' -Interval 86400 -Settings $Settings) {
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message 'PlannerBlockTaskDelete: write sweep already ran within the last 24h - skipping remediate until the guard expires or settings change.' -sev Info
+        } else {
+            $SuccessCount = 0
+            $Failures = [System.Collections.Generic.List[object]]::new()
+            foreach ($User in $Candidates) {
+                $Upn = "$($User.userPrincipalName)"
+                $SafeUpn = $Upn -replace "'", "''"
+                $Uri = "https://tasks.office.com/taskAPI/tenantAdminSettings/UserPolicy('$SafeUpn')"
+                $Body = @{ blockDeleteTasksNotCreatedBySelf = $true } | ConvertTo-Json -Compress
+                try {
+                    $null = New-GraphPOSTRequest -uri $Uri -tenantid $Tenant -scope $TasksScope -AsApp $true -type 'PUT' -body $Body
+                    $SuccessCount++
+                } catch {
+                    $ErrorMessage = Get-CippException -Exception $_
+                    $Failures.Add([pscustomobject]@{
+                            userPrincipalName = $Upn
+                            error             = $ErrorMessage.NormalizedError
+                        })
+                }
+            }
+            if ($Failures.Count -eq 0) {
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "PlannerBlockTaskDelete: successfully updated $SuccessCount users." -sev Info
+            } else {
+                $ReasonSummary = (
+                    $Failures | Group-Object -Property error | ForEach-Object {
+                        "$($_.Count) user(s): $($_.Name)"
+                    }
+                ) -join '; '
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "PlannerBlockTaskDelete: updated $SuccessCount of $($Candidates.Count) users; one or more failed due to: $ReasonSummary" -sev Error -LogData @($Failures)
+            }
+        }
+    }
+
+    # Alert/report need live state; GET only when those modes are on.
+    $IncorrectUsers = [System.Collections.Generic.List[object]]::new()
+    if ($Settings.alert -eq $true -or $Settings.report -eq $true) {
+        foreach ($User in $Candidates) {
+            $Upn = "$($User.userPrincipalName)"
+            $SafeUpn = $Upn -replace "'", "''"
+            $Uri = "https://tasks.office.com/taskAPI/tenantAdminSettings/UserPolicy('$SafeUpn')"
+            try {
+                $Policy = New-GraphGetRequest -uri $Uri -tenantid $Tenant -scope $TasksScope -AsApp $true
+                $Blocked = [bool]($Policy.blockDeleteTasksNotCreatedBySelf -eq $true)
+                if (-not $Blocked) {
+                    $IncorrectUsers.Add([pscustomobject]@{
+                            id                               = $User.id
+                            userPrincipalName                = $Upn
+                            displayName                      = $User.displayName
+                            blockDeleteTasksNotCreatedBySelf = $Policy.blockDeleteTasksNotCreatedBySelf
+                        })
+                }
+            } catch {
+                $Message = "$($_.Exception.Message)"
+                # First GET can 403 until a policy exists for the tenant/user; treat as non-compliant.
+                if ($Message -match '403|404|Access is denied|Not Found|Forbidden') {
+                    $IncorrectUsers.Add([pscustomobject]@{
+                            id                               = $User.id
+                            userPrincipalName                = $Upn
+                            displayName                      = $User.displayName
+                            blockDeleteTasksNotCreatedBySelf = $null
+                        })
+                } else {
+                    $ErrorMessage = Get-NormalizedError -Message $Message
+                    Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "PlannerBlockTaskDelete: failed to read UserPolicy for $Upn. Error: $ErrorMessage" -Sev Error
+                }
+            }
+        }
+    }
+
+    if ($Settings.alert -eq $true) {
+        if ($IncorrectUsers.Count -gt 0) {
+            Write-StandardsAlert -message 'The following accounts are not blocked from deleting Planner tasks they did not create' -object @($IncorrectUsers) -tenant $Tenant -standardName 'PlannerBlockTaskDelete' -standardId $Settings.standardId
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message "PlannerBlockTaskDelete: $($IncorrectUsers.Count) in-scope account(s) are missing blockDeleteTasksNotCreatedBySelf." -sev Info
+        } else {
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message 'All in-scope accounts have Planner blockDeleteTasksNotCreatedBySelf enabled.' -sev Info
+        }
+    }
+
+    if ($Settings.report -eq $true) {
+        $FieldValue = @($IncorrectUsers | Select-Object -Property userPrincipalName, displayName, blockDeleteTasksNotCreatedBySelf)
+
+        $CurrentValue = @{
+            incorrectUsers = @($FieldValue)
+        }
+        $ExpectedValue = @{
+            incorrectUsers = @()
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.PlannerBlockTaskDelete' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
+    }
+}
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1
index 8d7b5def84870..2828bc54427a4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardProfilePhotos.ps1
@@ -122,7 +122,6 @@ function Invoke-CIPPStandardProfilePhotos {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'ProfilePhotos' -FieldValue $CurrentStatesCorrect -StoreAs bool -Tenant $Tenant
         if ($CurrentStatesCorrect) {
             $FieldValue = $true
         } else {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1
index 0726c64b08447..d61be32cd15d2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardQuarantineRequestAlert.ps1
@@ -154,7 +154,6 @@ function Invoke-CIPPStandardQuarantineRequestAlert {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'QuarantineRequestAlert' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         # Both sides are normalised the same way and kept as arrays (a bare @() around an if-expression
         # unrolls a single element to a scalar, which would never match the array-shaped Current value).
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1
index bb2db7e31eaaa..0a87a5983cde4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRestrictThirdPartyStorageServices.ps1
@@ -102,6 +102,5 @@ function Invoke-CIPPStandardRestrictThirdPartyStorageServices {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.RestrictThirdPartyStorageServices' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'ThirdPartyStorageServicesRestricted' -FieldValue ($CurrentState.accountEnabled -eq $false) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1
index ef6c8eb436519..80d3dbae9aa89 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1
@@ -80,6 +80,5 @@ function Invoke-CIPPStandardRetentionCompliancePolicyTemplate {
         $ExpectedValue = @{ MissingPolicies = @() }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.RetentionCompliancePolicyTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'RetentionCompliancePolicyTemplate' -FieldValue ($MissingPolicies.Count -eq 0) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1
index d38c25f56144a..0d76e2540f19f 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1
@@ -130,7 +130,6 @@ function Invoke-CIPPStandardRetentionPolicyTag {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'RetentionPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
         $CurrentValue = @{
             retentionEnabled     = $CurrentState.RetentionEnabled
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1
index f2bf28002deeb..74a769882811a 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRotateDKIM.ps1
@@ -81,7 +81,6 @@ function Invoke-CIPPStandardRotateDKIM {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'DKIM' -FieldValue $DKIM -StoreAs json -Tenant $tenant
 
         $CurrentValue = @{
             domainsWith1024BitDKIM = @(@($DKIM.Identity) | Where-Object { $_ })
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1
index 334029b39daad..a3d24d8356ab3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPAzureB2B.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardSPAzureB2B {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'AzureB2B' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
         $CurrentValue = @{
             EnableAzureADB2BIntegration = $CurrentState.EnableAzureADB2BIntegration
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1
index a138b2efec37a..6b728761e77ee 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDirectSharing.ps1
@@ -88,7 +88,6 @@ function Invoke-CIPPStandardSPDirectSharing {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'DirectSharing' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
         $CurrentValue = @{
             DefaultSharingLinkType = $CurrentState.DefaultSharingLinkType
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1
index 805453d49c0d7..7348436374676 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableCustomScripts.ps1
@@ -94,6 +94,5 @@ function Invoke-CIPPStandardSPDisableCustomScripts {
             SPDisableCustomScripts = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.SPDisableCustomScripts' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'SPDisableCustomScripts' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1
index 49c13f27f5116..144250ccfa3ce 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableLegacyWorkflows.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardSPDisableLegacyWorkflows {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SPDisableLegacyWorkflows' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             StopNew2010Workflows = $CurrentState.StopNew2010Workflows
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1
index 0339550bcad77..b034a89d4d47a 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisableStoreAccess.ps1
@@ -93,6 +93,5 @@ function Invoke-CIPPStandardSPDisableStoreAccess {
             SPDisableStoreAccess = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.SPDisableStoreAccess' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'SPDisableStoreAccess' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1
index 92b624ffb2bde..0716abaf1c0a6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPDisallowInfectedFiles.ps1
@@ -91,7 +91,6 @@ function Invoke-CIPPStandardSPDisallowInfectedFiles {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SPDisallowInfectedFiles' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             DisallowInfectedFileDownload = $CurrentState.DisallowInfectedFileDownload
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1
index ade01fe5781a1..c3577b71f9abb 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPEmailAttestation.ps1
@@ -98,7 +98,6 @@ function Invoke-CIPPStandardSPEmailAttestation {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SPEmailAttestation' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             EmailAttestationReAuthDays = $CurrentState.EmailAttestationReAuthDays
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1
index 90ca95ac03f8d..0aaecff1febd4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPExternalUserExpiration.ps1
@@ -93,12 +93,6 @@ function Invoke-CIPPStandardSPExternalUserExpiration {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'ExternalUserExpiration' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        if ($StateIsCorrect) {
-            $FieldValue = $true
-        } else {
-            $FieldValue = $CurrentState
-        }
         $CurrentValue = @{
             ExternalUserExpireInDays       = $CurrentState.ExternalUserExpireInDays
             ExternalUserExpirationRequired = $CurrentState.ExternalUserExpirationRequired
@@ -108,6 +102,5 @@ function Invoke-CIPPStandardSPExternalUserExpiration {
             ExternalUserExpirationRequired = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.SPExternalUserExpiration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'standards.SPExternalUserExpiration' -FieldValue $FieldValue -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1
index 78a90454f7453..ca43b3eed3dff 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPFileRequests.ps1
@@ -145,15 +145,6 @@ function Invoke-CIPPStandardSPFileRequests {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SPFileRequestsEnabled' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'SPCoreFileRequestsEnabled' -FieldValue $CurrentState.CoreRequestFilesLinkEnabled -StoreAs bool -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'SPOneDriveFileRequestsEnabled' -FieldValue $CurrentState.OneDriveRequestFilesLinkEnabled -StoreAs bool -Tenant $Tenant
-
-        if ($null -ne $ExpirationDays) {
-            Add-CIPPBPAField -FieldName 'SPCoreFileRequestsExpirationDays' -FieldValue $CurrentState.CoreRequestFilesLinkExpirationInDays -StoreAs string -Tenant $Tenant
-            Add-CIPPBPAField -FieldName 'SPOneDriveFileRequestsExpirationDays' -FieldValue $CurrentState.OneDriveRequestFilesLinkExpirationInDays -StoreAs string -Tenant $Tenant
-        }
-
         $CurrentValue = @{
             CoreRequestFilesLinkEnabled              = $CurrentState.CoreRequestFilesLinkEnabled
             OneDriveRequestFilesLinkEnabled          = $CurrentState.OneDriveRequestFilesLinkEnabled
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPGuestPeoplePicker.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPGuestPeoplePicker.ps1
index c4c2541501253..2bb9d2cf72697 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPGuestPeoplePicker.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPGuestPeoplePicker.ps1
@@ -131,6 +131,5 @@ function Invoke-CIPPStandardSPGuestPeoplePicker {
             NonCompliantSiteCount = 0
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.SPGuestPeoplePicker' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'SPGuestPeoplePicker' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1
index 47c9d681bebe7..a694ca4d96857 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1
@@ -174,6 +174,5 @@ function Invoke-CIPPStandardSPOVersionControl {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.SPOVersionControl' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'SPOVersionControl' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1
index 694770223d2f4..1216c72a8fcab 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPSyncButtonState.ps1
@@ -90,7 +90,6 @@ function Invoke-CIPPStandardSPSyncButtonState {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SPSyncButtonDisabled' -FieldValue $CurrentState.HideSyncButtonOnDocLib -StoreAs bool -Tenant $Tenant
         if ($StateIsCorrect) {
             $FieldValue = $true
         } else {
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
index 61b515a26761b..caa4121bf591f 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1
@@ -194,7 +194,6 @@ function Invoke-CIPPStandardSafeAttachmentPolicy {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SafeAttachmentPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
         $CurrentValue = @{
             name            = $CurrentState.Name
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
index 3acb8aab1a6ed..661f241418820 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1
@@ -221,7 +221,6 @@ function Invoke-CIPPStandardSafeLinksPolicy {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SafeLinksPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
 
         $CurrentValue = @{
             Name                       = $CurrentState.Name
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1
index 475de0053c67a..f3514da94b2f8 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1
@@ -441,7 +441,6 @@ function Invoke-SafeLinksReport {
         }
     }
 
-    Add-CIPPBPAField -FieldName 'SafeLinksTemplatePolicy' -FieldValue $AllTemplatesApplied -StoreAs bool -Tenant $Tenant
 
     $CurrentValue = @{
         TemplateResults     = $ReportResults
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1
index f0697c0803e41..8ea46d6c33de6 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecureScoreRemediation.ps1
@@ -234,6 +234,5 @@ function Invoke-CIPPStandardSecureScoreRemediation {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.SecureScoreRemediation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $tenant
-        Add-CIPPBPAField -FieldName 'SecureScoreRemediation' -FieldValue $ReportData -StoreAs json -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
index 5840ed85f8e96..b2d2e5b7bf2d4 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSecurityDefaults.ps1
@@ -68,7 +68,6 @@ function Invoke-CIPPStandardSecurityDefaults {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SecurityDefaults' -FieldValue $SecureDefaultsState.IsEnabled -StoreAs bool -Tenant $tenant
         $CurrentData = @{
             SecurityDefaultsEnabled = $SecureDefaultsState.IsEnabled
         }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1
index d6fd2c15157fb..6a7fa70fb6b5c 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendFromAlias.ps1
@@ -81,7 +81,6 @@ function Invoke-CIPPStandardSendFromAlias {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SendFromAlias' -FieldValue $CurrentInfo -StoreAs bool -Tenant $Tenant
         $CurrentValue = @{ SendFromAliasEnabled = $CurrentInfo }
         $ExpectedValue = @{ SendFromAliasEnabled = $WantedState }
         Set-CIPPStandardsCompareField -FieldName 'standards.SendFromAlias' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
index 0443552cd728c..4a1a6ffa3380a 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSendReceiveLimitTenant.ps1
@@ -109,7 +109,6 @@ function Invoke-CIPPStandardSendReceiveLimitTenant {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SendReceiveLimit' -FieldValue $NotSetCorrectly -StoreAs json -Tenant $tenant
 
         $CurrentValue = @{
             SendLimit    = $Settings.SendLimit
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1
index b7bd969e0e982..db12dcc5cd902 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1
@@ -96,6 +96,5 @@ function Invoke-CIPPStandardSensitiveInfoTypeTemplate {
         $ExpectedValue = @{ NonCompliantSensitiveInfoTypes = @() }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.SensitiveInfoTypeTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'SensitiveInfoTypeTemplate' -FieldValue ($NonCompliant.Count -eq 0) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1
index 8cee20cffca5d..4ab76baf9bab1 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1
@@ -80,6 +80,5 @@ function Invoke-CIPPStandardSensitivityLabelTemplate {
         $ExpectedValue = @{ MissingLabels = @() }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.SensitivityLabelTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'SensitivityLabelTemplate' -FieldValue ($MissingLabels.Count -eq 0) -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1
index 2b42b1ed30dd8..58963f3173d06 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSharePointMassDeletionAlert.ps1
@@ -125,6 +125,5 @@ function Invoke-CIPPStandardSharePointMassDeletionAlert {
             NotifyUser = @($Settings.NotifyUser.value)
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.SharePointMassDeletionAlert' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'SharePointMassDeletionAlert' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
index c9f1b96850cd7..54fcf82730ad8 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardShortenMeetings.ps1
@@ -86,18 +86,6 @@ function Invoke-CIPPStandardShortenMeetings {
     }
 
     if ($Settings.report -eq $true) {
-        $BPAField = @{
-            FieldName  = 'ShortenMeetings'
-            FieldValue = $CorrectState
-            Tenant     = $Tenant
-        }
-
-        if ($CorrectState -eq $true) {
-            Add-CIPPBPAField @BPAField -StoreAs bool
-        } else {
-            Add-CIPPBPAField @BPAField -StoreAs json
-        }
-
         $CurrentValue = @{
             ShortenEventScopeDefault            = $CurrentState.ShortenEventScopeDefault
             DefaultMinutesToReduceShortEventsBy = $CurrentState.DefaultMinutesToReduceShortEventsBy
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1
index ba687cf031ea5..d201df9338ab1 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1
@@ -171,6 +171,5 @@ function Invoke-CIPPStandardSmartLockout {
         Set-CIPPStandardsCompareField -FieldName 'standards.SmartLockout' `
             -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
 
-        Add-CIPPBPAField -FieldName 'SmartLockout' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1
index 569ba58f16ac3..0859727b66ea0 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1
@@ -340,7 +340,6 @@ function Invoke-CIPPStandardSpamFilterPolicy {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SpamFilterPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
         $CurrentValue = @{
             Name                             = $CurrentState.Name
             SpamAction                       = $CurrentState.SpamAction
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
index deafdfc0afda9..21fd5bdfd0351 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpoofWarn.ps1
@@ -136,7 +136,6 @@ function Invoke-CIPPStandardSpoofWarn {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'SpoofingWarnings' -FieldValue $CurrentInfo.Enabled -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             Enabled     = $CurrentInfo.Enabled
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1
index 726cb64bf0d49..5e6a8177e3c13 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardStaleEntraDevices.ps1
@@ -213,14 +213,6 @@ function Invoke-CIPPStandardStaleEntraDevices {
 
     if ($Settings.report -eq $true) {
 
-        # Report only on actionable devices; skipped devices (hybrid-joined/Intune-managed/Autopilot) are excluded.
-        if ($RemediationEligibleStaleDevices.Count -gt 0) {
-            $StaleReport = ConvertTo-Json -InputObject ($RemediationEligibleStaleDevices | Select-Object -Property displayName, id, approximateLastSignInDateTime, accountEnabled, enrollmentProfileName, operatingSystem, managementType, profileType) -Depth 10 -Compress
-            Add-CIPPBPAField -FieldName 'StaleEntraDevices' -FieldValue $StaleReport -StoreAs json -Tenant $Tenant
-        } else {
-            Add-CIPPBPAField -FieldName 'StaleEntraDevices' -FieldValue $true -StoreAs bool -Tenant $Tenant
-        }
-
         if ($DevicesToDisable.Count -gt 0) {
             $EligibleToDisableFieldValue = $DevicesToDisable | Select-Object -Property displayName, id, approximateLastSignInDateTime, accountEnabled, enrollmentProfileName, operatingSystem, managementType, profileType
         }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1
index 80f06e8c2b469..f9d47d0c016da 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTAP.ps1
@@ -111,7 +111,6 @@ function Invoke-CIPPStandardTAP {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TemporaryAccessPass' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             state                    = $CurrentState.state
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1
index aaa33a4ae2d38..2e3e899dd8c9a 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsChatProtection.ps1
@@ -94,7 +94,6 @@ function Invoke-CIPPStandardTeamsChatProtection {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TeamsChatProtection' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             FileTypeCheck      = $CurrentState.FileTypeCheck
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsDisableResourceAccounts.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsDisableResourceAccounts.ps1
index 522283712d966..844700d8f7d8b 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsDisableResourceAccounts.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsDisableResourceAccounts.ps1
@@ -157,6 +157,5 @@ function Invoke-CIPPStandardTeamsDisableResourceAccounts {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsDisableResourceAccounts' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'TeamsDisableResourceAccounts' -FieldValue $EnabledResourceAccounts -StoreAs json -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1
index aa4735fa00c90..0a81f126987da 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEmailIntegration.ps1
@@ -95,7 +95,6 @@ function Invoke-CIPPStandardTeamsEmailIntegration {
             AllowEmailIntoChannel = $AllowEmailIntoChannel
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsEmailIntegration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'TeamsEmailIntoChannel' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1
index 805afb25e8680..f86b1cb2e64fb 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsEnrollUser.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardTeamsEnrollUser {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TeamsEnrollUser' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             EnrollUserOverride = $CurrentState.EnrollUserOverride
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1
index 37bd93c22a237..922bae79dd589 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalAccessPolicy.ps1
@@ -93,7 +93,6 @@ function Invoke-CIPPStandardTeamsExternalAccessPolicy {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TeamsExternalAccessPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             EnableFederationAccess     = $CurrentState.EnableFederationAccess
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1
index 14ac9225c9cc0..1218ae3c6ab1d 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalChatWithAnyone.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardTeamsExternalChatWithAnyone {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TeamsExternalChatWithAnyone' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             UseB2BInvitesToAddExternalUsers = $CurrentState.UseB2BInvitesToAddExternalUsers
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1
index abcc9c88488a9..04221175b19e3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsExternalFileSharing.ps1
@@ -104,7 +104,6 @@ function Invoke-CIPPStandardTeamsExternalFileSharing {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TeamsExternalFileSharing' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             AllowGoogleDrive = $CurrentState.AllowGoogleDrive
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
index f5ac98b73dbf1..c822359e6f7b2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsFederationConfiguration.ps1
@@ -187,7 +187,6 @@ function Invoke-CIPPStandardTeamsFederationConfiguration {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'FederationConfiguration' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentAllowedDomainsForReport = if ($IsCurrentAllowAllKnownDomains) {
             'AllowAllKnownDomains'
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1
index 62ca8f2ca0a1d..56e1691a7190c 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGlobalMeetingPolicy.ps1
@@ -171,7 +171,6 @@ function Invoke-CIPPStandardTeamsGlobalMeetingPolicy {
             AllowCloudRecording                        = $AllowCloudRecording
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsGlobalMeetingPolicy' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'TeamsGlobalMeetingPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1
index 043e4a988a87a..b249068fdc94d 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsGuestAccess.ps1
@@ -92,7 +92,6 @@ function Invoke-CIPPStandardTeamsGuestAccess {
             AllowGuestUser = $AllowGuestUser
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsGuestAccess' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'TeamsGuestAccess' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1
index 2e45f2ca7a5fb..7c35b8f123334 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingRecordingExpiration.ps1
@@ -89,7 +89,6 @@ function Invoke-CIPPStandardTeamsMeetingRecordingExpiration {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TeamsMeetingRecordingExpiration' -FieldValue $CurrentExpirationDays -StoreAs string -Tenant $Tenant
 
         $CurrentValue = @{
             MeetingRecordingExpirationDays = $CurrentExpirationDays
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1
index b4848b022703b..b2a8bbcbfd0b0 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingVerification.ps1
@@ -92,6 +92,5 @@ function Invoke-CIPPStandardTeamsMeetingVerification {
             CaptchaVerificationForMeetingJoin = $CaptchaVerificationForMeetingJoin
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsMeetingVerification' -CurrentValue $CurrentState -ExpectedValue $ExpectedState -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'TeamsMeetingVerification' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
index 5549004d5028f..869f373bce62d 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMeetingsByDefault.ps1
@@ -90,7 +90,6 @@ function Invoke-CIPPStandardTeamsMeetingsByDefault {
     if ($Settings.report -eq $true) {
         # Default is not set, not set means it's enabled
         if ($null -eq $CurrentState ) { $CurrentState = $true }
-        Add-CIPPBPAField -FieldName 'TeamsMeetingsByDefault' -FieldValue $CurrentState -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             OnlineMeetingsByDefaultEnabled = $CurrentState
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1
index 94fbf91a0705c..ea83336d3f53c 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsMessagingPolicy.ps1
@@ -117,7 +117,6 @@ function Invoke-CIPPStandardTeamsMessagingPolicy {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TeamsMessagingPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
 
         $CurrentValue = @{
             AllowOwnerDeleteMessage                      = $CurrentState.AllowOwnerDeleteMessage
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1
index 6beea759304c8..7e25e51fb29f3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1
@@ -100,6 +100,5 @@ function Invoke-CIPPStandardTeamsZAP {
             ZapEnabled = $true
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TeamsZAP' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'TeamsZAP' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1
index 7d7db531eee94..5df3ed80910c7 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1
@@ -160,7 +160,6 @@ function Invoke-CIPPStandardTenantAllowBlockListTemplate {
             }) -join '; '
             $CurrentValue = ($MissingByTemplate | ForEach-Object { "$($_.TemplateName) [$($_.ListType)/$($_.Action)] - Missing: $($_.MissingEntries -join ', ')" }) -join '; '
         }
-        Add-CIPPBPAField -FieldName 'TenantAllowBlockListTemplate' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.TenantAllowBlockListTemplate' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
index ec5836391ad51..8903679dbf081 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantDefaultTimezone.ps1
@@ -86,7 +86,6 @@ function Invoke-CIPPStandardTenantDefaultTimezone {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'TenantDefaultTimezone' -FieldValue $CurrentState.tenantDefaultTimezone -StoreAs string -Tenant $Tenant
         $CurrentValue = @{
             tenantDefaultTimezone = $CurrentState.tenantDefaultTimezone
         }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1
index 91e88460f8487..1f84826aa82e2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTwoClickEmailProtection.ps1
@@ -95,6 +95,5 @@ function Invoke-CIPPStandardTwoClickEmailProtection {
             TwoClickMailPreviewEnabled = $WantedState
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.TwoClickEmailProtection' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'TwoClickEmailProtection' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1
index e44e328385367..372d1c6800638 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUndoOauth.ps1
@@ -73,7 +73,6 @@ function Invoke-CIPPStandardUndoOauth {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'UndoOauth' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
         $CurrentValue = @{
             permissionGrantPolicyIdsAssignedToDefaultUserRole = $CurrentState.permissionGrantPolicyIdsAssignedToDefaultUserRole
         }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUsageLocation.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUsageLocation.ps1
new file mode 100644
index 0000000000000..997ff151d73c6
--- /dev/null
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUsageLocation.ps1
@@ -0,0 +1,172 @@
+function Invoke-CIPPStandardUsageLocation {
+    <#
+    .FUNCTIONALITY
+        Internal
+    .COMPONENT
+        (APIName) UsageLocation
+    .SYNOPSIS
+        (Label) Usage location for all users
+    .DESCRIPTION
+        (Helptext) Sets the Entra usage location (the two-letter country code that licensing and security tools such as Huntress ITDR depend on) on every member account. Optionally limit the sweep to members of named groups, skip members of named groups (users legitimately based in another country), or only fill in accounts that have no usage location yet.
+        (DocsDescription) Sets the usage location on every member account; guest accounts are ignored. Group names are resolved per tenant by display name and expanded to their transitive user members: include groups restrict the sweep to those members, exclude groups remove them from it. A configured group that does not exist in a tenant, or a failed membership lookup, skips the run rather than sweeping the wrong accounts. With 'only set when blank' enabled, accounts that already carry any usage location are left as they are. Directory-synced accounts are included: usage location is cloud-managed and stays writable for them unless a custom sync rule maps it from on-premises.
+    .NOTES
+        CAT
+            Entra (AAD) Standards
+        TAG
+        EXECUTIVETEXT
+            Ensures every employee account records the country it is used from, which Microsoft requires before licences can be assigned and which security monitoring uses to recognise sign-ins from unexpected locations. Staff based in other countries are exempted through a group.
+        ADDEDCOMPONENT
+            {"type":"CountryCodeSelect","required":true,"name":"standards.UsageLocation.usageLocation","label":"Usage location"}
+            {"type":"autoComplete","multiple":true,"creatable":true,"required":false,"name":"standards.UsageLocation.includeGroups","label":"Only apply to members of these groups (display names; blank = all member accounts)"}
+            {"type":"autoComplete","multiple":true,"creatable":true,"required":false,"name":"standards.UsageLocation.excludeGroups","label":"Skip members of these groups (display names; users legitimately located elsewhere)"}
+            {"type":"switch","name":"standards.UsageLocation.onlyWhenBlank","label":"Only set accounts that have no usage location (never overwrite an existing value)","required":false}
+        IMPACT
+            Medium Impact
+        ADDEDDATE
+            2026-09-16
+        POWERSHELLEQUIVALENT
+            Update-MgUser -UserId user@domain.com -UsageLocation 'US'
+        RECOMMENDEDBY
+        UPDATECOMMENTBLOCK
+            Run the Tools\Update-StandardsComments.ps1 script to update this comment block
+    .LINK
+        https://docs.cipp.app/user-documentation/tenant/standards/alignment/templates/available-standards
+    #>
+
+    param($Tenant, $Settings)
+
+    $UsageLocation = "$($Settings.usageLocation.value ?? $Settings.usageLocation)".Trim().ToUpperInvariant()
+    if ($UsageLocation -notmatch '^[A-Z]{2}$') {
+        Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "UsageLocation: '$UsageLocation' is not a two-letter country code. Skipping run." -Sev Error
+        return
+    }
+    $OnlyWhenBlank = [bool]($Settings.onlyWhenBlank -eq $true)
+
+    $ToNames = {
+        param($Value)
+        @(@($Value) | ForEach-Object {
+                if ($_ -is [string]) { $_ } else { "$($_.value ?? $_.label)" }
+            } | ForEach-Object { $_.Trim() } | Where-Object { $_ } | Select-Object -Unique)
+    }
+    $IncludeNames = & $ToNames $Settings.includeGroups
+    $ExcludeNames = & $ToNames $Settings.excludeGroups
+
+    try {
+        $AllUsers = @(New-CIPPDbRequest -TenantFilter $Tenant -Type 'Users' | Where-Object { $_ })
+    } catch {
+        $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+        Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "Could not get the UsageLocation state for $Tenant. Error: $ErrorMessage" -Sev Error
+        return
+    }
+
+    # Group scoping: names resolve live by display name (a template applies to many tenants,
+    # so an id would only ever match one) and expand to TRANSITIVE user members. An
+    # unresolved name or a failed lookup aborts the run - sweeping with half a scope is how
+    # an overseas office ends up with the wrong country and broken licences.
+    $IncludedIds = @{}
+    $ExcludedIds = @{}
+    if ($IncludeNames.Count -gt 0 -or $ExcludeNames.Count -gt 0) {
+        try {
+            $MemberRequests = [System.Collections.Generic.List[hashtable]]::new()
+            foreach ($Scope in @(@{ Prefix = 'include'; Names = $IncludeNames }, @{ Prefix = 'exclude'; Names = $ExcludeNames })) {
+                foreach ($Name in $Scope.Names) {
+                    $EscapedName = $Name -replace "'", "''"
+                    $GroupFilter = [System.Uri]::EscapeDataString("displayName eq '$EscapedName'")
+                    $Groups = @(New-GraphGetRequest -uri "https://graph.microsoft.com/v1.0/groups?`$filter=$GroupFilter&`$select=id,displayName" -tenantid $Tenant | Where-Object { $_.id })
+                    if ($Groups.Count -eq 0) { throw "the group '$Name' does not exist in this tenant" }
+                    foreach ($Group in $Groups) {
+                        $MemberRequests.Add(@{ id = "$($Scope.Prefix)-$($Group.id)"; method = 'GET'; url = "groups/$($Group.id)/transitiveMembers/microsoft.graph.user?`$select=id&`$top=999" })
+                    }
+                }
+            }
+            $Responses = @(New-GraphBulkRequest -tenantid $Tenant -Requests @($MemberRequests) -asapp $true -Version 'v1.0')
+            foreach ($Response in $Responses) {
+                if ([int]$Response.status -lt 200 -or [int]$Response.status -gt 299) {
+                    throw "membership lookup for $($Response.id) returned $($Response.status) $($Response.body.error.message)"
+                }
+                $Bucket = if ("$($Response.id)".StartsWith('include-')) { $IncludedIds } else { $ExcludedIds }
+                foreach ($MemberId in @($Response.body.value.id | Where-Object { $_ })) { $Bucket["$MemberId"] = $true }
+            }
+        } catch {
+            $ErrorMessage = Get-NormalizedError -Message $_.Exception.Message
+            Write-LogMessage -API 'Standards' -Tenant $Tenant -Message "UsageLocation: could not resolve the configured groups, refusing to run with a partial scope. Error: $ErrorMessage" -Sev Error
+            return
+        }
+    }
+
+    $Candidates = @($AllUsers | Where-Object { $_.userType -eq 'Member' -and $_.id })
+    if ($IncludeNames.Count -gt 0) { $Candidates = @($Candidates | Where-Object { $IncludedIds.ContainsKey("$($_.id)") }) }
+    if ($ExcludeNames.Count -gt 0) { $Candidates = @($Candidates | Where-Object { -not $ExcludedIds.ContainsKey("$($_.id)") }) }
+
+    $IncorrectUsers = @($Candidates | Where-Object {
+            $Location = "$($_.usageLocation)".Trim().ToUpperInvariant()
+            if ($OnlyWhenBlank) { [string]::IsNullOrWhiteSpace($Location) } else { $Location -ne $UsageLocation }
+        })
+
+    if ($Settings.remediate -eq $true) {
+        if ($IncorrectUsers.Count -gt 0) {
+            $UpdateDB = $false
+            $Index = 0
+            $BulkRequests = foreach ($User in $IncorrectUsers) {
+                @{
+                    id      = "$Index"
+                    method  = 'PATCH'
+                    url     = "users/$($User.id)"
+                    body    = @{ usageLocation = $UsageLocation }
+                    headers = @{ 'Content-Type' = 'application/json' }
+                }
+                $Index++
+            }
+
+            try {
+                $BulkResults = @(New-GraphBulkRequest -tenantid $Tenant -Requests @($BulkRequests) -asapp $true)
+                foreach ($Result in $BulkResults) {
+                    $User = $IncorrectUsers[[int]$Result.id]
+                    if ($Result.status -eq 200 -or $Result.status -eq 204) {
+                        $UpdateDB = $true
+                        Write-LogMessage -API 'Standards' -tenant $Tenant -message "Usage location for $($User.userPrincipalName) has been set to $UsageLocation" -sev Info
+                    } else {
+                        $ErrorMsg = if ($Result.body.error.message) { $Result.body.error.message } else { "Unknown error (Status: $($Result.status))" }
+                        Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set usage location for $($User.userPrincipalName): $ErrorMsg" -sev Error
+                    }
+                }
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to set usage location to $UsageLocation for all users: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
+            }
+
+            if ($UpdateDB) {
+                try {
+                    Set-CIPPDBCacheUsers -TenantFilter $Tenant
+                } catch {
+                    Write-LogMessage -API 'Standards' -tenant $Tenant -message "Failed to refresh user cache after remediation: $($_.Exception.Message)" -sev Warning
+                }
+            }
+        } else {
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message "All in-scope users already have the usage location set to $UsageLocation." -sev Info
+        }
+    }
+
+    if ($Settings.alert -eq $true) {
+        if ($IncorrectUsers.Count -gt 0) {
+            Write-StandardsAlert -message "The following accounts do not have the usage location set to $UsageLocation" -object $IncorrectUsers -tenant $Tenant -standardName 'UsageLocation' -standardId $Settings.standardId
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message "The following accounts do not have the usage location set to $UsageLocation : $($IncorrectUsers.userPrincipalName -join ', ')" -sev Info
+        } else {
+            Write-LogMessage -API 'Standards' -tenant $Tenant -message "All in-scope accounts have the usage location set to $UsageLocation." -sev Info
+        }
+    }
+
+    if ($Settings.report -eq $true) {
+        $FieldValue = @($IncorrectUsers | Select-Object -Property userPrincipalName, displayName, usageLocation, userType)
+
+        $CurrentValue = @{
+            usageLocation  = $UsageLocation
+            incorrectUsers = @($FieldValue)
+        }
+        $ExpectedValue = @{
+            usageLocation  = $UsageLocation
+            incorrectUsers = @()
+        }
+        Set-CIPPStandardsCompareField -FieldName 'standards.UsageLocation' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
+    }
+}
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1
index 3618fd75e89c6..c7294f042eb72 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserPreferredLanguage.ps1
@@ -92,7 +92,6 @@ function Invoke-CIPPStandardUserPreferredLanguage {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'IncorrectUsers' -FieldValue $IncorrectUsers -StoreAs json -Tenant $Tenant
 
         if ($IncorrectUsers.userPrincipalName) { $FieldValue = $IncorrectUsers | Select-Object -Property userPrincipalName, displayName, preferredLanguage, userType } else { $FieldValue = @() }
 
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
index cf8e2f4a6ae13..5b7fb17ec59dc 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardUserSubmissions.ps1
@@ -226,12 +226,6 @@ function Invoke-CIPPStandardUserSubmissions {
     }
 
     if ($Settings.report -eq $true) {
-        if ($PolicyState.length -eq 0) {
-            Add-CIPPBPAField -FieldName 'UserSubmissionPolicy' -FieldValue $false -StoreAs bool -Tenant $Tenant
-        } else {
-            Add-CIPPBPAField -FieldName 'UserSubmissionPolicy' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
-        }
-
         $PolicyState = $PolicyState | Select-Object EnableReportToMicrosoft, ReportJunkToCustomizedAddress, ReportNotJunkToCustomizedAddress, ReportPhishToCustomizedAddress, ReportJunkAddresses, ReportNotJunkAddresses, ReportPhishAddresses
         $RuleState = $RuleState | Select-Object State, SentTo
 
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1
index 3f03cb9cad1c3..9470677110049 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardWindowsBackupRestore.ps1
@@ -102,6 +102,5 @@ function Invoke-CIPPStandardWindowsBackupRestore {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.WindowsBackupRestore' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'WindowsBackupRestore' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
index 5dd97940219b0..0d8332355a477 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOAuthTokens.ps1
@@ -68,7 +68,6 @@ function Invoke-CIPPStandardallowOAuthTokens {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'softwareOath' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
         Set-CIPPStandardsCompareField -FieldName 'standards.allowOAuthTokens' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
index 39d996f64ea5e..6d80029fd62c1 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardallowOTPTokens.ps1
@@ -69,7 +69,6 @@ function Invoke-CIPPStandardallowOTPTokens {
 
     if ($Settings.report -eq $true) {
         Set-CIPPStandardsCompareField -FieldName 'standards.allowOTPTokens' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $tenant
-        Add-CIPPBPAField -FieldName 'MSAuthenticator' -FieldValue $CurrentInfo.isSoftwareOathEnabled -StoreAs bool -Tenant $tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
index d4d50f185a4f5..a606dbfb28f1c 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardcalDefault.ps1
@@ -166,9 +166,7 @@ function Invoke-CIPPStandardcalDefault {
     }
 
     if ($Settings.report -eq $true) {
-        $Filtered = $NeedsUpdate | Select-Object -Property Identity, AccessRights
         Set-CIPPStandardsCompareField -FieldName 'standards.calDefault' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'calDefault' -FieldValue $Filtered -StoreAs json -Tenant $Tenant
     }
 
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
index f5373e945d40f..bbec836f6a986 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandarddisableMacSync.ps1
@@ -89,6 +89,5 @@ function Invoke-CIPPStandarddisableMacSync {
         }
 
         Set-CIPPStandardsCompareField -FieldName 'standards.disableMacSync' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'MacSync' -FieldValue $CurrentState -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
index 2624bed22cdc2..0693daae420ea 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneBrandingProfile.ps1
@@ -141,6 +141,5 @@ function Invoke-CIPPStandardintuneBrandingProfile {
             privacyUrl                = $Settings.privacyUrl
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.intuneBrandingProfile' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'intuneBrandingProfile' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1
index ec7dd58175c8e..5736ef01bf7b8 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceReg.ps1
@@ -90,6 +90,5 @@ function Invoke-CIPPStandardintuneDeviceReg {
             userDeviceQuota = $Settings.max
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.intuneDeviceReg' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'intuneDeviceReg' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRegLocalAdmins.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRegLocalAdmins.ps1
index 2185834f5f89b..6ccf1484cc601 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRegLocalAdmins.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRegLocalAdmins.ps1
@@ -96,6 +96,5 @@ function Invoke-CIPPStandardintuneDeviceRegLocalAdmins {
             enableGlobalAdmins = $EnableGlobalAdmins
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.intuneDeviceRegLocalAdmins' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'intuneDeviceRegLocalAdmins' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
index d0184eabe354d..df8afa1a89879 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneDeviceRetirementDays.ps1
@@ -94,6 +94,5 @@ function Invoke-CIPPStandardintuneDeviceRetirementDays {
             deviceInactivityBeforeRetirementInDays = $Settings.days
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.intuneDeviceRetirementDays' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'intuneDeviceRetirementDays' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1
index 083fbe9c2ca67..0489d1a2b4eae 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRequireMFA.ps1
@@ -70,8 +70,6 @@ function Invoke-CIPPStandardintuneRequireMFA {
     }
 
     if ($Settings.report -eq $true) {
-        $RequireMFA = if ($PreviousSetting.multiFactorAuthConfiguration -eq 'required') { $true } else { $false }
-
         $CurrentValue = @{
             multiFactorAuthConfiguration = $PreviousSetting.multiFactorAuthConfiguration
         }
@@ -79,6 +77,5 @@ function Invoke-CIPPStandardintuneRequireMFA {
             multiFactorAuthConfiguration = 'required'
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.intuneRequireMFA' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'intuneRequireMFA' -FieldValue $RequireMFA -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1
index e036f2577e917..c571ec65965e2 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1
@@ -90,6 +90,5 @@ function Invoke-CIPPStandardintuneRestrictUserDeviceJoin {
             disableUserDeviceJoin = $DisableUserDeviceJoin
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.intuneRestrictUserDeviceJoin' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'intuneRestrictUserDeviceJoin' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1
index 345ee1092b1bb..ed8f8d5b39a46 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1
@@ -90,6 +90,5 @@ function Invoke-CIPPStandardintuneRestrictUserDeviceRegistration {
             disableUserDeviceRegistration = $DisableUserDeviceRegistration
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.intuneRestrictUserDeviceRegistration' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -TenantFilter $Tenant
-        Add-CIPPBPAField -FieldName 'intuneRestrictUserDeviceRegistration' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardlaps.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardlaps.ps1
index 11339e95d2ce1..a5f41e69537e3 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardlaps.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardlaps.ps1
@@ -71,6 +71,5 @@ function Invoke-CIPPStandardlaps {
     if ($Settings.report -eq $true) {
         $state = $PreviousSetting.localAdminPassword.isEnabled ? $true : $false
         Set-CIPPStandardsCompareField -FieldName 'standards.laps' -FieldValue $state -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'laps' -FieldValue $PreviousSetting.localAdminPassword.isEnabled -StoreAs bool -Tenant $tenant
     }
 }
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
index 33c7b9209a1ba..ce083ddf382ce 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingCapability.ps1
@@ -60,10 +60,6 @@ function Invoke-CIPPStandardsharingCapability {
         return
     }
 
-    if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'sharingCapability' -FieldValue $CurrentInfo.sharingCapability -StoreAs string -Tenant $Tenant
-    }
-
     # Get level value using null-coalescing operator
     $level = $Settings.Level.value ?? $Settings.Level
 
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
index 1517af22f3899..42964b7836ed5 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1
@@ -117,7 +117,6 @@ function Invoke-CIPPStandardsharingDomainRestriction {
     }
 
     if ($Settings.report -eq $true) {
-        Add-CIPPBPAField -FieldName 'sharingDomainRestriction' -FieldValue [bool]$StateIsCorrect -StoreAs bool -Tenant $tenant
 
         $CurrentValue = @{
             sharingDomainRestrictionMode = $CurrentState.sharingDomainRestrictionMode
diff --git a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1 b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1
index 23c1207c5fc49..351c083bf4d0e 100644
--- a/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1
+++ b/Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardunmanagedSync.ps1
@@ -94,6 +94,5 @@ function Invoke-CIPPStandardunmanagedSync {
             ConditionalAccessPolicy = $WantedState
         }
         Set-CIPPStandardsCompareField -FieldName 'standards.unmanagedSync' -CurrentValue $CurrentValue -ExpectedValue $ExpectedValue -Tenant $Tenant
-        Add-CIPPBPAField -FieldName 'unmanagedSync' -FieldValue $StateIsCorrect -StoreAs bool -Tenant $Tenant
     }
 }
diff --git a/Modules/CIPPTests/Public/Helpers/Invoke-CippSecuritySimulationTest.ps1 b/Modules/CIPPTests/Public/Helpers/Invoke-CippSecuritySimulationTest.ps1
new file mode 100644
index 0000000000000..6c0e65873078e
--- /dev/null
+++ b/Modules/CIPPTests/Public/Helpers/Invoke-CippSecuritySimulationTest.ps1
@@ -0,0 +1,333 @@
+function Invoke-CippSecuritySimulationTest {
+    <#
+    .SYNOPSIS
+        Plays one Security Simulation scenario against a tenant and returns its test result row.
+    .DESCRIPTION
+        Shared body of every Invoke-CippTestSecuritySimulation_* test. The scenario comes from
+        Tests/SecuritySimulations/scenarios.json. Standards are judged from the tenant's BaselineAlignment
+        rows (a standard in no baseline is a gap that "Add to baseline" closes), alert steps from the alert
+        rules the alert page writes, and the sign-in step live through the Conditional Access What If API
+        as an account picked from the cache. The per-step detail lands in ResultDataJson for the Security
+        Simulations page.
+    .FUNCTIONALITY
+        Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)][string]$Tenant,
+        [Parameter(Mandatory = $true)][string]$ScenarioId
+    )
+
+    $TestId = "SecuritySimulation_$ScenarioId"
+    $Path = Join-Path $env:CIPPRootPath 'Modules\CIPPTests\Public\Tests\SecuritySimulations\scenarios.json'
+    $Scenario = @([System.IO.File]::ReadAllText($Path) | ConvertFrom-Json -Depth 20) | Where-Object { $_.id -eq $ScenarioId } | Select-Object -First 1
+    if (-not $Scenario) {
+        return Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status 'Skipped' -Name $ScenarioId -ResultMarkdown "Scenario '$ScenarioId' is not defined."
+    }
+
+    $Capabilities = $(try { Get-CIPPTenantCapabilities -TenantFilter $Tenant } catch { $null })
+    $IsLicensed = {
+        param($Required)
+        $Needed = @($Required | Where-Object { $_ })
+        $Needed.Count -eq 0 -or @($Needed | Where-Object { $Capabilities.$_ -eq $true }).Count -gt 0
+    }
+    $Licensed = & $IsLicensed $Scenario.requiredCapabilities
+
+    $AlignmentTable = Get-CippTable -tablename 'BaselineAlignment'
+    $SafeTenant = ConvertTo-CIPPODataFilterValue -Value $Tenant
+    $AlignmentRows = @(Get-CIPPAzDataTableEntity @AlignmentTable -Filter "PartitionKey eq '$SafeTenant'")
+
+    $StandardState = {
+        param($Reference)
+        $Name = "$($Reference.name)"
+        $Definition = Get-CIPPBaselineDefinition -Name $Name | Select-Object -First 1
+        $State = [PSCustomObject]@{
+            name      = $Name
+            label     = "$($Definition.label ?? $Name)"
+            role      = $(if ("$($Reference.role)") { "$($Reference.role)" } else { 'prevents' })
+            status    = 'Not in a baseline'
+            compliant = $false
+            assigned  = $false
+            detail    = ''
+        }
+        $Row = @($AlignmentRows | Where-Object { ("$($_.StandardName)" -split '#')[0] -eq $Name }) |
+            Sort-Object -Property { [int64]($_.LastRun ?? 0) } -Descending | Select-Object -First 1
+        if ($Row) {
+            $State.assigned = $true
+            switch -Regex ("$($Row.Status)") {
+                '^Compliant$' { $State.status = 'Compliant'; $State.compliant = $true }
+                '^(Accepted|Partially Accepted)$' { $State.status = 'Accepted deviation'; $State.compliant = $false; $State.detail = "$($Row.DeviationReason)" }
+                '^(Denied|Drift)' { $State.status = 'Drift'; $State.compliant = $false }
+                '^Skipped - No License$' { $State.status = 'License missing'; $State.compliant = $null }
+                default { $State.status = 'No data'; $State.compliant = $null }
+            }
+        } elseif (-not (& $IsLicensed $Definition.requiredCapabilities)) {
+            $State.status = 'License missing'
+            $State.compliant = $null
+        } else {
+            try {
+                $Item = @{
+                    TenantFilter     = $Tenant
+                    TenantName       = $Tenant
+                    Standard         = $Name
+                    BaseName         = $Name
+                    Variables        = $null
+                    Tiers            = @()
+                    Stage            = 1
+                    StageName        = ''
+                    TemplateId       = ''
+                    SourceScope      = 'test'
+                    SourceTemplate   = 'Security Simulation'
+                    RemediateEnabled = $false
+                    AlertEnabled     = $false
+                }
+                $Graded = Invoke-CIPPBaselineStandard -Item $Item -Mode 'compare' -GradeOnly
+                if ($null -eq $Graded) {
+                    $State.status = 'Needs configuration'
+                    $State.detail = 'This standard needs its settings chosen in a baseline before it can be checked.'
+                } elseif ($Graded.Compliant -eq $true) {
+                    $State.status = 'Compliant'
+                    $State.compliant = $true
+                } else {
+                    $State.status = 'Not configured'
+                    $Properties = @($Graded.Diff | ForEach-Object { $_.Property } | Where-Object { $_ } | Select-Object -Unique)
+                    if ($Properties.Count -gt 0) { $State.detail = 'Differs on: {0}' -f ($Properties -join ', ') }
+                }
+            } catch {
+                $State.status = 'Could not evaluate'
+                $State.compliant = $null
+                $State.detail = $_.Exception.Message
+            }
+        }
+        $State
+    }
+
+    $Rules = $null
+    $AlertState = {
+        param($Alert)
+        if ($null -eq $Rules) {
+            $Rules = [System.Collections.Generic.List[object]]::new()
+            $RuleTable = Get-CippTable -TableName 'WebhookRules'
+            foreach ($Row in @(Get-CIPPAzDataTableEntity @RuleTable -Filter "PartitionKey eq 'Webhookv2'")) {
+                if ($Row.Disabled -eq $true -or [string]::IsNullOrEmpty($Row.Tenants)) { continue }
+                $Tenants = $(try { $Row.Tenants | ConvertFrom-Json -ErrorAction Stop } catch { $null })
+                if ($null -eq $Tenants) { continue }
+                $Expanded = @(Expand-CIPPTenantGroups -TenantFilter $Tenants)
+                if (-not ($Expanded.value -contains $Tenant -or $Expanded.value -contains 'AllTenants')) { continue }
+                $Excluded = $(try { $Row.excludedTenants | ConvertFrom-Json -ErrorAction Stop } catch { $null })
+                if ($Excluded -and (@(Expand-CIPPTenantGroups -TenantFilter $Excluded).value -contains $Tenant)) { continue }
+                $Operations = [System.Collections.Generic.List[string]]::new()
+                foreach ($Condition in @($(try { $Row.Conditions | ConvertFrom-Json -ErrorAction Stop } catch { @() }) | Where-Object { $_ })) {
+                    if ("$($Condition.Property.label)" -ne 'Operation' -and "$($Condition.Property.value)" -ne 'List:Operation') { continue }
+                    $Operator = "$($Condition.Operator.value)".ToLower()
+                    if ($Operator -notin @('eq', 'in', 'like', 'contains', 'match')) { continue }
+                    foreach ($Input in @($(if ($Condition.Input -is [array]) { $Condition.Input } else { @($Condition.Input) }))) {
+                        $Value = "$($Input.value ?? $Input)"
+                        if (-not $Value) { continue }
+                        if ($Operator -eq 'contains') { $Value = "*$Value*" }
+                        if (-not $Operations.Contains($Value)) { $Operations.Add($Value) }
+                    }
+                }
+                $Rules.Add([PSCustomObject]@{ Logbook = "$($Row.type)"; Comment = "$($Row.AlertComment)"; Operations = @($Operations) })
+            }
+        }
+        $Operation = "$($Alert.operation)"
+        $Logbook = "$($Alert.logbook)"
+        $Matched = @($Rules | Where-Object {
+                $Rule = $_
+                if ($Logbook -and $Rule.Logbook -and $Rule.Logbook -ne $Logbook) { return $false }
+                @($Rule.Operations | Where-Object { $Operation -eq $_ -or $Operation -like $_ }).Count -gt 0
+            })
+        [PSCustomObject]@{
+            operation  = $Operation
+            logbook    = $Logbook
+            preset     = "$($Alert.preset)"
+            configured = $Matched.Count -gt 0
+            rules      = @($Matched | ForEach-Object { if ($_.Comment) { $_.Comment } else { $_.Operations -join ', ' } })
+        }
+    }
+
+    $Steps = @($Scenario.steps | Where-Object { $_ })
+    $Persona = $(if ("$($Scenario.persona)") { "$($Scenario.persona)" } else { 'user' })
+    $NeedsIdentity = @($Steps | Where-Object { $_.whatIf }).Count -gt 0
+    $Identity = $(if ($NeedsIdentity -and $Licensed) { Resolve-CIPPSimulationIdentity -TenantFilter $Tenant -Persona $Persona } else { $null })
+    $AttackerCanSatisfy = @($Scenario.attackerCanSatisfy | Where-Object { $_ })
+
+    $WhatIfCalls = 0
+    $WhatIfSkipped = $false
+    $Results = [System.Collections.Generic.List[object]]::new()
+    $Reached = $true
+    $ReachedWhenFixed = $true
+    $PreventedAt = $null
+    $PreventedWhenFixedAt = $null
+    $Index = 0
+
+    foreach ($Step in $Steps) {
+        $Index++
+        $StepId = "$($Step.id)"
+        $Standards = @(foreach ($Reference in @($Step.standards | Where-Object { $_ })) { & $StandardState $Reference })
+        $Alerts = @(foreach ($Alert in @($Step.alerts | Where-Object { $_ })) { & $AlertState $Alert })
+
+        $WhatIf = $null
+        if ($Step.whatIf) {
+            if (-not $Licensed) {
+                $WhatIf = [PSCustomObject]@{ verdict = 'unknown'; detail = 'unlicensed'; error = 'This tenant is not licensed for Conditional Access.'; gaps = @(); policies = @() }
+                $WhatIfSkipped = $true
+            } elseif (-not $Identity) {
+                $WhatIf = [PSCustomObject]@{ verdict = 'unknown'; detail = 'noIdentity'; error = "No $Persona account is available in the cache to evaluate this sign-in."; gaps = @(); policies = @() }
+                $WhatIfSkipped = $true
+            } else {
+                $Body = New-CIPPCAWhatIfRequest -UserId $Identity.userId -IncludeApplications $Step.whatIf.includeApplications -Conditions ($Step.whatIf | Select-Object -Property * -ExcludeProperty includeApplications)
+                $WhatIfCalls++
+                $Evaluation = @(Invoke-CIPPCAWhatIf -TenantFilter $Tenant -Bodies @($Body))[0]
+                if ($Evaluation.Error) {
+                    $WhatIf = [PSCustomObject]@{ verdict = 'unknown'; detail = 'error'; error = "$($Evaluation.Error)"; gaps = @(); policies = @() }
+                    $WhatIfSkipped = $true
+                } else {
+                    $Verdict = Get-CIPPCAWhatIfVerdict -Policies $Evaluation.Policies -AttackerCanSatisfy $AttackerCanSatisfy
+                    $Gaps = foreach ($Gap in @($Step.gaps | Where-Object { $_ })) {
+                        $GapLicensed = & $IsLicensed $Gap.requiredCapabilities
+                        $When = @($Gap.when | Where-Object { $_ } | ForEach-Object { "$_".ToLower() })
+                        $Triggered = $GapLicensed -and (
+                            ($When -contains 'allowed' -and $Verdict.verdict -eq 'allowed') -or
+                            ($When -contains 'weakgrant' -and $Verdict.detail -eq 'grantSatisfied') -or
+                            ($When -contains 'reportonly' -and @($Verdict.reportOnlyWouldStop).Count -gt 0)
+                        )
+                        [PSCustomObject]@{
+                            text       = "$($Gap.text)"
+                            role       = $(if ("$($Gap.role)") { "$($Gap.role)" } else { 'prevents' })
+                            fix        = $Gap.fix
+                            triggered  = [bool]$Triggered
+                            unlicensed = -not $GapLicensed
+                        }
+                    }
+                    $WhatIf = [PSCustomObject]@{
+                        verdict             = $Verdict.verdict
+                        detail              = $Verdict.detail
+                        requiredControls    = @($Verdict.requiredControls)
+                        blockedBy           = @($Verdict.blockedBy)
+                        challengedBy        = @($Verdict.challengedBy)
+                        reportOnlyWouldStop = @($Verdict.reportOnlyWouldStop)
+                        policies            = @($Verdict.policies)
+                        conditions          = $Step.whatIf
+                        gaps                = @($Gaps)
+                        error               = $null
+                    }
+                }
+            }
+        }
+
+        $Checks = [System.Collections.Generic.List[bool]]::new()
+        foreach ($Standard in $Standards) { if ($null -ne $Standard.compliant) { $Checks.Add([bool]$Standard.compliant) } }
+        foreach ($Alert in $Alerts) { $Checks.Add([bool]$Alert.configured) }
+        $Passed = @($Checks | Where-Object { $_ }).Count
+        $HasChecks = $Standards.Count -gt 0 -or $Alerts.Count -gt 0
+        $Kind = if ($WhatIf -and $HasChecks) { 'mixed' } elseif ($WhatIf) { 'whatIf' } elseif ($HasChecks) { 'checks' } else { 'narrative' }
+
+        $StepVerdict = if ($WhatIf) { $WhatIf.verdict }
+        elseif ($Checks.Count -eq 0) { $(if ($HasChecks) { 'unknown' } else { 'info' }) }
+        elseif ($Passed -eq $Checks.Count) { 'pass' } elseif ($Passed -eq 0) { 'fail' } else { 'partial' }
+
+        $VerdictLabel = switch ($StepVerdict) {
+            'blocked' { $(if (@($WhatIf.blockedBy).Count -gt 0) { 'Blocked by policy' } else { 'Stopped - the attacker cannot satisfy the required controls' }) }
+            'allowed' { $(if ($WhatIf.detail -eq 'grantSatisfied') { 'Allowed - the required controls are satisfied by the attacker' } else { 'Allowed - no enforced policy applies' }) }
+            'pass' { 'Protected' }
+            'partial' { 'Partly protected' }
+            'fail' { 'Unprotected' }
+            'unknown' { 'Could not be evaluated' }
+            default { '' }
+        }
+
+        $TriggeredGaps = @($(if ($WhatIf) { $WhatIf.gaps | Where-Object { $_.triggered } }))
+        $VerdictWhenFixed = if ($WhatIf) { $(if ($WhatIf.verdict -eq 'blocked' -or $TriggeredGaps.Count -gt 0) { 'blocked' } else { $WhatIf.verdict }) }
+        elseif ($HasChecks) { 'pass' } else { 'info' }
+
+        $Fixes = [System.Collections.Generic.List[object]]::new()
+        foreach ($Standard in @($Standards | Where-Object { $_.compliant -eq $false })) {
+            $Fixes.Add([PSCustomObject]@{ type = 'standard'; name = $Standard.name; label = $Standard.label; role = $Standard.role; status = $Standard.status; assigned = $Standard.assigned; step = $StepId })
+        }
+        foreach ($Gap in $TriggeredGaps) {
+            $Fixes.Add([PSCustomObject]@{ type = 'caTemplate'; name = "$($Gap.fix.caTemplate)"; label = $Gap.text; role = $Gap.role; status = 'Missing'; assigned = $false; step = $StepId })
+        }
+        foreach ($Alert in @($Alerts | Where-Object { -not $_.configured })) {
+            $Fixes.Add([PSCustomObject]@{
+                    type      = 'alertPreset'
+                    name      = $(if ($Alert.preset) { $Alert.preset } else { $Alert.operation })
+                    label     = "Alert on $($Alert.operation)"
+                    role      = 'detects'
+                    status    = 'Not configured'
+                    assigned  = $false
+                    step      = $StepId
+                    operation = $Alert.operation
+                    logbook   = $Alert.logbook
+                })
+        }
+
+        $Results.Add([PSCustomObject]@{
+                id               = $StepId
+                index            = $Index
+                title            = "$($Step.title)"
+                text             = "$($Step.text)"
+                kind             = $Kind
+                verdict          = $StepVerdict
+                verdictLabel     = $VerdictLabel
+                reached          = $Reached
+                reachedWhenFixed = $ReachedWhenFixed
+                verdictWhenFixed = $VerdictWhenFixed
+                whenFixed        = $(if ("$($Step.whenFixed)") { "$($Step.whenFixed)" } else { $null })
+                standards        = @($Standards)
+                whatIf           = $WhatIf
+                alerts           = @($Alerts)
+                fixes            = @($Fixes)
+            })
+
+        $StopsWhen = "$($Step.stopsChainWhen)".ToLower()
+        if ($StopsWhen -and $Reached -and $StepVerdict -eq $StopsWhen) { $Reached = $false; $PreventedAt = $StepId }
+        if ($StopsWhen -and $ReachedWhenFixed -and $VerdictWhenFixed -eq $StopsWhen) { $ReachedWhenFixed = $false; $PreventedWhenFixedAt = $StepId }
+    }
+
+    $UniqueFixes = [System.Collections.Generic.List[object]]::new()
+    $Seen = [System.Collections.Generic.HashSet[string]]::new()
+    foreach ($Fix in @($Results | ForEach-Object { $_.fixes })) {
+        if ($Seen.Add("$($Fix.type)|$($Fix.name)")) { $UniqueFixes.Add($Fix) }
+    }
+    $Detected = @($Results | Where-Object { $_.reached } | ForEach-Object { $_.alerts } | Where-Object { $_.configured }).Count -gt 0
+    $Prevented = $null -ne $PreventedAt
+
+    $Data = [PSCustomObject]@{
+        scenario = [PSCustomObject]@{
+            id       = "$($Scenario.id)"
+            title    = "$($Scenario.title)"
+            category = "$($Scenario.category)"
+            severity = "$($Scenario.severity)"
+            summary  = "$($Scenario.summary)"
+            outcome  = $Scenario.outcome
+        }
+        licensed = [bool]$Licensed
+        identity = $Identity
+        lastRun  = [int64]([datetimeoffset]::UtcNow.ToUnixTimeSeconds())
+        steps    = @($Results)
+        summary  = [PSCustomObject]@{
+            prevented                = $Prevented
+            preventedAtStep          = $PreventedAt
+            preventedWhenFixed       = $null -ne $PreventedWhenFixedAt
+            preventedWhenFixedAtStep = $PreventedWhenFixedAt
+            detected                 = [bool]$Detected
+            fixCount                 = $UniqueFixes.Count
+            fixes                    = @($UniqueFixes)
+        }
+        evidence = [PSCustomObject]@{ whatIfCalls = $WhatIfCalls }
+    }
+
+    $Status = if (-not $Licensed) { 'Skipped' } elseif ($WhatIfSkipped) { 'Investigate' } elseif ($Prevented) { 'Passed' } else { 'Failed' }
+    $Headline = if (-not $Licensed) { 'Not evaluated: the tenant is not licensed for the capabilities this scenario needs.' }
+    elseif ($WhatIfSkipped) { 'The sign-in step could not be evaluated, so the outcome is unknown.' }
+    elseif ($Prevented) { "Prevented. $($Scenario.outcome.prevented)" }
+    elseif ($Detected) { "Not prevented, but an alert would fire. $($Scenario.outcome.notPrevented)" }
+    else { "Not prevented and undetected. $($Scenario.outcome.notPrevented)" }
+    $FixLine = if ($UniqueFixes.Count -gt 0) { "`n`nCloses the gaps: " + (@($UniqueFixes | ForEach-Object { if ($_.type -eq 'caTemplate') { $_.name } else { $_.label } }) -join '; ') + '.' } else { '' }
+
+    Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Identity' -Status $Status `
+        -Name "$($Scenario.title)" -Risk "$($Scenario.severity)" -Category "$($Scenario.category)" `
+        -ResultMarkdown ("$Headline$FixLine") -ResultDataJson (ConvertTo-Json -InputObject $Data -Depth 20 -Compress)
+}
diff --git a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1 b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1
index 34d40a641d180..d762a104a8962 100644
--- a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1
+++ b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1
@@ -57,13 +57,13 @@ function Invoke-CippTestCIS_1_1_1 {
 
         if ($NonCompliant.Count -eq 0) {
             $Status = 'Passed'
-            $Result = [System.Text.StringBuilder]::new("All $($PrivilegedUsers.Count) privileged users are cloud-only and unlicensed.")
+            $Result = [System.Text.StringBuilder]::new("All $($PrivilegedUsers.Count) privileged users are cloud-only, use an onmicrosoft.com UPN and are unlicensed.")
         } else {
             $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("$($NonCompliant.Count) of $($PrivilegedUsers.Count) privileged user(s) are not cloud-only or are licensed:`n`n")
-            $null = $Result.Append("| UPN | Synced | Licensed |`n| :-- | :----- | :------- |`n")
+            $Result = [System.Text.StringBuilder]::new("$($NonCompliant.Count) of $($PrivilegedUsers.Count) privileged user(s) fail one or more checks (synced from on-premises, non-onmicrosoft.com UPN, or licensed):`n`n")
+            $null = $Result.Append("| UPN | Synced | onmicrosoft UPN | Licensed |`n| :-- | :----- | :-------------- | :------- |`n")
             foreach ($U in ($NonCompliant | Select-Object -First 25)) {
-                $null = $Result.Append("| $($U.userPrincipalName) | $([bool]$U.onPremisesSyncEnabled) | $([bool]($U.assignedLicenses.Count -gt 0)) |`n")
+                $null = $Result.Append("| $($U.userPrincipalName) | $([bool]$U.onPremisesSyncEnabled) | $($U.userPrincipalName -like '*onmicrosoft.com') | $([bool]($U.assignedLicenses.Count -gt 0)) |`n")
             }
         }
 
diff --git a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_1.ps1 b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_1.ps1
index f0daa4b672546..1929bf2b146d3 100644
--- a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_1.ps1
+++ b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_1.ps1
@@ -6,17 +6,16 @@ function Invoke-CippTestCIS_2_1_1 {
     param($Tenant)
 
     try {
+        
+        if (-not (Test-CIPPStandardLicense -StandardName 'CIS_2_1_1' -TenantFilter $Tenant -Preset DefenderForOffice365 -SkipLog)) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_1' -TestType 'Identity' -Status 'Unlicensed' -ResultMarkdown 'This tenant is not licensed for Microsoft Defender for Office 365 (ATP). Required capabilities: ATP_ENTERPRISE, ATP_ENTERPRISE_GOV, THREAT_INTELLIGENCE, THREAT_INTELLIGENCE_GOV.' -Risk 'High' -Name 'Safe Links for Office Applications is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+            return
+        }
+
         $SafeLinks = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
 
         if (-not $SafeLinks) {
-            # A Count marker means the cache was collected but the tenant has no Safe Links policy -
-            # that is a real failure (Safe Links is not enabled), not a missing cache. No marker
-            # means the type was never collected, so a Cache refresh is the correct guidance.
-            if (Get-CIPPDbItem -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies' -CountsOnly) {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_1' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Links policy exists for this tenant, so Safe Links for Office applications is not enabled.' -Risk 'High' -Name 'Safe Links for Office Applications is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
-            } else {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_1' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoSafeLinksPolicies has not been collected for this tenant. Run a Cache refresh (Cache & Tests); if it persists, the tenant may not have Defender for Office 365.' -Risk 'High' -Name 'Safe Links for Office Applications is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
-            }
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_1' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoSafeLinksPolicies cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Safe Links for Office Applications is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
             return
         }
 
diff --git a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_4.ps1 b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_4.ps1
index f76297dcf85be..3194cc9c1ea71 100644
--- a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_4.ps1
+++ b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_4.ps1
@@ -6,17 +6,16 @@ function Invoke-CippTestCIS_2_1_4 {
     param($Tenant)
 
     try {
+
+        if (-not (Test-CIPPStandardLicense -StandardName 'CIS_2_1_4' -TenantFilter $Tenant -Preset DefenderForOffice365 -SkipLog)) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_4' -TestType 'Identity' -Status 'Unlicensed' -ResultMarkdown 'This tenant is not licensed for Microsoft Defender for Office 365 (ATP). Required capabilities: ATP_ENTERPRISE, ATP_ENTERPRISE_GOV, THREAT_INTELLIGENCE, THREAT_INTELLIGENCE_GOV.' -Risk 'High' -Name 'Safe Attachments policy is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+            return
+        }
+
         $SA = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoSafeAttachmentPolicies'
 
         if (-not $SA) {
-            # A Count marker means the cache was collected but the tenant has no Safe Attachments
-            # policy - that is a real failure, not a missing cache. No marker means the type was
-            # never collected, so a Cache refresh is the correct guidance.
-            if (Get-CIPPDbItem -TenantFilter $Tenant -Type 'ExoSafeAttachmentPolicies' -CountsOnly) {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_4' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Attachments policy exists for this tenant, so Safe Attachments is not enabled.' -Risk 'High' -Name 'Safe Attachments policy is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
-            } else {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_4' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoSafeAttachmentPolicies has not been collected for this tenant. Run a Cache refresh (Cache & Tests); if it persists, the tenant may not have Defender for Office 365.' -Risk 'High' -Name 'Safe Attachments policy is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
-            }
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_4' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoSafeAttachmentPolicies cache not found. Please refresh the cache for this tenant.' -Name 'Safe Attachments policy is enabled' -UserImpact 'Low' -Risk 'High' -ImplementationEffort 'Low' -Category 'Email Protection'
             return
         }
 
diff --git a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1 b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1
index 7c7f7f9c535f5..75a2c40b2a871 100644
--- a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1
+++ b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1
@@ -6,17 +6,16 @@ function Invoke-CippTestCIS_2_1_5 {
     param($Tenant)
 
     try {
+        
+        if (-not (Test-CIPPStandardLicense -StandardName 'CIS_2_1_5' -TenantFilter $Tenant -Preset DefenderForOffice365 -SkipLog)) {
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_5' -TestType 'Identity' -Status 'Unlicensed' -ResultMarkdown 'This tenant is not licensed for Microsoft Defender for Office 365 (ATP). Required capabilities: ATP_ENTERPRISE, ATP_ENTERPRISE_GOV, THREAT_INTELLIGENCE, THREAT_INTELLIGENCE_GOV.' -Risk 'High' -Name 'Safe Attachments policy is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+            return
+        }
+
         $Atp = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAtpPolicyForO365'
 
         if (-not $Atp) {
-            # A Count marker means the cache was collected but the tenant has no ATP policy - that is
-            # a real failure, not a missing cache. No marker means the type was never collected, so a
-            # Cache refresh is the correct guidance.
-            if (Get-CIPPDbItem -TenantFilter $Tenant -Type 'ExoAtpPolicyForO365' -CountsOnly) {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_5' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No ATP policy for Office 365 exists for this tenant, so Safe Attachments for SharePoint, OneDrive and Teams is not enabled.' -Risk 'High' -Name 'Safe Attachments for SharePoint, OneDrive, and Teams is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
-            } else {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_5' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoAtpPolicyForO365 has not been collected for this tenant. Run a Cache refresh (Cache & Tests); if it persists, the tenant may not have Defender for Office 365.' -Risk 'High' -Name 'Safe Attachments for SharePoint, OneDrive, and Teams is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
-            }
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_2_1_5' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoAtpPolicyForO365 cache not found. Please refresh the cache for this tenant.' -Risk 'High' -Name 'Safe Attachments for SharePoint, OneDrive, and Teams is enabled' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
             return
         }
 
diff --git a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_2_3.ps1 b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_2_3.ps1
index 24595c2ca8706..3930fa3a99d63 100644
--- a/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_2_3.ps1
+++ b/Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_2_3.ps1
@@ -6,22 +6,22 @@ function Invoke-CippTestCIS_6_2_3 {
     param($Tenant)
 
     try {
-        $Org = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoOrganizationConfig'
+        $Org = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoExternalInOutlook'
 
         if (-not $Org) {
-            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_6_2_3' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoOrganizationConfig cache not found.' -Risk 'Medium' -Name 'Email from external senders is identified' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_6_2_3' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'ExoExternalInOutlook cache not found.' -Risk 'Medium' -Name 'Email from external senders is identified' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
             return
         }
 
         $Cfg = $Org | Select-Object -First 1
-        $External = $Cfg.ExternalInOutlookEnabled
+        $External = $Cfg.Enabled
 
         if ($External -eq $true) {
             $Status = 'Passed'
-            $Result = 'External sender callouts are enabled in Outlook (ExternalInOutlookEnabled: true).'
+            $Result = 'External sender callouts are enabled in Outlook (Enabled: true).'
         } else {
             $Status = 'Failed'
-            $Result = "External sender callouts are disabled (ExternalInOutlookEnabled: $External). Run Set-ExternalInOutlook -Enabled $true."
+            $Result = "External sender callouts are disabled (Enabled: $External). Run Set-ExternalInOutlook -Enabled $true."
         }
 
         Add-CippTestResult -TenantFilter $Tenant -TestId 'CIS_6_2_3' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Email from external senders is identified' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection'
diff --git a/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.ps1 b/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.ps1
index 6951858c3e5b4..5e3e356a1431f 100644
--- a/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.ps1
+++ b/Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO71.ps1
@@ -4,7 +4,7 @@ function Invoke-CippTestCISAMSEXO71 {
     Tests MS.EXO.7.1 - External sender warnings SHALL be implemented
 
     .DESCRIPTION
-    Checks if external sender warnings are enabled in Exchange Online organization config
+    Checks if external sender identification (Get-ExternalInOutlook) is enabled in Exchange Online
 
     .FUNCTIONALITY
     Internal
@@ -16,22 +16,22 @@ function Invoke-CippTestCISAMSEXO71 {
     )
 
     try {
-        $OrgConfig = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoOrganizationConfig'
+        $OrgConfig = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoExternalInOutlook'
 
         if (-not $OrgConfig) {
-            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoOrganizationConfig cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'External sender warnings SHALL be implemented' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO71' -TenantFilter $Tenant
+            Add-CippTestResult -Status 'Skipped' -ResultMarkdown 'ExoExternalInOutlook cache not found. Please refresh the cache for this tenant.' -Risk 'Medium' -Name 'External sender warnings SHALL be implemented' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Email Protection' -TestId 'CISAMSEXO71' -TenantFilter $Tenant
             return
         }
 
         $OrgConfigObject = $OrgConfig | Select-Object -First 1
 
-        if ($OrgConfigObject.ExternalInOutlook -eq $true) {
+        if ($OrgConfigObject.Enabled -eq $true) {
             $Result = [System.Text.StringBuilder]::new('✅ **Pass**: External sender warnings are enabled in Outlook.')
             $Status = 'Passed'
         } else {
             $Result = [System.Text.StringBuilder]::new("❌ **Fail**: External sender warnings are not enabled in Outlook.`n`n")
             $null = $Result.Append("**Current Setting:**`n")
-            $null = $Result.Append("- ExternalInOutlook: $($OrgConfigObject.ExternalInOutlook)")
+            $null = $Result.Append("- ExternalInOutlook Enabled: $($OrgConfigObject.Enabled)")
             $Status = 'Failed'
         }
 
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.md b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.md
index 29973d7368347..165133c48b324 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.md
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.md
@@ -1,4 +1,4 @@
-Each accepted domain in your organization should be covered by a Safe Links policy to ensure all users receive URL protection. Without domain-specific Safe Links coverage, users in certain domains may not be protected from malicious links, creating security gaps that attackers can exploit to target specific business units or subsidiaries.
+Each accepted domain in your organization should be covered by a Safe Links policy to ensure all users receive URL protection. A domain is considered fully covered only when an enabled Safe Links policy rule targets the domain without domain, recipient, or group exclusions. Without domain-specific Safe Links coverage, users in certain domains may not be protected from malicious links, creating security gaps that attackers can exploit to target specific business units or subsidiaries.
 
 **Remediation action**
 
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.ps1 b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.ps1
index 252899ddfb8d3..02bc40a45b1cb 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.ps1
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA226.ps1
@@ -7,28 +7,35 @@ function Invoke-CippTestORCA226 {
 
     try {
         $AcceptedDomains = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
-        $SafeLinksPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoSafeLinksPolicies'
+        $SafeLinksRules = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoSafeLinksRules'
 
         if (-not $AcceptedDomains) {
             Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
             return
         }
 
-        if (-not $SafeLinksPolicies) {
+        if (-not $SafeLinksRules) {
             if (-not (Test-CIPPStandardLicense -StandardName 'ORCA226' -TenantFilter $Tenant -Preset DefenderForOffice365 -SkipLog)) {
                 Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status 'Unlicensed' -ResultMarkdown 'This tenant is not licensed for Microsoft Defender for Office 365 (ATP). Required capabilities: ATP_ENTERPRISE, ATP_ENTERPRISE_GOV, THREAT_INTELLIGENCE, THREAT_INTELLIGENCE_GOV.' -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
             } else {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Links policies found. Each domain should have a Safe Links policy.' -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
+                Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA226' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Links rules found. Each domain should have a Safe Links policy.' -Risk 'High' -Name 'Each domain has a Safe Links policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Links'
             }
             return
         }
 
-        # Get all recipient domains from policies
+        # Get all recipient domains from rules
         $CoveredDomains = [System.Collections.Generic.List[string]]::new()
-        foreach ($Policy in $SafeLinksPolicies) {
-            if ($Policy.RecipientDomainIs) {
-                foreach ($Domain in $Policy.RecipientDomainIs) {
-                    $CoveredDomains.Add($Domain) | Out-Null
+        foreach ($Rule in $SafeLinksRules) {
+            if (
+                $Rule.State -eq 'Enabled' -and
+                $Rule.RecipientDomainIs -and
+                -not $Rule.ExceptIfSentTo -and
+                -not $Rule.ExceptIfSentToMemberOf
+            ) {
+                foreach ($Domain in $Rule.RecipientDomainIs) {
+                    if ($Rule.ExceptIfRecipientDomainIs -notcontains $Domain) {
+                        $CoveredDomains.Add($Domain) | Out-Null
+                    }
                 }
             }
         }
@@ -44,11 +51,11 @@ function Invoke-CippTestORCA226 {
             $Status = 'Passed'
             $Result = [System.Text.StringBuilder]::new("All accepted domains are covered by Safe Links policies.`n`n")
             $null = $Result.Append("**Total Accepted Domains:** $($AcceptedDomains.Count)`n")
-            $null = $Result.Append("**Total Safe Links Policies:** $($SafeLinksPolicies.Count)")
+            $null = $Result.Append("**Total Safe Links Rules:** $($SafeLinksRules.Count)")
         } else {
             $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("$($DomainsWithoutPolicy.Count) domains do not have a Safe Links policy.`n`n")
-            $null = $Result.Append("**Domains Without Policy:**`n`n")
+            $Result = [System.Text.StringBuilder]::new("$($DomainsWithoutPolicy.Count) domains are not fully covered by a Safe Links policy.`n`n")
+            $null = $Result.Append("**Domains Without Full Policy Coverage:**`n`n")
             foreach ($Domain in $DomainsWithoutPolicy) {
                 $null = $Result.Append("- $Domain`n")
             }
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.md b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.md
index ad2b56ce49dba..234413f81f0d0 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.md
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.md
@@ -1,4 +1,4 @@
-Each accepted domain in your organization should be covered by a Safe Attachments policy to ensure all users receive malware protection. Without domain-specific Safe Attachments coverage, users in certain domains may not be protected from malicious files, creating security vulnerabilities that can be exploited to deliver malware to unprotected segments of your organization.
+Each accepted domain in your organization should be covered by a Safe Attachments policy to ensure all users receive malware protection. A domain is considered fully covered only when an enabled Safe Attachments policy rule targets the domain without domain, recipient, or group exclusions. Without domain-specific Safe Attachments coverage, users in certain domains may not be protected from malicious files, creating security vulnerabilities that can be exploited to deliver malware to unprotected segments of your organization.
 
 **Remediation action**
 
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.ps1 b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.ps1
index 82df15ac5abba..8d412e88d779a 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.ps1
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA227.ps1
@@ -7,28 +7,35 @@ function Invoke-CippTestORCA227 {
 
     try {
         $AcceptedDomains = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
-        $SafeAttachmentPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoSafeAttachmentPolicies'
+        $SafeAttachmentRules = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoSafeAttachmentRules'
 
         if (-not $AcceptedDomains) {
             Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
             return
         }
 
-        if (-not $SafeAttachmentPolicies) {
+        if (-not $SafeAttachmentRules) {
             if (-not (Test-CIPPStandardLicense -StandardName 'ORCA227' -TenantFilter $Tenant -Preset DefenderForOffice365 -SkipLog)) {
                 Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status 'Unlicensed' -ResultMarkdown 'This tenant is not licensed for Microsoft Defender for Office 365 (ATP). Required capabilities: ATP_ENTERPRISE, ATP_ENTERPRISE_GOV, THREAT_INTELLIGENCE, THREAT_INTELLIGENCE_GOV.' -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
             } else {
-                Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Attachments policies found. Each domain should have a Safe Attachments policy.' -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
+                Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA227' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Safe Attachments rules found. Each domain should have a Safe Attachments policy.' -Risk 'High' -Name 'Each domain has a Safe Attachments policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Safe Attachments'
             }
             return
         }
 
-        # Get all recipient domains from policies
+        # Get all recipient domains from rules
         $CoveredDomains = [System.Collections.Generic.List[string]]::new()
-        foreach ($Policy in $SafeAttachmentPolicies) {
-            if ($Policy.RecipientDomainIs) {
-                foreach ($Domain in $Policy.RecipientDomainIs) {
-                    $CoveredDomains.Add($Domain) | Out-Null
+        foreach ($Rule in $SafeAttachmentRules) {
+            if (
+                $Rule.State -eq 'Enabled' -and
+                $Rule.RecipientDomainIs -and
+                -not $Rule.ExceptIfSentTo -and
+                -not $Rule.ExceptIfSentToMemberOf
+            ) {
+                foreach ($Domain in $Rule.RecipientDomainIs) {
+                    if ($Rule.ExceptIfRecipientDomainIs -notcontains $Domain) {
+                        $CoveredDomains.Add($Domain) | Out-Null
+                    }
                 }
             }
         }
@@ -44,11 +51,11 @@ function Invoke-CippTestORCA227 {
             $Status = 'Passed'
             $Result = [System.Text.StringBuilder]::new("All accepted domains are covered by Safe Attachments policies.`n`n")
             $null = $Result.Append("**Total Accepted Domains:** $($AcceptedDomains.Count)`n")
-            $null = $Result.Append("**Total Safe Attachments Policies:** $($SafeAttachmentPolicies.Count)")
+            $null = $Result.Append("**Total Safe Attachments Rules:** $($SafeAttachmentRules.Count)")
         } else {
             $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("$($DomainsWithoutPolicy.Count) domains do not have a Safe Attachments policy.`n`n")
-            $null = $Result.Append("**Domains Without Policy:**`n`n")
+            $Result = [System.Text.StringBuilder]::new("$($DomainsWithoutPolicy.Count) domains are not fully covered by a Safe Attachments policy.`n`n")
+            $null = $Result.Append("**Domains Without Full Policy Coverage:**`n`n")
             foreach ($Domain in $DomainsWithoutPolicy) {
                 $null = $Result.Append("- $Domain`n")
             }
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.md b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.md
index 1c8dae777e9c7..cc091fcc0aa06 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.md
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.md
@@ -1,7 +1,9 @@
-Each accepted domain in your organization should be covered by an anti-phishing policy to ensure all users receive protection from impersonation and spoofing attacks. Without domain-specific anti-phishing coverage, users in certain domains may be vulnerable to targeted phishing campaigns that exploit the lack of protection for their email addresses.
+Anti-phishing policies are applied using policy rules and evaluated by priority. Multiple policy rules can target the same accepted domain, which can cause some policies or settings not to apply as intended. This check reports overlapping policy rules as informational so their scope and priority can be reviewed.
 
 **Remediation action**
 
+Review overlapping anti-phishing policy rules and verify that their scope and priority match the intended configuration.
+
 - [Configure anti-phishing policies in Microsoft Defender for Office 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-phishing-policies-mdo-configure)
 - [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
 <!--- Results --->
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.ps1 b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.ps1
index 37b89f62c44f7..75c70460b1450 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.ps1
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA230.ps1
@@ -7,54 +7,51 @@ function Invoke-CippTestORCA230 {
 
     try {
         $AcceptedDomains = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
-        $AntiPhishPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAntiPhishPolicies'
+        $AntiPhishRules = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAntiPhishRules'
 
         if (-not $AcceptedDomains) {
-            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'Medium' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
             return
         }
 
-        if (-not $AntiPhishPolicies) {
-            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No Anti-phishing policies found. Each domain should have an Anti-phishing policy.' -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
-            return
-        }
-
-        # Get all recipient domains from policies
-        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
-        foreach ($Policy in $AntiPhishPolicies) {
-            if ($Policy.RecipientDomainIs) {
-                foreach ($Domain in $Policy.RecipientDomainIs) {
-                    $CoveredDomains.Add($Domain) | Out-Null
-                }
-            }
-        }
-
-        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        $OverlappingDomains = [System.Collections.Generic.List[object]]::new()
         foreach ($Domain in $AcceptedDomains) {
-            if ($CoveredDomains -notcontains $Domain.DomainName) {
-                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            $ApplicableRules = @($AntiPhishRules | Where-Object {
+                    $_.State -eq 'Enabled' -and
+                    $_.RecipientDomainIs -contains $Domain.DomainName -and
+                    $_.ExceptIfRecipientDomainIs -notcontains $Domain.DomainName
+                })
+            if ($ApplicableRules.Count -gt 1) {
+                $OverlappingDomains.Add([PSCustomObject]@{
+                        Domain = $Domain.DomainName
+                        Rules  = $ApplicableRules
+                    }) | Out-Null
             }
         }
 
-        if ($DomainsWithoutPolicy.Count -eq 0) {
+        if ($OverlappingDomains.Count -eq 0) {
             $Status = 'Passed'
-            $Result = [System.Text.StringBuilder]::new("All accepted domains are covered by Anti-phishing policies.`n`n")
-            $null = $Result.Append("**Total Accepted Domains:** $($AcceptedDomains.Count)`n")
-            $null = $Result.Append("**Total Anti-phishing Policies:** $($AntiPhishPolicies.Count)")
+            $Result = 'No overlapping Anti-phishing policy rules were found.'
         } else {
-            $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("$($DomainsWithoutPolicy.Count) domains do not have an Anti-phishing policy.`n`n")
-            $null = $Result.Append("**Domains Without Policy:**`n`n")
-            foreach ($Domain in $DomainsWithoutPolicy) {
-                $null = $Result.Append("- $Domain`n")
+            $Status = 'Informational'
+            $Result = [System.Text.StringBuilder]::new("Multiple Anti-phishing policy rules apply to one or more domains.`n`n")
+            foreach ($Overlap in $OverlappingDomains) {
+                $null = $Result.Append("- **$($Overlap.Domain)**`n")
+                foreach ($Rule in ($Overlap.Rules | Sort-Object Priority)) {
+                    $null = $Result.Append("  - $($Rule.Name)")
+                    if ($null -ne $Rule.Priority) {
+                        $null = $Result.Append(" (Priority: $($Rule.Priority))")
+                    }
+                    $null = $Result.Append("`n")
+                }
             }
         }
 
-        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
-        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA230' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Each domain has an Anti-phishing policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Phish'
     }
 }
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.md b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.md
index 47e7daa0084e3..96bc85e7d7b3f 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.md
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.md
@@ -1,7 +1,9 @@
-Each accepted domain in your organization should be covered by an anti-spam policy to ensure all users receive protection from unwanted and malicious email. Without domain-specific anti-spam coverage, users in certain domains may receive higher volumes of spam and potentially malicious messages, increasing security risks and reducing productivity.
+Anti-spam policies are applied using policy rules and evaluated by priority. Multiple policy rules can target the same accepted domain, which can cause some policies or settings not to apply as intended. This check reports overlapping policy rules as informational so their scope and priority can be reviewed.
 
 **Remediation action**
 
+Review overlapping anti-spam policy rules and verify that their scope and priority match the intended configuration.
+
 - [Configure anti-spam policies in Microsoft 365](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-spam-policies-configure)
 - [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
 <!--- Results --->
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.ps1 b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.ps1
index b9a01cd1529a7..6f3451e259fff 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.ps1
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA231.ps1
@@ -7,54 +7,51 @@ function Invoke-CippTestORCA231 {
 
     try {
         $AcceptedDomains = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
-        $ContentFilterPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoHostedContentFilterPolicy'
+        $ContentFilterRules = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoHostedContentFilterRule'
 
         if (-not $AcceptedDomains) {
-            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'Medium' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
             return
         }
 
-        if (-not $ContentFilterPolicies) {
-            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No anti-spam policies found. Each domain should have an anti-spam policy.' -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
-            return
-        }
-
-        # Get all recipient domains from policies
-        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
-        foreach ($Policy in $ContentFilterPolicies) {
-            if ($Policy.RecipientDomainIs) {
-                foreach ($Domain in $Policy.RecipientDomainIs) {
-                    $CoveredDomains.Add($Domain) | Out-Null
-                }
-            }
-        }
-
-        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        $OverlappingDomains = [System.Collections.Generic.List[object]]::new()
         foreach ($Domain in $AcceptedDomains) {
-            if ($CoveredDomains -notcontains $Domain.DomainName) {
-                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            $ApplicableRules = @($ContentFilterRules | Where-Object {
+                    $_.State -eq 'Enabled' -and
+                    $_.RecipientDomainIs -contains $Domain.DomainName -and
+                    $_.ExceptIfRecipientDomainIs -notcontains $Domain.DomainName
+                })
+            if ($ApplicableRules.Count -gt 1) {
+                $OverlappingDomains.Add([PSCustomObject]@{
+                        Domain = $Domain.DomainName
+                        Rules  = $ApplicableRules
+                    }) | Out-Null
             }
         }
 
-        if ($DomainsWithoutPolicy.Count -eq 0) {
+        if ($OverlappingDomains.Count -eq 0) {
             $Status = 'Passed'
-            $Result = [System.Text.StringBuilder]::new("All accepted domains are covered by anti-spam policies.`n`n")
-            $null = $Result.Append("**Total Accepted Domains:** $($AcceptedDomains.Count)`n")
-            $null = $Result.Append("**Total Anti-spam Policies:** $($ContentFilterPolicies.Count)")
+            $Result = 'No overlapping Anti-spam policy rules were found.'
         } else {
-            $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("$($DomainsWithoutPolicy.Count) domains do not have an anti-spam policy.`n`n")
-            $null = $Result.Append("**Domains Without Policy:**`n`n")
-            foreach ($Domain in $DomainsWithoutPolicy) {
-                $null = $Result.Append("- $Domain`n")
+            $Status = 'Informational'
+            $Result = [System.Text.StringBuilder]::new("Multiple Anti-spam policy rules apply to one or more domains.`n`n")
+            foreach ($Overlap in $OverlappingDomains) {
+                $null = $Result.Append("- **$($Overlap.Domain)**`n")
+                foreach ($Rule in ($Overlap.Rules | Sort-Object Priority)) {
+                    $null = $Result.Append("  - $($Rule.Name)")
+                    if ($null -ne $Rule.Priority) {
+                        $null = $Result.Append(" (Priority: $($Rule.Priority))")
+                    }
+                    $null = $Result.Append("`n")
+                }
             }
         }
 
-        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
-        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA231' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Each domain has an anti-spam policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Anti-Spam'
     }
 }
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.md b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.md
index 9a2b166214ea7..90282972388bc 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.md
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.md
@@ -1,7 +1,9 @@
-Each accepted domain in your organization should be covered by a malware filter policy to ensure all users receive protection from malicious attachments and files. Without domain-specific malware filtering, users in certain domains may be exposed to viruses, trojans, and other malware delivered through email, creating potential entry points for security breaches.
+Malware filter policies are applied using policy rules and evaluated by priority. Multiple policy rules can target the same accepted domain, which can cause some policies or settings not to apply as intended. This check reports overlapping policy rules as informational so their scope and priority can be reviewed.
 
 **Remediation action**
 
+Review overlapping malware filter policy rules and verify that their scope and priority match the intended configuration.
+
 - [Configure anti-malware policies in EOP](https://learn.microsoft.com/microsoft-365/security/office-365-security/anti-malware-policies-configure)
 - [Recommended settings for EOP and Microsoft Defender for Office 365 security](https://learn.microsoft.com/microsoft-365/security/office-365-security/recommended-settings-for-eop-and-office365)
 <!--- Results --->
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.ps1 b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.ps1
index 280d54cc08772..57a62071550a6 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.ps1
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA232.ps1
@@ -7,54 +7,51 @@ function Invoke-CippTestORCA232 {
 
     try {
         $AcceptedDomains = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoAcceptedDomains'
-        $MalwarePolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoMalwareFilterPolicies'
+        $MalwareRules = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoMalwareFilterRules'
 
         if (-not $AcceptedDomains) {
-            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
+            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No accepted domains found in database.' -Risk 'Medium' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
             return
         }
 
-        if (-not $MalwarePolicies) {
-            Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Failed' -ResultMarkdown 'No malware filter policies found. Each domain should have a malware filter policy.' -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
-            return
-        }
-
-        # Get all recipient domains from policies
-        $CoveredDomains = [System.Collections.Generic.List[string]]::new()
-        foreach ($Policy in $MalwarePolicies) {
-            if ($Policy.RecipientDomainIs) {
-                foreach ($Domain in $Policy.RecipientDomainIs) {
-                    $CoveredDomains.Add($Domain) | Out-Null
-                }
-            }
-        }
-
-        $DomainsWithoutPolicy = [System.Collections.Generic.List[string]]::new()
+        $OverlappingDomains = [System.Collections.Generic.List[object]]::new()
         foreach ($Domain in $AcceptedDomains) {
-            if ($CoveredDomains -notcontains $Domain.DomainName) {
-                $DomainsWithoutPolicy.Add($Domain.DomainName) | Out-Null
+            $ApplicableRules = @($MalwareRules | Where-Object {
+                    $_.State -eq 'Enabled' -and
+                    $_.RecipientDomainIs -contains $Domain.DomainName -and
+                    $_.ExceptIfRecipientDomainIs -notcontains $Domain.DomainName
+                })
+            if ($ApplicableRules.Count -gt 1) {
+                $OverlappingDomains.Add([PSCustomObject]@{
+                        Domain = $Domain.DomainName
+                        Rules  = $ApplicableRules
+                    }) | Out-Null
             }
         }
 
-        if ($DomainsWithoutPolicy.Count -eq 0) {
+        if ($OverlappingDomains.Count -eq 0) {
             $Status = 'Passed'
-            $Result = [System.Text.StringBuilder]::new("All accepted domains are covered by malware filter policies.`n`n")
-            $null = $Result.Append("**Total Accepted Domains:** $($AcceptedDomains.Count)`n")
-            $null = $Result.Append("**Total Malware Filter Policies:** $($MalwarePolicies.Count)")
+            $Result = 'No overlapping Malware filter policy rules were found.'
         } else {
-            $Status = 'Failed'
-            $Result = [System.Text.StringBuilder]::new("$($DomainsWithoutPolicy.Count) domains do not have a malware filter policy.`n`n")
-            $null = $Result.Append("**Domains Without Policy:**`n`n")
-            foreach ($Domain in $DomainsWithoutPolicy) {
-                $null = $Result.Append("- $Domain`n")
+            $Status = 'Informational'
+            $Result = [System.Text.StringBuilder]::new("Multiple Malware filter policy rules apply to one or more domains.`n`n")
+            foreach ($Overlap in $OverlappingDomains) {
+                $null = $Result.Append("- **$($Overlap.Domain)**`n")
+                foreach ($Rule in ($Overlap.Rules | Sort-Object Priority)) {
+                    $null = $Result.Append("  - $($Rule.Name)")
+                    if ($null -ne $Rule.Priority) {
+                        $null = $Result.Append(" (Priority: $($Rule.Priority))")
+                    }
+                    $null = $Result.Append("`n")
+                }
             }
         }
 
-        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
 
     } catch {
         $ErrorMessage = Get-CippException -Exception $_
         Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
-        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
+        Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA232' -TestType 'Identity' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'Medium' -Name 'Each domain has a malware filter policy' -UserImpact 'High' -ImplementationEffort 'Medium' -Category 'Malware'
     }
 }
diff --git a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.ps1 b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.ps1
index ee20556e366dc..8d09c35d807cc 100644
--- a/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.ps1
+++ b/Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA240.ps1
@@ -6,7 +6,7 @@ function Invoke-CippTestORCA240 {
     param($Tenant)
 
     try {
-        $OrgConfig = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoOrganizationConfig'
+        $OrgConfig = Get-CIPPTestData -TenantFilter $Tenant -Type 'ExoExternalInOutlook'
 
         if (-not $OrgConfig) {
             Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA240' -TestType 'Identity' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing required licenses or data collection not yet completed.' -Risk 'Medium' -Name 'Outlook external tags are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Configuration'
@@ -15,14 +15,14 @@ function Invoke-CippTestORCA240 {
 
         $Config = $OrgConfig | Select-Object -First 1
 
-        if ($Config.ExternalInOutlook -ne 'Disabled') {
+        if ($Config.Enabled -eq $true) {
             $Status = 'Passed'
             $Result = [System.Text.StringBuilder]::new("Outlook external tags are configured.`n`n")
-            $null = $Result.Append("**ExternalInOutlook:** $($Config.ExternalInOutlook)")
+            $null = $Result.Append("**ExternalInOutlook Enabled:** $($Config.Enabled)")
         } else {
             $Status = 'Failed'
             $Result = [System.Text.StringBuilder]::new("Outlook external tags are NOT configured.`n`n")
-            $null = $Result.Append("**ExternalInOutlook:** $($Config.ExternalInOutlook)")
+            $null = $Result.Append("**ExternalInOutlook Enabled:** $($Config.Enabled)")
         }
 
         Add-CippTestResult -TenantFilter $Tenant -TestId 'ORCA240' -TestType 'Identity' -Status $Status -ResultMarkdown $Result -Risk 'Medium' -Name 'Outlook external tags are configured' -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Configuration'
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AdminNonCompliantDevice.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AdminNonCompliantDevice.ps1
new file mode 100644
index 0000000000000..06e335fa380b5
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AdminNonCompliantDevice.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_AdminNonCompliantDevice {
+    <#
+    .SYNOPSIS
+    Security Simulation - Global Admin on a non-compliant device
+
+    .DESCRIPTION
+    A Global Administrator signs in from an unmanaged, non-compliant computer, giving an attacker on that machine full control of the tenant.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'AdminNonCompliantDevice'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AnonymousLinkSensitiveSite.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AnonymousLinkSensitiveSite.ps1
new file mode 100644
index 0000000000000..385f860fab19a
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AnonymousLinkSensitiveSite.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_AnonymousLinkSensitiveSite {
+    <#
+    .SYNOPSIS
+    Security Simulation - Anyone link on a sensitive site
+
+    .DESCRIPTION
+    An attacker creates an Anyone link on a sensitive SharePoint site so files can be downloaded without signing in.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'AnonymousLinkSensitiveSite'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AuditingOff.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AuditingOff.ps1
new file mode 100644
index 0000000000000..6f0ff9237f9d6
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_AuditingOff.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_AuditingOff {
+    <#
+    .SYNOPSIS
+    Security Simulation - Silent tenant: auditing turned off
+
+    .DESCRIPTION
+    With the Unified Audit Log disabled, an attacker acts inside the tenant knowing that key actions leave no usable trail.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'AuditingOff'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_BulkSyncUnmanagedDevice.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_BulkSyncUnmanagedDevice.ps1
new file mode 100644
index 0000000000000..86c477eb321cb
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_BulkSyncUnmanagedDevice.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_BulkSyncUnmanagedDevice {
+    <#
+    .SYNOPSIS
+    Security Simulation - Bulk sync to an unmanaged device
+
+    .DESCRIPTION
+    A compromised user syncs entire document libraries to a personal, unmanaged computer, copying company data off managed systems.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'BulkSyncUnmanagedDevice'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_DeviceCodePhishing.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_DeviceCodePhishing.ps1
new file mode 100644
index 0000000000000..d779452f912da
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_DeviceCodePhishing.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_DeviceCodePhishing {
+    <#
+    .SYNOPSIS
+    Security Simulation - Device-code phishing
+
+    .DESCRIPTION
+    An attacker tricks a user into approving a device-code sign-in and receives a fully authenticated token that already includes the MFA claim.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'DeviceCodePhishing'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_GuestReshareSprawl.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_GuestReshareSprawl.ps1
new file mode 100644
index 0000000000000..3b08fc768e3b2
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_GuestReshareSprawl.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_GuestReshareSprawl {
+    <#
+    .SYNOPSIS
+    Security Simulation - Guest re-share sprawl
+
+    .DESCRIPTION
+    A guest re-shares files they were given, spreading access to more outsiders than the owner intended.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'GuestReshareSprawl'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_GuestWithDirectoryRole.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_GuestWithDirectoryRole.ps1
new file mode 100644
index 0000000000000..ed01e7fbc3d18
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_GuestWithDirectoryRole.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_GuestWithDirectoryRole {
+    <#
+    .SYNOPSIS
+    Security Simulation - Guest account holding a directory role
+
+    .DESCRIPTION
+    A guest account that was granted a directory role is used to read the directory and hand privileged access to another account.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'GuestWithDirectoryRole'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_LegacyAuthMailboxAccess.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_LegacyAuthMailboxAccess.ps1
new file mode 100644
index 0000000000000..f576b1a5e280a
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_LegacyAuthMailboxAccess.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_LegacyAuthMailboxAccess {
+    <#
+    .SYNOPSIS
+    Security Simulation - Legacy authentication mailbox access
+
+    .DESCRIPTION
+    An attacker uses an older mail protocol that cannot prompt for MFA to reach a mailbox with a stolen password.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'LegacyAuthMailboxAccess'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MailboxRuleExfiltration.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MailboxRuleExfiltration.ps1
new file mode 100644
index 0000000000000..7a6dd2eb242b3
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MailboxRuleExfiltration.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_MailboxRuleExfiltration {
+    <#
+    .SYNOPSIS
+    Security Simulation - Mailbox rule exfiltration
+
+    .DESCRIPTION
+    An attacker with mailbox access sets up inbox rules and forwarding to copy mail out of the tenant automatically.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'MailboxRuleExfiltration'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MaliciousOAuthConsent.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MaliciousOAuthConsent.ps1
new file mode 100644
index 0000000000000..4fe850397b8d6
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MaliciousOAuthConsent.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_MaliciousOAuthConsent {
+    <#
+    .SYNOPSIS
+    Security Simulation - Malicious OAuth app consent
+
+    .DESCRIPTION
+    A user is tricked into consenting to a malicious application, which then reads mail and files through the granted permissions.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'MaliciousOAuthConsent'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MassUserDeletion.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MassUserDeletion.ps1
new file mode 100644
index 0000000000000..c3c6131fdde53
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MassUserDeletion.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_MassUserDeletion {
+    <#
+    .SYNOPSIS
+    Security Simulation - Mass user deletion
+
+    .DESCRIPTION
+    A compromised administrator deletes many user accounts at once to disrupt the business.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'MassUserDeletion'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MfaTampering.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MfaTampering.ps1
new file mode 100644
index 0000000000000..7e0d47693b706
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_MfaTampering.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_MfaTampering {
+    <#
+    .SYNOPSIS
+    Security Simulation - MFA tampering after compromise
+
+    .DESCRIPTION
+    After taking over a privileged account, an attacker strips users' MFA and revokes their sessions to lock in control.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'MfaTampering'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_PasswordSprayNoMfa.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_PasswordSprayNoMfa.ps1
new file mode 100644
index 0000000000000..a6b509e6a6101
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_PasswordSprayNoMfa.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_PasswordSprayNoMfa {
+    <#
+    .SYNOPSIS
+    Security Simulation - Password spray on an account without MFA
+
+    .DESCRIPTION
+    An attacker guesses a common password for an account that has no MFA registered and signs in unchallenged.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'PasswordSprayNoMfa'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_RoleAssignmentEscalation.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_RoleAssignmentEscalation.ps1
new file mode 100644
index 0000000000000..8d0199bd08c19
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_RoleAssignmentEscalation.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_RoleAssignmentEscalation {
+    <#
+    .SYNOPSIS
+    Security Simulation - Privilege escalation by role assignment
+
+    .DESCRIPTION
+    An attacker who took over an account with role-management rights grants itself higher privileges and plants a back-door application.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'RoleAssignmentEscalation'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_SignInOutsideAllowedCountries.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_SignInOutsideAllowedCountries.ps1
new file mode 100644
index 0000000000000..ea97da150de12
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_SignInOutsideAllowedCountries.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_SignInOutsideAllowedCountries {
+    <#
+    .SYNOPSIS
+    Security Simulation - Sign-in from outside allowed countries
+
+    .DESCRIPTION
+    An attacker signs in from a country the organization never operates in and reaches a user's mailbox and files.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'SignInOutsideAllowedCountries'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_StolenTokenReplay.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_StolenTokenReplay.ps1
new file mode 100644
index 0000000000000..9b32ba73d349a
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_StolenTokenReplay.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_StolenTokenReplay {
+    <#
+    .SYNOPSIS
+    Security Simulation - Stolen session token replay
+
+    .DESCRIPTION
+    An attacker replays a session token stolen through a fake sign-in page and signs in as the user without re-entering a password or MFA.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'StolenTokenReplay'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_TransportRuleExfiltration.ps1 b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_TransportRuleExfiltration.ps1
new file mode 100644
index 0000000000000..5439c6a21776f
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/Identity/Invoke-CippTestSecuritySimulation_TransportRuleExfiltration.ps1
@@ -0,0 +1,12 @@
+function Invoke-CippTestSecuritySimulation_TransportRuleExfiltration {
+    <#
+    .SYNOPSIS
+    Security Simulation - Transport-rule exfiltration
+
+    .DESCRIPTION
+    An attacker with Exchange admin rights creates an organization-wide transport rule that blind-copies mail to an outside address.
+    #>
+    param($Tenant)
+
+    Invoke-CippSecuritySimulationTest -Tenant $Tenant -ScenarioId 'TransportRuleExfiltration'
+}
\ No newline at end of file
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/report.json b/Modules/CIPPTests/Public/Tests/SecuritySimulations/report.json
new file mode 100644
index 0000000000000..707bca94aa1a9
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/report.json
@@ -0,0 +1,26 @@
+{
+  "name": "Security Simulations",
+  "description": "Attack scenarios played against the tenant: each test walks one event (a stolen token, a password spray, a malicious inbox rule) step by step and reports whether the tenant prevents it, detects it, or neither, and which standard, Conditional Access policy or alert closes each gap.",
+  "version": "1.0",
+  "source": "CyberDrain",
+  "category": "Security Simulations",
+  "IdentityTests": [
+    "SecuritySimulation_AdminNonCompliantDevice",
+    "SecuritySimulation_AnonymousLinkSensitiveSite",
+    "SecuritySimulation_AuditingOff",
+    "SecuritySimulation_BulkSyncUnmanagedDevice",
+    "SecuritySimulation_DeviceCodePhishing",
+    "SecuritySimulation_GuestReshareSprawl",
+    "SecuritySimulation_GuestWithDirectoryRole",
+    "SecuritySimulation_LegacyAuthMailboxAccess",
+    "SecuritySimulation_MailboxRuleExfiltration",
+    "SecuritySimulation_MaliciousOAuthConsent",
+    "SecuritySimulation_MassUserDeletion",
+    "SecuritySimulation_MfaTampering",
+    "SecuritySimulation_PasswordSprayNoMfa",
+    "SecuritySimulation_RoleAssignmentEscalation",
+    "SecuritySimulation_SignInOutsideAllowedCountries",
+    "SecuritySimulation_StolenTokenReplay",
+    "SecuritySimulation_TransportRuleExfiltration"
+  ]
+}
diff --git a/Modules/CIPPTests/Public/Tests/SecuritySimulations/scenarios.json b/Modules/CIPPTests/Public/Tests/SecuritySimulations/scenarios.json
new file mode 100644
index 0000000000000..13496030fa005
--- /dev/null
+++ b/Modules/CIPPTests/Public/Tests/SecuritySimulations/scenarios.json
@@ -0,0 +1,1403 @@
+[
+  {
+    "id": "AdminNonCompliantDevice",
+    "title": "Global Admin on a non-compliant device",
+    "category": "Identity & Conditional Access",
+    "severity": "Critical",
+    "summary": "A Global Administrator signs in from an unmanaged, non-compliant computer, giving an attacker on that machine full control of the tenant.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "admin",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "An attacker controls a personal, unmanaged computer that a Global Administrator uses, and has the admin's password and MFA approval."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The admin account signs in from the unmanaged Windows machine. Only a device requirement can tell this machine apart from a trusted one.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "deviceInfo": {
+            "isCompliant": false
+          }
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "Admins are not required to use a compliant device, so any machine can hold an admin session.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Require a compliant device for administrators"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: administrators must use a compliant device, so the unmanaged machine cannot hold the session."
+      },
+      {
+        "id": "PortalAccess",
+        "title": "Admin portals opened",
+        "text": "The attacker opens the admin centers and reviews users, roles and licensing. Nothing is changed yet, so the session looks like routine administration.",
+        "whenFixed": "A shorter idle timeout ends the abandoned admin session before it can be misused.",
+        "standards": [
+          {
+            "name": "ActivityBasedTimeout",
+            "role": "limits"
+          }
+        ]
+      },
+      {
+        "id": "RoleGrant",
+        "title": "New administrator created",
+        "text": "The attacker adds a second account to a privileged role so access survives a password reset. This creates a standing back door into the tenant.",
+        "alerts": [
+          {
+            "operation": "Add member to role.",
+            "logbook": "Audit.AzureActiveDirectory",
+            "preset": "Add member to role."
+          }
+        ],
+        "whenFixed": "The role change is written to the audit log and surfaces for review.",
+        "standards": [
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "The admin session is refused on the unmanaged device, so the attacker never reaches the admin centers.",
+      "notPrevented": "The attacker gains lasting tenant-wide control through a hidden second administrator."
+    }
+  },
+  {
+    "id": "AnonymousLinkSensitiveSite",
+    "title": "Anyone link on a sensitive site",
+    "category": "SharePoint & Data",
+    "severity": "High",
+    "summary": "An attacker creates an Anyone link on a sensitive SharePoint site so files can be downloaded without signing in.",
+    "requiredCapabilities": [
+      "SHAREPOINTENTERPRISE"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker controls an account with access to a sensitive site and wants to move data out with as little friction as possible."
+      },
+      {
+        "id": "CreateLink",
+        "title": "Anyone link created",
+        "text": "The attacker creates an Anyone link that grants access to files without any sign-in. The link can be shared or sold freely.",
+        "whenFixed": "Anonymous sharing is disabled, so no Anyone link can be created, and the attempt is recorded.",
+        "standards": [
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          },
+          {
+            "name": "DefaultSharingLink",
+            "role": "limits"
+          },
+          {
+            "name": "sharingCapability",
+            "role": "prevents"
+          },
+          {
+            "name": "SPAnonymousLinkExpiration",
+            "role": "limits"
+          }
+        ]
+      },
+      {
+        "id": "Access",
+        "title": "Files downloaded through the link",
+        "text": "Anyone holding the link downloads the files without authenticating. There is no record of who took the data.",
+        "whenFixed": "A short expiry on Anyone links narrows the window in which the link works.",
+        "standards": [
+          {
+            "name": "SPAnonymousLinkExpiration",
+            "role": "limits"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "Anonymous sharing is refused, so a no-sign-in link is never created.",
+      "notPrevented": "Sensitive files are downloadable by anyone who receives the link."
+    }
+  },
+  {
+    "id": "AuditingOff",
+    "title": "Silent tenant: auditing turned off",
+    "category": "Audit & Detection",
+    "severity": "High",
+    "summary": "With the Unified Audit Log disabled, an attacker acts inside the tenant knowing that key actions leave no usable trail.",
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker has taken over an account and finds that the Unified Audit Log is turned off. Actions will not be recorded for later investigation."
+      },
+      {
+        "id": "DisableCheck",
+        "title": "No audit trail confirmed",
+        "text": "The attacker confirms that sign-ins and admin actions are not being logged. This removes the main record responders would rely on.",
+        "whenFixed": "The Unified Audit Log is on, so every following action is recorded for investigation.",
+        "standards": [
+          {
+            "name": "AnonReportDisable",
+            "role": "detects"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "MailboxAccess",
+        "title": "Mailbox read without a trace",
+        "text": "The attacker opens the mailbox and searches for valuable mail. With mailbox auditing off, the access leaves little evidence.",
+        "whenFixed": "Mailbox auditing records the access even when the attacker expects silence.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "Exfiltration",
+        "title": "Mail forwarded out",
+        "text": "The attacker adds a rule that forwards new mail to an external address, assuming the change will go unseen.",
+        "alerts": [
+          {
+            "operation": "New-InboxRule",
+            "logbook": "Audit.Exchange",
+            "preset": "New-InboxRuleForward"
+          }
+        ],
+        "whenFixed": "External forwarding is blocked and, with the audit log on, the rule creation raises an alert.",
+        "standards": [
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "With auditing on, every step is recorded and the forwarding rule is blocked and alerted.",
+      "notPrevented": "The attacker reads and forwards mail with almost no trace left behind."
+    }
+  },
+  {
+    "id": "BulkSyncUnmanagedDevice",
+    "title": "Bulk sync to an unmanaged device",
+    "category": "SharePoint & Data",
+    "severity": "High",
+    "summary": "A compromised user syncs entire document libraries to a personal, unmanaged computer, copying company data off managed systems.",
+    "requiredCapabilities": [
+      "SHAREPOINTENTERPRISE"
+    ],
+    "persona": "user",
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker controls a user's account and signs in from a personal, unmanaged computer to collect data."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The attacker connects the OneDrive client from an unmanaged Windows machine. Only an unmanaged-device control can limit what the sync client can pull.",
+        "whatIf": {
+          "clientAppType": "mobileAppsAndDesktopClients",
+          "devicePlatform": "windows",
+          "deviceInfo": {
+            "isCompliant": false
+          }
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "Access from unmanaged devices is not restricted, so the sync client can copy whole libraries.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Block downloads on unmanaged devices for SharePoint and OneDrive"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: unmanaged devices are limited to web-only access, so the sync client cannot download.",
+        "standards": [
+          {
+            "name": "unmanagedSync",
+            "role": "prevents"
+          }
+        ]
+      },
+      {
+        "id": "Sync",
+        "title": "Libraries copied to the local disk",
+        "text": "The attacker syncs entire libraries to the personal machine, pulling documents off managed systems. The data now sits outside the tenant's controls.",
+        "whenFixed": "The sync button is disabled and the copied data is limited by sync restrictions.",
+        "standards": [
+          {
+            "name": "ExcludedfileExt",
+            "role": "limits"
+          },
+          {
+            "name": "SPSyncButtonState",
+            "role": "limits"
+          },
+          {
+            "name": "unmanagedSync",
+            "role": "prevents"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "Unmanaged devices are held to web-only access, so libraries cannot be synced off.",
+      "notPrevented": "Whole libraries land on a personal machine beyond the reach of tenant controls."
+    }
+  },
+  {
+    "id": "DeviceCodePhishing",
+    "title": "Device-code phishing",
+    "category": "Identity & Conditional Access",
+    "severity": "High",
+    "summary": "An attacker tricks a user into approving a device-code sign-in and receives a fully authenticated token that already includes the MFA claim.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "user",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker starts a device-code sign-in and sends the code to the user with a convincing message. The user enters the code and approves it."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The device-code flow completes and hands the attacker a token that already satisfies MFA. Only a policy that blocks this flow can stop it.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "authenticationFlow": {
+            "transferMethod": "deviceCodeFlow"
+          },
+          "country": "DE",
+          "ipAddress": "185.220.100.8"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "Device code flow is not blocked, so a phished code becomes a working token.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Block device code flow sign-ins"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: device code flow is refused, so the phished code cannot become a token."
+      },
+      {
+        "id": "TokenUse",
+        "title": "Token used to read mail and files",
+        "text": "The attacker uses the token to read the user's mailbox and documents. The traffic looks like a normal signed-in app.",
+        "whenFixed": "Mailbox auditing records the access even though the sign-in looked legitimate."
+      },
+      {
+        "id": "Persistence",
+        "title": "Inbox rule created for ongoing reach",
+        "text": "The attacker adds an inbox rule to keep receiving the user's mail. This keeps a copy flowing after the token expires.",
+        "alerts": [
+          {
+            "operation": "New-InboxRule",
+            "logbook": "Audit.Exchange",
+            "preset": "New-InboxRule"
+          }
+        ],
+        "whenFixed": "The rule creation raises an alert and external delivery is blocked.",
+        "standards": [
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "The device-code sign-in is refused, so the phished code is useless.",
+      "notPrevented": "The attacker reads mail and files and sets up an inbox rule to keep access."
+    }
+  },
+  {
+    "id": "GuestReshareSprawl",
+    "title": "Guest re-share sprawl",
+    "category": "SharePoint & Data",
+    "severity": "Medium",
+    "summary": "A guest re-shares files they were given, spreading access to more outsiders than the owner intended.",
+    "requiredCapabilities": [
+      "SHAREPOINTENTERPRISE"
+    ],
+    "persona": "guest",
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "A guest was shared a folder for a project and can re-share it. The attacker controls that guest account."
+      },
+      {
+        "id": "Reshare",
+        "title": "Files re-shared to more outsiders",
+        "text": "The guest shares the files onward to additional external people. Access now reaches people the owner never approved.",
+        "whenFixed": "External users cannot re-share, so access does not spread beyond the owner's intent.",
+        "standards": [
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          },
+          {
+            "name": "DisableReshare",
+            "role": "prevents"
+          },
+          {
+            "name": "sharingDomainRestriction",
+            "role": "limits"
+          },
+          {
+            "name": "SPGuestPeoplePicker",
+            "role": "limits"
+          }
+        ]
+      },
+      {
+        "id": "Sprawl",
+        "title": "Access spreads beyond control",
+        "text": "Each new recipient can potentially share again, widening exposure. The owner loses track of who can reach the data.",
+        "whenFixed": "Automatic guest-access expiry removes stale external access before it spreads far.",
+        "standards": [
+          {
+            "name": "SPExternalUserExpiration",
+            "role": "limits"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "Re-sharing by external users is blocked, so access stays with the people the owner chose.",
+      "notPrevented": "The files spread to an unknown set of outsiders through repeated re-sharing."
+    }
+  },
+  {
+    "id": "GuestWithDirectoryRole",
+    "title": "Guest account holding a directory role",
+    "category": "Identity & Conditional Access",
+    "severity": "High",
+    "summary": "A guest account that was granted a directory role is used to read the directory and hand privileged access to another account.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "guest",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "A guest account was given a directory role during a project and never removed. The attacker controls that guest account."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The guest signs in through a browser and its role rights come along. Only guest-focused controls treat this account differently from a normal member.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "country": "NL",
+          "ipAddress": "185.220.101.9"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "Guest sign-ins are not restricted, so an external account can carry a privileged role.",
+            "role": "limits",
+            "fix": {
+              "caTemplate": "Restrict guest access with Conditional Access"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: guest access is restricted, so the external account cannot use its role.",
+        "standards": [
+          {
+            "name": "DisableGuests",
+            "role": "limits"
+          },
+          {
+            "name": "GuestInvite",
+            "role": "prevents"
+          }
+        ]
+      },
+      {
+        "id": "Enumerate",
+        "title": "Directory read",
+        "text": "The attacker lists users, groups and roles to map the organization. This makes it easy to choose high-value targets.",
+        "whenFixed": "Guest directory access is restricted, so the account cannot enumerate other users.",
+        "standards": [
+          {
+            "name": "DisableGuestDirectory",
+            "role": "prevents"
+          }
+        ]
+      },
+      {
+        "id": "RoleAbuse",
+        "title": "Another account promoted",
+        "text": "The attacker adds a second account to a privileged role to keep control if the guest is removed. This creates a standing back door.",
+        "alerts": [
+          {
+            "operation": "Add member to role.",
+            "logbook": "Audit.AzureActiveDirectory",
+            "preset": "Add member to role."
+          }
+        ],
+        "whenFixed": "The role change is written to the audit log and surfaces for review.",
+        "standards": [
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "Guest restrictions and directory limits stop the external account from reading or escalating.",
+      "notPrevented": "The attacker maps the tenant and plants a second privileged account."
+    }
+  },
+  {
+    "id": "LegacyAuthMailboxAccess",
+    "title": "Legacy authentication mailbox access",
+    "category": "Identity & Conditional Access",
+    "severity": "High",
+    "summary": "An attacker uses an older mail protocol that cannot prompt for MFA to reach a mailbox with a stolen password.",
+    "requiredCapabilities": [
+      "EXCHANGE_S_ENTERPRISE"
+    ],
+    "persona": "user",
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker has the user's password and connects with a legacy protocol that only supports password sign-in. MFA cannot be requested on that path."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The attacker authenticates with a legacy client, which never triggers an MFA prompt. Only blocking legacy authentication closes this path.",
+        "whatIf": {
+          "clientAppType": "other",
+          "devicePlatform": "windows",
+          "country": "NL",
+          "ipAddress": "91.219.236.10"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "Legacy authentication is still allowed, so a password alone reaches the mailbox.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Block legacy authentication"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: legacy authentication is refused, so the password-only client cannot connect.",
+        "standards": [
+          {
+            "name": "SecurityDefaults",
+            "role": "prevents"
+          },
+          {
+            "name": "DisableBasicAuthSMTP",
+            "role": "prevents"
+          }
+        ]
+      },
+      {
+        "id": "MailboxAccess",
+        "title": "Mailbox downloaded",
+        "text": "The attacker pulls mail through the legacy protocol, reading recent messages and attachments. The connection looks like an old mail client.",
+        "whenFixed": "Mailbox auditing records the legacy access for responders.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "Exfiltration",
+        "title": "External forwarding turned on",
+        "text": "The attacker configures mailbox forwarding to an outside address so new mail is copied automatically. Access continues even if the password changes.",
+        "alerts": [
+          {
+            "operation": "Set-Mailbox",
+            "logbook": "Audit.Exchange",
+            "preset": "Set-MailboxForwardingExternal"
+          }
+        ],
+        "whenFixed": "External forwarding is blocked and the change raises an alert.",
+        "standards": [
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "Legacy authentication is refused, so the stolen password cannot open the mailbox.",
+      "notPrevented": "The attacker reads the mailbox and forwards its mail out of the tenant."
+    }
+  },
+  {
+    "id": "MailboxRuleExfiltration",
+    "title": "Mailbox rule exfiltration",
+    "category": "Exchange & Email",
+    "severity": "High",
+    "summary": "An attacker with mailbox access sets up inbox rules and forwarding to copy mail out of the tenant automatically.",
+    "requiredCapabilities": [
+      "EXCHANGE_S_ENTERPRISE"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker already has access to a user's mailbox and wants a quiet, ongoing copy of incoming mail."
+      },
+      {
+        "id": "InboxRule",
+        "title": "Forwarding inbox rule created",
+        "text": "The attacker creates an inbox rule that forwards new mail to an outside address and hides it in a rarely-seen folder. Mail now leaves the mailbox on arrival.",
+        "alerts": [
+          {
+            "operation": "New-InboxRule",
+            "logbook": "Audit.Exchange",
+            "preset": "New-InboxRuleForward"
+          }
+        ],
+        "whenFixed": "External forwarding is blocked and the rule creation raises an alert.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          },
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "MailboxForward",
+        "title": "Mailbox forwarding enabled",
+        "text": "The attacker also turns on mailbox-level forwarding as a backup path. Even if the rule is removed, copies keep flowing out.",
+        "alerts": [
+          {
+            "operation": "Set-Mailbox",
+            "logbook": "Audit.Exchange",
+            "preset": "Set-MailboxForwardingExternal"
+          }
+        ],
+        "whenFixed": "External forwarding is blocked and the outbound spam alert flags the sudden external flow.",
+        "standards": [
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          },
+          {
+            "name": "OutBoundSpamAlert",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "External forwarding is refused, so no mail leaves the tenant and the attempts are alerted.",
+      "notPrevented": "Every incoming message is copied to the attacker for as long as the rules survive."
+    }
+  },
+  {
+    "id": "MaliciousOAuthConsent",
+    "title": "Malicious OAuth app consent",
+    "category": "Identity & Conditional Access",
+    "severity": "High",
+    "summary": "A user is tricked into consenting to a malicious application, which then reads mail and files through the granted permissions.",
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker sends a convincing link asking the user to grant an application access to their data. The user clicks through the consent screen."
+      },
+      {
+        "id": "Consent",
+        "title": "Consent granted to the application",
+        "text": "The user approves the application, which is added to the tenant and receives standing access to mail and files. No password is needed again.",
+        "alerts": [
+          {
+            "operation": "Add service principal.",
+            "logbook": "Audit.AzureActiveDirectory",
+            "preset": "Add service principal."
+          }
+        ],
+        "whenFixed": "User consent is routed to admin approval, so the malicious app is never granted access.",
+        "standards": [
+          {
+            "name": "AppManagementPolicy",
+            "role": "limits"
+          },
+          {
+            "name": "EnableAppConsentRequests",
+            "role": "prevents"
+          },
+          {
+            "name": "OauthConsent",
+            "role": "prevents"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "MailAccess",
+        "title": "Mail and files read through the app",
+        "text": "The app reads the user's mailbox and documents using the permissions it was given. The access continues without any further sign-in.",
+        "whenFixed": "Mailbox auditing records the app's access for responders to review.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "The consent request is held for admin approval, so the malicious app never gains access.",
+      "notPrevented": "The attacker's app reads mail and files quietly for as long as the grant remains."
+    }
+  },
+  {
+    "id": "MassUserDeletion",
+    "title": "Mass user deletion",
+    "category": "Audit & Detection",
+    "severity": "High",
+    "summary": "A compromised administrator deletes many user accounts at once to disrupt the business.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "admin",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker controls an account with user-management rights and intends to cause maximum disruption."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The account signs in from an unfamiliar address before the deletions begin. Strong sign-in controls are the last chance to stop it.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "country": "NL",
+          "ipAddress": "185.220.101.60"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "MFA is not enforced, so a stolen password reaches user management.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Require multifactor authentication for all users"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: MFA is required, so the stolen password cannot reach user management.",
+        "standards": [
+          {
+            "name": "PerUserMFA",
+            "role": "prevents"
+          },
+          {
+            "name": "SecurityDefaults",
+            "role": "prevents"
+          }
+        ]
+      },
+      {
+        "id": "DeleteUsers",
+        "title": "Accounts deleted in bulk",
+        "text": "The attacker deletes many accounts quickly, cutting off sign-in and mail for those users. The business impact is immediate.",
+        "alerts": [
+          {
+            "operation": "Delete user",
+            "logbook": "Audit.AzureActiveDirectory"
+          }
+        ],
+        "whenFixed": "Each deletion is written to the audit log, so the burst is detected quickly.",
+        "standards": [
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "Recover",
+        "title": "Recovery window",
+        "text": "Deleted accounts and their data can be restored for a limited time. The faster the burst is noticed, the more can be recovered.",
+        "whenFixed": "Retention of deleted users' OneDrive data keeps their files recoverable during the window.",
+        "standards": [
+          {
+            "name": "DeletedUserRentention",
+            "role": "recovers"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "MFA stops the takeover, so no accounts are deleted.",
+      "notPrevented": "Many users lose access at once, and only prompt detection limits the damage."
+    }
+  },
+  {
+    "id": "MfaTampering",
+    "title": "MFA tampering after compromise",
+    "category": "Audit & Detection",
+    "severity": "Critical",
+    "summary": "After taking over a privileged account, an attacker strips users' MFA and revokes their sessions to lock in control.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "admin",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker controls a privileged account that can manage other users' authentication methods."
+      },
+      {
+        "id": "DisableMfa",
+        "title": "Victims' MFA removed",
+        "text": "The attacker disables strong authentication on target accounts so they can be signed into with passwords alone. This weakens the accounts for later use.",
+        "alerts": [
+          {
+            "operation": "Disable Strong Authentication.",
+            "logbook": "Audit.AzureActiveDirectory",
+            "preset": "Disable Strong Authentication."
+          }
+        ],
+        "whenFixed": "The change is written to the audit log and re-enforced MFA restores protection.",
+        "standards": [
+          {
+            "name": "PerUserMFA",
+            "role": "recovers"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "RevokeSessions",
+        "title": "Existing sessions revoked",
+        "text": "The attacker revokes the users' sessions to force fresh sign-ins on the weakened accounts. This helps push out the legitimate users.",
+        "alerts": [
+          {
+            "operation": "Update StsRefreshTokenValidFrom Timestamp.",
+            "logbook": "Audit.AzureActiveDirectory",
+            "preset": "Update StsRefreshTokenValidFrom Timestamp."
+          }
+        ],
+        "whenFixed": "The session revocation is written to the audit log and surfaces for review.",
+        "standards": [
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "ReRegister",
+        "title": "Attacker registers its own MFA",
+        "text": "The attacker registers a new authentication method it controls on a target account. This gives durable access under the attacker's own factor.",
+        "whenFixed": "Method controls limit what can be registered and suspicious-activity reporting flags the change.",
+        "standards": [
+          {
+            "name": "AuthenticationMethods",
+            "role": "prevents"
+          },
+          {
+            "name": "AuthMethodsSettings",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "MFA policy re-enforces protection and every change is recorded and reviewable.",
+      "notPrevented": "The attacker holds weakened accounts under its own MFA method."
+    }
+  },
+  {
+    "id": "PasswordSprayNoMfa",
+    "title": "Password spray on an account without MFA",
+    "category": "Identity & Conditional Access",
+    "severity": "High",
+    "summary": "An attacker guesses a common password for an account that has no MFA registered and signs in unchallenged.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM_P2"
+    ],
+    "persona": "user",
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker tries a handful of common passwords against many accounts at a slow pace to avoid lockouts. One targeted account has never registered MFA."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "A sprayed password matches and the account signs in. With no MFA registered, only password and risk controls stand in the way.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "signInRiskLevel": "high",
+          "country": "US",
+          "ipAddress": "104.244.72.115"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "The account has no MFA, so a correct password alone grants access.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Require multifactor authentication for all users"
+            }
+          },
+          {
+            "when": [
+              "allowed"
+            ],
+            "text": "No sign-in risk policy, so the high-risk sign-in is not challenged.",
+            "role": "detects",
+            "requiredCapabilities": [
+              "AAD_PREMIUM_P2"
+            ],
+            "fix": {
+              "caTemplate": "Require multifactor authentication for medium and high sign-in risk"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: MFA is required, so the guessed password alone is not enough.",
+        "standards": [
+          {
+            "name": "CustomBannedPasswordList",
+            "role": "prevents"
+          },
+          {
+            "name": "PerUserMFA",
+            "role": "prevents"
+          },
+          {
+            "name": "SecurityDefaults",
+            "role": "prevents"
+          },
+          {
+            "name": "SmartLockout",
+            "role": "limits"
+          }
+        ]
+      },
+      {
+        "id": "AccountTakeover",
+        "title": "Account explored",
+        "text": "The attacker reads the mailbox and shared files to learn the business and find more targets. Nothing is changed, so the sign-in looks ordinary.",
+        "whenFixed": "Mailbox auditing records the access so the takeover can be spotted.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "Persistence",
+        "title": "Mail forwarded out",
+        "text": "The attacker creates a rule that forwards new mail to an outside address. This gives quiet, lasting access to the conversation.",
+        "alerts": [
+          {
+            "operation": "New-InboxRule",
+            "logbook": "Audit.Exchange",
+            "preset": "New-InboxRuleForward"
+          }
+        ],
+        "whenFixed": "External forwarding is blocked and the rule creation raises an alert.",
+        "standards": [
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "MFA and lockout controls stop the guessed password from granting access.",
+      "notPrevented": "The attacker takes over the account and forwards its mail out of the tenant."
+    }
+  },
+  {
+    "id": "RoleAssignmentEscalation",
+    "title": "Privilege escalation by role assignment",
+    "category": "Identity & Conditional Access",
+    "severity": "Critical",
+    "summary": "An attacker who took over an account with role-management rights grants itself higher privileges and plants a back-door application.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "user",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker has taken over a help-desk account that can manage group membership and role assignments."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The account signs in from an unfamiliar address at medium risk. Strong sign-in controls are the last chance to stop it before privileges are changed.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "signInRiskLevel": "medium",
+          "country": "NL",
+          "ipAddress": "185.220.101.33"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "MFA is not enforced for this account, so a stolen password reaches role management.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Require multifactor authentication for all users"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: MFA is required, so the stolen password cannot reach role management.",
+        "standards": [
+          {
+            "name": "PerUserMFA",
+            "role": "prevents"
+          },
+          {
+            "name": "SecurityDefaults",
+            "role": "prevents"
+          }
+        ]
+      },
+      {
+        "id": "RoleGrant",
+        "title": "Privileged role granted",
+        "text": "The attacker adds its account to a privileged role, gaining tenant-wide control. The change takes effect immediately.",
+        "alerts": [
+          {
+            "operation": "Add member to role.",
+            "logbook": "Audit.AzureActiveDirectory",
+            "preset": "Add member to role."
+          }
+        ],
+        "whenFixed": "The role change is written to the audit log and surfaces for review.",
+        "standards": [
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "Persistence",
+        "title": "Back-door application added",
+        "text": "The attacker registers a hidden application with broad permissions so access survives password and role cleanup. The application acts on its own, without a user present.",
+        "alerts": [
+          {
+            "operation": "Add service principal.",
+            "logbook": "Audit.AzureActiveDirectory",
+            "preset": "Add service principal."
+          }
+        ],
+        "whenFixed": "Consent and application-credential controls stop the back-door app from being usable.",
+        "standards": [
+          {
+            "name": "AppManagementPolicy",
+            "role": "limits"
+          },
+          {
+            "name": "OauthConsent",
+            "role": "prevents"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "MFA stops the takeover before any role can be changed.",
+      "notPrevented": "The attacker gains tenant-wide control and hides a back-door application."
+    }
+  },
+  {
+    "id": "SignInOutsideAllowedCountries",
+    "title": "Sign-in from outside allowed countries",
+    "category": "Identity & Conditional Access",
+    "severity": "High",
+    "summary": "An attacker signs in from a country the organization never operates in and reaches a user's mailbox and files.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "user",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker has the user's password and can approve MFA through a phished prompt. The organization only works from a small set of countries."
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The attacker connects from an address in Russia. Only a location control can tell this apart from an ordinary sign-in.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "country": "RU",
+          "ipAddress": "45.132.1.20"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "No location policy, so sign-ins from countries the business never uses are allowed.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Block sign-ins from countries outside the allowed list"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: the sign-in comes from a country outside the allowed list and is refused."
+      },
+      {
+        "id": "MailboxAccess",
+        "title": "Mailbox opened and read",
+        "text": "The attacker reads recent mail and searches for finance and reset messages. The session behaves like the real user, so nothing looks out of place.",
+        "whenFixed": "Mailbox auditing records the foreign-location access for responders to catch.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          },
+          {
+            "name": "ActivityBasedTimeout",
+            "role": "limits"
+          }
+        ]
+      },
+      {
+        "id": "Forwarding",
+        "title": "Mail forwarded outside the tenant",
+        "text": "The attacker creates an inbox rule that forwards new mail to an external address. Copies now leave the tenant automatically.",
+        "alerts": [
+          {
+            "operation": "New-InboxRule",
+            "logbook": "Audit.Exchange",
+            "preset": "New-InboxRuleForward"
+          }
+        ],
+        "whenFixed": "External forwarding is blocked and the rule creation raises an alert.",
+        "standards": [
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "The foreign sign-in is refused, so the mailbox is never opened.",
+      "notPrevented": "The attacker reads the mailbox and quietly forwards mail out of the tenant."
+    }
+  },
+  {
+    "id": "StolenTokenReplay",
+    "title": "Stolen session token replay",
+    "category": "Identity & Conditional Access",
+    "severity": "Critical",
+    "summary": "An attacker replays a session token stolen through a fake sign-in page and signs in as the user without re-entering a password or MFA.",
+    "requiredCapabilities": [
+      "AAD_PREMIUM"
+    ],
+    "persona": "user",
+    "attackerCanSatisfy": [
+      "mfa"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker has captured a valid session token from the user through a fake sign-in page that relayed the real one. The token still carries the multifactor approval the user completed.",
+        "whenFixed": "The Check browser extension recognises the fake sign-in page and blocks it, so no token is captured in the first place.",
+        "standards": [
+          {
+            "name": "DeployCheckChromeExtension",
+            "role": "prevents"
+          }
+        ]
+      },
+      {
+        "id": "SignIn",
+        "title": "Sign-in evaluated by Conditional Access",
+        "text": "The attacker replays the token from an unmanaged Windows browser on a hosting-provider address. Because the token already carries MFA, only device and risk controls can still stop the session.",
+        "whatIf": {
+          "clientAppType": "browser",
+          "devicePlatform": "windows",
+          "deviceInfo": {
+            "isCompliant": false
+          },
+          "signInRiskLevel": "medium",
+          "country": "NL",
+          "ipAddress": "185.220.101.47"
+        },
+        "gaps": [
+          {
+            "when": [
+              "allowed",
+              "weakGrant"
+            ],
+            "text": "No compliant-device requirement, so a replayed token from any machine is accepted.",
+            "role": "prevents",
+            "fix": {
+              "caTemplate": "Require a compliant or Microsoft Entra hybrid joined device"
+            }
+          },
+          {
+            "when": [
+              "allowed"
+            ],
+            "text": "No sign-in risk policy, so the medium-risk replay is not challenged.",
+            "role": "detects",
+            "requiredCapabilities": [
+              "AAD_PREMIUM_P2"
+            ],
+            "fix": {
+              "caTemplate": "Require multifactor authentication for medium and high sign-in risk"
+            }
+          }
+        ],
+        "stopsChainWhen": "blocked",
+        "whenFixed": "Blocked: the device is not compliant, so the replayed token is refused.",
+        "standards": [
+          {
+            "name": "PhishProtection",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "MailboxSearch",
+        "title": "Mailbox searched for valuable mail",
+        "text": "The attacker opens the mailbox and searches for invoices, payroll and password-reset messages. Nothing is changed yet, so the activity looks like normal browsing.",
+        "whenFixed": "Mailbox auditing records the search, giving responders an early signal of takeover.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          },
+          {
+            "name": "ActivityBasedTimeout",
+            "role": "limits"
+          }
+        ]
+      },
+      {
+        "id": "Persistence",
+        "title": "Forwarding set up for ongoing access",
+        "text": "The attacker creates an inbox rule and turns on mailbox forwarding so copies of new mail reach an outside address. This keeps the attacker informed even after the token expires.",
+        "alerts": [
+          {
+            "operation": "New-InboxRule",
+            "logbook": "Audit.Exchange",
+            "preset": "New-InboxRule"
+          },
+          {
+            "operation": "Set-Mailbox",
+            "logbook": "Audit.Exchange",
+            "preset": "Set-MailboxForwardingExternal"
+          }
+        ],
+        "whenFixed": "External forwarding is blocked by policy and the rule creation raises an alert.",
+        "standards": [
+          {
+            "name": "EnableMailboxAuditing",
+            "role": "detects"
+          },
+          {
+            "name": "EXODisableAutoForwarding",
+            "role": "prevents"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "The replayed token is refused at sign-in because the device is not compliant, and the takeover never starts.",
+      "notPrevented": "The attacker reads and quietly forwards mail for as long as the stolen token and forwarding rule survive."
+    }
+  },
+  {
+    "id": "TransportRuleExfiltration",
+    "title": "Transport-rule exfiltration",
+    "category": "Exchange & Email",
+    "severity": "High",
+    "summary": "An attacker with Exchange admin rights creates an organization-wide transport rule that blind-copies mail to an outside address.",
+    "requiredCapabilities": [
+      "EXCHANGE_S_ENTERPRISE"
+    ],
+    "steps": [
+      {
+        "id": "Assumption",
+        "title": "Starting assumption",
+        "text": "The attacker controls an Exchange administrator account and wants to capture mail across the whole organization at once."
+      },
+      {
+        "id": "TransportRule",
+        "title": "Organization-wide transport rule created",
+        "text": "The attacker creates a transport rule that blind-copies messages to an external address for every mailbox. One change captures the entire mail flow.",
+        "alerts": [
+          {
+            "operation": "New-TransportRule",
+            "logbook": "Audit.Exchange"
+          }
+        ],
+        "whenFixed": "The rule creation is written to the audit log and surfaces for review.",
+        "standards": [
+          {
+            "name": "DisableExchangeOnlinePowerShell",
+            "role": "limits"
+          },
+          {
+            "name": "AuditLog",
+            "role": "detects"
+          }
+        ]
+      },
+      {
+        "id": "Exfiltration",
+        "title": "Company mail copied out",
+        "text": "Mail for all users is now silently copied to the attacker. The volume of external mail rises sharply.",
+        "whenFixed": "The outbound spam alert flags the surge of external mail so responders can act.",
+        "standards": [
+          {
+            "name": "OutBoundSpamAlert",
+            "role": "detects"
+          }
+        ]
+      }
+    ],
+    "outcome": {
+      "prevented": "The transport-rule change is recorded and the external surge is alerted for fast removal.",
+      "notPrevented": "All company mail is copied out of the tenant through a single hidden rule."
+    }
+  }
+]
diff --git a/Modules/CippExtensions/Private/Hudu/Get-HuduLinkBlock.ps1 b/Modules/CippExtensions/Private/Hudu/Get-HuduLinkBlock.ps1
index 69bc48342d063..60653a1589971 100644
--- a/Modules/CippExtensions/Private/Hudu/Get-HuduLinkBlock.ps1
+++ b/Modules/CippExtensions/Private/Hudu/Get-HuduLinkBlock.ps1
@@ -1,3 +1,7 @@
 function Get-HuduLinkBlock($URL, $Icon, $Title) {
-    return '<button class="button" style="background-color: var(--primary)" role="button"><a style="color: white;" role="button" href="{0}" target="_blank"><i class="{1} me-2"></i>{2}</a></button>' -f $URL, $Icon, $Title
+    # Background and text colour are set together on the same element with fixed values.
+    # Hudu does not define the --primary CSS variable in either theme, so the previous button
+    # background never rendered and the hard-coded white link text was invisible in light mode.
+    $Style = 'display: inline-block; margin: 0 .25rem .25rem 0; padding: .375rem .75rem; border-radius: .25rem; background-color: #1f6feb; color: #ffffff; text-decoration: none; white-space: nowrap;'
+    return '<a class="button" role="button" style="{0}" href="{1}" target="_blank"><i class="{2} me-2"></i>{3}</a>' -f $Style, $URL, $Icon, $Title
 }
diff --git a/Modules/CippExtensions/Public/Extension Functions/Add-HuduAssetLayoutField.ps1 b/Modules/CippExtensions/Public/Extension Functions/Add-HuduAssetLayoutField.ps1
index 8669019b33217..6028619e14b6c 100644
--- a/Modules/CippExtensions/Public/Extension Functions/Add-HuduAssetLayoutField.ps1	
+++ b/Modules/CippExtensions/Public/Extension Functions/Add-HuduAssetLayoutField.ps1	
@@ -1,13 +1,23 @@
 function Add-HuduAssetLayoutField {
-    Param(
-        $AssetLayoutId,
-        $Label = 'Microsoft 365',
-        $FieldType = 'RichText',
-        $Position = 0,
-        $ShowInList = $false
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [int]$AssetLayoutId,
+
+        [Parameter(Mandatory = $false)]
+        [string]$Label = 'Microsoft 365',
+
+        [Parameter(Mandatory = $false)]
+        [string]$FieldType = 'RichText',
+
+        [Parameter(Mandatory = $false)]
+        [int]$Position = 0,
+
+        [Parameter(Mandatory = $false)]
+        [bool]$ShowInList = $false
     )
 
-    $M365Field = @{
+    $DesiredField = @{
         position     = $Position
         label        = $Label
         field_type   = $FieldType
@@ -16,17 +26,47 @@ function Add-HuduAssetLayoutField {
         expiration   = $false
     }
 
-    $AssetLayout = Get-HuduAssetLayouts -LayoutId $AssetLayoutId
+    $AssetLayout = Get-HuduAssetLayouts -LayoutId $AssetLayoutId -ErrorAction Stop
 
-    if ($AssetLayout.fields.label -contains $Label) {
-        return $AssetLayout
+    $AssetLayoutFields = [System.Collections.Generic.List[object]]::new()
+    $ExistingField = $AssetLayout.fields | Where-Object { $_.label -eq $Label } | Select-Object -First 1
+    if ($ExistingField) {
+        if ($ExistingField -is [System.Collections.IDictionary]) {
+            foreach ($Key in $ExistingField.Keys) { $DesiredField[$Key] = $ExistingField[$Key] }
+        } else {
+            foreach ($Property in $ExistingField.PSObject.Properties) { $DesiredField[$Property.Name] = $Property.Value }
+        }
+        $DesiredField.position = $Position
+        $DesiredField.field_type = $FieldType
+        $DesiredField.show_in_list = $ShowInList
     }
 
-    $AssetLayoutFields = [System.Collections.Generic.List[object]]::new()
-    $AssetLayoutFields.Add($M365Field)
-    foreach ($Field in $AssetLayout.fields) {
-        $Field.position++
-        $AssetLayoutFields.Add($Field)
+    $RemainingFields = @($AssetLayout.fields | Where-Object { $_.label -ne $Label } | Sort-Object position)
+    $InsertAt = [Math]::Min([Math]::Max(0, [int]$Position), $RemainingFields.Count)
+    for ($Index = 0; $Index -le $RemainingFields.Count; $Index++) {
+        if ($Index -eq $InsertAt) { [void]$AssetLayoutFields.Add($DesiredField) }
+        if ($Index -lt $RemainingFields.Count) {
+            $Field = $RemainingFields[$Index]
+            $LayoutField = @{}
+            if ($Field -is [System.Collections.IDictionary]) {
+                foreach ($Key in $Field.Keys) { $LayoutField[$Key] = $Field[$Key] }
+            } else {
+                foreach ($Property in $Field.PSObject.Properties) { $LayoutField[$Property.Name] = $Property.Value }
+            }
+            [void]$AssetLayoutFields.Add($LayoutField)
+        }
     }
-    Set-HuduAssetLayout -Id $AssetLayoutId -Fields $AssetLayoutFields
+
+    for ($Index = 0; $Index -lt $AssetLayoutFields.Count; $Index++) {
+        $AssetLayoutFields[$Index].position = $Index
+    }
+
+    if ($ExistingField -and [int]$ExistingField.position -eq $InsertAt -and
+        [string]$ExistingField.field_type -eq $FieldType -and
+        [bool]$ExistingField.show_in_list -eq [bool]$ShowInList) {
+        return $AssetLayout
+    }
+
+    $Result = Set-HuduAssetLayout -Id $AssetLayoutId -Fields $AssetLayoutFields -ErrorAction Stop
+    return $Result
 }
diff --git a/Modules/CippExtensions/Public/Gradient/New-GradientServiceSyncRun.ps1 b/Modules/CippExtensions/Public/Gradient/New-GradientServiceSyncRun.ps1
index 15c1c4b74b4e3..ed6e5d4fb3eb3 100644
--- a/Modules/CippExtensions/Public/Gradient/New-GradientServiceSyncRun.ps1
+++ b/Modules/CippExtensions/Public/Gradient/New-GradientServiceSyncRun.ps1
@@ -4,6 +4,7 @@ function New-GradientServiceSyncRun {
 
     $Table = Get-CIPPTable -TableName Extensionsconfig
     $Configuration = ((Get-CIPPAzDataTableEntity @Table).config | ConvertFrom-Json).Gradient
+    $APIName = 'GradientSync'
     $Tenants = Get-Tenants
     #creating accounts in Gradient
     try {
@@ -23,51 +24,26 @@ function New-GradientServiceSyncRun {
             $ActivateRequest = Invoke-RestMethod -Uri 'https://app.usegradient.com/api/vendor-api/organization/status/active' -Method PATCH -Headers $GradientToken
         }
     } catch {
-        Write-LogMessage -API $APINAME -message "Failed to create tenants in Gradient API. Error: $($_.Exception.Message)" -Sev 'Error' -tenant 'GradientAPI'
+        Write-LogMessage -API $APIName -message "Failed to create tenants in Gradient API. Error: $($_.Exception.Message)" -Sev 'Error' -tenant 'GradientAPI'
     }
 
     $ConvertTable = [System.IO.File]::ReadAllText((Join-Path $env:CIPPRootPath 'Config\ConversionTable.csv')) | ConvertFrom-Csv
-    $Table = Get-CIPPTable -TableName cachelicenses
-    $LicenseTable = Get-CIPPTable -TableName ExcludedLicenses
-    $ExcludedSkuList = Get-CIPPAzDataTableEntity @LicenseTable
-    # Only exclude licenses marked as ExcludedEverywhere (not alert-only exclusions)
-    $ExcludedEverywhereRowKeys = @($ExcludedSkuList | Where-Object {
-        $null -eq $_.ExcludedEverywhere -or $_.ExcludedEverywhere -eq $true
-    } | ForEach-Object { $_.RowKey })
 
-    $RawGraphRequest = $Tenants | ForEach-Object -Parallel {
-        $domainName = $_.defaultDomainName
-        Import-Module (Join-Path $env:CIPPRootPath 'Modules\AzBobbyTables')
-        Import-Module (Join-Path $env:CIPPRootPath 'Modules\CIPPCore')
-        Write-Host "Doing $domainName"
-        try {
-            $Licrequest = New-GraphGetRequest -uri 'https://graph.microsoft.com/beta/subscribedSkus' -tenantid $_.defaultDomainName -ErrorAction Stop | Where-Object -Property skuId -NotIn $using:ExcludedEverywhereRowKeys
-            [PSCustomObject]@{
-                Tenant   = $domainName
-                Licenses = $Licrequest
-            }
-        } catch {
-            [PSCustomObject]@{
-                Tenant   = $domainName
-                Licenses = @{
-                    skuid         = "Could not connect to client: $($_.Exception.Message)"
-                    skuPartNumber = 'Could not connect to client'
-                    consumedUnits = 0
-                    prepaidUnits  = { Enabled = 0 }
-                }
-            }
+    # Licence counts come from the reporting DB (LicenseOverview), which already drops licences
+    # excluded everywhere, rather than a live subscribedSkus call per tenant.
+    foreach ($Tenant in $Tenants) {
+        $TenantName = $Tenant.defaultDomainName
+        $Licenses = @(New-CIPPDbRequest -TenantFilter $TenantName -Type 'LicenseOverview' -Fields 'skuId', 'License', 'TotalLicenses' | Where-Object { $_.skuId })
+        if ($Licenses.Count -eq 0) {
+            Write-LogMessage -API $APIName -message 'No cached licence data for this tenant, skipped. The licence cache fills on the next CIPP data collection.' -Sev 'Warning' -tenant $TenantName
+            continue
         }
-    }
-    $LicenseTable = foreach ($singlereq in $RawGraphRequest) {
-        $skuid = $singlereq.Licenses
-        foreach ($sku in $skuid) {
+        foreach ($sku in $Licenses) {
             try {
-                if ($sku.skuId -eq 'Could not connect to client') { continue }
-                $PrettyName = ($ConvertTable | Where-Object { $_.guid -eq $sku.skuid }).'Product_Display_Name' | Select-Object -Last 1
-                if (!$PrettyName) { $PrettyName = $sku.skuPartNumber }
+                $PrettyName = ($ConvertTable | Where-Object { $_.guid -eq $sku.skuId }).'Product_Display_Name' | Select-Object -Last 1
+                if (!$PrettyName) { $PrettyName = $sku.License }
                 #Check if serviceID exists by SKUID in gradient
                 $ExistingService = (Invoke-RestMethod -Uri 'https://app.usegradient.com/api/vendor-api' -Method GET -Headers $GradientToken).data.skus | Where-Object name -EQ $PrettyName
-                Write-Host "New service: $($ExistingService.name) ID: $($ExistingService.id)"
                 if (!$ExistingService) {
                     #Create service
                     $ServiceBody = [PSCustomObject]@{
@@ -78,15 +54,14 @@ function New-GradientServiceSyncRun {
                     } | ConvertTo-Json -Depth 10
                     $ExistingService = (Invoke-RestMethod -Uri 'https://app.usegradient.com/api/vendor-api/service' -Method POST -Headers $GradientToken -Body $ServiceBody -ContentType 'application/json').skus | Where-Object name -EQ $PrettyName
                 }
-                #Post the CountAvailable to the service
+                #Post the purchased licence count to the service
                 $ServiceBody = [PSCustomObject]@{
-                    accountId = $singlereq.Tenant
-                    unitCount = $sku.prepaidUnits.enabled
+                    accountId = $TenantName
+                    unitCount = [int]$sku.TotalLicenses
                 } | ConvertTo-Json -Depth 10
-                $Results = Invoke-RestMethod -Uri "https://app.usegradient.com/api/vendor-api/service/$($ExistingService.id)/count" -Method POST -Headers $GradientToken -Body $ServiceBody -ContentType 'application/json'
+                $null = Invoke-RestMethod -Uri "https://app.usegradient.com/api/vendor-api/service/$($ExistingService.id)/count" -Method POST -Headers $GradientToken -Body $ServiceBody -ContentType 'application/json'
             } catch {
-                Write-LogMessage -API $APINAME -message "Failed to create license in Gradient API. Error: $($_). $results" -Sev 'Error' -tenant $singlereq.tenant
-
+                Write-LogMessage -API $APIName -message "Failed to sync licence '$PrettyName' to Gradient. Error: $($_.Exception.Message)" -Sev 'Error' -tenant $TenantName
             }
         }
     }
diff --git a/Modules/CippExtensions/Public/Halo/New-HaloPSATicket.ps1 b/Modules/CippExtensions/Public/Halo/New-HaloPSATicket.ps1
index f8bdc32b7a71e..b2d4530885013 100644
--- a/Modules/CippExtensions/Public/Halo/New-HaloPSATicket.ps1
+++ b/Modules/CippExtensions/Public/Halo/New-HaloPSATicket.ps1
@@ -11,7 +11,8 @@ function New-HaloPSATicket {
     # priority id or the {label, value} shape the alert form stores, matching how the
     # integration-wide DefaultPriority is read below.
     $TicketPriority,
-    [int]$TicketId
+    [int]$TicketId,
+    [string]$ConsolidationKey
   )
   #Get HaloPSA Token based on the config we have.
   $Table = Get-CIPPTable -TableName Extensionsconfig
@@ -36,10 +37,21 @@ function New-HaloPSATicket {
       $description = "$description<p><em>Affected user: $UnmatchedLabel - no matching HaloPSA contact found, ticket assigned to General User.</em></p>"
     }
   }
+  # A caller may provide a stable consolidation key when the visible title contains
+  # dynamic data such as a timestamp. Without one, retain the existing title behavior.
+  $HashBase = if ([string]::IsNullOrWhiteSpace($ConsolidationKey)) {
+    $title
+  } else {
+    $ConsolidationKey
+  }
+
+  # Preserve the existing per-user separation when LinkTicketsToUsers is enabled.
+  $HashInput = if ($UserLinkActive -and $UserUPN) {
+    "$HashBase|$UserUPN"
+  } else {
+    $HashBase
+  }
 
-  # When linking is active, include UPN in the consolidation key so per-user tickets don't
-  # collapse onto each other when the same alert title fires for multiple users.
-  $HashInput = if ($UserLinkActive -and $UserUPN) { "$title|$UserUPN" } else { $title }
   $TitleHash = Get-StringHash -String $HashInput
 
   # Halo requires a site_id whenever a specific user is set on the ticket; pull it from the
diff --git a/Modules/CippExtensions/Public/Hudu/Find-HuduDeviceMatch.ps1 b/Modules/CippExtensions/Public/Hudu/Find-HuduDeviceMatch.ps1
new file mode 100644
index 0000000000000..f068b7b185217
--- /dev/null
+++ b/Modules/CippExtensions/Public/Hudu/Find-HuduDeviceMatch.ps1
@@ -0,0 +1,54 @@
+function Find-HuduDeviceMatch {
+    <#
+        .SYNOPSIS
+        Finds Hudu assets that correspond to an Intune managed device.
+
+        .DESCRIPTION
+        Uses a usable serial number first and falls back to the device name. Blank
+        and excluded serial numbers never participate in serial matching.
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [object]$Device,
+
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]]$HuduDevices,
+
+        [Parameter(Mandatory = $false)]
+        [AllowEmptyCollection()]
+        [string[]]$ExcludeSerials = @()
+    )
+
+    $SerialNumber = [string]$Device.serialNumber
+    $DeviceName = [string]$Device.deviceName
+    $SerialIsUsable = -not [string]::IsNullOrWhiteSpace($SerialNumber) -and $SerialNumber -notin $ExcludeSerials
+
+    if ($SerialIsUsable) {
+        $SerialMatches = @(
+            $HuduDevices | Where-Object {
+                $_.primary_serial -eq $SerialNumber -or
+                ($_.cards | Where-Object {
+                        $_.integrator_name -eq 'cw_manage' -and $_.data.serialNumber -eq $SerialNumber
+                    })
+            }
+        )
+        if ($SerialMatches.Count -gt 0) {
+            return $SerialMatches
+        }
+    }
+
+    if ([string]::IsNullOrWhiteSpace($DeviceName)) {
+        return @()
+    }
+
+    return @(
+        $HuduDevices | Where-Object {
+            $_.name -eq $DeviceName -or
+            ($_.cards | Where-Object {
+                    $_.integrator_name -eq 'cw_manage' -and $_.data.name -contains $DeviceName
+                })
+        }
+    )
+}
diff --git a/Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerKeySlot.ps1 b/Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerKeySlot.ps1
new file mode 100644
index 0000000000000..866542221010f
--- /dev/null
+++ b/Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerKeySlot.ps1
@@ -0,0 +1,30 @@
+function Get-HuduBitLockerKeySlot {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]]$KeyMetadata
+    )
+
+    $Counters = @{}
+    $Slots = foreach ($Key in @($KeyMetadata | Sort-Object id -Unique)) {
+        $Group = switch ([string]$Key.volumeType) {
+            { $_ -in '1', 'operatingSystemVolume' } { 'OS Drive'; break }
+            { $_ -in '2', 'fixedDataVolume' } { 'Fixed Data Drive'; break }
+            { $_ -in '3', 'removableDataVolume' } { 'Removable Data Drive'; break }
+            default { 'Unknown Drive' }
+        }
+        $Counters[$Group] = 1 + [int]$Counters[$Group]
+        $Label = "BitLocker $Group $($Counters[$Group])"
+        $Prefix = $Label.Replace(' ', '_').ToLowerInvariant()
+        [PSCustomObject]@{
+            KeyId         = [string]$Key.id
+            IdLabel       = "$Label Key ID"
+            PasswordLabel = "$Label Recovery Key"
+            IdField       = "${Prefix}_key_id"
+            PasswordField = "${Prefix}_recovery_key"
+        }
+    }
+
+    return $Slots
+}
diff --git a/Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerSyncField.ps1 b/Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerSyncField.ps1
new file mode 100644
index 0000000000000..174219bfcfbd0
--- /dev/null
+++ b/Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerSyncField.ps1
@@ -0,0 +1,65 @@
+function Get-HuduBitLockerSyncField {
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [object[]]$KeyMetadata,
+
+        [Parameter(Mandatory = $false)]
+        [AllowEmptyCollection()]
+        [object[]]$ExistingFields = @(),
+
+        [Parameter(Mandatory = $true)]
+        [string]$DeviceId,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
+    )
+
+    $Slots = @(Get-HuduBitLockerKeySlot -KeyMetadata $KeyMetadata)
+    $KeyIds = @($Slots.KeyId | Sort-Object -Unique)
+    $FieldsByName = @{}
+    foreach ($Field in $ExistingFields) {
+        $Name = if ($Field.label) { $Field.label.Replace(' ', '_').ToLowerInvariant() } else { $Field.slug }
+        if ($Name) { $FieldsByName[$Name] = [string]$Field.value }
+    }
+    $NeedsUpdate = $false
+    foreach ($Slot in $Slots) {
+        if ($FieldsByName[$Slot.IdField] -ne $Slot.KeyId -or
+            [string]::IsNullOrWhiteSpace($FieldsByName[$Slot.PasswordField])) {
+            $NeedsUpdate = $true
+        }
+    }
+    $ExpectedNames = @($Slots.IdField) + @($Slots.PasswordField)
+    $StaleNames = @($FieldsByName.Keys | Where-Object {
+        ($_ -match '^bitlocker_(?:key_id|recovery_key)_\d+$' -or
+            $_ -match '^bitlocker_(?:os|fixed_data|removable_data|unknown)_drive_\d+_(?:key_id|recovery_key)$') -and
+        $_ -notin $ExpectedNames -and
+        -not [string]::IsNullOrWhiteSpace($FieldsByName[$_])
+    })
+    $LegacyNames = @('bitlocker_key_ids', 'bitlocker_recovery_keys' | Where-Object {
+        -not [string]::IsNullOrWhiteSpace($FieldsByName[$_])
+    })
+    $Updates = @{}
+    if ($NeedsUpdate) {
+        $Keys = @(Get-CIPPBitLockerKey -Device $DeviceId -TenantFilter $TenantFilter -ErrorAction Stop)
+        $ValidKeys = @($Keys | Where-Object {
+            $_ -isnot [string] -and $_.state -eq 'success' -and
+            -not [string]::IsNullOrWhiteSpace([string]$_.keyId) -and
+            -not [string]::IsNullOrWhiteSpace([string]$_.copyField)
+        } | Sort-Object keyId)
+        if ($ValidKeys.Count -ne $Keys.Count -or $ValidKeys.Count -ne $KeyIds.Count -or
+            (@($ValidKeys.keyId) -join "`n") -ne ($KeyIds -join "`n")) {
+            throw 'The BitLocker recovery key response did not match the cached key metadata.'
+        }
+        $KeysById = @{}
+        foreach ($Key in $ValidKeys) { $KeysById[[string]$Key.keyId] = [string]$Key.copyField }
+        foreach ($Slot in $Slots) {
+            $Updates[$Slot.IdField] = $Slot.KeyId
+            $Updates[$Slot.PasswordField] = $KeysById[$Slot.KeyId]
+        }
+    }
+    # Clear superseded values only after all required credentials were retrieved successfully.
+    foreach ($Name in @($StaleNames) + @($LegacyNames)) { $Updates[$Name] = '' }
+    return $Updates
+}
diff --git a/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1 b/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1
index 0e854f88b6ede..705020474d20e 100644
--- a/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1
+++ b/Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1
@@ -3,9 +3,13 @@ function Invoke-HuduExtensionSync {
         .FUNCTIONALITY
         Internal
     #>
+    [CmdletBinding()]
     param(
-        $Configuration,
-        $TenantFilter
+        [Parameter(Mandatory = $true)]
+        [object]$Configuration,
+
+        [Parameter(Mandatory = $true)]
+        [string]$TenantFilter
     )
     try {
         Connect-HuduAPI -configuration $Configuration | Out-Null
@@ -38,9 +42,6 @@ function Invoke-HuduExtensionSync {
         $HuduRelationsCache = Get-CippTable -tablename 'CacheHuduRelations'
         $HuduRelationsCacheTTLMinutes = 15
 
-        # Import license mapping
-        $LicTable = [System.IO.File]::ReadAllText((Join-Path $env:CIPPRootPath 'Config\ConversionTable.csv')) | ConvertFrom-Csv
-
         $CompanyResult.Logs.Add('Starting Hudu Extension Sync')
 
         # Get CIPP URL
@@ -80,6 +81,7 @@ function Invoke-HuduExtensionSync {
                 # Add required fields to People Layout
                 $null = Add-HuduAssetLayoutField -AssetLayoutId $PeopleLayoutId -Label 'Microsoft 365'
                 $null = Add-HuduAssetLayoutField -AssetLayoutId $PeopleLayoutId -Label 'Email Address' -Position 1 -ShowInList $true -FieldType 'Text'
+                $null = Add-HuduAssetLayoutField -AssetLayoutId $PeopleLayoutId -Label 'Licenses' -Position 2 -FieldType 'Text'
                 $CreateUsers = $Configuration.CreateMissingUsers
                 $PeopleLayout = Get-HuduAssetLayouts -Id $PeopleLayoutId
                 if ($PeopleLayout.id) {
@@ -104,9 +106,27 @@ function Invoke-HuduExtensionSync {
 
         try {
             if (![string]::IsNullOrEmpty($DeviceLayoutId)) {
-                $null = Add-HuduAssetLayoutField -AssetLayoutId $DeviceLayoutId
-                $CreateDevices = $Configuration.CreateMissingDevices
                 $DesktopsLayout = Get-HuduAssetLayouts -Id $DeviceLayoutId
+                $DeviceLayoutFieldsAdded = $false
+                $RequiredDeviceLayoutFields = [System.Collections.Generic.List[object]]::new()
+                if ($Configuration.IncludeLAPS) {
+                    [void]$RequiredDeviceLayoutFields.Add(@{ Label = 'LAPS Account'; FieldType = 'Email'; Position = 0 })
+                    [void]$RequiredDeviceLayoutFields.Add(@{ Label = 'LAPS Password'; FieldType = 'Password'; Position = 1 })
+                    [void]$RequiredDeviceLayoutFields.Add(@{ Label = 'LAPS Backup Date'; FieldType = 'Text'; Position = 2 })
+                }
+                [void]$RequiredDeviceLayoutFields.Add(@{ Label = 'Microsoft 365'; FieldType = 'RichText'; Position = $(if ($Configuration.IncludeLAPS) { 3 } else { 0 }) })
+                foreach ($RequiredField in $RequiredDeviceLayoutFields) {
+                    $CurrentField = $DesktopsLayout.fields | Where-Object { $_.label -eq $RequiredField.Label } | Select-Object -First 1
+                    if (-not $CurrentField -or [string]$CurrentField.field_type -ne $RequiredField.FieldType -or [int]$CurrentField.position -ne [int]$RequiredField.Position) {
+                        $null = Add-HuduAssetLayoutField -AssetLayoutId $DeviceLayoutId -Label $RequiredField.Label -FieldType $RequiredField.FieldType -Position $RequiredField.Position
+                        $DeviceLayoutFieldsAdded = $true
+                        $DesktopsLayout = Get-HuduAssetLayouts -Id $DeviceLayoutId
+                    }
+                }
+                if ($DeviceLayoutFieldsAdded) {
+                    $DesktopsLayout = Get-HuduAssetLayouts -Id $DeviceLayoutId
+                }
+                $CreateDevices = $Configuration.CreateMissingDevices
                 if ($DesktopsLayout.id) {
                     $HuduDesktopDevices = Get-HuduAssets -CompanyId $company_id -AssetLayoutId $DesktopsLayout.id
                     $HuduDevices = [System.Collections.Generic.List[object]]::new([object[]]@($HuduDesktopDevices))
@@ -130,12 +150,10 @@ function Invoke-HuduExtensionSync {
 
         # Defaults
         $IntuneDesktopDeviceTypes = 'windowsRT,macMDM' -split ','
-        $DefaultSerials = [System.Collections.Generic.List[string]]@('SystemSerialNumber', 'To Be Filled By O.E.M.', 'System Serial Number', '0123456789', '123456789', 'TobefilledbyO.E.M.')
+        $ExcludeSerials = [System.Collections.Generic.List[string]]@('SystemSerialNumber', 'To Be Filled By O.E.M.', 'System Serial Number', '0123456789', '123456789', 'TobefilledbyO.E.M.')
 
         if ($Configuration.ExcludeSerials) {
-            $ExcludeSerials = $DefaultSerials.AddRange($Configuration.ExcludeSerials -split ',')
-        } else {
-            $ExcludeSerials = $DefaultSerials
+            [void]$ExcludeSerials.AddRange([string[]]($Configuration.ExcludeSerials -split ','))
         }
 
         $RelationsCacheMeta = Get-CIPPAzDataTableEntity @HuduRelationsCache -Filter "PartitionKey eq 'CacheMetadata' and RowKey eq 'LastRefresh'"
@@ -162,12 +180,12 @@ function Invoke-HuduExtensionSync {
 
             $RelationEntities = foreach ($Relation in $HuduRelations) {
                 [PSCustomObject]@{
-                    PartitionKey  = 'HuduRelation'
-                    RowKey        = [string]$Relation.id
-                    FromableType  = [string]$Relation.fromable_type
-                    FromableId    = [string]$Relation.fromable_id
-                    ToableType    = [string]$Relation.toable_type
-                    ToableId      = [string]$Relation.toable_id
+                    PartitionKey = 'HuduRelation'
+                    RowKey       = [string]$Relation.id
+                    FromableType = [string]$Relation.fromable_type
+                    FromableId   = [string]$Relation.fromable_id
+                    ToableType   = [string]$Relation.toable_type
+                    ToableId     = [string]$Relation.toable_id
                 }
             }
             if ($RelationEntities) {
@@ -207,7 +225,7 @@ function Invoke-HuduExtensionSync {
                 URL   = 'https://admin.teams.microsoft.com/?delegatedOrg={0}' -f $Tenant.defaultDomainName
                 Icon  = 'fas fa-users'
             }
-			@{
+            @{
                 Title = 'SharePoint Portal'
                 URL   = 'https://admin.cloud.microsoft/Partner/beginclientsession.aspx?CTID={0}&CSDEST=SharePoint' -f $Tenant.customerId
                 Icon  = 'fas fa-sitemap'
@@ -254,14 +272,24 @@ function Invoke-HuduExtensionSync {
 
 
         $Roles = foreach ($Role in $AllRoles) {
-            # Members are now inline with each role object
-            $Members = $Role.members
+            # Active + Direct + PIM-eligible members, de-duplicated by principal. Tenants without
+            # PIM cache rows fall through to direct membership only, same output as before.
+            # Pass the TEMPLATE id: PIM keys on roleDefinitionId, an instance id matches nothing.
+            $AllMembers = @(Get-CippDbRoleMembers -TenantFilter $Tenant.defaultDomainName -RoleTemplateId $Role.roleTemplateId)
+            $Members = $AllMembers | Where-Object { $_.AssignmentType -ne 'Eligible' }
+            $Eligible = $AllMembers | Where-Object {
+                $_.AssignmentType -eq 'Eligible' -and
+                (-not $_.EndDateTime -or [datetime]$_.EndDateTime -gt [datetime]::UtcNow)
+            }
             [PSCustomObject]@{
-                ID            = $Role.id
-                DisplayName   = $Role.displayName
-                Description   = $Role.description
-                Members       = $Members
-                ParsedMembers = $Members.displayName -join ', '
+                ID              = $Role.id
+                DisplayName     = $Role.displayName
+                Description     = $Role.description
+                Members         = $Members
+                ParsedMembers   = $Members.displayName -join ', '
+                EligibleMembers = ($Eligible | ForEach-Object {
+                        if ($_.EndDateTime) { '{0} (until {1:yyyy-MM-dd})' -f $_.displayName, [datetime]$_.EndDateTime } else { $_.displayName }
+                    }) -join ', '
             }
         }
 
@@ -272,10 +300,10 @@ function Invoke-HuduExtensionSync {
         $post = '</div>'
 
         if ($Configuration.HideEmptyRoles) {
-            $Roles = $Roles | Where-Object { $_.ParsedMembers }
+            $Roles = $Roles | Where-Object { $_.ParsedMembers -or $_.EligibleMembers }
         }
 
-        $RolesHtml = $Roles | Select-Object DisplayName, Description, ParsedMembers | ConvertTo-Html -PreContent $pre -PostContent $post -Fragment | ForEach-Object { $tmp = $_ -replace '&lt;', '<'; $tmp -replace '&gt;', '>'; } | Out-String
+        $RolesHtml = $Roles | Select-Object DisplayName, Description, ParsedMembers, EligibleMembers | ConvertTo-Html -PreContent $pre -PostContent $post -Fragment | ForEach-Object { $tmp = $_ -replace '&lt;', '<'; $tmp -replace '&gt;', '>'; } | Out-String
 
         $AdminUsers = (($Roles | Where-Object { $_.displayName -match 'Administrator' }).Members | Where-Object { $null -ne $_.displayName } | Select-Object @{N = 'Name'; E = { "<a target='_blank' href='https://entra.microsoft.com/$($Tenant.defaultDomainName)/#blade/Microsoft_AAD_IAM/UserDetailsMenuBlade/Profile/userId/$($_.Id)'>$($_.displayName) - $($_.userPrincipalName)</a>" } } -Unique).name -join '<br/>'
 
@@ -344,6 +372,77 @@ function Invoke-HuduExtensionSync {
         $devices = $ExtensionCache.Devices
         $CompanyResult.Devices = ($Devices | Measure-Object).count
 
+        $LAPSMetadataAvailable = $true
+        $LAPSMetadataByDeviceId = @{}
+        if ($Configuration.IncludeLAPS) {
+            try {
+                $LAPSMetadata = @(New-GraphGetRequest -NoAuthCheck $true -uri 'https://graph.microsoft.com/v1.0/directory/deviceLocalCredentials?$select=id,deviceName,lastBackupDateTime,refreshDateTime' -tenantid $TenantFilter -ErrorAction Stop)
+                foreach ($LAPSMetadataItem in $LAPSMetadata) {
+                    if ($LAPSMetadataItem -is [string] -or [string]::IsNullOrWhiteSpace([string]$LAPSMetadataItem.id) -or [string]::IsNullOrWhiteSpace([string]$LAPSMetadataItem.lastBackupDateTime)) {
+                        throw 'The LAPS metadata response contained an incomplete record.'
+                    }
+                    $LAPSMetadataByDeviceId[[string]$LAPSMetadataItem.id] = $LAPSMetadataItem
+                }
+            } catch {
+                $LAPSMetadataAvailable = $false
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-Warning "Unable to retrieve LAPS metadata for $($Tenant.defaultDomainName): $($ErrorMessage.NormalizedError)"
+            }
+        }
+
+        $BitLockerMetadataAvailable = $true
+        $BitLockerKeyMetadata = @()
+        if ($Configuration.IncludeBitLocker) {
+            try {
+                $BitLockerCacheRows = @(Get-CIPPDbItem -TenantFilter $TenantFilter -Type 'BitlockerKeys' -ErrorAction Stop)
+                $BitLockerCountRow = $BitLockerCacheRows | Where-Object { $_.RowKey -eq 'BitlockerKeys-Count' } | Select-Object -First 1
+                if ($null -eq $BitLockerCountRow) {
+                    throw 'BitLocker key metadata cache has not been populated.'
+                }
+
+                $BitLockerKeyMetadata = @(
+                    $BitLockerCacheRows |
+                        Where-Object { $_.RowKey -ne 'BitlockerKeys-Count' } |
+                        ForEach-Object {
+                            if ($_.Data -is [string]) {
+                                $_.Data | ConvertFrom-Json -ErrorAction Stop
+                            } else {
+                                $_.Data
+                            }
+                        }
+                )
+                if ($BitLockerKeyMetadata.Count -ne [int]$BitLockerCountRow.DataCount) {
+                    throw 'BitLocker key metadata cache is incomplete.'
+                }
+                if ($BitLockerKeyMetadata | Where-Object { [string]::IsNullOrWhiteSpace([string]$_.id) -or [string]::IsNullOrWhiteSpace([string]$_.deviceId) }) {
+                    throw 'BitLocker key metadata cache contains incomplete records.'
+                }
+                if ($DeviceLayoutId) {
+                    $LayoutSlots = @(
+                        foreach ($DeviceKeys in ($BitLockerKeyMetadata | Group-Object deviceId)) {
+                            Get-HuduBitLockerKeySlot -KeyMetadata $DeviceKeys.Group
+                        }
+                    ) | Sort-Object IdLabel -Unique
+                    $NextPosition = 1 + [int](($DesktopsLayout.fields | Measure-Object position -Maximum).Maximum)
+                    foreach ($Slot in $LayoutSlots) {
+                        foreach ($PairField in @(
+                                @{ Label = $Slot.IdLabel; Type = 'Text' }
+                                @{ Label = $Slot.PasswordLabel; Type = 'Password' }
+                            )) {
+                            if ($DesktopsLayout.fields.label -notcontains $PairField.Label) {
+                                $null = Add-HuduAssetLayoutField -AssetLayoutId $DeviceLayoutId -Label $PairField.Label -FieldType $PairField.Type -Position $NextPosition -ErrorAction Stop
+                                $NextPosition++
+                            }
+                        }
+                    }
+                }
+            } catch {
+                $BitLockerMetadataAvailable = $false
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-Warning "Unable to retrieve BitLocker key metadata for $($Tenant.defaultDomainName): $($ErrorMessage.NormalizedError)"
+            }
+        }
+
         $DeviceCompliancePolicies = $ExtensionCache.DeviceCompliancePolicies
 
         $DeviceComplianceDetails = foreach ($Policy in $DeviceCompliancePolicies) {
@@ -515,6 +614,12 @@ function Invoke-HuduExtensionSync {
 
             $post = '</div>'
             $CompanyResult.Logs.Add('Starting User Processing')
+            $LicenseNamesBySku = @{}
+            foreach ($License in $Licenses) {
+                if ($License.skuId -and $License.skuPartNumber) {
+                    $LicenseNamesBySku[([string]$License.skuId).ToLowerInvariant()] = [string]$License.skuPartNumber
+                }
+            }
             $OutputUsers = foreach ($user in $licensedUsers) {
                 try {
                     $HuduUser = $null
@@ -553,29 +658,24 @@ function Invoke-HuduExtensionSync {
                     $CASRequest = ''
 
                     $CASRequest = $CASFull | Where-Object { $_.ExternalDirectoryObjectId -eq $User.id }
-                    $MailboxDetailedRequest = $MailboxDetailedFull | Where-Object { $_.Id -eq $User.id }
+                    $MailboxDetailedRequest = $MailboxDetailedFull | Where-Object { $_.ExternalDirectoryObjectId -eq $User.id }
                     $StatsRequest = $MailboxStatsFull | Where-Object { $_.'userPrincipalName' -eq $User.userPrincipalName }
 
-                    $PermsRequest = $Permissions | Where-Object { $_.Identity -eq $User.id }
+                    $MailboxIdentities = @($User.id, $User.userPrincipalName, $MailboxDetailedRequest.id, $MailboxDetailedRequest.UPN, $MailboxDetailedRequest.primarySmtpAddress) | Where-Object { $_ }
+                    $PermsRequest = $Permissions | Where-Object { $_.Identity -in $MailboxIdentities }
 
                     $ParsedPerms = foreach ($Perm in $PermsRequest) {
-                        if ($Perm.User -ne 'NT AUTHORITY\SELF') {
+                        if ($Perm.User -ne 'NT AUTHORITY\SELF' -and $Perm.Deny -ne $true) {
                             [pscustomobject]@{
                                 User         = $Perm.User
-                                AccessRights = $Perm.PermissionList.AccessRights -join ', '
+                                AccessRights = $Perm.AccessRights -join ', '
                             }
                         }
                     }
 
-                    try {
-                        $TotalItemSize = [math]::Round($StatsRequest.storageUsedInBytes / 1Gb, 2)
-                    } catch {
-                        $TotalItemSize = 0
-                    }
-
                     $UserMailSettings = [pscustomobject]@{
                         ForwardAndDeliver        = $MailboxDetailedRequest.DeliverToMailboxAndForward
-                        ForwardingAddress        = $MailboxDetailedRequest.ForwardingAddress + ' ' + $MailboxDetailedRequest.ForwardingSmtpAddress
+                        ForwardingAddress        = (@($MailboxDetailedRequest.InternalForwardingAddress, $MailboxDetailedRequest.ForwardingSmtpAddress) | Where-Object { $_ }) -join ' '
                         LitiationHold            = $MailboxDetailedRequest.LitigationHoldEnabled
                         HiddenFromAddressLists   = $MailboxDetailedRequest.HiddenFromAddressListsEnabled
                         EWSEnabled               = $CASRequest.EwsEnabled
@@ -607,14 +707,16 @@ function Invoke-HuduExtensionSync {
 
                     $aliases = (($user.proxyAddresses | Where-Object { $_ -cnotmatch 'SMTP' -and $_ -notmatch '.onmicrosoft.com' }) -replace 'SMTP:', ' ') -join ', '
 
+                    # The license cache already carries the admin-portal display name and has excluded SKUs removed,
+                    # so SKUs missing from it are excluded and dropped. Fall back to the raw SKU ID only when there is no cache.
                     $userLicenses = ($user.AssignedLicenses.SkuID | ForEach-Object {
-                            $UserLic = $_
-                            $SkuPartNumber = ($Licenses | Where-Object { $_.SkuId -eq $UserLic }).SkuPartNumber
-                            if (!$SkuPartNumber) {
-                                $SkuPartNumber = 'Unknown License'
+                            $UserLic = ([string]$_).ToLowerInvariant()
+                            if ($LicenseNamesBySku.Count -eq 0) {
+                                $UserLic
+                            } elseif ($LicenseNamesBySku.ContainsKey($UserLic)) {
+                                $LicenseNamesBySku[$UserLic]
                             }
-                            $SkuPartNumber
-                        }) -join ', '
+                        } | Where-Object { $_ } | Sort-Object -Unique) -join ', '
 
                     $UserOneDriveDetails = $OneDriveDetails | Where-Object { $_.ownerPrincipalName -eq $user.userPrincipalName }
 
@@ -785,7 +887,7 @@ function Invoke-HuduExtensionSync {
                     if ($EnableCIPP) {
                         $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/users/user?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id)" -Icon 'far fa-eye' -Title 'CIPP - View User'))
                         $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/users/user/edit?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id)" -Icon 'fas fa-user-cog' -Title 'CIPP - Edit User'))
-                        $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/users/user/bec?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id)" -Icon 'fas fa-user-secret' -Title 'CIPP - BEC Tool'))
+                        $CIPPLinksFormatted.add((Get-HuduLinkBlock -URL "$($CIPPURL)/identity/administration/bec/case?tenantFilter=$($Tenant.defaultDomainName)&userId=$($User.id)" -Icon 'fas fa-user-secret' -Title 'CIPP - BEC Tool'))
                     }
 
                     [System.Collections.Generic.List[PSCustomObject]]$UserLinksFormatted = @()
@@ -807,11 +909,13 @@ function Invoke-HuduExtensionSync {
                     $UserBody = "<div>$AssignedPlansBlock<br />$UserLinksBlock<br /><div class=`"nasa__content`">$($UserOverviewBlock)$($UserMailDetailsBlock)$($OneDriveBlock)$($UserMailSettingsBlock)$($UserPoliciesBlock)</div><div class=`"nasa__content`">$($UserDevicesDetailsBlock)</div><div class=`"nasa__content`">$($UserGroupsBlock)</div></div>"
 
                     if (![string]::IsNullOrEmpty($PeopleLayoutId)) {
+                        # Hash is calculated before the timestamp is added, otherwise every asset would be rewritten on every sync
+                        $NewHash = Get-StringHash -String $UserBody
                         $UserAssetFields = @{
-                            microsoft_365 = $UserBody
+                            microsoft_365 = "$UserBody<div>Last Updated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')</div>"
                             email_address = $user.userPrincipalName
+                            licenses      = $userLicenses
                         }
-                        $NewHash = Get-StringHash -String $UserBody
                         $HuduUserCount = ($HuduUser | Measure-Object).Count
 
                         if ($HuduUserCount -eq 1) {
@@ -997,14 +1101,7 @@ function Invoke-HuduExtensionSync {
                     #$DeviceAppsBlock = Get-HuduFormattedBlock -Heading 'App Details' -Body ($DeviceAppsFormatted -join '')
                     $DeviceGroupsBlock = Get-HuduFormattedBlock -Heading 'Device Groups' -Body ($DeviceGroupsFormatted -join '')
 
-                    if ("$($device.serialNumber)" -in $ExcludeSerials) {
-                        $HuduDevice = $HuduDevices | Where-Object { $_.name -eq $device.deviceName -or ($_.cards.integrator_name -eq 'cw_manage' -and $_.cards.data.name -contains $device.deviceName) }
-                    } else {
-                        $HuduDevice = $HuduDevices | Where-Object { $_.primary_serial -eq $device.serialNumber -or ($_.cards.integrator_name -eq 'cw_manage' -and $_.cards.data.serialNumber -eq $device.serialNumber) }
-                        if (!$HuduDevice) {
-                            $HuduDevice = $HuduDevices | Where-Object { $_.name -eq $device.deviceName -or ($_.cards.integrator_name -eq 'cw_manage' -and $_.cards.data.name -contains $device.deviceName) }
-                        }
-                    }
+                    $HuduDevice = Find-HuduDeviceMatch -Device $Device -HuduDevices $HuduDevices -ExcludeSerials $ExcludeSerials
 
                     [System.Collections.Generic.List[PSCustomObject]]$DeviceLinksFormatted = @()
                     $DeviceLinksFormatted.add((Get-HuduLinkBlock -URL "https://intune.microsoft.com/$($Tenant.defaultDomainName)/#blade/Microsoft_Intune_Devices/DeviceSettingsBlade/overview/mdmDeviceId/$($Device.id)" -Icon 'fas fa-laptop' -Title 'Endpoint Manager'))
@@ -1027,9 +1124,124 @@ function Invoke-HuduExtensionSync {
                     $DeviceIntuneDetailshtml = "<div><div>$DeviceLinksBlock<br /><div class=`"nasa__content`">$($DeviceOverviewBlock)$($DeviceHardwareBlock)$($DeviceEnrollmentBlock)$($DevicePolicyBlock)$($DeviceAppsBlock)$($DeviceGroupsBlock)</div></div>"
 
                     $DeviceAssetFields = @{
-                        microsoft_365 = $DeviceIntuneDetailshtml
+                        microsoft_365 = "$DeviceIntuneDetailshtml<div>Last Updated: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')</div>"
+                    }
+                    # Exclude the timestamp from the hash so unchanged assets are not rewritten on every sync.
+                    $DeviceHashMaterial = $DeviceIntuneDetailshtml
+                    $CredentialRetrievalFailed = $false
+                    $CredentialFieldsChanged = $false
+                    $CredentialSyncEnabled = $Configuration.IncludeLAPS -or $Configuration.IncludeBitLocker
+                    $IsWindowsDevice = $Device.operatingSystem -eq 'Windows'
+                    $IsNewHuduDevice = -not $HuduDevice
+                    $SingleHuduDevice = if (($HuduDevice | Measure-Object).Count -eq 1) { $HuduDevice } else { $null }
+
+                    if ($IsWindowsDevice -and $CredentialSyncEnabled -and [string]::IsNullOrWhiteSpace([string]$Device.azureADDeviceId)) {
+                        Write-Warning "Unable to synchronize credentials for $($Device.deviceName): azureADDeviceId is missing."
+                        $CredentialRetrievalFailed = $true
+                    } elseif ($IsWindowsDevice -and $CredentialSyncEnabled -and ($IsNewHuduDevice -or $SingleHuduDevice)) {
+                        $ExistingLAPSAccount = [string](
+                            $SingleHuduDevice.fields |
+                                Where-Object { $_.label -eq 'LAPS Account' -or $_.slug -eq 'laps_account' } |
+                                Select-Object -First 1 -ExpandProperty value
+                        )
+                        $ExistingLAPSBackupDate = [string](
+                            $SingleHuduDevice.fields |
+                                Where-Object { $_.label -eq 'LAPS Backup Date' -or $_.slug -eq 'laps_backup_date' } |
+                                Select-Object -First 1 -ExpandProperty value
+                        )
+                        $ExistingLAPSCredentialPresent = -not [string]::IsNullOrWhiteSpace([string](
+                                $SingleHuduDevice.fields |
+                                    Where-Object { $_.label -eq 'LAPS Password' -or $_.slug -eq 'laps_password' } |
+                                    Select-Object -First 1 -ExpandProperty value
+                            ))
+                        if ($Configuration.IncludeLAPS) {
+                            try {
+                                if (-not $LAPSMetadataAvailable) {
+                                    throw 'LAPS metadata is unavailable.'
+                                }
+
+                                $LAPSMetadata = $LAPSMetadataByDeviceId[[string]$Device.azureADDeviceId]
+                                if ($null -eq $LAPSMetadata) {
+                                    $DeviceAssetFields.laps_account = ''
+                                    $DeviceAssetFields.laps_password = ''
+                                    $DeviceAssetFields.laps_backup_date = ''
+                                    $DeviceHashMaterial += "`nLAPS Account:`nLAPS Backup Date:"
+                                } else {
+                                    $LAPSBackupDate = [string]$LAPSMetadata.lastBackupDateTime
+                                    $LAPSAccount = ([string]$ExistingLAPSAccount) -replace '^\.\\', ''
+                                    $FormattedLAPSAccount = if ([string]::IsNullOrWhiteSpace($LAPSAccount)) { '' } else { ".\$LAPSAccount" }
+                                    if ($ExistingLAPSAccount -ne $FormattedLAPSAccount) {
+                                        $DeviceAssetFields.laps_account = $FormattedLAPSAccount
+                                        $CredentialFieldsChanged = $true
+                                    }
+                                    $RetrieveLAPSPassword = $IsNewHuduDevice -or -not $ExistingLAPSCredentialPresent -or [string]::IsNullOrWhiteSpace($ExistingLAPSBackupDate) -or $ExistingLAPSBackupDate -ne $LAPSBackupDate
+
+                                    if ($RetrieveLAPSPassword) {
+                                        $LAPSResult = Get-CIPPLapsPassword -Device $Device.azureADDeviceId -TenantFilter $TenantFilter -ErrorAction Stop
+                                        if ($LAPSResult -isnot [string] -and $LAPSResult.state -eq 'success' -and -not [string]::IsNullOrWhiteSpace([string]$LAPSResult.accountName) -and -not [string]::IsNullOrWhiteSpace([string]$LAPSResult.copyField) -and -not [string]::IsNullOrWhiteSpace([string]$LAPSResult.backupDateTime)) {
+                                            $LAPSAccount = ([string]$LAPSResult.accountName) -replace '^\.\\', ''
+                                            $LAPSBackupDate = [string]$LAPSResult.backupDateTime
+                                            $DeviceAssetFields.laps_account = ".\$LAPSAccount"
+                                            $DeviceAssetFields.laps_password = [string]$LAPSResult.copyField
+                                            $CredentialFieldsChanged = $true
+                                            $DeviceAssetFields.laps_backup_date = $LAPSBackupDate
+                                        } elseif ([string]$LAPSResult -like 'No LAPS password found*') {
+                                            $LAPSAccount = ''
+                                            $LAPSBackupDate = ''
+                                            $DeviceAssetFields.laps_account = ''
+                                            $DeviceAssetFields.laps_password = ''
+                                            $DeviceAssetFields.laps_backup_date = ''
+                                        } else {
+                                            throw "Unable to retrieve LAPS password: $LAPSResult"
+                                        }
+                                    }
+                                    $DeviceHashMaterial += "`nLAPS Account:$LAPSAccount`nLAPS Backup Date:$LAPSBackupDate"
+                                }
+                            } catch {
+                                $ErrorMessage = Get-CippException -Exception $_
+                                Write-Warning "Unable to retrieve LAPS data for $($Device.deviceName): $($ErrorMessage.NormalizedError)"
+                                $CredentialRetrievalFailed = $true
+                            }
+                        }
+
+                        if ($Configuration.IncludeBitLocker) {
+                            try {
+                                if (-not $BitLockerMetadataAvailable) {
+                                    throw 'BitLocker key metadata is unavailable.'
+                                }
+
+                                $BitLockerKeyIds = @(
+                                    $BitLockerKeyMetadata |
+                                        Where-Object { $_.deviceId -eq $Device.azureADDeviceId } |
+                                        ForEach-Object { [string]$_.id } |
+                                        Where-Object { -not [string]::IsNullOrWhiteSpace($_) } |
+                                        Sort-Object -Unique
+                                )
+                                $DeviceHashMaterial += "`nBitLocker Key IDs:$($BitLockerKeyIds -join ',')"
+
+                                $BitLockerFields = Get-HuduBitLockerSyncField -KeyMetadata @($BitLockerKeyMetadata | Where-Object { $_.deviceId -eq $Device.azureADDeviceId }) -ExistingFields $SingleHuduDevice.fields -DeviceId $Device.azureADDeviceId -TenantFilter $TenantFilter -ErrorAction Stop
+                                if ($BitLockerFields.Count -gt 0) {
+                                    $CredentialFieldsChanged = $true
+                                    foreach ($FieldName in $BitLockerFields.Keys) {
+                                        $DeviceAssetFields[$FieldName] = $BitLockerFields[$FieldName]
+                                    }
+                                }
+                            } catch {
+                                $ErrorMessage = Get-CippException -Exception $_
+                                Write-Warning "Unable to retrieve BitLocker recovery keys for $($Device.deviceName): $($ErrorMessage.NormalizedError)"
+                                $CredentialRetrievalFailed = $true
+                            }
+                        }
+                    }
+
+                    $NewHash = Get-StringHash -String $DeviceHashMaterial
+
+                    if ($CredentialRetrievalFailed) {
+                        $CredentialFailureMessage = "Device $($Device.deviceName): Skipped Hudu asset and cache update because credential retrieval failed."
+                        Write-Warning $CredentialFailureMessage
+                        [void]$CompanyResult.Errors.Add($CredentialFailureMessage)
+                        continue
                     }
-                    $NewHash = Get-StringHash -String $DeviceIntuneDetailshtml
 
                     if (![string]::IsNullOrEmpty($DeviceLayoutId)) {
                         if ($HuduDevice) {
@@ -1037,7 +1249,7 @@ function Invoke-HuduExtensionSync {
                                 $ExistingAsset = Get-CIPPAzDataTableEntity @HuduAssetCache -Filter "PartitionKey eq 'HuduDevice' and CompanyId eq '$company_id' and RowKey eq '$($HuduDevice.id)'"
                                 $ExistingHash = $ExistingAsset.Hash
 
-                                if (!$ExistingAsset -or $ExistingAsset.Hash -ne $NewHash) {
+                                if (!$ExistingAsset -or $ExistingAsset.Hash -ne $NewHash -or $CredentialFieldsChanged) {
                                     $CompanyResult.Logs.Add("Updating $($HuduDevice.name) in Hudu")
                                     $null = Set-HuduAsset -asset_id $HuduDevice.id -Name $HuduDevice.name -company_id $company_id -asset_layout_id $HuduDevice.asset_layout_id -Fields $DeviceAssetFields -PrimarySerial $Device.serialNumber
                                     $AssetCache = [PSCustomObject]@{
diff --git a/Modules/CippExtensions/Public/New-CippExtAlert.ps1 b/Modules/CippExtensions/Public/New-CippExtAlert.ps1
index e32ab469f2278..e160c5095a513 100644
--- a/Modules/CippExtensions/Public/New-CippExtAlert.ps1
+++ b/Modules/CippExtensions/Public/New-CippExtAlert.ps1
@@ -104,6 +104,12 @@ function New-CippExtAlert {
                         $TicketParams.TicketPriority = $Alert.PsaTicketPriority
                     }
 
+                    # HaloPSA may use a stable consolidation key independently
+                    # from the visible ticket title.
+                    if ($Alert.PSAConsolidationKey) {
+                        $TicketParams.ConsolidationKey = $Alert.PSAConsolidationKey
+                    }
+
                     New-HaloPSATicket @TicketParams
                 }
             }
diff --git a/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneDeviceNonCompliantSettings.ps1 b/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneDeviceNonCompliantSettings.ps1
new file mode 100644
index 0000000000000..b0e1f8f4d2aa1
--- /dev/null
+++ b/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneDeviceNonCompliantSettings.ps1
@@ -0,0 +1,108 @@
+function Get-NinjaOneDeviceNonCompliantSettings {
+    <#
+    .SYNOPSIS
+    Lists, per Intune managed device, the compliance policy settings the device currently fails.
+
+    .DESCRIPTION
+    Backs the 'Intune Non-Compliant Settings' NinjaOne custom field. Runs two Graph batch rounds for the
+    whole set of devices instead of a call per device: first every device's compliance policy states, then
+    the setting states of each policy state that is not compliant. Returns a hashtable keyed by managed
+    device id whose value is a newline separated list of 'Policy name: Setting name' lines. Devices with
+    nothing failing are absent from the result.
+
+    .PARAMETER TenantFilter
+    Tenant to query.
+
+    .PARAMETER ManagedDeviceIds
+    Intune managed device ids to look up. Only non-compliant devices need to be passed.
+
+    .FUNCTIONALITY
+    Internal
+    #>
+    [CmdletBinding()]
+    param(
+        [Parameter(Mandatory = $true)]
+        $TenantFilter,
+        [Parameter(Mandatory = $true)]
+        [AllowEmptyCollection()]
+        [string[]]$ManagedDeviceIds
+    )
+
+    # Matches the states the device page treats as failures (CippDevicePolicySettingStates.jsx).
+    $FailingStates = @('nonCompliant', 'error', 'conflict')
+    $Results = @{}
+
+    $DeviceIds = @($ManagedDeviceIds | Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -Unique)
+    if ($DeviceIds.Count -eq 0) {
+        return $Results
+    }
+
+    $PolicyStateRequests = [System.Collections.Generic.List[object]]::new()
+    foreach ($DeviceId in $DeviceIds) {
+        $PolicyStateRequests.Add(@{
+                id     = $DeviceId
+                method = 'GET'
+                url    = "/deviceManagement/managedDevices('$DeviceId')/deviceCompliancePolicyStates"
+            })
+    }
+    $PolicyStateResponses = New-GraphBulkRequest -Requests $PolicyStateRequests -tenantid $TenantFilter
+
+    # The policy state list only carries the policy name; the failing settings come from a second call per policy state.
+    $SettingStateRequests = [System.Collections.Generic.List[object]]::new()
+    $PolicyNames = @{}
+    foreach ($Response in $PolicyStateResponses) {
+        if (($Response.status -as [int]) -ge 400) {
+            Write-Warning "Get-NinjaOneDeviceNonCompliantSettings: compliance policy states for device '$($Response.id)' returned $($Response.status): $($Response.body.error.message)"
+            continue
+        }
+        $DeviceId = [string]$Response.id
+        foreach ($PolicyState in @($Response.body.value | Where-Object { $_.state -in $FailingStates })) {
+            $RequestId = "$DeviceId|$($PolicyState.id)"
+            $PolicyNames[$RequestId] = $PolicyState.displayName
+            $SettingStateRequests.Add(@{
+                    id     = $RequestId
+                    method = 'GET'
+                    url    = "/deviceManagement/managedDevices('$DeviceId')/deviceCompliancePolicyStates/$($PolicyState.id)/settingStates"
+                })
+        }
+    }
+
+    if ($SettingStateRequests.Count -eq 0) {
+        return $Results
+    }
+
+    $SettingStateResponses = New-GraphBulkRequest -Requests $SettingStateRequests -tenantid $TenantFilter
+
+    $Lines = @{}
+    foreach ($Response in $SettingStateResponses) {
+        if (($Response.status -as [int]) -ge 400) {
+            Write-Warning "Get-NinjaOneDeviceNonCompliantSettings: setting states for '$($Response.id)' returned $($Response.status): $($Response.body.error.message)"
+            continue
+        }
+        $ResponseId = [string]$Response.id
+        $DeviceId = ($ResponseId -split '\|', 2)[0]
+        $PolicyName = $PolicyNames[$ResponseId]
+        if (-not $Lines.ContainsKey($DeviceId)) {
+            $Lines[$DeviceId] = [System.Collections.Generic.List[string]]::new()
+        }
+        foreach ($Setting in @($Response.body.value | Where-Object { $_.state -in $FailingStates })) {
+            $SettingName = if ($Setting.settingName) { $Setting.settingName } elseif ($Setting.setting) { $Setting.setting } else { 'Unknown setting' }
+            $Line = "$($PolicyName): $SettingName"
+            if ($Setting.state -ne 'nonCompliant') {
+                $Line = "$Line ($($Setting.state))"
+            }
+            # A policy reports one setting state per user, so the same failure can appear several times.
+            if (-not $Lines[$DeviceId].Contains($Line)) {
+                $Lines[$DeviceId].Add($Line)
+            }
+        }
+    }
+
+    foreach ($DeviceId in $Lines.Keys) {
+        if ($Lines[$DeviceId].Count -gt 0) {
+            $Results[$DeviceId] = $Lines[$DeviceId] -join "`n"
+        }
+    }
+
+    return $Results
+}
diff --git a/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1 b/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1
index 464b7d790407b..402f12c512974 100644
--- a/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1
+++ b/Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneFieldMapping.ps1
@@ -63,6 +63,12 @@ function Get-NinjaOneFieldMapping {
                 FieldLabel = 'Intune Device Compliance Status - Field Used to Monitor Device Compliance'
                 FieldType  = 'Device'
                 Type       = 'TEXT'
+            },
+            [PSCustomObject]@{
+                FieldName  = 'DeviceNonCompliantSettings'
+                FieldLabel = 'Intune Non-Compliant Settings - Field Used to List the Compliance Policy Settings a Device Fails'
+                FieldType  = 'Device'
+                Type       = @('TEXT_MULTILINE', 'TEXT')
             }
         )
 
diff --git a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1 b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1
index 87688f4144e85..a5e8cae0105cc 100644
--- a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1
+++ b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneDeviceWebhook.ps1
@@ -12,7 +12,7 @@ function Invoke-NinjaOneDeviceWebhook {
             $MappedFields | Add-Member -NotePropertyName $_.RowKey -NotePropertyValue $($_.IntegrationId)
         }
 
-        if ($MappedFields.DeviceCompliance) {
+        if ($MappedFields.DeviceCompliance -or $MappedFields.DeviceNonCompliantSettings) {
             Write-LogMessage -Headers $Headers -API 'NinjaDeviceCompliance' -message "Webhook Received - Updating NinjaOne Device compliance for $($Data.resourceData.id) in $($Data.tenantId)" -Sev 'Info' -tenant $TenantFilter
             $tenantfilter = $Data.tenantId
             $M365DeviceID = $Data.resourceData.id
@@ -32,17 +32,36 @@ function Invoke-NinjaOneDeviceWebhook {
                         return
                     }
 
-                    if ($DeviceM365.isCompliant -eq $True) {
-                        $Compliant = 'Compliant'
-                    } else {
-                        $Compliant = 'Non-Compliant'
+                    $ComplianceBody = @{}
+
+                    if ($MappedFields.DeviceCompliance) {
+                        if ($DeviceM365.isCompliant -eq $True) {
+                            $Compliant = 'Compliant'
+                        } else {
+                            $Compliant = 'Non-Compliant'
+                        }
+                        $ComplianceBody[$MappedFields.DeviceCompliance] = $Compliant
+                    }
+
+                    if ($MappedFields.DeviceNonCompliantSettings) {
+                        # A compliant device clears the field. A non-compliant one gets its failing settings looked up in Intune.
+                        $NonCompliantSettings = $null
+                        if ($DeviceM365.isCompliant -ne $True) {
+                            $ManagedDeviceId = $Device.M365ID
+                            if (-not $ManagedDeviceId) {
+                                # Device map rows written before the Intune id was stored: resolve it from the Entra device id.
+                                $ManagedDeviceId = (New-GraphGetRequest -uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$filter=azureADDeviceId eq '$($DeviceM365.deviceId)'&`$select=id" -Tenantid $tenantfilter | Select-Object -First 1).id
+                            }
+                            if ($ManagedDeviceId) {
+                                $NonCompliantSettings = (Get-NinjaOneDeviceNonCompliantSettings -TenantFilter $tenantfilter -ManagedDeviceIds @($ManagedDeviceId))["$ManagedDeviceId"]
+                            }
+                        }
+                        $ComplianceBody[$MappedFields.DeviceNonCompliantSettings] = $NonCompliantSettings
                     }
 
-                    $ComplianceBody = @{
-                        "$($MappedFields.DeviceCompliance)" = $Compliant
-                    } | ConvertTo-Json
+                    $ComplianceBodyJson = $ComplianceBody | ConvertTo-Json
 
-                    $Null = Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/device/$($Device.NinjaOneID)/custom-fields" -Method PATCH -Body $ComplianceBody -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json'
+                    $Null = Invoke-WebRequest -Uri "https://$($Configuration.Instance)/api/v2/device/$($Device.NinjaOneID)/custom-fields" -Method PATCH -Body $ComplianceBodyJson -Headers @{Authorization = "Bearer $($token.access_token)" } -ContentType 'application/json; charset=utf-8'
 
                     Write-Host 'Updated NinjaOne Device Compliance'
                 } catch {
diff --git a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1 b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1
index e632361a688ce..e2486aff76977 100644
--- a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1
+++ b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneExtensionScheduler.ps1
@@ -43,14 +43,6 @@ function Invoke-NinjaOneExtensionScheduler {
             }
         }
 
-        $CveBatch = foreach ($Tenant in $TenantsToProcess) {
-            [PSCustomObject]@{
-                'NinjaAction'  = 'CveSyncTenant'
-                'MappedTenant' = $Tenant
-                'FunctionName' = 'NinjaOneQueue'
-            }
-        }
-
         if (($Batch | Measure-Object).Count -gt 0) {
             $InputObject = [PSCustomObject]@{
                 OrchestratorName = 'NinjaOneOrchestrator'
@@ -61,15 +53,6 @@ function Invoke-NinjaOneExtensionScheduler {
             Write-Host "Started permissions orchestration with ID = '$InstanceId'"
         }
 
-        if (($CveBatch | Measure-Object).Count -gt 0) {
-            $CveInputObject = [PSCustomObject]@{
-                OrchestratorName = 'NinjaOneOrchestrator'
-                Batch            = @($CveBatch)
-            }
-            $CveInstanceId = Start-CIPPOrchestrator -InputObject $CveInputObject
-            Write-Host "Started CVE sync orchestration with ID = '$CveInstanceId'"
-        }
-
         $AddObject = @{
             PartitionKey   = 'NinjaConfig'
             RowKey         = 'NinjaLastRunTime'
diff --git a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1
index 4b740b1d2eb46..86393938a0edc 100644
--- a/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1
+++ b/Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1
@@ -462,6 +462,21 @@ function Invoke-NinjaOneTenantSync {
 
         $DevicesToProcess = $Devices | Where-Object { $_.id -notin $ParsedDevices.id }
 
+        # Look up the compliance policy settings each non-compliant device fails in one Graph batch for the tenant.
+        # If the lookup fails the field is left untouched this run rather than being cleared.
+        $NonCompliantSettings = @{}
+        $NonCompliantSettingsAvailable = $false
+        if ($MappedFields.DeviceNonCompliantSettings) {
+            $NonCompliantDeviceIds = @($DevicesToProcess | Where-Object { $_.complianceState -ne 'compliant' -and $_.id } | Select-Object -ExpandProperty id)
+            try {
+                $NonCompliantSettings = Get-NinjaOneDeviceNonCompliantSettings -TenantFilter $Customer.defaultDomainName -ManagedDeviceIds $NonCompliantDeviceIds
+                $NonCompliantSettingsAvailable = $true
+            } catch {
+                $ErrorMessage = Get-CippException -Exception $_
+                Write-LogMessage -tenant $TenantFilter -API 'NinjaOneSync' -message "Failed to retrieve the non-compliant settings for $($NonCompliantDeviceIds.Count) devices, the Intune Non-Compliant Settings field will not be updated this run: $($ErrorMessage.NormalizedError)" -Sev 'Warning' -LogData $ErrorMessage
+            }
+        }
+
         # Parse Devices
         foreach ($Device in $DevicesToProcess) {
 
@@ -550,6 +565,9 @@ function Invoke-NinjaOneTenantSync {
                 }
             }
 
+            # Only non-compliant devices carry failing settings; compliant devices get the field cleared.
+            $DeviceNonCompliantSettings = if ($Device.complianceState -ne 'compliant') { $NonCompliantSettings["$($Device.id)"] } else { $null }
+
             $ParsedDevice = [PSCustomObject]@{
                 PartitionKey        = $Customer.CustomerId
                 RowKey              = $device.AzureADDeviceId
@@ -578,6 +596,7 @@ function Invoke-NinjaOneTenantSync {
                 UserIDs             = $DeviceUserIDs
                 UserDetails         = $DeviceUsersDetail
                 CompliancePolicies  = $DevicePolcies
+                NonCompliantSettings = $DeviceNonCompliantSettings
                 Groups              = $DeviceGroups
                 NinjaDevice         = $MatchedNinjaDevice
                 DeviceLink          = $ParsedDeviceName
@@ -705,9 +724,14 @@ function Invoke-NinjaOneTenantSync {
 
             }
 
+            if ($MappedFields.DeviceNonCompliantSettings -and $NonCompliantSettingsAvailable) {
+                # A null value clears the field, so a NinjaOne condition on 'is not empty' only fires for devices with a real failure.
+                $NinjaDeviceUpdate | Add-Member -NotePropertyName $MappedFields.DeviceNonCompliantSettings -NotePropertyValue $DeviceNonCompliantSettings
+            }
+
             # Update Device. Default to success so devices with no mapped fields are still cached.
             $DeviceFieldsUpdated = $true
-            if ($MappedFields.DeviceSummary -or $MappedFields.DeviceLinks -or $MappedFields.DeviceCompliance) {
+            if ($MappedFields.DeviceSummary -or $MappedFields.DeviceLinks -or $MappedFields.DeviceCompliance -or $MappedFields.DeviceNonCompliantSettings) {
                 $DeviceFieldsUpdated = $false
                 try {
                     $UpdateBody = $NinjaDeviceUpdate | ConvertTo-Json -Depth 100
@@ -732,7 +756,7 @@ function Invoke-NinjaOneTenantSync {
         }
 
         # Enable Device Updates Subscription if needed.
-        if ($MappedFields.DeviceCompliance) {
+        if ($MappedFields.DeviceCompliance -or $MappedFields.DeviceNonCompliantSettings) {
             New-CIPPGraphSubscription -TenantFilter $TenantFilter -TypeofSubscription 'updated' -BaseURL $CIPPUrl -Resource 'devices' -EventType 'DeviceUpdate' -Headers 'NinjaOneSync'
         }
 
@@ -1095,7 +1119,7 @@ function Invoke-NinjaOneTenantSync {
                     },
                     @{
                         Name = 'Research Compromise'
-                        Link = "https://$($CIPPURL)/identity/administration/users/user/bec?userId=$($User.id)&tenantFilter=$($Customer.defaultDomainName)"
+                        Link = "https://$($CIPPURL)/identity/administration/bec/case?userId=$($User.id)&tenantFilter=$($Customer.defaultDomainName)"
                         Icon = 'fas fa-user-secret'
                     }
                 )
@@ -2025,7 +2049,7 @@ function Invoke-NinjaOneTenantSync {
             }
 
             # Unused Licenses
-            $UnusedLicenseLink = "https://$CIPPUrl/tenant/standards/bpa-report?tenantFilter=$($Customer.defaultDomainName)"
+            $UnusedLicenseLink = "https://$CIPPUrl/tenant/reports/list-licenses?tenantFilter=$($Customer.defaultDomainName)"
             if (-not $HasLicenseData) {
                 $WidgetData.add([PSCustomObject]@{ Value = 'No data'; Description = 'Unused Licenses'; Colour = '#CCCCCC'; Link = $UnusedLicenseLink })
             } else {
@@ -2041,7 +2065,7 @@ function Invoke-NinjaOneTenantSync {
             $WidgetData.add((& $NewPostureWidget -Description 'Unified Audit Log' -Link "https://security.microsoft.com/auditlogsearch?viewid=Async%20Search&tid=$($Customer.customerId)" -HasData $HasAuditConfig -State $UnifiedAuditLogEnabled))
 
             # Password Never Expires
-            $WidgetData.add((& $NewPostureWidget -Description 'Password Never Expires' -Link "https://$CIPPUrl/tenant/standards/bpa-report?tenantFilter=$($Customer.defaultDomainName)" -HasData $HasDomainData -State $PasswordNeverExpires))
+            $WidgetData.add((& $NewPostureWidget -Description 'Password Never Expires' -Link "https://$CIPPUrl/tenant/administration/domains?tenantFilter=$($Customer.defaultDomainName)" -HasData $HasDomainData -State $PasswordNeverExpires))
 
             # OAuth App Consent
             $WidgetData.add((& $NewPostureWidget -Description 'OAuth App Consent' -Link "https://entra.microsoft.com/$($Customer.defaultDomainName)/#view/Microsoft_AAD_IAM/ConsentPoliciesMenuBlade/~/UserSettings" -HasData $HasAuthPolicy -State $OAuthConsentRestricted))
diff --git a/Modules/HuduAPI/2.4.9/HuduAPI.psm1 b/Modules/HuduAPI/2.4.9/HuduAPI.psm1
index 24c908667318d..c060007467900 100644
--- a/Modules/HuduAPI/2.4.9/HuduAPI.psm1
+++ b/Modules/HuduAPI/2.4.9/HuduAPI.psm1
@@ -3321,10 +3321,14 @@ function Set-HuduAssetLayout {
             'dropdown'          { $field.'field_type' = 'Dropdown' }
             'embed'             { $field.'field_type' = 'Embed' }
             'phone'             { $field.'field_type' = 'Phone' }
-            ('email'    -or 'copyabletext')     { $field.'field_type' = 'Email' }
-            ('assettag' -or 'assetlink')        { $field.'field_type' = 'AssetTag' }
-            ('website'  -or 'link')             { $field.'field_type' = 'Website' }
-            ('password' -or 'confidentialtext') { $field.'field_type' = 'Password' }
+            'email'             { $field.'field_type' = 'Email' }
+            'copyabletext'      { $field.'field_type' = 'Email' }
+            'assettag'          { $field.'field_type' = 'AssetTag' }
+            'assetlink'         { $field.'field_type' = 'AssetTag' }
+            'website'           { $field.'field_type' = 'Website' }
+            'link'              { $field.'field_type' = 'Website' }
+            'password'          { $field.'field_type' = 'Password' }
+            'confidentialtext'  { $field.'field_type' = 'Password' }
             Default { Write-Error "Invalid field type: $($field.'field_type') found in field $($field.name)"; break }
         }
     }
diff --git a/Shared/CIPPSharp/CIPPRestClient.cs b/Shared/CIPPSharp/CIPPRestClient.cs
index f0cd53d979e00..a81e711306a36 100644
--- a/Shared/CIPPSharp/CIPPRestClient.cs
+++ b/Shared/CIPPSharp/CIPPRestClient.cs
@@ -293,6 +293,11 @@ public static class CIPPRestClient
         /// Covers graph.microsoft.com and any *.microsoft.com graph surface.
         /// Cap: 30 connections.
         /// </summary>
+        // Per-lane connection cap. Override any lane with env "<Lane>MaxConnectionsPerServer"
+        // (e.g. ExoMaxConnectionsPerServer) for load testing; otherwise the tuned default applies.
+        private static int MaxConn(string envVar, int fallback)
+            => int.TryParse(Environment.GetEnvironmentVariable(envVar), out var v) && v > 0 ? v : fallback;
+
         private static HttpClient BuildGraphClient() => new HttpClient(new SocketsHttpHandler
         {
             AutomaticDecompression         = DecompressionMethods.All,
@@ -301,14 +306,14 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = true,   // Graph supports HTTP/2; streams share connections
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 10,
-            MaxConnectionsPerServer        = 30,
+            MaxConnectionsPerServer        = MaxConn("GraphMaxConnectionsPerServer", 30),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
         /// EXO client — Exchange Online and Outlook endpoints.
         /// Covers outlook.office365.com, outlook.office.com, outlook.com,
         /// and *.protection.outlook.com (mail protection / transport).
-        /// Cap: 20 connections.
+        /// Cap: 30 connections (override with env <c>ExoMaxConnectionsPerServer</c>).
         /// HTTP/2 enabled — EXO REST APIs support it.
         /// </summary>
         private static HttpClient BuildExoClient() => new HttpClient(new SocketsHttpHandler
@@ -319,7 +324,7 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = true,
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 10,
-            MaxConnectionsPerServer        = 20,
+            MaxConnectionsPerServer        = MaxConn("ExoMaxConnectionsPerServer", 30),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
@@ -337,7 +342,7 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = false,
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 5,
-            MaxConnectionsPerServer        = 5,
+            MaxConnectionsPerServer        = MaxConn("LoginMaxConnectionsPerServer", 5),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
@@ -356,7 +361,7 @@ public static class CIPPRestClient
             PooledConnectionIdleTimeout    = TimeSpan.FromMinutes(2),
             EnableMultipleHttp2Connections = false,
             AllowAutoRedirect              = false,  // 3xx IS the expected response here
-            MaxConnectionsPerServer        = 5,
+            MaxConnectionsPerServer        = MaxConn("ComplianceMaxConnectionsPerServer", 5),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
@@ -373,7 +378,7 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = true,
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 10,
-            MaxConnectionsPerServer        = 5,
+            MaxConnectionsPerServer        = MaxConn("PartnerCenterMaxConnectionsPerServer", 5),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
@@ -389,7 +394,7 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = true,
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 10,
-            MaxConnectionsPerServer        = 5,
+            MaxConnectionsPerServer        = MaxConn("AdminPlaneMaxConnectionsPerServer", 5),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
@@ -410,7 +415,7 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = false,
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 10,
-            MaxConnectionsPerServer        = 5,
+            MaxConnectionsPerServer        = MaxConn("SpoMaxConnectionsPerServer", 5),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
@@ -428,7 +433,7 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = false,
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 5,
-            MaxConnectionsPerServer        = 2,
+            MaxConnectionsPerServer        = MaxConn("DnsMaxConnectionsPerServer", 2),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         /// <summary>
@@ -447,7 +452,7 @@ public static class CIPPRestClient
             EnableMultipleHttp2Connections = true,
             AllowAutoRedirect              = true,
             MaxAutomaticRedirections       = 10,
-            MaxConnectionsPerServer        = 5,
+            MaxConnectionsPerServer        = MaxConn("DefaultMaxConnectionsPerServer", 5),
         }) { Timeout = Timeout.InfiniteTimeSpan };
 
         // -----------------------------------------------------------------
diff --git a/Shared/CIPPSharp/CIPPSharp.csproj b/Shared/CIPPSharp/CIPPSharp.csproj
index 6c7a3f192bdb0..c3c5620a59000 100644
--- a/Shared/CIPPSharp/CIPPSharp.csproj
+++ b/Shared/CIPPSharp/CIPPSharp.csproj
@@ -13,8 +13,22 @@
     <AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
     <OutputPath>bin\</OutputPath>
     <AppendRuntimeIdentifierToOutputPath>false</AppendRuntimeIdentifierToOutputPath>
+    <!-- No deps.json is generated (GenerateDependencyFile=false), so NuGet runtime assemblies must be
+         copied physically next to CIPPSharp.dll for the PowerShell host to resolve them by same-dir probing. -->
+    <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="PowerShellStandard.Library" Version="5.1.1" PrivateAssets="all" />
+    <!-- Compile-only: ExcludeAssets="runtime" keeps the System.Management.Automation facade out of bin\
+         (PowerShell supplies the real assembly at runtime) while still compiling against its types. -->
+    <PackageReference Include="PowerShellStandard.Library" Version="5.1.1" PrivateAssets="all" ExcludeAssets="runtime" />
+  </ItemGroup>
+  <ItemGroup>
+    <!-- Server-side PDF renderer. MIT, zero third-party deps: only OfficeIMO.Pdf.dll + OfficeIMO.Core.dll land in bin\.
+         INTERIM: vendored net8.0 builds of OfficeIMO 3.4.3 (unreleased) from upstream master 399adf1d1, which
+         carries the report-generation performance work (#2577: table layout, text/number formatting, image reuse
+         and segmented object storage; output unchanged), measured with build/tools/pdf-bench. Once a release
+         ships that work, restore <PackageReference Include="OfficeIMO.Pdf" Version="..." /> and delete lib\. -->
+    <Reference Include="OfficeIMO.Pdf" HintPath="lib\OfficeIMO.Pdf.dll" />
+    <Reference Include="OfficeIMO.Core" HintPath="lib\OfficeIMO.Core.dll" />
   </ItemGroup>
 </Project>
diff --git a/Shared/CIPPSharp/Reporting/FontCmap.cs b/Shared/CIPPSharp/Reporting/FontCmap.cs
new file mode 100644
index 0000000000000..b322e49711c6b
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/FontCmap.cs
@@ -0,0 +1,98 @@
+using System.Collections.Generic;
+using System.Text;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// A minimal read-only TrueType/OpenType <c>cmap</c> reader: enough to enumerate the Unicode code
+    /// points a font can draw, so the bundled emoji fallback is the single source of truth for both what
+    /// <see cref="ReportMarkdown.Sanitize"/> keeps and which ranges OfficeIMO routes to it. Reads the
+    /// Windows Unicode BMP subtable (format 4) and the full-repertoire subtable (format 12, which carries
+    /// the astral emoji); all multi-byte fields are big-endian per the sfnt spec.
+    /// </summary>
+    internal static class FontCmap
+    {
+        public static IEnumerable<int> ReadCodepoints(byte[] f)
+        {
+            var result = new List<int>();
+            if (f.Length < 12) return result;
+
+            var numTables = U16(f, 4);
+            var cmapOffset = -1;
+            for (var i = 0; i < numTables; i++)
+            {
+                var rec = 12 + i * 16;
+                if (rec + 16 > f.Length) break;
+                if (Encoding.ASCII.GetString(f, rec, 4) == "cmap") { cmapOffset = (int)U32(f, rec + 8); break; }
+            }
+            if (cmapOffset < 0 || cmapOffset + 4 > f.Length) return result;
+
+            var subCount = U16(f, cmapOffset + 2);
+            var best4 = -1;
+            var best12 = -1;
+            for (var i = 0; i < subCount; i++)
+            {
+                var p = cmapOffset + 4 + i * 8;
+                if (p + 8 > f.Length) break;
+                var platform = U16(f, p);
+                var encoding = U16(f, p + 2);
+                var subOffset = cmapOffset + (int)U32(f, p + 4);
+                if (subOffset + 2 > f.Length) continue;
+                var format = U16(f, subOffset);
+                if (format == 12 && (platform == 3 && encoding == 10 || platform == 0)) best12 = subOffset;
+                else if (format == 4 && best4 < 0 && (platform == 3 && encoding == 1 || platform == 0)) best4 = subOffset;
+            }
+
+            if (best12 >= 0) ReadFormat12(f, best12, result);
+            if (best4 >= 0) ReadFormat4(f, best4, result);
+            return result;
+        }
+
+        private static void ReadFormat4(byte[] f, int o, List<int> outp)
+        {
+            var segX2 = U16(f, o + 6);
+            var segCount = segX2 / 2;
+            var endO = o + 14;
+            var startO = endO + segX2 + 2;
+            var deltaO = startO + segX2;
+            var rangeO = deltaO + segX2;
+            for (var s = 0; s < segCount; s++)
+            {
+                var end = U16(f, endO + s * 2);
+                var start = U16(f, startO + s * 2);
+                if (start == 0xFFFF) continue;
+                var delta = U16(f, deltaO + s * 2);
+                var ro = U16(f, rangeO + s * 2);
+                for (var c = start; c <= end; c++)
+                {
+                    int g;
+                    if (ro == 0) g = (c + delta) & 0xFFFF;
+                    else
+                    {
+                        var gi = rangeO + s * 2 + ro + (c - start) * 2;
+                        if (gi + 2 > f.Length) continue;
+                        g = U16(f, gi);
+                        if (g != 0) g = (g + delta) & 0xFFFF;
+                    }
+                    if (g != 0) outp.Add(c);
+                }
+            }
+        }
+
+        private static void ReadFormat12(byte[] f, int o, List<int> outp)
+        {
+            var nGroups = U32(f, o + 12);
+            for (long i = 0; i < nGroups; i++)
+            {
+                var p = o + 16 + (int)i * 12;
+                if (p + 12 > f.Length) break;
+                var startChar = U32(f, p);
+                var endChar = U32(f, p + 4);
+                for (var c = startChar; c <= endChar && c <= 0x10FFFF; c++) outp.Add((int)c);
+            }
+        }
+
+        private static int U16(byte[] f, int o) => (f[o] << 8) | f[o + 1];
+        private static long U32(byte[] f, int o) => ((long)f[o] << 24) | ((long)f[o + 1] << 16) | ((long)f[o + 2] << 8) | f[o + 3];
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/ReportComponents.cs b/Shared/CIPPSharp/Reporting/ReportComponents.cs
new file mode 100644
index 0000000000000..797b4f46017f9
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/ReportComponents.cs
@@ -0,0 +1,2117 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using OfficeIMO.Drawing;
+using OfficeIMO.Pdf;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// The reusable component kit - the server port of reportPdfPrimitives.jsx. Every component takes the
+    /// <see cref="ReportContext"/> (theme/styles/variables) and the current OfficeIMO <see cref="PdfContentBuilder"/>,
+    /// and encapsulates all OfficeIMO calls. Reports compose these; no report inlines a raw OfficeIMO call.
+    /// </summary>
+    public static class ReportComponents
+    {
+        private const double CodeParagraphSize = ReportStyles.CodeBlock;
+
+        // Make any raw string safe for the PDF standard fonts (strips/maps emoji etc.).
+        private static string San(string? s) => ReportMarkdown.Sanitize(s);
+
+        // -- colour bridge --
+        public static PdfColor Pdf(string hex)
+        {
+            var (r, g, b) = ColourMath.ToRgb(hex);
+            return PdfColor.FromRgb((byte)r, (byte)g, (byte)b);
+        }
+
+        // -- images --
+        /// <summary>Decode a data-URL/base64 image (or resolve a bundled /reportImages/ path) into bytes OfficeIMO can draw anywhere, or null.</summary>
+        public static byte[]? DecodeImage(string? dataUrl)
+        {
+            if (string.IsNullOrWhiteSpace(dataUrl)) return null;
+            var s = dataUrl.Trim();
+
+            // A bundled stock image referenced by the frontend path it has always used, e.g.
+            // "/reportImages/board.jpg". The browser used to fetch these from public/reportImages; the
+            // server ships the same files beside the assembly under reportImages/, so resolve the path to
+            // those bytes. Only the file name is honoured (no traversal), and only files that ship return.
+            var stock = ReportImagesPathPattern.Match(s);
+            if (stock.Success) return ReportImage(stock.Groups[1].Value);
+
+            // A branding logo or uploaded cover is the same data URL on every render for a tenant, so it is
+            // decoded (and an SVG rasterised) once, and every render hands OfficeIMO the same array - which
+            // also lets OfficeIMO's per-array prepared-image cache hit across renders. Keyed by the data URL
+            // itself: a lookup is a fast string hash and compare, where a digest of a large upload is not.
+            var key = s;
+            if (DecodedImageCache.TryGetValue(key, out var cached)) return cached;
+            var comma = s.IndexOf("base64,", StringComparison.OrdinalIgnoreCase);
+            if (comma >= 0) s = s.Substring(comma + "base64,".Length);
+            byte[]? bytes;
+            try { bytes = NormaliseImage(Convert.FromBase64String(s.Trim())); } catch { bytes = null; }
+            // ponytail: clear-on-overflow, not LRU; a byte budget keeps a burst of distinct brandings bounded.
+            // An entry bigger than a quarter of the budget (an upload of roughly 3 MB, counting its data URL)
+            // is not kept, so one huge image cannot clear everything else for itself. Each cached array also
+            // keeps OfficeIMO's prepared copy of it alive, so what this retains is a few times the budget.
+            var size = 2L * key.Length + (bytes?.Length ?? 0);
+            if (size > DecodedImageCacheBudget / 4) return bytes;
+            if (Interlocked.Add(ref decodedImageCacheBytes, size) > DecodedImageCacheBudget)
+            {
+                DecodedImageCache.Clear();
+                Interlocked.Exchange(ref decodedImageCacheBytes, size);
+            }
+            DecodedImageCache[key] = bytes;
+            return bytes;
+        }
+
+        private const long DecodedImageCacheBudget = 32L * 1024 * 1024;
+        private static long decodedImageCacheBytes;
+        private static readonly ConcurrentDictionary<string, byte[]?> DecodedImageCache = new(StringComparer.Ordinal);
+
+        // Every raster OfficeIMO decodes (PNG, JPEG, GIF, BMP, TIFF, WebP) is handed to it as-is. An SVG
+        // is only accepted by the drawing API, not by flow images or page backgrounds, so it is rasterised
+        // once here through OfficeIMO's own SVG reader - transparent background, ~1200px on the long side,
+        // crisp at logo and cover sizes and a few KB for a typical logo - and then behaves like a PNG.
+        // Anything OfficeIMO cannot identify is dropped here rather than left to fail at serialisation.
+        // Add-CIPPImage enforces the same list at upload time.
+        private const double SvgRasterSize = 1200;
+        private static byte[]? NormaliseImage(byte[] bytes)
+        {
+            try
+            {
+                if (!OfficeImageReader.TryIdentifyByContent(bytes, null, out var info)) return null;
+                if (info.Format != OfficeImageFormat.Svg) return bytes;
+                if (!OfficeSvgDrawingReader.TryRead(bytes, out var drawing) || drawing.Width <= 0 || drawing.Height <= 0) return null;
+                return OfficeDrawingRasterRenderer.ToPng(drawing, SvgRasterSize / Math.Max(drawing.Width, drawing.Height), null);
+            }
+            catch { return null; }
+        }
+
+        private static readonly Regex ReportImagesPathPattern =
+            new(@"(?:^|/)reportImages/([A-Za-z0-9_.\-]+\.(?:jpg|jpeg|png|gif|webp))$", RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+        // Stock report images (cover/hero photos) ship beside the assembly under reportImages/, mirroring
+        // how the twemoji PNG set and the fallback font are placed. Loaded once per file and cached.
+        private static readonly Lazy<string?> ReportImageDir = new(() =>
+        {
+            try
+            {
+                var d = Path.GetDirectoryName(typeof(ReportComponents).Assembly.Location);
+                if (string.IsNullOrEmpty(d)) return null;
+                var dir = Path.Combine(d, "reportImages");
+                return Directory.Exists(dir) ? dir : null;
+            }
+            catch { return null; }
+        });
+
+        private static readonly ConcurrentDictionary<string, byte[]?> ReportImageCache = new(StringComparer.OrdinalIgnoreCase);
+
+        /// <summary>Load a bundled stock report image by file name (no path segments), or null if it is not shipped.</summary>
+        public static byte[]? ReportImage(string? fileName)
+        {
+            if (string.IsNullOrWhiteSpace(fileName)) return null;
+            var key = Path.GetFileName(fileName); // defence in depth: strip any path
+            return ReportImageCache.GetOrAdd(key, k =>
+            {
+                var dir = ReportImageDir.Value;
+                if (dir is null) return null;
+                try
+                {
+                    var path = Path.Combine(dir, k);
+                    return File.Exists(path) ? File.ReadAllBytes(path) : null;
+                }
+                catch { return null; }
+            });
+        }
+
+        /// <summary>
+        /// The box a branding logo is drawn in: the client sets a fixed height (cover 100pt, page header
+        /// 30pt) and lets the width follow the image's aspect ratio; the width cap keeps a banner-shaped
+        /// logo off the cover date and out of the page-header title column.
+        /// </summary>
+        public static (double w, double h) LogoBox(byte[] bytes, double height, double maxWidth)
+        {
+            var (pxW, pxH) = ImageSize(bytes);
+            var w = pxW * (height / pxH);
+            if (w > maxWidth) { height *= maxWidth / w; w = maxWidth; }
+            return (Math.Round(w), Math.Round(height));
+        }
+
+        /// <summary>The MIME type a drawing needs beside the bytes, from the content itself; null when OfficeIMO cannot identify it (skipped rather than failing).</summary>
+        public static string? ImageContentType(byte[] b)
+        {
+            try { return OfficeImageReader.TryIdentifyByContent(b, null, out var info) ? info.MimeType : null; }
+            catch { return null; }
+        }
+
+        /// <summary>Pixel size of any image OfficeIMO identifies (a 4:3 guess for anything it cannot).</summary>
+        public static (int w, int h) ImageSize(byte[] b)
+        {
+            try
+            {
+                if (OfficeImageReader.TryIdentifyByContent(b, null, out var info) && info.Width > 0 && info.Height > 0)
+                    return (info.Width, info.Height);
+            }
+            catch { /* fall through to the guess */ }
+            return (800, 600);
+        }
+
+        // -- inline runs --
+        // `size` is the base font size for the paragraph's runs (markdown has no size marks, so every run
+        // in a paragraph shares it). Without an explicit size OfficeIMO falls back to its ~12pt default,
+        // which is why body copy rendered far larger than the client's 9pt.
+        private static void ApplyRuns(PdfParagraphBuilder b, IReadOnlyList<TextRun> runs, string bodyColour, double size)
+        {
+            if (runs.Count == 0) { b.Text(" "); return; }
+            b.Color(Pdf(bodyColour)).FontSize(size);
+            foreach (var r in runs)
+            {
+                // Emoji split out to inline colour images (or a monochrome glyph) so the surrounding copy
+                // keeps its font/weight and an emoji never lands in a bold/italic run the fallback can't draw.
+                foreach (var seg in SegmentEmoji(r.Text))
+                {
+                    switch (seg.Kind)
+                    {
+                        case EmojiSegKind.Image:
+                            b.InlineImage(seg.Image!, size, size, seg.Text, OfficeImageFit.Contain, EmojiOffset(size));
+                            break;
+                        case EmojiSegKind.Mono:
+                            b.Bold(false).Italic(false).Underline(false).Strike(false).Font(PdfStandardFont.Helvetica).Color(Pdf(seg.Tint ?? bodyColour)).Text(seg.Text);
+                            break;
+                        default:
+                            b.Bold(r.Bold).Italic(r.Italic).Underline(r.Underline).Strike(r.Strike)
+                             .Font(r.Code ? PdfStandardFont.Courier : PdfStandardFont.Helvetica).Color(Pdf(bodyColour)).Text(seg.Text);
+                            break;
+                    }
+                }
+            }
+        }
+
+        // -- primitives --
+        public static void Heading(ReportContext ctx, PdfContentBuilder item, int level, IReadOnlyList<TextRun> runs)
+        {
+            var text = RunsToPlain(runs);
+            var colour = level switch { 1 => ReportColours.Ink, 2 => ctx.Theme.Palette["heading"], _ => ReportColours.Body };
+            var size = level switch { 1 => ReportStyles.Heading1, 2 => ReportStyles.Heading2, _ => ReportStyles.Heading3 };
+            // A markdown heading is drawn as a bold paragraph (rather than item.H1/H2/H3) so an emoji in the
+            // heading renders as an inline colour image instead of a monochrome font glyph.
+            item.Paragraph(b => { b.FontSize(size); EmitInline(b, text, colour, size, bold: true); },
+                PdfAlign.Left, null, new PdfParagraphStyle { LineHeight = 1.15, SpacingAfter = 6 });
+        }
+
+        // The text style a run of copy is drawn with. Threaded from the enclosing component so body copy,
+        // callout text and captions each render at their own size/colour/alignment - the server mirror of
+        // the client's context-driven styles.
+        public readonly struct TextStyle
+        {
+            public double Size { get; init; }
+            public string Colour { get; init; }
+            public PdfAlign Align { get; init; }
+            public double LineHeight { get; init; }
+            public double SpacingAfter { get; init; }
+        }
+
+        // OfficeIMO leads a flow paragraph off the document's 11pt default size rather than its runs' size (a
+        // larger run raises its line by the same ratio) and seats the first baseline FlowBaseline under the
+        // paragraph's top. A client line is its lineHeight x the size, with the baseline 0.9x the size under
+        // the line top. So a client lineHeight becomes a LineHeight scaled by size / 11, and a paragraph of
+        // runs larger than 9pt needs (0.9 x size - FlowBaseline) of space above it to seat its baseline.
+        internal const double FlowBaseSize = 11, FlowBaseline = 8.1;
+        private static double FlowLineHeight(double clientLineHeight, double size) => clientLineHeight * size / Math.Max(size, FlowBaseSize);
+
+        // Body copy (client bodyText): 9pt at lineHeight 1.5, 8pt after, justified.
+        public static TextStyle BodyStyle(ReportContext ctx) => new()
+        {
+            Size = ReportStyles.Body, Colour = ctx.Theme.Palette["body"], Align = PdfAlign.Justify, LineHeight = FlowLineHeight(1.5, ReportStyles.Body), SpacingAfter = 8,
+        };
+
+        public static void Paragraph(ReportContext ctx, PdfContentBuilder item, IReadOnlyList<TextRun> runs, TextStyle? style = null)
+        {
+            var st = style ?? BodyStyle(ctx);
+            item.Paragraph(b => ApplyRuns(b, runs, st.Colour, st.Size), st.Align, null,
+                new PdfParagraphStyle { LineHeight = st.LineHeight, SpacingAfter = st.SpacingAfter });
+        }
+
+        // Section title (client sectionTitle): 14pt bold heading colour on the page's 14pt line, marginBottom 8.
+        // The space above seats the baseline 0.9x the size under the line top, and comes out of the 8 below.
+        private const double SectionTitleSeat = 0.9 * ReportStyles.SectionTitle - FlowBaseline;
+        public static void SectionTitle(ReportContext ctx, PdfContentBuilder item, string title)
+            => item.Paragraph(b => { b.FontSize(ReportStyles.SectionTitle); EmitInline(b, title, ctx.Theme.Palette["heading"], ReportStyles.SectionTitle, bold: true); },
+                PdfAlign.Left, null, new PdfParagraphStyle
+                {
+                    LineHeight = FlowLineHeight(14 / ReportStyles.SectionTitle, ReportStyles.SectionTitle),
+                    SpacingBefore = SectionTitleSeat,
+                    SpacingAfter = 8 - SectionTitleSeat,
+                });
+
+        // A callout's list rendered as one paragraph, a line break between items (a panel ignores list
+        // styling, so this matches the client's single-text-block callout bullets). `marker(i)` prefixes
+        // each line (a bullet dot, or "N. " for numbered).
+        private static void BulletLines(ReportContext ctx, PdfContentBuilder item, IReadOnlyList<string> items, TextStyle ts, Func<int, string> marker)
+        {
+            if (items.Count == 0) return;
+            item.Paragraph(b =>
+            {
+                b.FontSize(ts.Size).Color(Pdf(ts.Colour));
+                for (var i = 0; i < items.Count; i++)
+                {
+                    if (i > 0) b.LineBreak();
+                    b.Color(Pdf(ts.Colour)).Text(marker(i));
+                    EmitToBuilder(b, San(items[i]), ts.Colour, ts.Size);
+                }
+            }, PdfAlign.Left, null, new PdfParagraphStyle { LeftIndent = 12, SpacingAfter = ts.SpacingAfter, LineHeight = ts.LineHeight });
+        }
+
+        public static void Bullets(ReportContext ctx, PdfContentBuilder item, IEnumerable<string> items, double? size = null)
+            => BulletParagraphs(ctx, item, new List<string>(items), size ?? ReportStyles.BulletText, _ => "•  ");
+
+        // A bullet/numbered list drawn as one paragraph per item (marker + emoji-aware text) rather than
+        // item.Bullets, so an emoji in a list item renders as an inline colour image. Marker in the heading
+        // colour; matches the old ListStyle (indent 12, 4pt item spacing, 1.3 line height).
+        private static void BulletParagraphs(ReportContext ctx, PdfContentBuilder item, IReadOnlyList<string> items, double size, Func<int, string> marker)
+        {
+            var body = ctx.Theme.Palette["body"];
+            var markerColour = ctx.Theme.Palette["heading"];
+            for (var i = 0; i < items.Count; i++)
+            {
+                var idx = i;
+                item.Paragraph(b =>
+                {
+                    b.FontSize(size);
+                    b.Bold(true).Color(Pdf(markerColour)).Text(marker(idx));
+                    EmitToBuilder(b, San(items[idx]), body, size);
+                }, PdfAlign.Left, null, new PdfParagraphStyle { LeftIndent = 12, SpacingAfter = 4, LineHeight = 1.3 });
+            }
+        }
+
+        public static void Numbered(ReportContext ctx, PdfContentBuilder item, IEnumerable<string> items, int start, double? size = null)
+            => BulletParagraphs(ctx, item, new List<string>(items), size ?? ReportStyles.BulletText, i => (start + i) + ".  ");
+
+        // The branded cover, drawn as a page-sized OfficeDrawing over an optional full-bleed cover photo
+        // (client CoverPage): date top-right, a rounded pill label chip, the two-tone title, the subtitle
+        // and tenant vertically placed, and the confidential note at the bottom. A drawing lets the chip
+        // be a real rounded pill and the confidential note sit at the page foot - neither is possible in
+        // the plain content flow.
+        public static void RenderCoverDrawing(ReportContext ctx, PdfContentBuilder item)
+        {
+            var w = ctx.ContentWidth - 2;
+            // A drawing exactly the content height is rejected as too tall (as with width): landscape trips
+            // this because the A4 long edge is a hair over the page height, so shave 2pt off both here.
+            var h = ctx.ContentHeight - 2;
+            const double leftPad = 28;
+            var coverText = ctx.Theme.Palette["coverText"];
+            var subtitleC = ctx.Theme.Palette["subtitle"];
+            var primary = ctx.Theme.Primary;
+            var dw = new OfficeDrawing(w, h);
+
+            // Vertical anchors mirror the client cover's fixed paddings (page pad 60, a header row of the
+            // logo and date with a 40pt margin under it, hero paddingTop 24) rather than a proportion of
+            // page height, so the block lands where the react-pdf cover puts it. The drawing origin already
+            // sits at the page margin, so each client "from page top" figure is offset by PagePadding here.
+            const double coverPad = 60, headerGap = 40, heroPad = 24, logoHeight = 100;
+            var headerTop = coverPad - ReportStyles.PagePadding;
+
+            // The client cover's text sits on react-pdf's natural Helvetica leading: a line box 1.1x the size
+            // with the baseline 0.9x the size under its top. AddText puts the baseline a full size under its
+            // box top, so a line is drawn 0.1x its size above the top of the client line it stands for, and
+            // `y` below always tracks the client's line tops.
+            const double lineBox = 1.1;
+            void Line(string text, double x, double top, double width, double size, string colour, OfficeTextAlignment align, bool bold = false)
+                => AddT(dw, text, x, top - 0.1 * size, width, size * 1.2, size, colour, align, bold);
+
+            // Client coverHeader: the branding logo on the left at 100pt (width by aspect ratio, capped so
+            // a banner never reaches the date), the date on the right, the two vertically centred on each
+            // other. Without a logo the row is just the date line. The date keeps the cover's 60pt page
+            // inset on the right, like everything else on the cover.
+            var logoType = ctx.Logo is { Length: > 0 } ? ImageContentType(ctx.Logo) : null;
+            var logoBox = logoType is null ? (w: 0.0, h: 0.0) : LogoBox(ctx.Logo!, logoHeight, 260);
+            var dateLine = 9 * lineBox;
+            var headerH = Math.Max(dateLine, logoBox.h);
+            if (logoType is not null)
+                dw.AddImage(ctx.Logo!, logoType, new OfficeImageProjection(
+                    new OfficeImagePlacement(leftPad, headerTop, logoBox.w, logoBox.h), new OfficeImageSourceCrop(0, 0, 0, 0), 0, null, null, false, false));
+            if (!string.IsNullOrEmpty(ctx.GeneratedOn))
+                Line(San(ctx.GeneratedOn).ToUpperInvariant(), 0, headerTop + (headerH - dateLine) / 2, ctx.ContentWidth - leftPad, 9, coverText, OfficeTextAlignment.Right);
+
+            var coverLabel = (ctx.Variables.TryGetValue("coverlabel", out var cl) && !string.IsNullOrWhiteSpace(cl)) ? cl : "ASSESSMENT REPORT";
+            coverLabel = San(coverLabel).ToUpperInvariant();
+            var chipW = Math.Min(w - leftPad * 2, 26 + coverLabel.Length * 6.4);
+            // Client coverLabel: the 10pt label on its natural line inside 8pt of padding, so a 27pt pill.
+            var chipH = 8 + ReportStyles.CoverLabel * lineBox + 8;
+            var y = headerTop + headerH + headerGap + heroPad;   // client coverHero content top (chip)
+            var chip = OfficeShape.RoundedRectangle(chipW, chipH, chipH / 2); chip.FillColor = OC(primary);
+            dw.AddShape(chip, leftPad, y);
+            Line(coverLabel, leftPad, y + 8, chipW, ReportStyles.CoverLabel, ctx.Theme.OnPrimary, OfficeTextAlignment.Center, true);
+            y += chipH + 30;                          // client coverLabel marginBottom 30
+
+            // Cover title: an explicit covertitle/coveraccent override (client coverTitle/coverAccent, e.g.
+            // the BEC report's "BEC Compromise" / "Analysis") else the report name split on its last word.
+            string lead, accent;
+            if (ctx.Variables.TryGetValue("covertitle", out var ctv) && !string.IsNullOrWhiteSpace(ctv))
+            {
+                lead = San(ctv).ToUpperInvariant();
+                accent = (ctx.Variables.TryGetValue("coveraccent", out var cav) && !string.IsNullOrWhiteSpace(cav)) ? San(cav).ToUpperInvariant() : string.Empty;
+            }
+            else
+            {
+                var words = San(ctx.ReportName).ToUpperInvariant().Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries);
+                lead = words.Length > 1 ? string.Join(" ", words[..^1]) : (words.Length == 1 ? words[0] : string.Empty);
+                accent = words.Length > 1 ? words[^1] : string.Empty;
+            }
+            // A long line shrinks to fit rather than running off the page ("QUARTERLY SECURITY" did):
+            // Helvetica Bold capitals average about 0.7em, so the size that fits is the box over that.
+            double FitTitle(string s) => Math.Min(ReportStyles.CoverTitle, (w - leftPad) / Math.Max(1, s.Length * 0.7));
+            var titleSize = Math.Min(FitTitle(lead), FitTitle(accent));
+            if (!string.IsNullOrEmpty(lead)) { Line(lead, leftPad, y, w - leftPad, titleSize, coverText, OfficeTextAlignment.Left, true); y += titleSize * lineBox; }
+            if (!string.IsNullOrEmpty(accent)) { Line(accent, leftPad, y, w - leftPad, titleSize, primary, OfficeTextAlignment.Left, true); y += titleSize * lineBox; }
+            if (!string.IsNullOrEmpty(lead) || !string.IsNullOrEmpty(accent)) y += 20;  // client title marginBottom 20
+
+            // Client coverHero is the page less its 60pt padding each side; the text under the title wraps
+            // inside it. Its footer note is the last thing on the cover: it wraps in the same width (counting
+            // its 1pt letter spacing) and its last line box ends at the 60pt page pad. The client keeps 32pt
+            // above it (coverFooter marginTop) and spills a cover that outgrows the page onto a second one;
+            // the cover here is one fixed drawing, so the block may run into that 32pt - a landscape cover
+            // with a logo needs it for the tenant line - and only a line that would touch the note is dropped.
+            var heroW = ctx.ContentWidth + 2 * ReportStyles.PagePadding - 2 * coverPad;
+            // Branding's cover note wins and the report's own wording is the fallback (client ReportDocument),
+            // so a configured note is not silently ignored by every report that words its own. Like the client,
+            // the note is held to the footer's length once its variables are filled.
+            var note = "CONFIDENTIAL & PROPRIETARY";
+            if (!string.IsNullOrEmpty(ctx.Theme.CoverFooterText)) note = ctx.Theme.CoverFooterText;
+            else if (ctx.Variables.TryGetValue("coverfooternote", out var cfn) && !string.IsNullOrWhiteSpace(cfn)) note = cfn;
+            var noteLines = WrapLines(San(ReportTheme.ApplyFooter(note, ctx.Variables)).ToUpperInvariant(), heroW, 9, bold: false, tracking: 1);
+            var noteTop = ctx.ContentHeight + ReportStyles.PagePadding - coverPad - noteLines.Count * 9 * lineBox;
+            // Draws `text` wrapped to `width` on `pitch`-point lines from the client line top `top` and returns
+            // the height of the lines drawn. Each line is placed like any other cover line: react-pdf seats the
+            // baseline 0.9x the size under the line top even in a taller line (the subtitle's 21pt one).
+            double Wrapped(string text, double top, double width, double size, double pitch, string colour, bool bold = false)
+            {
+                var drawn = 0.0;
+                foreach (var line in WrapLines(text, width, size, bold))
+                {
+                    if (top + drawn + pitch > noteTop - 4) break;
+                    Line(line, leftPad, top + drawn, width, size, colour, OfficeTextAlignment.Left, bold);
+                    drawn += pitch;
+                }
+                return drawn;
+            }
+
+            if (ctx.Variables.TryGetValue("coversubtitle", out var cs) && !string.IsNullOrWhiteSpace(cs))
+            {
+                // The client subtitle: maxWidth 400 at its lineHeight 1.5 (21pt a line), then marginBottom 40.
+                y += Wrapped(San(cs), y, Math.Min(400, heroW), ReportStyles.CoverSubtitle, ReportStyles.CoverSubtitle * 1.5, coverText) + 40;
+            }
+
+            // The subject line under the title: usually the tenant, but a covertenant override names a
+            // different subject (the BEC report puts the compromised user here instead of the tenant).
+            // Client coverMetaCard: maxWidth 500, then the label's marginBottom 8.
+            var coverTenant = (ctx.Variables.TryGetValue("covertenant", out var cvt) && !string.IsNullOrWhiteSpace(cvt)) ? cvt : ctx.TenantName;
+            if (!string.IsNullOrEmpty(coverTenant))
+                y += Wrapped(San(coverTenant), y, Math.Min(500, heroW), 18, 18 * lineBox, coverText, bold: true) + 8;
+            // Optional cover meta (client CoverMeta): extra detail lines under the tenant (4pt under each),
+            // then a note 8pt under them.
+            if (ctx.Variables.TryGetValue("covermeta", out var cm) && !string.IsNullOrWhiteSpace(cm))
+                foreach (var line in cm.Replace("\r", "").Split('\n'))
+                    y += Wrapped(San(line), y, heroW, 12, 12 * lineBox, subtitleC) + 4;
+            if (ctx.Variables.TryGetValue("covermetanote", out var cmn) && !string.IsNullOrWhiteSpace(cmn))
+                Wrapped(San(cmn), y + 8, heroW, 11, 11 * lineBox, subtitleC);
+
+            for (var i = 0; i < noteLines.Count; i++)
+                Line(noteLines[i], 0, noteTop + i * 9 * lineBox, w, 9, ctx.Theme.Palette["footer"], OfficeTextAlignment.Center);
+
+            item.Drawing(dw, PdfAlign.Left);
+        }
+
+        // Full-bleed hero content (client HeroPage overlay): the big highlight figure plus overtitle/
+        // headline/subtext block, vertically centred and left-aligned, with the footer note bottom-right.
+        // Drawn as one page-sized OfficeDrawing (transparent) over the section's background image, because
+        // flow layout can neither vertically centre nor pin the footer to the bottom-right corner.
+        public static void RenderHeroDrawing(ReportContext ctx, PdfContentBuilder item, ReportNode block)
+        {
+            var w = ctx.ContentWidth - 2;
+            // See RenderCoverDrawing: a page-tall drawing is rejected in landscape without this 2pt shave.
+            var h = ctx.ContentHeight - 2;
+            var highlightColour = ctx.Theme.Palette["infographic"];
+            var onDark = ctx.Theme.OnInfographic;
+            var overtitle = block.Str("overtitle") ?? block.Str("heroOvertitle");
+            var highlight = block.Str("highlight") ?? block.Str("heroHighlight");
+            var headline = block.Str("headline") ?? block.Str("heroHeadline") ?? block.Str("title");
+            var subText = block.Str("subText") ?? block.Str("heroSubText");
+            var footerText = block.Str("footerText") ?? block.Str("heroFooterText");
+            const double leftPad = 28, textW = 440;
+            var subLines = string.IsNullOrEmpty(subText) ? Array.Empty<string>() : subText.Replace("\r", "").Split('\n');
+
+            var blockH = (string.IsNullOrEmpty(overtitle) ? 0 : 24) + (string.IsNullOrEmpty(highlight) ? 0 : 84)
+                + (string.IsNullOrEmpty(headline) ? 0 : 24) + subLines.Length * 19;
+            var y = Math.Max(40, (h - blockH) / 2);
+
+            var dw = new OfficeDrawing(w, h);
+            if (!string.IsNullOrEmpty(overtitle)) { AddT(dw, San(overtitle), leftPad, y, textW, 22, 18, onDark, OfficeTextAlignment.Left, true); y += 24; }
+            if (!string.IsNullOrEmpty(highlight)) { AddT(dw, San(highlight), leftPad, y, textW, 82, 72, highlightColour, OfficeTextAlignment.Left, true); y += 84; }
+            if (!string.IsNullOrEmpty(headline)) { AddT(dw, San(headline), leftPad, y, textW, 22, 18, onDark, OfficeTextAlignment.Left, true); y += 24; }
+            foreach (var line in subLines) { AddT(dw, San(line), leftPad, y, textW, 18, 14, onDark, OfficeTextAlignment.Left, true); y += 19; }
+
+            if (!string.IsNullOrEmpty(footerText))
+            {
+                var fLines = footerText.Replace("\r", "").Split('\n');
+                var fy = h - 40 - (fLines.Length - 1) * 16;
+                foreach (var line in fLines) { AddT(dw, San(line), 0, fy, w - leftPad, 16, 12, onDark, OfficeTextAlignment.Right, true); fy += 16; }
+            }
+            item.Drawing(dw, PdfAlign.Left);
+        }
+
+        /// <summary>Rich bullets (client BulletList with {label, text}): an orange marker, a bold label, then
+        /// body text - each an item.Paragraph with per-run colour so the marker and label differ from the text.</summary>
+        public static void RichBullets(ReportContext ctx, PdfContentBuilder item, List<object?> items)
+        {
+            // Client BulletList: the list is inset 12 with 12 under it; each item is a row of the 8pt bold
+            // marker (6pt after it, 1pt down, on the page's 14pt line) and the 9pt text at lineHeight 1.4, 6pt
+            // under the item. The text column hangs: a wrapped line starts under the text, not the marker, so
+            // the paragraph is indented to the text and the first line pulled back to the marker, with a tab
+            // stop at the text column. A one-line item is as tall as the marker's 15pt line, not the 12.6pt
+            // text line, so it keeps the 2.4pt difference below it.
+            const double markerSize = 8, markerGap = 6, listInset = 12, itemGap = 6, listGap = 12;
+            var textLine = 1.4 * ReportStyles.BulletText;
+            for (var i = 0; i < items.Count; i++)
+            {
+                var it = items[i];
+                var label = ReportNode.RowStr(it, "label");
+                var text = ReportNode.RowStr(it, "text") ?? string.Empty;
+                var marker = ReportNode.RowStr(it, "marker"); // custom marker (e.g. "1.") else a bullet dot
+                marker = string.IsNullOrEmpty(marker) ? "•" : San(marker);
+                var hang = TextEm(marker, bold: true) * markerSize + markerGap;
+                var copy = string.IsNullOrEmpty(label) ? text : label + " " + text;
+                // ponytail: the label is measured as regular text, a hair narrow for its bold face.
+                var oneLine = WrappedLines(copy, ctx.ContentWidth - listInset - hang, ReportStyles.BulletText, bold: false) == 1;
+                var style = new PdfParagraphStyle
+                {
+                    LeftIndent = listInset + hang,
+                    FirstLineIndent = -hang,
+                    LineHeight = FlowLineHeight(1.4, ReportStyles.BulletText),
+                    SpacingAfter = itemGap + (oneLine ? 1 + 14 - textLine : 0) + (i == items.Count - 1 ? listGap : 0),
+                };
+                style.AddTabStop(0.01);
+                item.Paragraph(b =>
+                {
+                    b.FontSize(ReportStyles.BulletText);
+                    b.Bold(true).Color(Pdf(ctx.Theme.Palette["heading"])).FontSize(markerSize).Text(marker).Text("\t").FontSize(ReportStyles.BulletText);
+                    var body = ctx.Theme.Palette["body"];
+                    if (!string.IsNullOrEmpty(label)) EmitToBuilder(b, San(label) + " ", body, ReportStyles.BulletText, bold: true);
+                    EmitToBuilder(b, San(text), body, ReportStyles.BulletText, bold: false);
+                }, PdfAlign.Left, null, style);
+            }
+        }
+
+        /// <summary>Brand-coloured table: header band in the tenant's table colour, striped rows, repeating header.</summary>
+        public static PdfTableStyle BrandedTableStyle(ReportContext ctx) => new()
+        {
+            HeaderFill = Pdf(ctx.Theme.Palette["table"]),
+            HeaderTextColor = Pdf(ctx.Theme.OnTable),
+            HeaderBold = true,
+            HeaderFontSize = ReportStyles.TableHeaderCell,
+            RowStripeFill = Pdf(ReportColours.Panel),
+            BorderColor = Pdf(ReportColours.Line),
+            BorderWidth = 0.5,
+            RowSeparatorColor = Pdf(ReportColours.Line),
+            RowSeparatorWidth = 0.5,
+            TextColor = Pdf(ReportColours.Body),
+            FontSize = ReportStyles.TableCell,
+            RepeatHeaderRowCount = 1,
+            CellPaddingX = 12,   // client TABLE_ROW_PADDING (horizontal cell inset)
+            CellPaddingY = 6,    // client tableRow paddingVertical
+        };
+
+        /// <summary>
+        /// A plain table of text rows, the first row its header (a markdown, HTML or database table; client
+        /// ReportBuilderPDF renderTable). The client draws it as the same DataTable as a rich table, with
+        /// equal columns and the first column bold, so it is one: the header row names the columns and every
+        /// other row is squared off to that many cells.
+        /// </summary>
+        public static void Table(ReportContext ctx, PdfContentBuilder item, IReadOnlyList<string[]> rows)
+        {
+            if (rows.Count == 0) return;
+            var count = rows[0].Length > 0 ? rows[0].Length : rows.Max(r => r.Length);
+            string Cell(string[] row, int i) => i < row.Length ? row[i] ?? string.Empty : string.Empty;
+            var columns = Enumerable.Range(0, count).Select(i => (object?)new Dictionary<string, object?>
+            {
+                ["header"] = Cell(rows[0], i), ["key"] = "c" + i, ["width"] = 1.0, ["bold"] = i == 0,
+            }).ToList();
+            var body = rows.Skip(1).Select(r => (object?)Enumerable.Range(0, count).ToDictionary(i => "c" + i, i => (object?)Cell(r, i))).ToList();
+            RichTable(ctx, item, columns, body, 0);
+        }
+
+        // Shared status vocabulary (client STATUS_TONES): a status word coloured by tone.
+        private static string ToneColour(string? tone) => tone switch
+        {
+            "pass" => ReportColours.Success,
+            "warn" => ReportColours.Warning,
+            "fail" => ReportColours.Danger,
+            "muted" => ReportColours.Faint,
+            _ => ReportColours.Body,
+        };
+
+        private static bool RowBool(object? row, string key)
+            => row is Dictionary<string, object?> d && d.TryGetValue(key, out var v) && v is bool b && b;
+
+        /// <summary>
+        /// The client DataTable: column specs (header/key/width weight/bold/align) with per-cell rendering.
+        /// A column with <c>toneField</c> draws its value as italic status text coloured by the row's tone
+        /// field (Compliant=green, Review=red, ...); a <c>bold</c> column draws its value bold. Header band
+        /// in the brand table colour, uppercase; striped body rows; rows beyond <c>limit</c> drop to a note.
+        /// With no rows, <c>emptyText</c> is drawn inside the border as one full-width italic row (client
+        /// DataTable emptyText: 8pt faint italic, padding 12); without it the table is a bare header, as a
+        /// markdown or HTML table is (client renderTable has no empty state).
+        /// </summary>
+        public static void RichTable(ReportContext ctx, PdfContentBuilder item, List<object?> columns, List<object?> rows, int limit, string? emptyText = null)
+        {
+            if (columns.Count == 0) return;
+            var widths = new List<double>();
+            var aligns = new List<PdfColumnAlign>();
+            var header = new List<PdfTableCell>();
+            foreach (var c in columns)
+            {
+                var w = ReportNode.RowNum(c, "width"); if (w <= 0) w = 1;
+                widths.Add(w);
+                aligns.Add((ReportNode.RowStr(c, "align")) switch { "center" => PdfColumnAlign.Center, "right" => PdfColumnAlign.Right, _ => PdfColumnAlign.Left });
+                // Header runs (not a plain string) so an emoji in a column header renders as a colour image;
+                // the brand header fill/uppercase come from the table style, the text colour is OnTable bold.
+                header.Add(CellRuns((ReportNode.RowStr(c, "header") ?? string.Empty).ToUpperInvariant(), ctx.Theme.OnTable, bold: true, size: ReportStyles.TableHeaderCell));
+            }
+
+            var shown = limit > 0 ? rows.Take(limit).ToList() : rows;
+            var hidden = rows.Count - (limit > 0 ? Math.Min(limit, rows.Count) : rows.Count);
+            var cells = new List<PdfTableCell[]> { header.ToArray() };
+            foreach (var r in shown)
+            {
+                var rowCells = new PdfTableCell[columns.Count];
+                for (var ci = 0; ci < columns.Count; ci++)
+                {
+                    var col = columns[ci];
+                    var key = ReportNode.RowStr(col, "key") ?? string.Empty;
+                    var text = San(ReportNode.RowStr(r, key) ?? string.Empty);
+                    var toneField = ReportNode.RowStr(col, "toneField");
+                    var colourField = ReportNode.RowStr(col, "colourField");
+                    if (!string.IsNullOrEmpty(toneField))
+                    {
+                        var colour = ToneColour(ReportNode.RowStr(r, toneField));
+                        rowCells[ci] = CellRuns(text, colour, bold: false, italic: true, size: ReportStyles.StatusText);
+                    }
+                    else if (!string.IsNullOrEmpty(colourField))
+                    {
+                        // Bold text in an arbitrary per-row colour (client column.colour(row), e.g. risk bands).
+                        var colour = ReportNode.RowStr(r, colourField);
+                        rowCells[ci] = CellRuns(text, string.IsNullOrEmpty(colour) ? ReportColours.Body : colour, bold: true);
+                    }
+                    else if (RowBool(col, "bold"))
+                    {
+                        rowCells[ci] = CellRuns(text, ReportColours.Body, bold: true);
+                    }
+                    else
+                    {
+                        rowCells[ci] = CellRuns(text, ReportColours.Body);
+                    }
+                }
+                cells.Add(rowCells);
+            }
+
+            var emptyRow = shown.Count == 0 && !string.IsNullOrEmpty(emptyText);
+            if (emptyRow)
+            {
+                var runs = new List<PdfTextRun>();
+                EmitRuns(runs, San(emptyText!), ReportColours.Faint, ReportStyles.TableCell, bold: false, italic: true);
+                cells.Add(new[] { new PdfTableCell(runs, columnSpan: columns.Count) });
+            }
+
+            var style = BrandedTableStyle(ctx);
+            ApplyDataTableGeometry(ctx, style, widths, cells.Count, hidden > 0, emptyRow);
+            style.Alignments = aligns;
+            // A status word stands in the client page's 14pt line rather than the 10.4pt cell line, so its
+            // cell carries the difference as padding: the word sits 0.9pt lower and a one-line row is 27pt.
+            for (var ci = 0; ci < columns.Count; ci++)
+            {
+                if (string.IsNullOrEmpty(ReportNode.RowStr(columns[ci], "toneField"))) continue;
+                for (var ri = 1; ri <= shown.Count; ri++)
+                {
+                    var pad = style.CellPaddings!.TryGetValue((ri, ci), out var p) ? p : new PdfCellPadding();
+                    pad.Top = (pad.Top ?? style.CellPaddingTop) + 0.9;
+                    pad.Bottom = (pad.Bottom ?? style.CellPaddingBottom) + 1.4;
+                    style.CellPaddings[(ri, ci)] = pad;
+                }
+            }
+            // Client body rows are wrap={false}: a row that does not fit moves whole to the next page. OfficeIMO
+            // throws on an unsplittable row taller than a page, so a row is kept whole only when its height,
+            // measured by word-wrapping each cell with the Helvetica metrics, is under half a page (the
+            // margin covers the measure differing from OfficeIMO's own wrap).
+            var totalWeight = widths.Sum();
+            var keepWhole = new List<bool?> { null }; // the header row keeps the style default
+            foreach (var r in shown)
+            {
+                var lines = 1;
+                for (var ci = 0; ci < columns.Count; ci++)
+                {
+                    var textWidth = Math.Max(1, (ctx.ContentWidth - 2 * (TableInset + TableBorder)) * widths[ci] / totalWeight - TableGutter);
+                    var text = ReportNode.RowStr(r, ReportNode.RowStr(columns[ci], "key") ?? string.Empty) ?? string.Empty;
+                    var bold = RowBool(columns[ci], "bold") || !string.IsNullOrEmpty(ReportNode.RowStr(columns[ci], "colourField"));
+                    lines = Math.Max(lines, WrappedLines(text, textWidth, ReportStyles.TableCell, bold));
+                }
+                keepWhole.Add(lines * ReportStyles.TableCell * 1.3 + style.CellPaddingTop + style.CellPaddingBottom < ctx.ContentHeight / 2 ? false : null);
+            }
+            style.RowAllowBreakAcrossPages = keepWhole;
+            item.Table(cells, PdfAlign.Left, style);
+            if (hidden > 0)
+                Note(ctx, item, $"... and {hidden} more. Export the table from the report page for the full list.");
+        }
+
+        // The client DataTable's box (styles.table/tableHeader/tableRow + tableColumns): the row is inset 12pt
+        // inside a 1pt border and each column but the last keeps a 6pt gutter on its right, so a cell's text
+        // width is its share of the inset row less the gutter. OfficeIMO pads every cell alike, so the edge
+        // columns carry the inset (and the border) as their own padding and are widened by it, which gives
+        // every column exactly the client's text width. No vertical rules: the outline is straight per-cell
+        // borders on the perimeter, because a table-level border draws the full grid. The corners stay square:
+        // OfficeIMO strokes a rounded cell border as the cell's whole rounded box clipped to a strip, which on
+        // a multi-column table leaves 6pt stubs across the header band. Rows are divided by the client's pale
+        // 1pt panel line, which sits inside the row's box (so a row is 13pt of padding plus its 10.4pt lines),
+        // and the header band is 28pt for one line of 7pt text on a 14pt pitch. The pads are split to put the
+        // text where the client's sits. 16pt follows the table, 4pt when the truncation note does.
+        private const double TableInset = 12, TableGutter = 6, TableBorder = 1;
+        private static void ApplyDataTableGeometry(ReportContext ctx, PdfTableStyle style, List<double> weights, int rowCount, bool noteFollows, bool emptyRow = false)
+        {
+            var cols = weights.Count;
+            var edge = TableInset + TableBorder;
+            var total = weights.Sum();
+            var inner = ctx.ContentWidth - 2 * edge;
+            style.ColumnWidthWeights = weights.Select((w, i) => w / total * inner + (i == 0 ? edge : 0) + (i == cols - 1 ? edge : 0)).ToList();
+            style.BorderWidth = 0;
+            style.RowSeparatorColor = Pdf(ReportColours.Panel);
+            style.RowSeparatorWidth = 1;
+            style.HeaderSeparatorColor = Pdf(ctx.Theme.Palette["table"]); // no line under the band
+            style.HeaderSeparatorWidth = 1;
+            style.LineHeight = 1.3;                                      // client tableCell lineHeight
+            style.HeaderFontSize = 14 / 1.3;                             // header leading 14 (runs stay 7pt)
+            style.CellPaddingLeft = 0;
+            style.CellPaddingRight = TableGutter;
+            style.CellPaddingTop = 7.3;
+            style.CellPaddingBottom = 5.7;
+            style.SpacingAfter = noteFollows ? 4 : 16;
+            // The client's header repeats on each page and its rows move whole, so a table starts on the page
+            // as soon as the header and one row fit there (OfficeIMO's default waits for two).
+            style.MinimumBodyRowsOnFirstPage = 1;
+            var line = Pdf(ReportColours.Line);
+            style.CellPaddings = new Dictionary<(int, int), PdfCellPadding>();
+            style.CellBorders = new Dictionary<(int, int), PdfCellBorder>();
+            for (var r = 0; r < rowCount; r++)
+            {
+                for (var c = 0; c < cols; c++)
+                {
+                    // The client's outline sits outside the rows, so the header band starts and the last row
+                    // ends a border's width further in than a cell border drawn on the cell edge: the header's
+                    // top pad and the last row's bottom pad each carry it.
+                    var first = c == 0; var last = c == cols - 1; var top = r == 0; var bottom = r == rowCount - 1;
+                    if (first || last || top || bottom)
+                        style.CellPaddings[(r, c)] = new PdfCellPadding
+                        {
+                            Left = first ? edge : null,
+                            Right = last ? edge : null,
+                            Top = top ? 5.4 + TableBorder : null,
+                            Bottom = (top ? 6.7 + TableBorder : style.CellPaddingBottom) + (bottom ? TableBorder : 0),
+                        };
+                    if (first || last || top || bottom)
+                        style.CellBorders[(r, c)] = new PdfCellBorder { Color = line, Width = TableBorder, Left = first, Right = last, Top = top, Bottom = bottom };
+                }
+            }
+            // The empty-state row (client tableEmpty: 12pt all round inside the 1pt border) is one cell
+            // spanning every column, so it carries the row's whole outline itself. The client's row is
+            // 38pt with the text's cap top 13.5pt under the band; the pads put the text there.
+            if (emptyRow)
+            {
+                for (var c = 1; c < cols; c++) { style.CellPaddings.Remove((1, c)); style.CellBorders.Remove((1, c)); }
+                style.CellPaddings[(1, 0)] = new PdfCellPadding { Left = TableBorder + 12, Right = TableBorder + 12, Top = 13.5, Bottom = 15.3 + TableBorder };
+                style.CellBorders[(1, 0)] = new PdfCellBorder { Color = line, Width = TableBorder, Left = true, Right = true, Top = false, Bottom = true };
+            }
+        }
+
+        public static void Code(ReportContext ctx, PdfContentBuilder item, string text)
+            => item.Paragraph(b =>
+            {
+                b.Font(PdfStandardFont.Courier).FontSize(CodeParagraphSize).Color(Pdf(ReportColours.Body));
+                var lines = San(text).Replace("\r\n", "\n").Split('\n');
+                for (var i = 0; i < lines.Length; i++) { if (i > 0) b.LineBreak(); b.Text(lines[i]); }
+            });
+
+        public static void Hr(ReportContext ctx, PdfContentBuilder item) => item.HR();
+
+        // A small italic aside after a truncated list (client styles.truncationNote): 8pt faint italic,
+        // indented to the table's inner padding.
+        public static void Note(ReportContext ctx, PdfContentBuilder item, string text)
+            => item.Paragraph(b => { b.Italic(true).FontSize(ReportStyles.TableCell); EmitInline(b, text, ReportColours.Faint, ReportStyles.TableCell); },
+                PdfAlign.Left, null, new PdfParagraphStyle { LeftIndent = 12, SpacingAfter = 4 });
+
+        // -- callouts (InfoBox / AlertBox / ClearBox) --
+        // Callouts are drawn as a single-cell bordered TABLE, not a Panel: OfficeIMO panels apply a fixed
+        // internal paragraph leading and ignore per-call line-height/spacing, which opens a loose gap
+        // between the title and body and between body lines. A table cell honours run sizing and cell
+        // padding exactly (the same reason StatCard is a cell), so the callout matches the client's tight
+        // spacing. The title is a bold run, then a small line-break run sets the title/body gap, then the
+        // body runs; a left accent stripe is a per-cell LeftBorder over the cell's full border.
+        private const double CalloutPadX = 12;      // client infoBox/alertBox padding (horizontal)
+        private const double CalloutPadY = 12;      // client infoBox/alertBox padding (vertical)
+        private const double CellAscent = 0.74;     // a table cell's first baseline under its padding, x the table font size
+        private const double CardCornerRadius = 6; // rounded corners on callout boxes and stat cards (client border-radius)
+        private const double CalloutGap = 12;    // space after an InfoBox/ClearBox (client infoBox marginBottom 12)
+        private const double AlertGap = 16;      // space after an AlertBox (client alertBox marginBottom 16)
+        private const double SectionGap = 12;    // space before a new section's heading (client section marginBottom 12)
+
+        private static PdfTextRun Run(string text, string colour, double size, bool bold = false, bool italic = false, bool underline = false, bool strike = false)
+            => new(San(text), bold, underline, Pdf(colour), italic, strike, size);
+
+        // The brand tint for the three report emoji when they fall back to the monochrome font (no colour
+        // image bundled); every other emoji renders untinted. Null for anything that is not a report emoji.
+        public static string? EmojiTint(int cp) =>
+            cp == ReportMarkdown.EmojiWarning ? "#DD9B26" :   // amber
+            cp == ReportMarkdown.EmojiCheck ? "#2F9E44" :     // green
+            cp == ReportMarkdown.EmojiInfo ? "#3182CE" :      // blue
+            null;
+
+        // An emoji renders at the run's font size, dropped a touch below the baseline so it sits like a glyph.
+        private const double EmojiBaselineFactor = -0.12;
+        private static double EmojiOffset(double size) => size * EmojiBaselineFactor;
+
+        private enum EmojiSegKind { Text, Image, Mono }
+        private readonly struct EmojiSegment
+        {
+            public EmojiSegKind Kind { get; init; }
+            public string Text { get; init; }    // Text: the copy; Image: alt text; Mono: the glyph
+            public byte[]? Image { get; init; }   // Image: the colour PNG bytes
+            public string? Tint { get; init; }    // Mono: brand tint hex, or null
+        }
+
+        // Split (already-sanitized) text into text / colour-image / monochrome-glyph segments. An emoji
+        // grapheme cluster (including a multi-code-point ZWJ sequence, flag or skin-tone) routes to a bundled
+        // Twemoji colour image when one exists, else to the monochrome fallback font (tinted for the three
+        // report emoji); everything else stays as text, so ordinary copy is untouched.
+        private static IEnumerable<EmojiSegment> SegmentEmoji(string text)
+        {
+            var list = new List<EmojiSegment>();
+            // Most copy has no character above U+00FF, so no emoji: one text segment, without walking it
+            // cluster by cluster (a string per character).
+            if (!text.AsSpan().ContainsAnyExceptInRange('\0', 'ÿ'))
+            {
+                if (text.Length > 0) list.Add(new EmojiSegment { Kind = EmojiSegKind.Text, Text = text });
+                return list;
+            }
+            var sb = new System.Text.StringBuilder();
+            void FlushText() { if (sb.Length > 0) { list.Add(new EmojiSegment { Kind = EmojiSegKind.Text, Text = sb.ToString() }); sb.Clear(); } }
+            var e = System.Globalization.StringInfo.GetTextElementEnumerator(text);
+            while (e.MoveNext())
+            {
+                var cluster = (string)e.Current;
+                if (cluster.Length == 1 && cluster[0] <= 'ÿ') { sb.Append(cluster); continue; }
+                var bytes = TwemojiAssets.Enabled ? TwemojiAssets.Bytes(cluster) : null;
+                if (bytes is not null) { FlushText(); list.Add(new EmojiSegment { Kind = EmojiSegKind.Image, Image = bytes, Text = cluster }); continue; }
+                if (cluster.Length <= 2 && ReportMarkdown.RenderEmojiGlyphs)
+                {
+                    var cp = char.ConvertToUtf32(cluster, 0);
+                    if (ReportMarkdown.EmojiCoverage.Contains(cp) || EmojiTint(cp) is not null)
+                    { FlushText(); list.Add(new EmojiSegment { Kind = EmojiSegKind.Mono, Text = cluster, Tint = EmojiTint(cp) }); continue; }
+                }
+                sb.Append(cluster);
+            }
+            FlushText();
+            return list;
+        }
+
+        // Emit text as OfficeIMO runs for table-cell content (callouts): each emoji becomes an inline colour-
+        // image run (or a monochrome glyph run when no image is bundled), the rest keeps the given colour and
+        // marks. A monochrome glyph carries no weight or decoration of its own, so it is emitted plain.
+        private static void EmitRuns(List<PdfTextRun> dest, string text, string colour, double size,
+            bool bold = false, bool italic = false, bool underline = false, bool strike = false,
+            double? emojiSize = null, double? emojiOffset = null)
+        {
+            // An emoji image defaults to the run's font size, but a caller can shrink it and set its baseline
+            // offset (the stat card's big number sizes the emoji to ~the digit height and drops it onto the
+            // number's cap box, so it doesn't raise the line's ascent and push the number below a sibling card
+            // whose number has no emoji).
+            var es = emojiSize ?? size;
+            var eo = emojiOffset ?? EmojiOffset(es);
+            foreach (var seg in SegmentEmoji(San(text)))
+            {
+                switch (seg.Kind)
+                {
+                    case EmojiSegKind.Image:
+                        dest.Add(PdfTextRun.Inline(new PdfInlineImage(seg.Image!, es, es, seg.Text, OfficeImageFit.Contain, eo)));
+                        break;
+                    case EmojiSegKind.Mono:
+                        dest.Add(new PdfTextRun(seg.Text, false, false, Pdf(seg.Tint ?? colour), false, false, size));
+                        break;
+                    default:
+                        dest.Add(new PdfTextRun(seg.Text, bold, underline, Pdf(colour), italic, strike, size));
+                        break;
+                }
+            }
+        }
+
+        // A table cell whose text renders emoji as inline colour images (via EmitRuns) at the given colour
+        // and weight, so a body cell like "ok ✅" shows a colour glyph rather than a monochrome one.
+        private static PdfTableCell CellRuns(string text, string colour, bool bold = false, bool italic = false, double? size = null)
+        {
+            var runs = new List<PdfTextRun>();
+            EmitRuns(runs, text, colour, size ?? ReportStyles.TableCell, bold, italic);
+            return new PdfTableCell(runs);
+        }
+
+        // Emit inline text (with colour-image emoji) into a paragraph builder. For callers that compose on a
+        // builder outside the component kit - the page header title/subtitle in ReportPdf.
+        public static void EmitInline(PdfParagraphBuilder b, string text, string colour, double size, bool bold = false)
+            => EmitToBuilder(b, San(text), colour, size, bold);
+
+        // Convert parsed inline runs to OfficeIMO runs at a callout's size/colour, marks carried through,
+        // with kept emoji split into their own tinted runs.
+        private static IEnumerable<PdfTextRun> ToPdfRuns(IEnumerable<TextRun> runs, string colour, double size)
+        {
+            var dest = new List<PdfTextRun>();
+            foreach (var r in runs) EmitRuns(dest, r.Text, colour, size, r.Bold, r.Italic, r.Underline, r.Strike);
+            return dest;
+        }
+
+        // A callout body flattened to one run list: each logical line separated by a line-break run, so the
+        // cell renders it as tight consecutive lines. `lines` keeps the source '\n' splits (label/value
+        // detail lists); otherwise the markdown blocks are flattened (paragraphs, and bullets as "- " lines).
+        private static List<PdfTextRun> CalloutBodyRuns(ReportContext ctx, string content, bool lines, double size, string colour)
+        {
+            var outRuns = new List<PdfTextRun>();
+            void AddLine(IEnumerable<PdfTextRun> lineRuns)
+            {
+                if (outRuns.Count > 0) outRuns.Add(Run("\n", colour, size));
+                outRuns.AddRange(lineRuns);
+            }
+            if (lines)
+            {
+                foreach (var ln in San(content).Replace("\r\n", "\n").Split('\n'))
+                    AddLine(ToPdfRuns(ReportMarkdown.MarkdownRuns(ln), colour, size));
+            }
+            else
+            {
+                foreach (var node in ReportMarkdown.MarkdownToNodes(content))
+                {
+                    switch (node.Type)
+                    {
+                        case "paragraph":
+                            AddLine(ToPdfRuns(node.Get<List<TextRun>>("runs") ?? new List<TextRun>(), colour, size));
+                            break;
+                        case "bullets":
+                            foreach (var s in StringItems(node)) AddLine(new[] { Run("•  " + s, colour, size) });
+                            break;
+                        case "numbered":
+                            var n = (int)(node.Num("start") ?? 1);
+                            foreach (var s in StringItems(node)) AddLine(new[] { Run($"{n++}.  " + s, colour, size) });
+                            break;
+                        default:
+                            var t = node.Str("content") ?? node.Str("text");
+                            if (!string.IsNullOrEmpty(t)) AddLine(ToPdfRuns(ReportMarkdown.MarkdownRuns(t), colour, size));
+                            break;
+                    }
+                }
+            }
+            if (outRuns.Count == 0) outRuns.Add(Run(" ", colour, size));
+            return outRuns;
+        }
+
+        // The callout as stacked table rows: a title row (with its own bottom margin) over a body row (with
+        // a tight body line height), or a single body row when untitled. One bordered cell stack lets the
+        // title/body gap and the body line spacing each be set exactly - a single cell forces one uniform
+        // line advance (the title can't get its own margin), and a panel's leading can't be set at all.
+        private static List<PdfTableCell[]> CalloutRows(string? title, string titleColour, double titleSize, List<PdfTextRun> bodyRuns, double bodySize)
+        {
+            // One cell, one row: a multi-row table always draws a divider between rows (OfficeIMO borders are
+            // a grid), so title and body live in the same cell. A cell line is as tall as its largest run at
+            // the style's 1.4 leading and every line's baseline sits at the same depth in it, so the title
+            // line is sized to the client's baseline-to-baseline step from the title to the body: the title's
+            // 14pt page line plus its 6pt marginBottom, less the 0.9x-size baseline difference of the two.
+            // (A bare line break carries no size, so a no-break space at that size ends the title line.)
+            var runs = new List<PdfTextRun>();
+            if (!string.IsNullOrEmpty(title))
+            {
+                EmitRuns(runs, title!, titleColour, titleSize, bold: true);
+                runs.Add(Run("\u00A0", titleColour, (14 + 6 - 0.9 * (titleSize - bodySize)) / 1.4));
+                runs.Add(Run("\n", titleColour, bodySize));
+            }
+            runs.AddRange(bodyRuns);
+            return new List<PdfTableCell[]> { new[] { new PdfTableCell(runs) } };
+        }
+
+        private static PdfTableStyle CalloutStyle(string bgHex, string? stripeHex, double stripeWidth, string borderHex, double borderWidth, double bodySize, double firstSize)
+        {
+            // The client pads 12 inside the border (the stripe, on the left) and sets a line's baseline 0.9x its
+            // size under the line top; OfficeIMO sets a cell's first baseline CellAscent x the table's font size
+            // under its padding, and ends the cell that much above the last line's foot. The top and bottom
+            // pads carry the difference, so every line lands where the client's does.
+            var padding = new PdfCellPadding
+            {
+                Left = CalloutPadX + (stripeHex is null ? borderWidth : stripeWidth),
+                Right = CalloutPadX + borderWidth,
+                Top = CalloutPadY + borderWidth + 0.9 * firstSize - CellAscent * bodySize,
+                Bottom = CalloutPadY + borderWidth - (0.9 - CellAscent) * bodySize,
+            };
+            // Single cell -> the table's BorderWidth draws just the perimeter box (no interior grid). The left
+            // edge is overridden with the accent stripe via a per-cell LeftBorder when the callout has one.
+            var style = new PdfTableStyle
+            {
+                HeaderRowCount = 0,
+                FontSize = bodySize,
+                LineHeight = 1.4,
+                BorderColor = Pdf(borderHex),
+                BorderWidth = borderWidth,
+                CornerRadius = CardCornerRadius,  // softly rounded box; stripe/border are clipped to the rounded corners
+                RowSeparatorWidth = 0,
+                CellPaddingX = CalloutPadX,
+                CellPaddingY = CalloutPadY,
+                CellPaddings = new Dictionary<(int, int), PdfCellPadding>
+                {
+                    [(0, 0)] = padding,
+                },
+                SpacingAfter = 0,                 // the gap after a callout is an explicit Spacer, not the table's
+                KeepTogether = true,              // a callout never splits across a page (client keeps each whole)
+                CellFills = new Dictionary<(int, int), PdfColor> { [(0, 0)] = Pdf(bgHex) },
+            };
+            if (stripeHex is not null)
+                style.CellBorders = new Dictionary<(int, int), PdfCellBorder>
+                {
+                    // only the left stripe; disable the class-default grey sides so 3.4.x's general
+                    // cell-border renderer doesn't lay grey over the accent at the rounded corners.
+                    [(0, 0)] = new PdfCellBorder { LeftBorder = new PdfCellBorderSide { Color = Pdf(stripeHex), Width = stripeWidth }, Top = false, Right = false, Bottom = false },
+                };
+            return style;
+        }
+
+        /// <summary>
+        /// A titled note with an accent stripe down its left edge (client InfoBox). `tone` (ok/warn) tints
+        /// the background and title; `colour` recolours the stripe (and the title when tintTitle). `content`
+        /// is markdown, or line-broken label/value text when `lines`.
+        /// </summary>
+        public static void InfoBox(ReportContext ctx, PdfContentBuilder item, string? title, string? tone,
+            string? colour, bool tintTitle, string content, bool lines = false)
+        {
+            var (accent, bg, titleColour) = InfoBoxColours(ctx, tone, colour, tintTitle);
+            var body = CalloutBodyRuns(ctx, content, lines, ReportStyles.InfoText, ctx.Theme.Palette["subtitle"]);
+            item.Table(CalloutRows(title, titleColour, ReportStyles.InfoTitle, body, ReportStyles.InfoText), PdfAlign.Left,
+                CalloutStyle(bg, accent, 4, ReportColours.Line, 1, ReportStyles.InfoText, string.IsNullOrEmpty(title) ? ReportStyles.InfoText : ReportStyles.InfoTitle));
+            item.Spacer(CalloutGap);
+        }
+
+        // An InfoBox's stripe accent, background tint and title colour: `tone` (ok/warn) picks the tint,
+        // `colour` overrides the stripe (and the title when tintTitle).
+        private static (string accent, string bg, string title) InfoBoxColours(ReportContext ctx, string? tone, string? colour, bool tintTitle)
+        {
+            var accent = string.IsNullOrEmpty(colour) ? ctx.Theme.Palette["card"] : colour!;
+            var (bg, title) = tone switch
+            {
+                "ok" => (ReportColours.OkBg, ReportColours.Success),
+                "warn" => (ReportColours.WarnBg, ReportColours.Warning),
+                _ => (ReportColours.Panel, ctx.Theme.Palette["body"]),
+            };
+            if (tintTitle && !string.IsNullOrEmpty(colour)) title = colour!;
+            return (accent, bg, title);
+        }
+
+        /// <summary>A warning callout: red-tinted background with a full accent-coloured border (client AlertBox).</summary>
+        public static void AlertBox(ReportContext ctx, PdfContentBuilder item, string? title, string? colour, string content, bool lines = false)
+        {
+            var accent = string.IsNullOrEmpty(colour) ? ctx.Theme.Palette["card"] : colour!;
+            var body = CalloutBodyRuns(ctx, content, lines, ReportStyles.AlertText, ctx.Theme.Palette["body"]);
+            item.Table(CalloutRows(title, accent, ReportStyles.AlertTitle, body, ReportStyles.AlertText), PdfAlign.Left,
+                CalloutStyle(ReportColours.AlertBg, null, 0, accent, 2, ReportStyles.AlertText, string.IsNullOrEmpty(title) ? ReportStyles.AlertText : ReportStyles.AlertTitle));
+            item.Spacer(AlertGap);
+        }
+
+        /// <summary>The all-clear counterpart to AlertBox - a green InfoBox for a check that found nothing.</summary>
+        public static void ClearBox(ReportContext ctx, PdfContentBuilder item, string? title, string content, bool lines = false)
+            => InfoBox(ctx, item, title, "ok", null, false, content, lines);
+
+        // Body copy stepped in under a heading (client Paragraph indent: marginLeft 12, marginTop 8). Used
+        // for the BEC summary lines that introduce a check's detail callouts.
+        public static void IndentedParagraph(ReportContext ctx, PdfContentBuilder item, string text)
+        {
+            item.Spacer(4);
+            var body = ctx.Theme.Palette["body"];
+            item.Paragraph(b => { b.FontSize(ReportStyles.Body); EmitToBuilder(b, San(text), body, ReportStyles.Body); },
+                PdfAlign.Left, null, new PdfParagraphStyle { LeftIndent = 12, LineHeight = 1.3, SpacingAfter = 0 });
+        }
+
+        // Write text into a paragraph builder: emoji as inline colour images (or a monochrome glyph), the
+        // rest as coloured text - the paragraph equivalent of EmitRuns, for contexts that compose directly
+        // on a PdfParagraphBuilder.
+        private static void EmitToBuilder(PdfParagraphBuilder b, string text, string colour, double size, bool bold = false)
+        {
+            foreach (var seg in SegmentEmoji(text))
+            {
+                switch (seg.Kind)
+                {
+                    case EmojiSegKind.Image:
+                        b.InlineImage(seg.Image!, size, size, seg.Text, OfficeImageFit.Contain, EmojiOffset(size));
+                        break;
+                    case EmojiSegKind.Mono:
+                        b.Bold(false).Color(Pdf(seg.Tint ?? colour)).Text(seg.Text);
+                        break;
+                    default:
+                        b.Bold(bold).Color(Pdf(colour)).Text(seg.Text);
+                        break;
+                }
+            }
+        }
+
+        /// <summary>
+        /// A grid of InfoBoxes laid out `cols` per row (client `Columns` of callouts, e.g. the Shadow AI
+        /// risk-level pairs). Each item is a node with title/content/tone/colour/tintTitle. Short final rows
+        /// are padded so columns keep their width.
+        /// </summary>
+        public static void InfoBoxColumns(ReportContext ctx, PdfContentBuilder item, List<object?> items, int cols)
+        {
+            if (items.Count == 0) return;
+            if (cols < 1) cols = 1;
+            var width = 100.0 / cols;
+            for (var start = 0; start < items.Count; start += cols)
+            {
+                var slice = items.Skip(start).Take(cols).ToList();
+                item.Row(r =>
+                {
+                    r.Gap(10);
+                    foreach (var node in slice)
+                        r.PercentColumn(width, col => InfoBoxCol(ctx, col,
+                            ReportNode.RowStr(node, "title"), ReportNode.RowStr(node, "tone"),
+                            ReportNode.RowStr(node, "colour"), RowBool(node, "tintTitle"),
+                            ReportNode.RowStr(node, "content") ?? string.Empty));
+                    for (var k = slice.Count; k < cols; k++) r.PercentColumn(width, _ => { });
+                });
+                item.Spacer(CalloutGap);
+            }
+        }
+
+        // One InfoBox rendered inside a row column, as the same single-cell table used full width.
+        private static void InfoBoxCol(ReportContext ctx, PdfContentBuilder col, string? title, string? tone,
+            string? colour, bool tintTitle, string content)
+        {
+            var (accent, bg, titleColour) = InfoBoxColours(ctx, tone, colour, tintTitle);
+            var body = CalloutBodyRuns(ctx, content, false, ReportStyles.InfoText, ctx.Theme.Palette["subtitle"]);
+            col.Table(CalloutRows(title, titleColour, ReportStyles.InfoTitle, body, ReportStyles.InfoText), PdfAlign.Left,
+                CalloutStyle(bg, accent, 4, ReportColours.Line, 1, ReportStyles.InfoText, string.IsNullOrEmpty(title) ? ReportStyles.InfoText : ReportStyles.InfoTitle));
+        }
+
+        // Series colour for a chart entry: its own colour, else the theme series cycled by index.
+        private static string SeriesColour(ReportContext ctx, string? own, int index)
+        {
+            if (!string.IsNullOrEmpty(own)) return own;
+            var s = ctx.Theme.Series;
+            return s.Count > 0 ? s[index % s.Count] : ctx.Theme.Palette["chart"];
+        }
+
+        // A row of stat cards. Each card is a single-column table inside its own row column, because a
+        // panel inside a row column left-aligns its text regardless of alignment, whereas a table cell
+        // honours Alignments.Center - so the number and label sit centred like the client statCard. The
+        // gaps between cards come from the row gap; the brand accent is the card's top border.
+        public static void StatRow(ReportContext ctx, PdfContentBuilder item, List<object?> stats)
+        {
+            if (stats.Count == 0) return;
+            var accent = ctx.Theme.Palette["card"];
+            var width = 100.0 / stats.Count; // column widths are percentages and must sum to ~100
+            // The number's room: the card's share of the row, less its side pads and a point of slack.
+            var valueWidth = (ctx.ContentWidth - StatGap * (stats.Count - 1)) / stats.Count - 2 * StatPadX - 1;
+            // Each card is its own single-cell table, so a caption or a wrapped label makes only that card
+            // taller. The client's statsGrid stretches every card to the tallest, so each card's lines under
+            // the figure are measured (14pt label lines, then a caption 4pt under them on 14pt lines) and a
+            // shorter card makes up the difference in its bottom padding.
+            // ponytail: a caption card's label is measured without the 4pt strut that ends it, so a label
+            // within ~5pt of the card width can wrap unpredicted; measure the strut in if that shows up.
+            var textHeights = stats.Select(s =>
+            {
+                var label = San((ReportNode.RowStr(s, "label") ?? string.Empty).ToUpperInvariant());
+                var caption = ReportNode.RowStr(s, "caption");
+                var h = StatLine * WrappedLines(label, valueWidth, ReportStyles.StatLabel, bold: true);
+                return string.IsNullOrEmpty(caption) ? h : h + 4 + StatLine * WrappedLines(San(caption), valueWidth, ReportStyles.StatCaption, bold: false);
+            }).ToList();
+            var tallest = textHeights.Max();
+            item.Row(r =>
+            {
+                r.Gap(StatGap);
+                for (var i = 0; i < stats.Count; i++)
+                {
+                    var s = stats[i];
+                    var value = ReportNode.RowStr(s, "value") ?? string.Empty;
+                    var label = (ReportNode.RowStr(s, "label") ?? string.Empty).ToUpperInvariant();
+                    var caption = ReportNode.RowStr(s, "caption");
+                    var colour = ReportNode.RowStr(s, "colour") ?? accent;
+                    var stretch = tallest - textHeights[i];
+                    r.PercentColumn(width, col => StatCard(ctx, col, value, label, caption, colour, accent, stretch, valueWidth));
+                }
+            });
+            item.Spacer(14);                           // client statsGrid marginBottom
+        }
+
+        private const double StatGap = 10, StatPadX = 6;
+
+        // Client statCard: the figure on a 23pt line (20pt at lineHeight 1.15) with 7pt under it, then the 7pt
+        // label and any caption on the page's 14pt lines. A cell line is its largest run x LineHeight but never
+        // under the table's size x LineHeight, so StatLeading makes the figure's line the client's step from
+        // the figure's baseline to the label's, and a table size of StatLine / StatLeading makes every other
+        // line (a label, a wrapped label line, a caption) the 14pt page line.
+        private const double StatLine = 14;
+        private const double StatLeading = (ReportStyles.StatNumber * 1.15 + 7 + 0.9 * (ReportStyles.StatLabel - ReportStyles.StatNumber)) / ReportStyles.StatNumber;
+
+        // Helvetica and Helvetica-Bold advance widths (per 1000 em) for the WinAnsi code points ' '..U+00FF, the
+        // metrics OfficeIMO lays the standard font out with (the oblique faces share them): ASCII, then 0x7F-0x9F
+        // (the cp1252 specials, which TextEm reaches through WinAnsiSpecials), then Latin-1. The accented
+        // capitals are as wide as their base letters (up to 778), so pricing them at a flat 556 let a cover line
+        // be packed past its box and cut off mid-word. Anything outside WinAnsi still counts as a digit-wide 556.
+        private static readonly int[] HelveticaWidths =
+        {
+            278, 278, 355, 556, 556, 889, 667, 191, 333, 333, 389, 584, 278, 333, 278, 278, 556, 556, 556, 556,
+            556, 556, 556, 556, 556, 556, 278, 278, 584, 584, 584, 556, 1015, 667, 667, 722, 722, 667, 611, 778,
+            722, 278, 500, 667, 556, 833, 722, 778, 667, 778, 722, 667, 611, 722, 667, 944, 667, 667, 611, 278,
+            278, 278, 469, 556, 333, 556, 556, 500, 556, 556, 278, 556, 556, 222, 222, 500, 222, 833, 556, 556,
+            556, 556, 333, 500, 278, 556, 500, 722, 500, 500, 500, 334, 260, 334, 584,
+            556, 556, 556, 222, 556, 333, 1000, 556, 556, 333, 1000, 667, 333, 1000, 556, 611, 556, 556, 222, 222,
+            333, 333, 350, 556, 1000, 333, 1000, 500, 333, 944, 556, 500, 667, 278, 333, 556, 556, 556, 556, 260,
+            556, 333, 737, 370, 556, 584, 333, 737, 333, 400, 584, 333, 333, 333, 556, 537, 278, 333, 333, 365,
+            556, 834, 834, 834, 611, 667, 667, 667, 667, 667, 667, 1000, 722, 667, 667, 667, 667, 278, 278, 278,
+            278, 722, 722, 778, 778, 778, 778, 778, 584, 778, 722, 722, 722, 722, 667, 667, 611, 556, 556, 556,
+            556, 556, 556, 889, 500, 556, 556, 556, 556, 278, 278, 278, 278, 556, 556, 556, 556, 556, 556, 556,
+            584, 611, 556, 556, 556, 556, 500, 556, 500,
+        };
+        private static readonly int[] HelveticaBoldWidths =
+        {
+            278, 333, 474, 556, 556, 889, 722, 238, 333, 333, 389, 584, 278, 333, 278, 278, 556, 556, 556, 556,
+            556, 556, 556, 556, 556, 556, 333, 333, 584, 584, 584, 611, 975, 722, 722, 722, 722, 667, 611, 778,
+            722, 278, 556, 722, 611, 833, 722, 778, 667, 778, 722, 667, 611, 722, 667, 944, 667, 667, 611, 333,
+            278, 333, 584, 556, 333, 556, 611, 556, 611, 556, 333, 611, 611, 278, 278, 556, 278, 889, 611, 611,
+            611, 611, 389, 556, 333, 611, 556, 778, 556, 556, 500, 389, 280, 389, 584,
+            556, 556, 556, 278, 556, 500, 1000, 556, 556, 333, 1000, 667, 333, 1000, 556, 611, 556, 556, 278, 278,
+            500, 500, 350, 556, 1000, 333, 1000, 556, 333, 944, 556, 500, 667, 278, 333, 556, 556, 556, 556, 280,
+            556, 333, 737, 370, 556, 584, 333, 737, 333, 400, 584, 333, 333, 333, 611, 556, 278, 333, 333, 365,
+            556, 834, 834, 834, 611, 722, 722, 722, 722, 722, 722, 1000, 722, 667, 667, 667, 667, 278, 278, 278,
+            278, 722, 722, 778, 778, 778, 778, 778, 584, 778, 722, 722, 722, 722, 667, 667, 611, 556, 556, 556,
+            556, 556, 556, 889, 556, 556, 556, 556, 556, 278, 278, 278, 278, 611, 611, 611, 611, 611, 611, 611,
+            584, 611, 611, 611, 611, 611, 556, 611, 556,
+        };
+
+        // What cp1252 puts at 0x80..0x9F (its five unassigned bytes kept as themselves), so a curly quote, dash
+        // or bullet finds its WinAnsi width.
+        private const string WinAnsiSpecials = "\u20AC\u0081\u201A\u0192\u201E\u2026\u2020\u2021\u02C6\u2030\u0160\u2039\u0152\u008D\u017D\u008F\u0090\u2018\u2019\u201C\u201D\u2022\u2013\u2014\u02DC\u2122\u0161\u203A\u0153\u009D\u017E\u0178";
+
+        // A character's code in WinAnsi, the standard fonts' encoding (the cp1252 specials at 0x80..0x9F, anything
+        // else its Latin-1 byte), or -1 when WinAnsi has no code for it.
+        internal static int WinAnsiCode(char ch)
+        {
+            var special = WinAnsiSpecials.IndexOf(ch);
+            return special >= 0 ? 0x80 + special : ch <= 0xFF ? ch : -1;
+        }
+
+        // A run of text's advance in em.
+        internal static double TextEm(string s, bool bold)
+        {
+            var widths = bold ? HelveticaBoldWidths : HelveticaWidths;
+            return s.Sum(ch =>
+            {
+                var special = WinAnsiSpecials.IndexOf(ch);
+                var code = special >= 0 ? 0x80 + special : ch;
+                return (code >= ' ' && code <= 0xFF ? widths[code - ' '] : 556) / 1000.0;
+            });
+        }
+
+        // How many lines `text` takes in a column `width` points wide: each '\n' line word-wrapped greedily,
+        // a word wider than the column broken across as many lines as it fills.
+        internal static int WrappedLines(string text, double width, double size, bool bold)
+        {
+            var lines = 0;
+            var space = 0.278 * size;
+            foreach (var line in text.Replace("\r", "").Split('\n'))
+            {
+                lines++;
+                var x = 0.0;
+                foreach (var word in line.Split(' '))
+                {
+                    var w = TextEm(word, bold) * size;
+                    if (x > 0 && x + space + w > width) { lines++; x = 0; }
+                    else if (x > 0) x += space;
+                    var extra = Math.Max(0, (int)Math.Ceiling(w / width) - 1);
+                    lines += extra;
+                    x += w - extra * width;
+                }
+            }
+            return lines;
+        }
+
+        // `text` broken into the lines WrappedLines counts: greedy word wrap, with a word wider than the
+        // column cut where it fills a line (never inside a surrogate pair). `tracking` is the client's
+        // letterSpacing, which react-pdf adds after every character when it decides where a line breaks.
+        internal static List<string> WrapLines(string text, double width, double size, bool bold, double tracking = 0)
+        {
+            var lines = new List<string>();
+            double Em(string s) => TextEm(s, bold) * size + tracking * s.Length;
+            foreach (var para in text.Replace("\r", "").Split('\n'))
+            {
+                var line = string.Empty;
+                foreach (var word in para.Split(' '))
+                {
+                    if (line.Length > 0 && Em(line + " " + word) > width) { lines.Add(line); line = string.Empty; }
+                    var rest = line.Length > 0 ? line + " " + word : word;
+                    while (Em(rest) > width && rest.Length > 1)
+                    {
+                        var n = rest.Length - 1;
+                        while (n > 1 && Em(rest[..n]) > width) n--;
+                        if (char.IsHighSurrogate(rest[n - 1]) && n > 1) n--;
+                        lines.Add(rest[..n]);
+                        rest = rest[n..];
+                    }
+                    line = rest;
+                }
+                lines.Add(line);
+            }
+            return lines;
+        }
+
+        // The stat number's font size: 20pt, or smaller when the figure would not fit its card on one line.
+        // The client lets a long figure run into the card's padding; the kit would break it inside the
+        // digits ("SEK 105,62" / "6"), so it scales the figure down to fit instead. A shrunk figure keeps
+        // one 20pt space (StatCard's strut), so that space is left out of the scaling. An emoji is 0.55em.
+        private const double SpaceEm = 0.278;
+        private static double StatValueSize(string value, double maxWidth)
+        {
+            var em = 0.0;
+            foreach (var seg in SegmentEmoji(San(value)))
+                em += seg.Kind == EmojiSegKind.Text ? TextEm(seg.Text, bold: true) : 0.55;
+            if (em * ReportStyles.StatNumber <= maxWidth) return ReportStyles.StatNumber;
+            var scaled = StatStrutAt(value) >= 0 ? em - SpaceEm : em;
+            return Math.Max(ReportStyles.StatLabel, (maxWidth - SpaceEm * ReportStyles.StatNumber) / scaled);
+        }
+
+        // Where a shrunk figure's 20pt strut goes: its first space ("KRW 13,580,460"), else -1 (appended).
+        private static int StatStrutAt(string value) => value.IndexOfAny(new[] { ' ', '\u00A0' });
+
+        private static void StatCard(ReportContext ctx, PdfContentBuilder col, string value, string label, string? caption, string colour, string accent, double stretch = 0, double valueWidth = double.MaxValue)
+        {
+            // One cell, the number over the label as separate runs split by a line break, so there is no
+            // internal row divider - just the outer card border and its brand top accent.
+            var runs = new List<PdfTextRun>();
+            // Size a number-adjacent emoji to ~the digit height and seat it on the digit cap box, so it does
+            // not raise the line's ascent - otherwise the number rides lower than a sibling card with no emoji
+            // (proportions measured for alignment: emoji ~0.55x the number, dropped ~0.18x onto the baseline).
+            // A figure too wide for the card shrinks. One of its spaces stays 20pt as a strut: OfficeIMO sizes
+            // a line by its text runs, so the strut keeps the 20pt line - the card keeps its height, the label
+            // stays level with the sibling cards' and the figure sits on their baseline. A figure with no
+            // space gets the strut after it.
+            var size = StatValueSize(value, valueWidth);
+            if (size < ReportStyles.StatNumber)
+            {
+                var at = StatStrutAt(value);
+                var head = at < 0 ? value : value[..at];
+                EmitRuns(runs, head, colour, size, bold: true, emojiSize: size * 0.55, emojiOffset: size * -0.18);
+                runs.Add(new PdfTextRun("\u00A0", true, false, Pdf(colour), false, false, ReportStyles.StatNumber));
+                if (at >= 0) EmitRuns(runs, value[(at + 1)..], colour, size, bold: true, emojiSize: size * 0.55, emojiOffset: size * -0.18);
+            }
+            else
+            {
+                EmitRuns(runs, value, colour, size, bold: true, emojiSize: size * 0.55, emojiOffset: size * -0.18);
+            }
+            runs.Add(Run("\n", colour, ReportStyles.StatNumber));
+            EmitRuns(runs, label, ReportColours.Muted, ReportStyles.StatLabel, bold: true);
+            // A caption sits 4pt under the label's 14pt line: a no-break space that tall ends the label line.
+            if (!string.IsNullOrEmpty(caption))
+            {
+                runs.Add(new PdfTextRun("\u00A0", true, false, Pdf(ReportColours.Muted), false, false, (StatLine + 4) / StatLeading));
+                runs.Add(Run("\n", ctx.Theme.Palette["subtitle"], ReportStyles.StatCaption));
+                EmitRuns(runs, caption!, ctx.Theme.Palette["subtitle"], ReportStyles.StatCaption);
+            }
+            var rows = new List<PdfTableCell[]> { new[] { new PdfTableCell(runs) } };
+            var style = new PdfTableStyle
+            {
+                HeaderRowCount = 0,
+                FontSize = StatLine / StatLeading,
+                LineHeight = StatLeading,
+                BorderColor = Pdf(ReportColours.Line),
+                BorderWidth = 1,
+                CornerRadius = CardCornerRadius,  // softly rounded card; top accent bar is clipped to the rounded corners
+                RowSeparatorWidth = 0,
+                CellPaddingX = 6,
+                CellPaddingY = 8,
+                // The first baseline where the client's figure sits (3pt accent, 10pt padding, 0.9x the figure
+                // size under its line top), and the card's foot 10pt of padding and the 1pt border under the
+                // last 14pt line, stretched to the row's tallest card.
+                CellPaddings = new Dictionary<(int, int), PdfCellPadding>
+                {
+                    [(0, 0)] = new PdfCellPadding
+                    {
+                        Left = StatPadX, Right = StatPadX,
+                        Top = 3 + 10 + 0.9 * ReportStyles.StatNumber - CellAscent * StatLine / StatLeading,
+                        Bottom = 10 + 1 - 0.9 * ReportStyles.StatLabel + CellAscent * StatLine / StatLeading + stretch,
+                    },
+                },
+                Alignments = new List<PdfColumnAlign> { PdfColumnAlign.Center },
+                CellFills = new Dictionary<(int, int), PdfColor> { [(0, 0)] = Pdf(ReportColours.White) },
+                CellBorders = new Dictionary<(int, int), PdfCellBorder>
+                {
+                    // only the top accent bar; disable the class-default grey sides so 3.4.x's general
+                    // cell-border renderer doesn't lay grey over the accent at the rounded corners.
+                    [(0, 0)] = new PdfCellBorder { TopBorder = new PdfCellBorderSide { Color = Pdf(accent), Width = 3 }, Left = false, Right = false, Bottom = false },
+                },
+            };
+            col.Table(rows, PdfAlign.Left, style);
+        }
+
+        // Labelled progress bars (client ProgressList): each item is its own bordered row box holding a
+        // bold label, a data bar over a grey track, and a bold value. One 1-row table per item gives the
+        // per-row border and lets the label/value be bold via cell runs; the row gap comes from a spacer.
+        public static void Progress(ReportContext ctx, PdfContentBuilder item, List<object?> items)
+        {
+            if (items.Count == 0) return;
+            for (var i = 0; i < items.Count; i++)
+            {
+                var it = items[i];
+                var label = ReportNode.RowStr(it, "label") ?? string.Empty;
+                var value = ReportNode.RowNum(it, "value");
+                var max = ReportNode.RowNum(it, "max"); if (max <= 0) max = 100;
+                var pct = Math.Max(0, Math.Min(1, value / max));
+                var display = ReportNode.RowStr(it, "display");
+                if (string.IsNullOrEmpty(display)) display = Math.Round(pct * 100) + "%";
+                var colour = ReportNode.RowStr(it, "colour") ?? SeriesColour(ctx, null, i);
+                var rows = new List<PdfTableCell[]>
+                {
+                    new[]
+                    {
+                        CellRuns(label, ctx.Theme.Palette["body"], bold: true),
+                        new PdfTableCell(string.Empty),
+                        CellRuns(display!, ReportColours.Body, bold: true),
+                    },
+                };
+                var style = new PdfTableStyle
+                {
+                    HeaderRowCount = 0,
+                    BorderColor = Pdf(ReportColours.Line),
+                    BorderWidth = 1,
+                    RowSeparatorWidth = 0,
+                    CellPaddingX = 10,
+                    CellPaddingY = 7,
+                    ColumnWidthWeights = new List<double> { 28, 58, 14 },
+                    Alignments = new List<PdfColumnAlign> { PdfColumnAlign.Left, PdfColumnAlign.Left, PdfColumnAlign.Right },
+                    VerticalAlignments = new List<PdfCellVerticalAlign> { PdfCellVerticalAlign.Middle, PdfCellVerticalAlign.Middle, PdfCellVerticalAlign.Middle },
+                    CellFills = new Dictionary<(int, int), PdfColor> { [(0, 1)] = Pdf(ReportColours.Line) },
+                    CellDataBars = new Dictionary<(int, int), PdfCellDataBar> { [(0, 1)] = new PdfCellDataBar { Color = Pdf(colour), Ratio = pct, StartRatio = 0 } },
+                };
+                item.Table(rows, PdfAlign.Left, style);
+                item.Spacer(6);
+            }
+        }
+
+        // -- charts (vector) --
+        // Real vector charts, ported 1:1 from the client charts.jsx which draws SVG into a 400x200 viewBox.
+        // Built as an OfficeDrawing (a fixed-size composite that flows as one block and reserves its
+        // height - unlike item.Canvas, which paints page-absolute and lets neighbours overlap it). The
+        // drawing shares the SVG coordinate system (top-left origin, y down), so the geometry is copied
+        // verbatim: the 400x200 plot is centred in a bordered white frame, title above, caption below.
+        // Client chartContainer/chartCanvas: a 1pt border and 16pt padding round the title (10pt on the 14pt
+        // page line, 12pt under it), the canvas and the 8pt under it, and a caption 8pt under that.
+        private const double ChartViewW = 400, ChartViewH = 200, ChartCanvasGap = 8;
+        private const double ChartTitleSize = 10, ChartLabelSize = 7, ChartCaptionSize = 8;
+
+        internal static OfficeColor OC(string hex)
+        {
+            var (r, g, b) = ColourMath.ToRgb(hex);
+            return OfficeColor.FromRgb((byte)r, (byte)g, (byte)b);
+        }
+
+        private static string FmtNum(double v)
+            => v == Math.Floor(v) ? ((long)v).ToString(CultureInfo.InvariantCulture) : v.ToString("0.##", CultureInfo.InvariantCulture);
+
+        // Positioned text into an OfficeDrawing at an explicit size/colour/alignment (AddText takes the
+        // size via the font, so every label supplies a Helvetica OfficeFontInfo).
+        private static void AddT(OfficeDrawing dw, string text, double x, double y, double w, double h,
+            double size, string colourHex, OfficeTextAlignment align, bool bold = false, bool wrap = false, double? lineHeight = null)
+            // The extended overload's wrapText makes a long block (the cover subtitle) fold inside its box
+            // instead of overrunning the page; the short overload leaves WrapText off (read-only afterwards).
+            // `lineHeight` is the line pitch in points (null: 1.2x the size).
+            => dw.AddText(text, x, y, w, h,
+                new OfficeFontInfo("Helvetica", size, bold ? OfficeFontStyle.Bold : OfficeFontStyle.Regular),
+                OC(colourHex), align, lineHeight: lineHeight, wrapText: wrap);
+
+        public static void Chart(ReportContext ctx, PdfContentBuilder item, string? kind, List<object?> data,
+            string? title = null, string? caption = null, double? max = null, string? centreLabel = null,
+            double? availableWidth = null)
+        {
+            var k = (kind ?? "bar").ToLowerInvariant();
+            // A drawing exactly the content width is rejected as too wide; availableWidth lets a chart draw
+            // inside a narrower column (half-width side-by-side charts) instead of the full page width.
+            var w = (availableWidth ?? ctx.ContentWidth) - 2;
+            const double border = 1, pad = 16, titleH = 14, titleGap = 12, captionGap = 8, captionH = ChartCaptionSize * 1.4;
+            var hasTitle = !string.IsNullOrEmpty(title);
+            var hasCaption = !string.IsNullOrEmpty(caption);
+            var plotTop = border + pad + (hasTitle ? titleH + titleGap : 0);
+            // The plot's own coordinate width: the 400pt design width, or the drawing if it is narrower
+            // (a half-width chart), so the geometry scales down to fit rather than overflowing the frame.
+            var vw = Math.Min(ChartViewW, w);
+            var leftPad = Math.Max(0, (w - vw) / 2);
+
+            var entries = data.Select((d, i) => (
+                label: ReportNode.RowStr(d, "label") ?? string.Empty,
+                value: ReportNode.RowNum(d, "value"),
+                colour: SeriesColour(ctx, ReportNode.RowStr(d, "colour"), i))).ToList();
+
+            // A donut grows past the 200pt canvas only when its legend packs into more rows than fit it.
+            var viewH = k == "donut" && entries.Count > 0 ? DonutViewHeight(entries, vw) : ChartViewH;
+            var captionTop = plotTop + viewH + ChartCanvasGap + captionGap;
+            var totalH = (hasCaption ? captionTop + captionH : plotTop + viewH + ChartCanvasGap) + pad + border;
+
+            var dw = new OfficeDrawing(w, totalH);
+            var frame = OfficeShape.RoundedRectangle(w, totalH, 6);
+            frame.FillColor = OC(ReportColours.White); frame.StrokeColor = OC(ReportColours.Line); frame.StrokeWidth = 1;
+            dw.AddShape(frame, 0, 0);
+            if (hasTitle)
+                AddT(dw, San(title!), 0, border + pad, w, titleH, ChartTitleSize, ctx.Theme.Palette["body"], OfficeTextAlignment.Center, true);
+
+            if (entries.Count == 0)
+                AddT(dw, "No data available for this chart.", 0, plotTop + viewH / 2 - 6, w, 12, ReportStyles.Body, ReportColours.Faint, OfficeTextAlignment.Center);
+            else if (k == "donut") DrawDonut(ctx, dw, entries, leftPad, plotTop, centreLabel, vw);
+            else if (k == "trend") DrawTrend(ctx, dw, entries, leftPad, plotTop, max, vw);
+            else DrawBar(ctx, dw, entries, leftPad, plotTop, vw);
+
+            if (hasCaption)
+                AddT(dw, San(caption!), 0, captionTop, w, captionH, ChartCaptionSize, ctx.Theme.Palette["chart"], OfficeTextAlignment.Center, true);
+
+            item.Drawing(dw, PdfAlign.Left);
+            item.Spacer(20);                           // client chartContainer marginBottom
+        }
+
+        /// <summary>A chart block flagged to render at half the page width (so two can sit side by side).</summary>
+        public static bool IsHalfWidthChart(ReportNode block)
+            => block.Type == "chart" && string.Equals(block.Str("width"), "half", StringComparison.OrdinalIgnoreCase);
+
+        // Render a chart block, optionally into a given width (a half-width column). Shared by the block
+        // dispatch (a lone half-width chart) and the side-by-side pair renderer.
+        private static void ChartFromBlock(ReportContext ctx, PdfContentBuilder item, ReportNode block, double? availableWidth)
+            => Chart(ctx, item, block.Str("chartKind"), block.ListOf("chartData") ?? new List<object?>(),
+                block.Str("title"), block.Str("caption") ?? block.Str("chartCaption"),
+                block.Num("max") ?? ParseNumber(block.Str("chartMax")), block.Str("centreLabel") ?? block.Str("chartCentreLabel"),
+                availableWidth);
+
+        /// <summary>Two half-width charts side by side in one row (the caller has checked both qualify).</summary>
+        public static void RenderChartPair(ReportContext ctx, PdfContentBuilder item, ReportNode a, ReportNode b, bool firstOnPage)
+        {
+            const double gap = 16;
+            var colWidth = (ctx.ContentWidth - gap) / 2;
+            item.Row(r =>
+            {
+                r.Gap(gap);
+                r.PercentColumn(50, col => ChartFromBlock(ctx, col, a, colWidth));
+                r.PercentColumn(50, col => ChartFromBlock(ctx, col, b, colWidth));
+            });
+        }
+
+        private static (double x, double y) Polar(double cx, double cy, double r, double deg)
+            => (cx + r * Math.Cos(deg * Math.PI / 180), cy + r * Math.Sin(deg * Math.PI / 180));
+
+        // Append cubic-bezier segments approximating a circular arc from a0 to a1 (radians) at radius r.
+        // Assumes the current path point is already at a0. Handles either sweep direction via the sign of
+        // (a1 - a0), splitting into <=90 degree segments (the standard 4/3*tan(dθ/4) control-point method).
+        private static void ArcBeziers(List<OfficePathCommand> cmds, double cx, double cy, double r, double a0, double a1)
+        {
+            var segs = Math.Max(1, (int)Math.Ceiling(Math.Abs(a1 - a0) / (Math.PI / 2)));
+            var d = (a1 - a0) / segs;
+            var t = a0;
+            for (var s = 0; s < segs; s++)
+            {
+                var t2 = t + d;
+                var k = 4.0 / 3.0 * Math.Tan(d / 4);
+                var x0 = cx + r * Math.Cos(t); var y0 = cy + r * Math.Sin(t);
+                var x3 = cx + r * Math.Cos(t2); var y3 = cy + r * Math.Sin(t2);
+                var c1x = x0 - k * r * Math.Sin(t); var c1y = y0 + k * r * Math.Cos(t);
+                var c2x = x3 + k * r * Math.Sin(t2); var c2y = y3 - k * r * Math.Cos(t2);
+                cmds.Add(OfficePathCommand.CubicBezierTo(c1x, c1y, c2x, c2y, x3, y3));
+                t = t2;
+            }
+        }
+
+        private static void DrawBar(ReportContext ctx, OfficeDrawing dw,
+            List<(string label, double value, string colour)> entries, double ox, double oy, double viewW = ChartViewW)
+        {
+            const double plotLeft = 40, plotTop = 20, plotHeight = 130;
+            var plotWidth = viewW - plotLeft - 20; // 340 at the full 400 design width
+            const double plotBottom = plotTop + plotHeight;
+            var maxValue = Math.Max(entries.Max(e => e.value), 0); if (maxValue <= 0) maxValue = 1;
+            var slot = plotWidth / entries.Count;
+            var barWidth = Math.Min(slot * 0.6, 46);
+
+            // Lines are placed at their start point with endpoints relative to it (a shape's coordinates
+            // are normalised to its own box, so absolute endpoints would collapse to the origin).
+            var axis = OfficeShape.Line(0, 0, plotWidth, 0);
+            axis.StrokeColor = OC(ReportColours.Line); axis.StrokeWidth = 1; dw.AddShape(axis, ox + plotLeft, oy + plotBottom);
+
+            for (var i = 0; i < entries.Count; i++)
+            {
+                var e = entries[i];
+                var height = Math.Max(e.value / maxValue * plotHeight, e.value > 0 ? 2 : 1);
+                var x = plotLeft + i * slot + (slot - barWidth) / 2;
+                var y = plotBottom - height;
+                var barRadius = Math.Min(2, Math.Min(barWidth, height) / 2);
+                var bar = OfficeShape.RoundedRectangle(barWidth, height, barRadius);
+                bar.FillColor = OC(e.colour); dw.AddShape(bar, ox + x, oy + y);
+                AddT(dw, FmtNum(e.value), ox + plotLeft + i * slot, oy + y - 11, slot, 9, ChartLabelSize, ctx.Theme.Palette["body"], OfficeTextAlignment.Center);
+                var label = e.label.Length > 14 ? e.label.Substring(0, 13) + "…" : e.label;
+                AddT(dw, San(label), ox + plotLeft + i * slot, oy + plotBottom + 5, slot, 9, ChartLabelSize, ReportColours.Muted, OfficeTextAlignment.Center);
+            }
+        }
+
+        // Donut geometry in chart coords (the client's): the ring's centre and radius, and where the legend starts.
+        private const double DonutCy = 85, DonutOuterR = 60, DonutInnerR = 25, DonutLegendY = 172, LegendRowH = 14;
+        private const double LegendSwatch = 8, LegendSwatchGap = 4, LegendEntryGap = 18, LegendCharW = 3.6;
+
+        // Legend entries packed into rows that fit the given width: they flow left to right and wrap when
+        // the next entry would overrun, so a narrow (half-width) donut stacks its legend rather than
+        // running its labels off the edge (which OfficeIMO rejects). Shared by the height reservation and
+        // the drawing so both agree on the row count.
+        private static List<List<(string label, double value, string colour)>> PackLegend(
+            List<(string label, double value, string colour)> entries, double viewW)
+        {
+            var budget = Math.Max(60, viewW - 20);
+            var rows = new List<List<(string label, double value, string colour)>>();
+            var current = new List<(string label, double value, string colour)>();
+            double used = 0;
+            foreach (var e in entries)
+            {
+                var text = San($"{e.label} ({FmtNum(e.value)})");
+                var entryW = LegendSwatch + LegendSwatchGap + text.Length * LegendCharW;
+                var add = (current.Count == 0 ? 0 : LegendEntryGap) + entryW;
+                if (current.Count > 0 && used + add > budget) { rows.Add(current); current = new List<(string, double, string)>(); used = 0; add = entryW; }
+                current.Add(e); used += add;
+            }
+            if (current.Count > 0) rows.Add(current);
+            return rows;
+        }
+
+        /// <summary>The height a donut needs: the client's 200pt canvas, which holds the ring and three legend
+        /// rows (the third runs into the 8pt under it), and a row more for each legend row past that.</summary>
+        private static double DonutViewHeight(List<(string label, double value, string colour)> entries, double viewW = ChartViewW)
+        {
+            var rows = Math.Max(1, PackLegend(entries.Where(e => e.value > 0).ToList(), viewW).Count);
+            return Math.Max(ChartViewH, DonutLegendY + (rows - 1) * LegendRowH + 4 - ChartCanvasGap);
+        }
+
+        private static void DrawDonut(ReportContext ctx, OfficeDrawing dw,
+            List<(string label, double value, string colour)> entries, double ox, double oy, string? centreLabel = null,
+            double viewW = ChartViewW)
+        {
+            var visible = entries.Where(e => e.value > 0).ToList();
+            var total = visible.Sum(e => e.value);
+            var viewH = DonutViewHeight(entries, viewW);
+            if (total <= 0)
+            {
+                AddT(dw, "No data available for this chart.", ox, oy + viewH / 2 - 6, viewW, 12, ReportStyles.Body, ReportColours.Faint, OfficeTextAlignment.Center);
+                return;
+            }
+            // Local chart coords (0..viewW, 0..viewH); all slices share one path box placed at the chart
+            // offset, so they align (a bare Path() normalises each to its own box and misplaces them).
+            double cx = viewW / 2, cy = DonutCy, outerR = DonutOuterR, innerR = DonutInnerR;
+            double preceding = 0;
+            foreach (var e in visible)
+            {
+                var startAngle = -90 + preceding / total * 360;
+                var angle = Math.Min(e.value / total * 360, 359.99);
+                var endAngle = startAngle + angle;
+                var os = Polar(cx, cy, outerR, startAngle);
+                var ie = Polar(cx, cy, innerR, endAngle);
+                var cmds = new List<OfficePathCommand> { OfficePathCommand.MoveTo(os.x, os.y) };
+                ArcBeziers(cmds, cx, cy, outerR, startAngle * Math.PI / 180, endAngle * Math.PI / 180);
+                cmds.Add(OfficePathCommand.LineTo(ie.x, ie.y));
+                ArcBeziers(cmds, cx, cy, innerR, endAngle * Math.PI / 180, startAngle * Math.PI / 180);
+                cmds.Add(OfficePathCommand.Close());
+                var slice = OfficeShape.Path(viewW, viewH, cmds);
+                slice.FillColor = OC(e.colour); slice.StrokeColor = OC(ReportColours.White); slice.StrokeWidth = 1;
+                dw.AddShape(slice, ox, oy);
+                preceding += e.value;
+            }
+            // Total in the middle, with an optional caption under it (client centreLabel): baselines 2pt above
+            // and 10pt below the centre, a text box's baseline sitting its font size under its top.
+            AddT(dw, FmtNum(total), ox + viewW / 2 - 40, oy + cy - 2 - 14, 80, 16, 14, ReportColours.Ink, OfficeTextAlignment.Center);
+            if (!string.IsNullOrEmpty(centreLabel))
+                AddT(dw, San(centreLabel!), ox + viewW / 2 - 40, oy + cy + 10 - 7, 80, 10, 7, ReportColours.Muted, OfficeTextAlignment.Center);
+            DrawLegend(ctx, dw, visible, ox, oy, DonutLegendY, viewW);
+        }
+
+        private static void DrawLegend(ReportContext ctx, OfficeDrawing dw,
+            List<(string label, double value, string colour)> entries, double ox, double oy, double baseY, double viewW = ChartViewW)
+        {
+            // Rows are packed to the width (see PackLegend), each centred; a text box is clamped to what
+            // is left inside the drawing so a long label never runs past the edge.
+            var packed = PackLegend(entries, viewW);
+            for (var row = 0; row < packed.Count; row++)
+            {
+                var rowEntries = packed[row];
+                var texts = rowEntries.Select(e => San($"{e.label} ({FmtNum(e.value)})")).ToList();
+                var widths = texts.Select(t => LegendSwatch + LegendSwatchGap + t.Length * LegendCharW).ToList();
+                var x = Math.Max(6, (viewW - (widths.Sum() + LegendEntryGap * (rowEntries.Count - 1))) / 2);
+                var rowY = baseY + row * LegendRowH;
+                for (var i = 0; i < rowEntries.Count; i++)
+                {
+                    var sw = OfficeShape.Rectangle(LegendSwatch, LegendSwatch); sw.FillColor = OC(rowEntries[i].colour); dw.AddShape(sw, ox + x, oy + rowY - 6);
+                    var textX = x + LegendSwatch + LegendSwatchGap;
+                    var textW = Math.Max(4, Math.Min(texts[i].Length * LegendCharW + 8, viewW - textX - 2));
+                    AddT(dw, texts[i], ox + textX, oy + rowY - 6, textW, 10, ChartLabelSize, ctx.Theme.Palette["body"], OfficeTextAlignment.Left);
+                    x += widths[i] + LegendEntryGap;
+                }
+            }
+        }
+
+        private static void DrawTrend(ReportContext ctx, OfficeDrawing dw,
+            List<(string label, double value, string colour)> entries, double ox, double oy, double? max, double viewW = ChartViewW)
+        {
+            const double plotLeft = 40, plotTop = 20, plotHeight = 140;
+            var plotWidth = viewW - plotLeft - 40; // 320 at the full 400 design width
+            const double plotBottom = plotTop + plotHeight;
+            var colour = ctx.Theme.Primary;
+            var dataMax = Math.Max(entries.Max(e => e.value), 0);
+            var scaleMax = max is > 0 ? max!.Value : dataMax > 0 ? dataMax : 1;
+            var spacing = plotWidth / Math.Max(entries.Count - 1, 1);
+            var pts = entries.Select((e, i) => (
+                x: plotLeft + i * spacing,
+                y: plotBottom - Math.Min(e.value / scaleMax, 1) * plotHeight)).ToList();
+
+            var rect = OfficeShape.Rectangle(plotWidth, plotHeight);
+            rect.FillColor = OC(ReportColours.Panel); rect.StrokeColor = OC(ReportColours.Line); rect.StrokeWidth = 1;
+            dw.AddShape(rect, ox + plotLeft, oy + plotTop);
+            for (var g = 0; g <= 4; g++)
+            {
+                var gy = plotTop + g * (plotHeight / 4);
+                var gl = OfficeShape.Line(0, 0, plotWidth, 0);
+                gl.StrokeColor = OC(ReportColours.Line); gl.StrokeWidth = 0.5; dw.AddShape(gl, ox + plotLeft, oy + gy);
+            }
+            if (pts.Count > 1)
+            {
+                // Local coords in a 400x200 box placed at the chart offset (see donut note).
+                var area = new List<OfficePathCommand> { OfficePathCommand.MoveTo(pts[0].x, pts[0].y) };
+                for (var i = 1; i < pts.Count; i++) area.Add(OfficePathCommand.LineTo(pts[i].x, pts[i].y));
+                area.Add(OfficePathCommand.LineTo(pts[^1].x, plotBottom));
+                area.Add(OfficePathCommand.LineTo(pts[0].x, plotBottom));
+                area.Add(OfficePathCommand.Close());
+                var areaShape = OfficeShape.Path(viewW, ChartViewH, area); areaShape.FillColor = OC(colour); areaShape.FillOpacity = 0.3; dw.AddShape(areaShape, ox, oy);
+
+                var line = new List<OfficePathCommand> { OfficePathCommand.MoveTo(pts[0].x, pts[0].y) };
+                for (var i = 1; i < pts.Count; i++) line.Add(OfficePathCommand.LineTo(pts[i].x, pts[i].y));
+                var lineShape = OfficeShape.Path(viewW, ChartViewH, line); lineShape.StrokeColor = OC(colour); lineShape.StrokeWidth = 2; dw.AddShape(lineShape, ox, oy);
+            }
+            foreach (var p in pts)
+            {
+                var dot = OfficeShape.Ellipse(6, 6); dot.FillColor = OC(colour); dw.AddShape(dot, ox + p.x - 3, oy + p.y - 3);
+            }
+            var stride = (int)Math.Ceiling(entries.Count / 7.0);
+            for (var i = 0; i < entries.Count; i++)
+                if (i % stride == 0)
+                    AddT(dw, San(entries[i].label), ox + pts[i].x - 20, oy + plotBottom + 8, 40, 9, ChartLabelSize, ReportColours.Muted, OfficeTextAlignment.Center);
+            foreach (var frac in new[] { 0, 0.25, 0.5, 0.75, 1.0 })
+                AddT(dw, FmtNum(Math.Round(scaleMax * frac)), ox, oy + plotBottom - frac * plotHeight - 4, plotLeft - 5, 9, ChartLabelSize, ReportColours.Muted, OfficeTextAlignment.Right);
+        }
+
+        // -- sankey (the dashboard CippSankey / nivo flow diagram) --
+        // A sankey is a layered DAG: nodes fall into columns by the longest path from a source (a node is
+        // one column right of everything that flows into it), a node's height is proportional to the flow
+        // through it, and links are ribbons whose thickness carries the value. Same OfficeDrawing canvas as
+        // the other charts (top-left origin, y down) so the geometry mirrors d3-sankey directly.
+        private sealed class SankeyNode
+        {
+            public string Id = string.Empty;
+            public string Label = string.Empty;
+            public string Colour = string.Empty;
+            public double Value;      // max(in, out)
+            public int Depth;
+            public double X, Y, H;    // laid-out position/size in plot coords
+            public readonly List<SankeyLink> Out = new();
+            public readonly List<SankeyLink> In = new();
+        }
+
+        private sealed class SankeyLink
+        {
+            public SankeyNode Src = null!;
+            public SankeyNode Tgt = null!;
+            public double Value, Width, Sy, Ty; // Sy/Ty = top edge of the ribbon at the source/target node
+        }
+
+        private const double SankeyNodeThickness = 12, SankeyNodeSpacing = 12, SankeyLabelGutter = 88;
+
+        public static void Sankey(ReportContext ctx, PdfContentBuilder item, List<object?> nodes, List<object?> links,
+            string? title = null, string? caption = null, double? height = null)
+        {
+            var w = ctx.ContentWidth - 2; // a drawing exactly the content width is rejected as too wide
+            const double pad = 16, titleH = 14, titleGap = 12, captionGap = 8, captionH = 10;
+            var hasTitle = !string.IsNullOrEmpty(title);
+            var hasCaption = !string.IsNullOrEmpty(caption);
+            var plotTop = pad + (hasTitle ? titleH + titleGap : 0);
+            var plotH = height is > 0 ? height!.Value : 240;
+            var totalH = plotTop + plotH + pad + (hasCaption ? captionGap + captionH : 0);
+
+            var dw = new OfficeDrawing(w, totalH);
+            var frame = OfficeShape.RoundedRectangle(w, totalH, 6);
+            frame.FillColor = OC(ReportColours.White); frame.StrokeColor = OC(ReportColours.Line); frame.StrokeWidth = 1;
+            dw.AddShape(frame, 0, 0);
+            if (hasTitle)
+                AddT(dw, San(title!), 0, pad, w, titleH, ChartTitleSize, ctx.Theme.Palette["body"], OfficeTextAlignment.Center, true);
+
+            var model = BuildSankey(ctx, nodes, links, w - 2 * SankeyLabelGutter, plotH);
+            if (model.Count == 0)
+                AddT(dw, "No data available for this chart.", 0, plotTop + plotH / 2 - 6, w, 12, ReportStyles.Body, ReportColours.Faint, OfficeTextAlignment.Center);
+            else
+                DrawSankey(dw, model, SankeyLabelGutter, plotTop, w - 2 * SankeyLabelGutter, w, totalH);
+
+            if (hasCaption)
+                AddT(dw, San(caption!), 0, plotTop + plotH + captionGap, w, captionH, ChartLabelSize, ctx.Theme.Palette["chart"], OfficeTextAlignment.Center);
+
+            item.Drawing(dw, PdfAlign.Left);
+            item.Spacer(12);
+        }
+
+        // Read the nodes/links payload, assign columns, scale node heights to the plot, and relax the vertical
+        // positions so linked nodes line up (fewer ribbon crossings). Returns the laid-out nodes, or empty when
+        // there is nothing to draw.
+        private static List<SankeyNode> BuildSankey(ReportContext ctx, List<object?> nodes, List<object?> links,
+            double plotW, double plotH)
+        {
+            var byId = new Dictionary<string, SankeyNode>(StringComparer.Ordinal);
+            SankeyNode NodeFor(string id) => byId.TryGetValue(id, out var n) ? n
+                : byId[id] = new SankeyNode { Id = id, Label = id, Colour = ctx.Theme.Palette["chart"] };
+
+            var order = 0;
+            var sequence = new Dictionary<string, int>(StringComparer.Ordinal);
+            foreach (var raw in nodes)
+            {
+                var id = ReportNode.RowStr(raw, "id");
+                if (string.IsNullOrEmpty(id)) continue;
+                var n = NodeFor(id!);
+                n.Label = ReportNode.RowStr(raw, "label") ?? id!;
+                var colour = ReportNode.RowStr(raw, "nodeColor") ?? ReportNode.RowStr(raw, "colour");
+                if (!string.IsNullOrEmpty(colour)) n.Colour = colour!;
+                if (!sequence.ContainsKey(id!)) sequence[id!] = order++;
+            }
+            foreach (var raw in links)
+            {
+                var s = ReportNode.RowStr(raw, "source"); var t = ReportNode.RowStr(raw, "target");
+                var v = ReportNode.RowNum(raw, "value");
+                if (string.IsNullOrEmpty(s) || string.IsNullOrEmpty(t) || v <= 0) continue;
+                var src = NodeFor(s!); var tgt = NodeFor(t!);
+                if (!sequence.ContainsKey(s!)) sequence[s!] = order++;
+                if (!sequence.ContainsKey(t!)) sequence[t!] = order++;
+                var link = new SankeyLink { Src = src, Tgt = tgt, Value = v };
+                src.Out.Add(link); tgt.In.Add(link);
+            }
+
+            var all = byId.Values.Where(n => n.Out.Count > 0 || n.In.Count > 0).ToList();
+            if (all.Count == 0) return all;
+            foreach (var n in all) n.Value = Math.Max(n.Out.Sum(l => l.Value), n.In.Sum(l => l.Value));
+
+            // Column (depth): longest path from a source, then leaf nodes (no outgoing link) are pushed to
+            // the LAST column - this is nivo align="justify", which the dashboard uses. Terminal buckets
+            // such as the auth-methods "Single factor" therefore land in the output column exactly as on
+            // the dashboard; input-order stacking (below, nivo sort="input") keeps them at the top so their
+            // ribbons run cleanly across rather than cutting through the middle stage.
+            for (var i = 0; i < all.Count; i++)
+                foreach (var n in all)
+                    foreach (var l in n.Out)
+                        if (l.Tgt.Depth < n.Depth + 1) l.Tgt.Depth = n.Depth + 1;
+            var columnCount = all.Max(n => n.Depth) + 1;
+            foreach (var n in all) if (n.Out.Count == 0) n.Depth = columnCount - 1;
+
+            var columns = Enumerable.Range(0, columnCount)
+                .Select(d => all.Where(n => n.Depth == d).OrderBy(n => sequence[n.Id]).ToList())
+                .ToList();
+
+            // One vertical scale across every column - the tightest column (most flow / most nodes) sets it, so
+            // nothing overflows the plot. ky converts a value to points of height.
+            var ky = double.PositiveInfinity;
+            foreach (var col in columns)
+            {
+                var sum = col.Sum(n => n.Value);
+                if (sum <= 0) continue;
+                var available = plotH - (col.Count - 1) * SankeyNodeSpacing;
+                ky = Math.Min(ky, Math.Max(available, 1) / sum);
+            }
+            if (double.IsInfinity(ky) || ky <= 0) ky = 1;
+
+            foreach (var n in all)
+            {
+                n.H = Math.Max(n.Value * ky, 2);
+                n.X = columnCount == 1 ? 0 : (double)n.Depth / (columnCount - 1) * Math.Max(plotW - SankeyNodeThickness, 1);
+            }
+            // Initial y: stack each column and centre the stack in the plot.
+            foreach (var col in columns)
+            {
+                var stack = col.Sum(n => n.H) + (col.Count - 1) * SankeyNodeSpacing;
+                var y = Math.Max(0, (plotH - stack) / 2);
+                foreach (var n in col) { n.Y = y; y += n.H + SankeyNodeSpacing; }
+            }
+            // A few relaxation passes align a node with the weighted centre of what flows into/out of it, the
+            // way d3-sankey does; collisions are then resolved IN THE FIXED INPUT ORDER (never re-sorted by
+            // Y), so the vertical order stays the data order - matching nivo sort="input" on the dashboard.
+            for (var iter = 0; iter < 6; iter++)
+            {
+                var alpha = 0.9 * Math.Pow(0.99, iter);
+                foreach (var col in columns)
+                    foreach (var n in col)
+                    {
+                        var linked = n.In.Concat(n.Out).ToList();
+                        var weight = linked.Sum(l => l.Value);
+                        if (weight <= 0) continue;
+                        var target = linked.Sum(l => ((l.Src == n ? l.Tgt : l.Src).Y + (l.Src == n ? l.Tgt : l.Src).H / 2) * l.Value) / weight;
+                        n.Y += (target - (n.Y + n.H / 2)) * alpha;
+                    }
+                foreach (var col in columns) ResolveSankeyCollisions(col, plotH);
+            }
+
+            // Stack the ribbon endpoints on each node face, ordered by the counterpart's position so ribbons
+            // fan out without crossing at the node.
+            foreach (var n in all)
+            {
+                var oy = n.Y;
+                foreach (var l in n.Out.OrderBy(l => l.Tgt.Y)) { l.Width = l.Value * ky; l.Sy = oy; oy += l.Width; }
+                var iy = n.Y;
+                foreach (var l in n.In.OrderBy(l => l.Src.Y)) { l.Ty = iy; iy += l.Width; }
+            }
+            return all;
+        }
+
+        private static void ResolveSankeyCollisions(List<SankeyNode> col, double plotH)
+        {
+            if (col.Count == 0) return;
+            // Resolve overlaps in the column's GIVEN order (input/sequence order), not by Y - re-sorting by
+            // Y would scramble the nivo sort="input" ordering the dashboard uses. Push down, then if the
+            // stack overruns the plot, push back up from the bottom.
+            var y = 0.0;
+            foreach (var n in col) { if (n.Y < y) n.Y = y; y = n.Y + n.H + SankeyNodeSpacing; }
+            var overflow = y - SankeyNodeSpacing - plotH;
+            if (overflow > 0)
+            {
+                y = plotH;
+                for (var i = col.Count - 1; i >= 0; i--)
+                {
+                    var n = col[i];
+                    if (n.Y + n.H > y) n.Y = y - n.H;
+                    y = n.Y - SankeyNodeSpacing;
+                }
+            }
+            foreach (var n in col) n.Y = Math.Max(0, Math.Min(n.Y, plotH - n.H));
+        }
+
+        private static void DrawSankey(OfficeDrawing dw, List<SankeyNode> nodes, double ox, double oy, double plotW,
+            double boxW, double boxH)
+        {
+            // Ribbons first (under the node bars): a horizontal cubic band from the source's right face to the
+            // target's left face, tinted the source colour so a node's outflow reads as one family.
+            foreach (var n in nodes)
+                foreach (var l in n.Out)
+                {
+                    double x0 = ox + l.Src.X + SankeyNodeThickness, x1 = ox + l.Tgt.X, xm = (x0 + x1) / 2;
+                    double t0 = oy + l.Sy, t1 = oy + l.Ty, b0 = t0 + l.Width, b1 = t1 + l.Width;
+                    var cmds = new List<OfficePathCommand>
+                    {
+                        OfficePathCommand.MoveTo(x0, t0),
+                        OfficePathCommand.CubicBezierTo(xm, t0, xm, t1, x1, t1),
+                        OfficePathCommand.LineTo(x1, b1),
+                        OfficePathCommand.CubicBezierTo(xm, b1, xm, b0, x0, b0),
+                        OfficePathCommand.Close(),
+                    };
+                    var ribbon = OfficeShape.Path(boxW, boxH, cmds);
+                    ribbon.FillColor = OC(l.Src.Colour); ribbon.FillOpacity = 0.45;
+                    dw.AddShape(ribbon, 0, 0);
+                }
+            // Node bars + labels: end columns label outward into the gutter, inner columns label to the right.
+            foreach (var n in nodes)
+            {
+                // A thin node (tiny flow) is shorter than twice the corner radius, which RoundedRectangle
+                // rejects - clamp the radius to what fits.
+                var radius = Math.Min(3, Math.Min(SankeyNodeThickness, n.H) / 2);
+                var bar = OfficeShape.RoundedRectangle(SankeyNodeThickness, n.H, radius);
+                bar.FillColor = OC(n.Colour); dw.AddShape(bar, ox + n.X, oy + n.Y);
+
+                var label = n.Label.Length > 22 ? n.Label.Substring(0, 21) + "…" : n.Label;
+                var midY = oy + n.Y + n.H / 2 - 4;
+                if (n.X <= 0.01)
+                    AddT(dw, San(label), ox - SankeyLabelGutter, midY, SankeyLabelGutter - 5, 12, ChartLabelSize, ReportColours.Body, OfficeTextAlignment.Right);
+                else if (n.X >= plotW - SankeyNodeThickness - 0.01)
+                    AddT(dw, San(label), ox + n.X + SankeyNodeThickness + 5, midY, SankeyLabelGutter - 5, 12, ChartLabelSize, ReportColours.Body, OfficeTextAlignment.Left);
+                else
+                    AddT(dw, San(label), ox + n.X + SankeyNodeThickness + 4, midY, 100, 12, ChartLabelSize, ReportColours.Muted, OfficeTextAlignment.Left);
+            }
+        }
+
+        private static string RunsToPlain(IReadOnlyList<TextRun> runs)
+        {
+            var sb = new System.Text.StringBuilder();
+            foreach (var r in runs) sb.Append(r.Text);
+            return sb.ToString();
+        }
+
+        // -- dispatch --
+        /// <summary>Render a list of component/primitive nodes into the current item flow. An optional text
+        /// style flows into paragraph nodes so a callout renders its body at the callout size, not body copy.</summary>
+        public static void RenderNodes(ReportContext ctx, PdfContentBuilder item, IEnumerable<ReportNode> nodes, TextStyle? textStyle = null)
+        {
+            foreach (var node in nodes) RenderNode(ctx, item, node, textStyle);
+        }
+
+        private static void RenderNode(ReportContext ctx, PdfContentBuilder item, ReportNode node, TextStyle? textStyle = null)
+        {
+            switch (node.Type)
+            {
+                case "heading":
+                    Heading(ctx, item, (int)(node.Num("level") ?? 2), node.Get<List<TextRun>>("runs") ?? new List<TextRun>());
+                    break;
+                case "paragraph":
+                    Paragraph(ctx, item, node.Get<List<TextRun>>("runs") ?? new List<TextRun>(), textStyle);
+                    break;
+                case "bullets":
+                    // Inside a callout (textStyle set) OfficeIMO panels ignore a per-call list style, so
+                    // the list is drawn as one styled paragraph with a marker per line - matching the
+                    // client, which renders callout bullets as a single text block. Elsewhere the real
+                    // list renderer is used.
+                    if (textStyle is { } bts) BulletLines(ctx, item, StringItems(node), bts, _ => "•  ");
+                    else Bullets(ctx, item, StringItems(node));
+                    break;
+                case "numbered":
+                    if (textStyle is { } nts)
+                    {
+                        var start = (int)(node.Num("start") ?? 1);
+                        BulletLines(ctx, item, StringItems(node), nts, i => $"{start + i}.  ");
+                    }
+                    else Numbered(ctx, item, StringItems(node), (int)(node.Num("start") ?? 1));
+                    break;
+                case "table":
+                    RenderTableNode(ctx, item, node);
+                    break;
+                case "code":
+                    Code(ctx, item, node.Str("text") ?? node.Str("content") ?? string.Empty);
+                    break;
+                case "hr":
+                    Hr(ctx, item);
+                    break;
+                default:
+                    // Unknown primitive: fall back to its text content as a paragraph.
+                    var text = node.Str("content") ?? node.Str("text");
+                    if (!string.IsNullOrEmpty(text)) Paragraph(ctx, item, ReportMarkdown.MarkdownRuns(text));
+                    break;
+            }
+        }
+
+        private static void RenderTableNode(ReportContext ctx, PdfContentBuilder item, ReportNode node)
+        {
+            var rows = node.Get<List<string[]>>("rows");
+            if (rows is { Count: > 0 }) Table(ctx, item, rows);
+        }
+
+        private static List<string> StringItems(ReportNode node)
+        {
+            var result = new List<string>();
+            if (node.Get<List<string>>("items") is { } typed) return typed;
+            // Items may be plain strings (markdown) or objects with a text/label/content field (the report
+            // builder's row editor saves objects), so read the field when an item is a dictionary.
+            if (node.ListOf("items") is { } raw)
+                foreach (var o in raw)
+                    result.Add(o is Dictionary<string, object?>
+                        ? (ReportNode.RowStr(o, "text") ?? ReportNode.RowStr(o, "label") ?? ReportNode.RowStr(o, "content") ?? string.Empty)
+                        : o?.ToString() ?? string.Empty);
+            return result;
+        }
+
+        /// <summary>
+        /// Block -> component adapter for the Report Builder. Each top-level block renders its title as a
+        /// section heading, then its body composed from the component kit. Hero/pagebreak are handled by
+        /// the document scaffold, not here.
+        /// </summary>
+        private static double? ParseNumber(string? text)
+            => double.TryParse(text, NumberStyles.Any, CultureInfo.InvariantCulture, out var value) ? value : null;
+
+        public static void RenderBlock(ReportContext ctx, PdfContentBuilder item, ReportNode block, bool firstOnPage = false)
+        {
+            var content = block.Str("content") ?? string.Empty;
+
+            // Callouts carry their own title inside the box, so they are handled before the generic
+            // section-title emit below - the title must not also appear as a heading above the panel.
+            switch (block.Type)
+            {
+                case "infobox":
+                    InfoBox(ctx, item, block.Str("title"), block.Str("tone"), block.Str("colour"), block.Bool("tintTitle"), content, block.Bool("lines"));
+                    return;
+                case "infoboxcolumns":
+                    InfoBoxColumns(ctx, item, block.ListOf("items") ?? new List<object?>(), (int)(block.Num("columns") ?? 2));
+                    return;
+                case "alertbox":
+                    AlertBox(ctx, item, block.Str("title"), block.Str("colour"), content, block.Bool("lines"));
+                    return;
+                case "clearbox":
+                    ClearBox(ctx, item, block.Str("title"), content, block.Bool("lines"));
+                    return;
+                case "paragraphindent":
+                    IndentedParagraph(ctx, item, content);
+                    return;
+                case "note":
+                    Note(ctx, item, content);
+                    return;
+                case "chart":
+                    // The fixed reports name these caption/max/centreLabel; the report builder saves them
+                    // with a chart prefix. Both reach the page. A half-width chart with no adjacent partner
+                    // renders at half width on its own line (the pair renderer handles two together).
+                    ChartFromBlock(ctx, item, block, IsHalfWidthChart(block) ? (ctx.ContentWidth - 16) / 2 : (double?)null);
+                    return;
+                case "sankey":
+                    Sankey(ctx, item, block.ListOf("nodes") ?? new List<object?>(), block.ListOf("links") ?? new List<object?>(),
+                        block.Str("title"), block.Str("caption") ?? block.Str("chartCaption"),
+                        block.Num("height") ?? ParseNumber(block.Str("height")));
+                    return;
+            }
+
+            // A titled block opens a new section (client <Section>). Every section but the first on a page
+            // carries the client's section marginBottom 12 above its heading, on top of the previous
+            // block's own trailing space - so sections sit apart the way they do in the react-pdf reports.
+            var title = block.Str("title");
+            if (!string.IsNullOrEmpty(title))
+            {
+                if (!firstOnPage) item.Spacer(SectionGap);
+                SectionTitle(ctx, item, title);
+            }
+
+            // Test-block status line (Passed/Failed/Investigate/Skipped).
+            if (block.Type == "test" && !string.IsNullOrEmpty(block.Str("status")))
+                Note(ctx, item, "Status: " + block.Str("status"));
+
+            switch (block.Type)
+            {
+                case "scorecard":
+                    StatRow(ctx, item, block.ListOf("stats") ?? new List<object?>());
+                    break;
+                case "richtable":
+                    // The client DataTable always has an empty state: its emptyText, else 'Nothing to report.'.
+                    RichTable(ctx, item, block.ListOf("columns") ?? new List<object?>(), block.ListOf("rows") ?? new List<object?>(), (int)(block.Num("limit") ?? ParseNumber(block.Str("limit")) ?? 0), block.Str("emptyText") ?? "Nothing to report.");
+                    break;
+                case "richbullets":
+                    RichBullets(ctx, item, block.ListOf("items") ?? new List<object?>());
+                    break;
+                case "progress":
+                    Progress(ctx, item, block.ListOf("items") ?? new List<object?>());
+                    break;
+                case "database":
+                    var format = block.Str("format");
+                    if (!string.IsNullOrEmpty(format) && format != "text") Code(ctx, item, content);
+                    else RenderNodes(ctx, item, ReportMarkdown.MarkdownToNodes(content));
+                    break;
+                case "blank":
+                    RenderNodes(ctx, item, ReportMarkdown.HtmlToNodes(content));
+                    break;
+                case "test":
+                    RenderNodes(ctx, item, block.Bool("static")
+                        ? ReportMarkdown.HtmlToNodes(content)
+                        : ReportMarkdown.MarkdownToNodes(content));
+                    break;
+                default:
+                    // A raw primitive node passed straight through (e.g. from a fixed report composing the kit).
+                    RenderNode(ctx, item, block);
+                    break;
+            }
+        }
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/ReportContext.cs b/Shared/CIPPSharp/Reporting/ReportContext.cs
new file mode 100644
index 0000000000000..ea5d9cbe440cd
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/ReportContext.cs
@@ -0,0 +1,101 @@
+using System;
+using System.Collections.Generic;
+using System.Text.Json;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// Branding as saved by Get-CIPPBrandingSettings (or a preset), parsed from JSON. Mirrors the shape
+    /// the client theme consumes: brand colours, per-role colour overrides, footer/watermark config, and
+    /// the logo/cover as data-URLs. Missing toggles stay null so the theme applies its "!== false" defaults.
+    /// </summary>
+    public sealed class BrandingInput
+    {
+        public string? Colour { get; init; }
+        public string? SecondaryColour { get; init; }
+        public string? FooterText { get; init; }
+        public string? CoverFooterText { get; init; }
+        public bool? ShowFooter { get; init; }
+        public bool? ShowPageNumbers { get; init; }
+        public string? WatermarkText { get; init; }
+        public bool? WatermarkEnabled { get; init; }
+        public string? Logo { get; init; }        // data-URL
+        public string? CoverImage { get; init; }   // data-URL (an uploaded cover)
+        public string? CoverStock { get; init; }   // a bundled /reportImages/ path, or "none"
+        private Dictionary<string, string> RoleColours { get; init; } = new();
+        private Dictionary<string, string> FlatColours { get; init; } = new();
+
+        /// <summary>roleColours[setting] first, then a flat property of the same name (preset/template case).</summary>
+        public string? RoleColour(string setting)
+        {
+            if (RoleColours.TryGetValue(setting, out var v)) return v;
+            return FlatColours.TryGetValue(setting, out var f) ? f : null;
+        }
+
+        public static BrandingInput FromJson(string? json)
+        {
+            if (string.IsNullOrWhiteSpace(json)) return new BrandingInput();
+            JsonDocument doc;
+            try { doc = JsonDocument.Parse(json); }
+            catch { return new BrandingInput(); }
+            using var _ = doc;
+            var root = doc.RootElement;
+            if (root.ValueKind != JsonValueKind.Object) return new BrandingInput();
+
+            string? Str(string name) => root.TryGetProperty(name, out var e) && e.ValueKind == JsonValueKind.String ? e.GetString() : null;
+            bool? Bool(string name) => root.TryGetProperty(name, out var e) && (e.ValueKind == JsonValueKind.True || e.ValueKind == JsonValueKind.False) ? e.GetBoolean() : (bool?)null;
+
+            var roles = new Dictionary<string, string>();
+            if (root.TryGetProperty("roleColours", out var rc) && rc.ValueKind == JsonValueKind.Object)
+            {
+                foreach (var p in rc.EnumerateObject())
+                    if (p.Value.ValueKind == JsonValueKind.String) roles[p.Name] = p.Value.GetString()!;
+            }
+            // Flat colour overrides (a preset/template can set e.g. "headingColour" directly).
+            var flat = new Dictionary<string, string>();
+            foreach (var p in root.EnumerateObject())
+                if (p.Name.EndsWith("Colour", StringComparison.Ordinal) && p.Value.ValueKind == JsonValueKind.String)
+                    flat[p.Name] = p.Value.GetString()!;
+
+            return new BrandingInput
+            {
+                Colour = Str("colour"),
+                SecondaryColour = Str("secondaryColour"),
+                FooterText = Str("footerText"),
+                CoverFooterText = Str("coverFooterText"),
+                ShowFooter = Bool("showFooter"),
+                ShowPageNumbers = Bool("showPageNumbers"),
+                WatermarkText = Str("watermarkText"),
+                WatermarkEnabled = Bool("watermarkEnabled"),
+                Logo = Str("logo"),
+                CoverImage = Str("coverImage"),
+                CoverStock = Str("coverStock"),
+                RoleColours = roles,
+                FlatColours = flat,
+            };
+        }
+    }
+
+    /// <summary>
+    /// Everything a component needs while rendering - the ReportProvider equivalent. Passed to every
+    /// component so none of them reach for global state or inline a colour.
+    /// </summary>
+    public sealed class ReportContext
+    {
+        public required ReportTheme Theme { get; init; }
+        public required IReadOnlyDictionary<string, string> Variables { get; init; }
+        public string PageSize { get; init; } = "A4";
+        public bool Landscape { get; init; }
+        public string TenantName { get; init; } = "Organization";
+        public string ReportName { get; init; } = "Report";
+        public string GeneratedOn { get; init; } = "";
+        public byte[]? Logo { get; init; }
+        public byte[]? CoverImage { get; init; }
+
+        /// <summary>Usable content width in points (paper - page padding both sides). Mirrors contentWidth().</summary>
+        public double ContentWidth => ReportStyles.ContentWidth(PageSize, Landscape);
+
+        /// <summary>Usable content height in points (paper - page padding both sides).</summary>
+        public double ContentHeight => ReportStyles.ContentHeight(PageSize, Landscape);
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/ReportMarkdown.cs b/Shared/CIPPSharp/Reporting/ReportMarkdown.cs
new file mode 100644
index 0000000000000..bae4c95a2b7cb
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/ReportMarkdown.cs
@@ -0,0 +1,627 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text;
+using System.Text.RegularExpressions;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// Faithful C# port of the frontend fidelity contract:
+    ///   markdown-inline.js, html-inline.js, markdown-table.js and the markdown/HTML block converters
+    ///   in ReportBuilderPDF.jsx.
+    /// Inline parsing yields a shared nested tree that flattens into <see cref="TextRun"/>s; block
+    /// parsing yields <see cref="ReportNode"/>s the component kit renders. Both markdown and HTML feed
+    /// the same run emitter - ported once, exactly as the JS does.
+    /// </summary>
+    public static class ReportMarkdown
+    {
+        private sealed class InlineNode
+        {
+            public string Type = "text";           // text|strong|em|strongEm|code|strike|underline
+            public string Value = string.Empty;    // for text
+            public List<InlineNode> Children = new();
+        }
+
+        // -- Inline markdown --
+        private static readonly (string marker, string type)[] EmphasisMarkers =
+        {
+            ("***", "strongEm"), ("___", "strongEm"), ("**", "strong"), ("__", "strong"),
+            ("~~", "strike"), ("*", "em"), ("_", "em"),
+        };
+        private const string Escapable = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
+
+        private static bool IsBoundary(char? c)
+            => c is null || char.IsWhiteSpace(c.Value) || char.IsPunctuation(c.Value) || char.IsSymbol(c.Value);
+
+        private static List<InlineNode> ParseInlineMarkdown(string? text)
+        {
+            var source = text ?? string.Empty;
+            var nodes = new List<InlineNode>();
+            var buffer = new StringBuilder();
+            var i = 0;
+
+            void Flush()
+            {
+                if (buffer.Length > 0) { nodes.Add(new InlineNode { Type = "text", Value = buffer.ToString() }); buffer.Clear(); }
+            }
+
+            while (i < source.Length)
+            {
+                var ch = source[i];
+
+                if (ch == '\\' && i + 1 < source.Length && Escapable.IndexOf(source[i + 1]) >= 0)
+                {
+                    buffer.Append(source[i + 1]); i += 2; continue;
+                }
+                if (ch == '`')
+                {
+                    var end = source.IndexOf('`', i + 1);
+                    if (end > i + 1)
+                    {
+                        Flush();
+                        nodes.Add(new InlineNode { Type = "code", Children = { new InlineNode { Type = "text", Value = source.Substring(i + 1, end - i - 1) } } });
+                        i = end + 1; continue;
+                    }
+                }
+                if (ch == '[')
+                {
+                    var link = Regex.Match(source.Substring(i), "^\\[([^\\]]*)\\]\\([^)\\s]*(?:\\s+\"[^\"]*\")?\\)");
+                    if (link.Success)
+                    {
+                        Flush();
+                        nodes.AddRange(ParseInlineMarkdown(link.Groups[1].Value));
+                        i += link.Value.Length; continue;
+                    }
+                }
+                if (ch == '*' || ch == '_' || ch == '~')
+                {
+                    var span = MatchEmphasis(source, i);
+                    if (span is not null)
+                    {
+                        Flush();
+                        nodes.Add(new InlineNode { Type = span.Value.type, Children = ParseInlineMarkdown(span.Value.content) });
+                        i = span.Value.end; continue;
+                    }
+                }
+                buffer.Append(ch); i += 1;
+            }
+            Flush();
+            return nodes;
+        }
+
+        private static (string type, string content, int end)? MatchEmphasis(string source, int start)
+        {
+            foreach (var (marker, type) in EmphasisMarkers)
+            {
+                if (string.CompareOrdinal(source, start, marker, 0, marker.Length) != 0) continue;
+                if (marker[0] == '_' && !IsBoundary(start - 1 >= 0 ? source[start - 1] : (char?)null)) continue;
+
+                var contentStart = start + marker.Length;
+                if (contentStart >= source.Length || char.IsWhiteSpace(source[contentStart])) continue;
+
+                var search = contentStart;
+                while (search < source.Length)
+                {
+                    var close = source.IndexOf(marker, search, StringComparison.Ordinal);
+                    if (close == -1) break;
+                    var before = source[close - 1];
+                    var after = close + marker.Length < source.Length ? source[close + marker.Length] : (char?)null;
+                    var closes = !char.IsWhiteSpace(before)
+                        && (marker[0] != '_' || IsBoundary(after))
+                        && close > contentStart;
+                    if (closes)
+                        return (type, source.Substring(contentStart, close - contentStart), close + marker.Length);
+                    search = close + 1;
+                }
+            }
+            return null;
+        }
+
+        // -- Inline HTML --
+        private static readonly Dictionary<string, string> MarkTags = new(StringComparer.OrdinalIgnoreCase)
+        {
+            ["strong"] = "strong", ["b"] = "strong", ["em"] = "em", ["i"] = "em",
+            ["s"] = "strike", ["del"] = "strike", ["strike"] = "strike", ["u"] = "underline", ["code"] = "code",
+        };
+        private static readonly HashSet<string> VoidContentTags = new(StringComparer.OrdinalIgnoreCase) { "script", "style" };
+        private static readonly Dictionary<string, string> NamedEntities = new(StringComparer.OrdinalIgnoreCase)
+        {
+            ["amp"] = "&", ["lt"] = "<", ["gt"] = ">", ["quot"] = "\"", ["apos"] = "'", ["nbsp"] = " ",
+            ["ndash"] = "–", ["mdash"] = "—", ["hellip"] = "…",
+            ["lsquo"] = "‘", ["rsquo"] = "’", ["ldquo"] = "“", ["rdquo"] = "”",
+        };
+
+        public static string DecodeHtmlEntities(string? text) => Regex.Replace(text ?? string.Empty,
+            "&(#x?[0-9a-fA-F]+|[a-zA-Z][a-zA-Z0-9]*);", m =>
+            {
+                var entity = m.Groups[1].Value;
+                if (entity[0] == '#')
+                {
+                    var isHex = entity.Length > 1 && (entity[1] == 'x' || entity[1] == 'X');
+                    var ok = int.TryParse(isHex ? entity.Substring(2) : entity.Substring(1),
+                        isHex ? NumberStyles.HexNumber : NumberStyles.Integer, CultureInfo.InvariantCulture, out var cp);
+                    return ok && cp > 0 ? char.ConvertFromUtf32(cp) : m.Value;
+                }
+                return NamedEntities.TryGetValue(entity, out var named) ? named : m.Value;
+            });
+
+        private static readonly Regex TagPattern = new("<(/?)([a-zA-Z][a-zA-Z0-9]*)\\b[^>]*>");
+
+        private static List<InlineNode> ParseInlineHtml(string? html)
+        {
+            var source = html ?? string.Empty;
+            var root = new InlineNode();
+            var stack = new List<InlineNode> { root };
+            var buffer = new StringBuilder();
+            string? skipUntil = null;
+
+            void Flush()
+            {
+                if (buffer.Length == 0) return;
+                stack[^1].Children.Add(new InlineNode { Type = "text", Value = DecodeHtmlEntities(buffer.ToString()) });
+                buffer.Clear();
+            }
+
+            var cursor = 0;
+            foreach (Match match in TagPattern.Matches(source))
+            {
+                var isClosing = match.Groups[1].Value == "/";
+                var name = match.Groups[2].Value.ToLowerInvariant();
+                var tag = match.Value;
+
+                if (skipUntil is not null)
+                {
+                    cursor = match.Index + match.Length;
+                    if (isClosing && name == skipUntil) skipUntil = null;
+                    continue;
+                }
+
+                buffer.Append(source.Substring(cursor, match.Index - cursor));
+                cursor = match.Index + match.Length;
+
+                if (VoidContentTags.Contains(name))
+                {
+                    if (!isClosing && !tag.EndsWith("/>", StringComparison.Ordinal)) skipUntil = name;
+                    continue;
+                }
+                if (name == "br")
+                {
+                    Flush();
+                    stack[^1].Children.Add(new InlineNode { Type = "text", Value = "\n" });
+                    continue;
+                }
+                if (!MarkTags.TryGetValue(name, out var type)) continue;
+
+                if (isClosing)
+                {
+                    for (var i = stack.Count - 1; i > 0; i--)
+                    {
+                        if (stack[i].Type == type) { Flush(); stack.RemoveRange(i, stack.Count - i); break; }
+                    }
+                    continue;
+                }
+                if (tag.EndsWith("/>", StringComparison.Ordinal)) continue;
+
+                Flush();
+                var node = new InlineNode { Type = type };
+                stack[^1].Children.Add(node);
+                stack.Add(node);
+            }
+            if (skipUntil is null) buffer.Append(source.Substring(cursor));
+            Flush();
+            return root.Children;
+        }
+
+        // The light check/cross marks (✓ ✗) have no colour Twemoji asset, so they are mapped to the same
+        // [Pass]/[Fail] tokens the fixed reports use, which then promote to a colour glyph. Every other
+        // status emoji (✅ ❌ 🔴 🟠 🟡 🟢 ...) has a Twemoji image and is left for Sanitize/the renderer to
+        // draw in colour. Also strips the VS16 emoji-style variation selector.
+        private static readonly (string from, string to)[] GlyphMap =
+        {
+            ("✓", "[Pass]"), ("✗", "[Fail]"),
+            ("️", ""),
+        };
+
+        // The three report emoji: warning ⚠, the green white-heavy-check ✅ (the client's pass indicator),
+        // and info ℹ. They render as colour Twemoji images, or fall back to the monochrome font tinted to
+        // their brand colour. Kept verbatim rather than mapped to a token, and are the tokens' promotion
+        // targets. (The plain heavy check ✔ (U+2714) is Twemoji's dark check, so ✅ is used for "pass".)
+        public const char EmojiWarning = '⚠';
+        public const char EmojiCheck = '✅';
+        public const char EmojiInfo = 'ℹ';
+        private static readonly HashSet<char> EmojiKept = new() { EmojiWarning, EmojiCheck, EmojiInfo };
+
+        // The monochrome fallback font ships next to the assembly as emoji-fallback.ttf (like the OfficeIMO
+        // DLLs). Loaded once; absence just means emoji degrade to the ASCII tokens rather than throwing.
+        internal static readonly Lazy<byte[]?> EmojiFontBytes = new(() =>
+        {
+            try
+            {
+                var dir = System.IO.Path.GetDirectoryName(typeof(ReportMarkdown).Assembly.Location);
+                if (string.IsNullOrEmpty(dir)) return null;
+                var path = System.IO.Path.Combine(dir, "emoji-fallback.ttf");
+                return System.IO.File.Exists(path) ? System.IO.File.ReadAllBytes(path) : null;
+            }
+            catch { return null; }
+        });
+
+        // Exactly the code points the bundled font can draw above U+00FF, minus the CP1252 specials the
+        // standard fonts render: the single source of truth for what Sanitize keeps (keeping one the font
+        // can't draw would make OfficeIMO's encoding preflight throw) and which ranges ReportPdf declares
+        // for the fallback. Read once from the font's own cmap so the two never drift; empty without a font.
+        private static readonly Lazy<HashSet<int>> EmojiCoverageSet = new(() =>
+        {
+            var set = new HashSet<int>();
+            var font = EmojiFontBytes.Value;
+            if (font is not { Length: > 0 }) return set;
+            try
+            {
+                foreach (var cp in FontCmap.ReadCodepoints(font))
+                    if (cp > 0xFF && !IsWinAnsiSpecial(cp)) set.Add(cp);
+            }
+            catch { set.Clear(); }
+            return set;
+        });
+        public static HashSet<int> EmojiCoverage => EmojiCoverageSet.Value;
+
+        // With the fallback font bundled, the reports' portable ASCII status tokens are promoted to the
+        // matching glyph (rendered downstream); without it they stay as tokens, so the report degrades.
+        public static bool RenderEmojiGlyphs => EmojiFontBytes.Value is { Length: > 0 };
+
+        // True when the bundled Twemoji colour PNG set is present, so an emoji grapheme cluster (including
+        // multi-code-point ZWJ sequences, flags and skin tones) is kept whole for the renderer to place as
+        // an inline colour image; the monochrome font remains the fallback for anything not bundled.
+        public static bool RenderEmojiImages => TwemojiAssets.Enabled;
+        private static readonly (string token, string glyph)[] EmojiTokens =
+        {
+            ("[!]", "⚠"), ("[Pass]", "✅"), ("[Fail]", "❌"), ("[i]", "ℹ"),
+        };
+
+        // CP1252 / WinAnsi code points above U+00FF that the PDF standard fonts CAN encode - kept as-is.
+        private static readonly HashSet<char> WinAnsiSpecials = new(new[]
+        {
+            '€','‚','ƒ','„','…','†','‡','ˆ','‰','Š',
+            '‹','Œ','Ž','‘','’','“','”','•','–','—',
+            '˜','™','š','›','œ','ž','Ÿ',
+        });
+
+        // A CP1252 special (rendered by the standard fonts) rather than an emoji - excluded from the
+        // fallback coverage so normal punctuation like — or ™ never routes to the emoji font.
+        public static bool IsWinAnsiSpecial(int cp) => cp >= 0 && cp <= 0xFFFF && WinAnsiSpecials.Contains((char)cp);
+
+        /// <summary>
+        /// Make text safe for the PDF standard fonts (WinAnsi): map the colour-coded status emoji to ASCII
+        /// tokens (a monochrome filled circle can't tell red from green), then keep anything the fonts can
+        /// draw - at or below U+00FF, the CP1252 punctuation set, or, when a fallback font is bundled, an
+        /// emoji that font actually carries (BMP or astral). Any remaining non-encodable character becomes
+        /// '?' so OfficeIMO's encoding preflight never throws.
+        /// </summary>
+        public static string Sanitize(string? s)
+        {
+            if (string.IsNullOrEmpty(s)) return s ?? string.Empty;
+            foreach (var g in GlyphMap) s = s.Replace(g.from, g.to);
+            if (RenderEmojiGlyphs) foreach (var e in EmojiTokens) s = s.Replace(e.token, e.glyph);
+            var needsFilter = false;
+            foreach (var c in s) { if (c > 'ÿ' && !WinAnsiSpecials.Contains(c) && !EmojiKept.Contains(c)) { needsFilter = true; break; } }
+            if (!needsFilter) return s;
+            var sb = new StringBuilder(s.Length);
+            // Walk by grapheme cluster so a multi-code-point emoji (ZWJ sequence, flag, skin-tone) is judged
+            // and kept as one unit for the colour-image renderer; plain text falls through to the per-code-
+            // point keep rule (WinAnsi, CP1252 specials, or a code point the monochrome fallback font draws).
+            var elements = System.Globalization.StringInfo.GetTextElementEnumerator(s);
+            while (elements.MoveNext())
+            {
+                var cluster = (string)elements.Current;
+                if (cluster.Length == 1 && cluster[0] <= 'ÿ') { sb.Append(cluster); continue; }
+                if (RenderEmojiImages && TwemojiAssets.Has(cluster)) { sb.Append(cluster); continue; }
+                for (var i = 0; i < cluster.Length; i++)
+                {
+                    var c = cluster[i];
+                    if (char.IsHighSurrogate(c) && i + 1 < cluster.Length && char.IsLowSurrogate(cluster[i + 1]))
+                    {
+                        var cp = char.ConvertToUtf32(c, cluster[i + 1]);
+                        if (RenderEmojiGlyphs && EmojiCoverage.Contains(cp)) { sb.Append(c); sb.Append(cluster[i + 1]); }
+                        i++; // the low surrogate was consumed with its high half
+                        continue;
+                    }
+                    if (c <= 'ÿ' || WinAnsiSpecials.Contains(c) || EmojiKept.Contains(c) || (RenderEmojiGlyphs && EmojiCoverage.Contains(c)))
+                        sb.Append(c);
+                    else if (!char.IsHighSurrogate(c) && !char.IsLowSurrogate(c))
+                        sb.Append('?');
+                    // a lone surrogate (no matching half) is dropped
+                }
+            }
+            return sb.ToString();
+        }
+
+        // -- Flatten to runs --
+        private static List<TextRun> Flatten(List<InlineNode> nodes)
+        {
+            var runs = new List<TextRun>();
+            void Walk(List<InlineNode> ns, TextRun marks)
+            {
+                foreach (var n in ns)
+                {
+                    if (n.Type == "text")
+                    {
+                        if (n.Value.Length == 0) continue;
+                        var r = marks.Clone(); r.Text = Sanitize(n.Value); runs.Add(r);
+                        continue;
+                    }
+                    var next = marks.Clone();
+                    switch (n.Type)
+                    {
+                        case "strong": next.Bold = true; break;
+                        case "em": next.Italic = true; break;
+                        case "strongEm": next.Bold = true; next.Italic = true; break;
+                        case "code": next.Code = true; break;
+                        case "strike": next.Strike = true; break;
+                        case "underline": next.Underline = true; break;
+                    }
+                    Walk(n.Children, next);
+                }
+            }
+            Walk(nodes, new TextRun());
+            return runs;
+        }
+
+        private static string PlainText(List<InlineNode> nodes)
+        {
+            var sb = new StringBuilder();
+            void Walk(List<InlineNode> ns) { foreach (var n in ns) { if (n.Type == "text") sb.Append(Sanitize(n.Value)); else Walk(n.Children); } }
+            Walk(nodes);
+            return sb.ToString();
+        }
+
+        public static List<TextRun> MarkdownRuns(string? text) => Flatten(ParseInlineMarkdown(text));
+        public static List<TextRun> HtmlRuns(string? html) => Flatten(ParseInlineHtml(html));
+        public static string MarkdownPlain(string? text) => PlainText(ParseInlineMarkdown(text));
+        public static string HtmlPlain(string? html) => PlainText(ParseInlineHtml(html));
+
+        // -- Table rows (markdown-table.js) --
+        private static readonly Regex SeparatorRow = new("^\\|?[\\s:|-]*-[\\s:|-]*\\|?$");
+
+        public static bool IsTableSeparatorRow(string? line)
+        {
+            var t = (line ?? string.Empty).Trim();
+            if (!t.Contains('|') || !t.Contains('-')) return false;
+            return SeparatorRow.IsMatch(t);
+        }
+
+        public static List<string> ParseTableRow(string? line)
+        {
+            var raw = (line ?? string.Empty).Trim();
+            var cells = new List<string>();
+            if (raw.Length == 0) return cells;
+            var current = new StringBuilder();
+            var leading = false; var trailing = false;
+            for (var i = 0; i < raw.Length; i++)
+            {
+                var ch = raw[i];
+                var next = i + 1 < raw.Length ? raw[i + 1] : '\0';
+                if (ch == '\\' && (next == '|' || next == '\\')) { current.Append(next); i++; continue; }
+                if (ch == '|')
+                {
+                    if (i == 0) leading = true;
+                    if (i == raw.Length - 1) trailing = true;
+                    cells.Add(current.ToString()); current.Clear(); continue;
+                }
+                current.Append(ch);
+            }
+            cells.Add(current.ToString());
+            if (leading && cells.Count > 0) cells.RemoveAt(0);
+            if (trailing && cells.Count > 0) cells.RemoveAt(cells.Count - 1);
+            for (var i = 0; i < cells.Count; i++) cells[i] = Sanitize(cells[i].Trim());
+            return cells;
+        }
+
+        public static string[] NormaliseTableRow(List<string> cells, int columnCount)
+        {
+            if (columnCount <= 0) return Array.Empty<string>();
+            if (cells.Count == columnCount) return cells.ToArray();
+            if (cells.Count < columnCount)
+            {
+                var padded = new string[columnCount];
+                for (var i = 0; i < columnCount; i++) padded[i] = i < cells.Count ? cells[i] : string.Empty;
+                return padded;
+            }
+            var head = cells.GetRange(0, columnCount - 1);
+            head.Add(string.Join(" | ", cells.GetRange(columnCount - 1, cells.Count - (columnCount - 1))));
+            return head.ToArray();
+        }
+
+        // -- Block markdown -> nodes (markdownToElements) --
+        public static List<ReportNode> MarkdownToNodes(string? markdown)
+        {
+            var elements = new List<ReportNode>();
+            if (string.IsNullOrEmpty(markdown)) return elements;
+            var lines = markdown.Replace("\r\n", "\n").Split('\n');
+
+            var inCode = false; var code = new StringBuilder();
+            var inTable = false; var tableRows = new List<List<string>>();
+
+            void FlushTable()
+            {
+                if (tableRows.Count > 0)
+                {
+                    var cols = tableRows[0].Count;
+                    var rows = new List<string[]>();
+                    foreach (var r in tableRows) rows.Add(NormaliseTableRow(r, cols));
+                    var node = new ReportNode("table"); node.Set("rows", rows); node.Set("hasHeader", true);
+                    elements.Add(node);
+                }
+                inTable = false; tableRows = new List<List<string>>();
+            }
+
+            // Consecutive list items are grouped into one bullets/numbered node.
+            List<string>? listItems = null; var listOrdered = false; var listStart = 1;
+            void FlushList()
+            {
+                if (listItems is { Count: > 0 })
+                {
+                    var node = new ReportNode(listOrdered ? "numbered" : "bullets");
+                    node.Set("items", new List<string>(listItems));
+                    if (listOrdered) node.Set("start", (double)listStart);
+                    elements.Add(node);
+                }
+                listItems = null;
+            }
+
+            foreach (var raw in lines)
+            {
+                var line = raw;
+                var trimmed = line.Trim();
+
+                if (trimmed.StartsWith("```", StringComparison.Ordinal))
+                {
+                    if (inCode)
+                    {
+                        FlushList();
+                        elements.Add(new ReportNode("code").Set("text", code.ToString().TrimEnd()));
+                        code.Clear(); inCode = false;
+                    }
+                    else { FlushList(); inCode = true; }
+                    continue;
+                }
+                if (inCode) { code.Append(line).Append('\n'); continue; }
+
+                if (trimmed.StartsWith("|", StringComparison.Ordinal))
+                {
+                    FlushList();
+                    if (!inTable) { inTable = true; tableRows = new List<List<string>>(); }
+                    if (IsTableSeparatorRow(line)) continue;
+                    tableRows.Add(ParseTableRow(line));
+                    continue;
+                }
+                if (inTable) FlushTable();
+
+                if (trimmed.Length == 0) { FlushList(); continue; }
+
+                if (line.StartsWith("### ", StringComparison.Ordinal)) { FlushList(); elements.Add(Heading(3, line.Substring(4), false)); }
+                else if (line.StartsWith("## ", StringComparison.Ordinal)) { FlushList(); elements.Add(Heading(2, line.Substring(3), false)); }
+                else if (line.StartsWith("# ", StringComparison.Ordinal)) { FlushList(); elements.Add(Heading(1, line.Substring(2), false)); }
+                else if (Regex.IsMatch(trimmed, "^[-*_]{3,}$")) { FlushList(); elements.Add(new ReportNode("hr")); }
+                else if (Regex.IsMatch(trimmed, "^[-*+]\\s"))
+                {
+                    if (listItems is null || listOrdered) { FlushList(); listItems = new List<string>(); listOrdered = false; }
+                    listItems.Add(MarkdownPlain(Regex.Replace(trimmed, "^[-*+]\\s", string.Empty)));
+                }
+                else if (Regex.IsMatch(trimmed, "^\\d+\\.\\s"))
+                {
+                    var num = int.Parse(Regex.Match(trimmed, "^(\\d+)\\.").Groups[1].Value, CultureInfo.InvariantCulture);
+                    if (listItems is null || !listOrdered) { FlushList(); listItems = new List<string>(); listOrdered = true; listStart = num; }
+                    listItems.Add(MarkdownPlain(Regex.Replace(trimmed, "^\\d+\\.\\s", string.Empty)));
+                }
+                else { FlushList(); elements.Add(Paragraph(MarkdownRuns(line))); }
+            }
+            if (inCode && code.Length > 0) elements.Add(new ReportNode("code").Set("text", code.ToString().TrimEnd()));
+            if (inTable) FlushTable();
+            FlushList();
+            return elements;
+        }
+
+        // -- Block HTML -> nodes (htmlToElements) --
+        public static List<ReportNode> HtmlToNodes(string? html)
+        {
+            var elements = new List<ReportNode>();
+            if (string.IsNullOrEmpty(html)) return elements;
+
+            // Extract tables first, replacing each with a placeholder paragraph.
+            var tables = new List<string>();
+            var remaining = Regex.Replace(html, "<table[^>]*>([\\s\\S]*?)</table>", m =>
+            {
+                var placeholder = $"__TABLE_{tables.Count}__"; tables.Add(m.Value); return $"<p>{placeholder}</p>";
+            }, RegexOptions.IgnoreCase);
+
+            var blocks = Regex.Split(remaining, "</p>|</h[1-6]>|</li>|</pre>|</blockquote>|<br\\s*/?>");
+            var inOrdered = false; var orderedIndex = 0;
+
+            // Group consecutive <li> into one list node.
+            List<string>? listItems = null; var listOrdered = false; var listStart = 1;
+            void FlushList()
+            {
+                if (listItems is { Count: > 0 })
+                {
+                    var node = new ReportNode(listOrdered ? "numbered" : "bullets");
+                    node.Set("items", new List<string>(listItems));
+                    if (listOrdered) node.Set("start", (double)listStart);
+                    elements.Add(node);
+                }
+                listItems = null;
+            }
+
+            foreach (var block in blocks)
+            {
+                var cleaned = block.Trim();
+                if (cleaned.Length == 0) continue;
+
+                if (Regex.IsMatch(cleaned, "<ol[\\s>]", RegexOptions.IgnoreCase)) { inOrdered = true; orderedIndex = 0; }
+                else if (Regex.IsMatch(cleaned, "<ul[\\s>]", RegexOptions.IgnoreCase)) inOrdered = false;
+
+                var tableMatch = Regex.Match(cleaned, "__TABLE_(\\d+)__");
+                if (tableMatch.Success)
+                {
+                    FlushList();
+                    var idx = int.Parse(tableMatch.Groups[1].Value, CultureInfo.InvariantCulture);
+                    if (idx < tables.Count) elements.Add(HtmlTable(tables[idx]));
+                    continue;
+                }
+
+                if (Regex.IsMatch(cleaned, "<h1[^>]*>", RegexOptions.IgnoreCase)) { FlushList(); elements.Add(Heading(1, Regex.Replace(cleaned, "<h1[^>]*>", string.Empty, RegexOptions.IgnoreCase), true)); }
+                else if (Regex.IsMatch(cleaned, "<h2[^>]*>", RegexOptions.IgnoreCase)) { FlushList(); elements.Add(Heading(2, Regex.Replace(cleaned, "<h2[^>]*>", string.Empty, RegexOptions.IgnoreCase), true)); }
+                else if (Regex.IsMatch(cleaned, "<h3[^>]*>", RegexOptions.IgnoreCase)) { FlushList(); elements.Add(Heading(3, Regex.Replace(cleaned, "<h3[^>]*>", string.Empty, RegexOptions.IgnoreCase), true)); }
+                else if (Regex.IsMatch(cleaned, "<li[^>]*>", RegexOptions.IgnoreCase))
+                {
+                    if (inOrdered) orderedIndex++;
+                    if (listItems is null || listOrdered != inOrdered) { FlushList(); listItems = new List<string>(); listOrdered = inOrdered; listStart = inOrdered ? orderedIndex : 1; }
+                    listItems.Add(HtmlPlain(Regex.Replace(cleaned, "<li[^>]*>", string.Empty, RegexOptions.IgnoreCase)));
+                }
+                else if (Regex.IsMatch(cleaned, "<pre[^>]*>", RegexOptions.IgnoreCase))
+                {
+                    FlushList();
+                    var inner = Regex.Replace(Regex.Replace(cleaned, "<pre[^>]*>", string.Empty, RegexOptions.IgnoreCase), "<code[^>]*>", string.Empty, RegexOptions.IgnoreCase);
+                    elements.Add(new ReportNode("code").Set("text", HtmlPlain(inner)));
+                }
+                else
+                {
+                    var inner = Regex.Replace(cleaned, "<p[^>]*>", string.Empty, RegexOptions.IgnoreCase);
+                    if (HtmlPlain(inner).Trim().Length > 0) { FlushList(); elements.Add(Paragraph(HtmlRuns(inner))); }
+                }
+
+                if (Regex.IsMatch(cleaned, "</(ol|ul)>", RegexOptions.IgnoreCase)) { FlushList(); inOrdered = false; }
+            }
+            FlushList();
+            return elements;
+        }
+
+        private static ReportNode HtmlTable(string tableHtml)
+        {
+            var rows = new List<string[]>();
+            var rowHeaderFlags = new List<bool>();
+            foreach (Match rowMatch in Regex.Matches(tableHtml, "<tr[^>]*>([\\s\\S]*?)</tr>", RegexOptions.IgnoreCase))
+            {
+                var cells = new List<string>();
+                var allHeader = true;
+                foreach (Match cellMatch in Regex.Matches(rowMatch.Groups[1].Value, "<(td|th)[^>]*>([\\s\\S]*?)</(?:td|th)>", RegexOptions.IgnoreCase))
+                {
+                    if (!cellMatch.Groups[1].Value.Equals("th", StringComparison.OrdinalIgnoreCase)) allHeader = false;
+                    cells.Add(HtmlPlain(cellMatch.Groups[2].Value.Trim()));
+                }
+                if (cells.Count > 0) { rows.Add(cells.ToArray()); rowHeaderFlags.Add(allHeader); }
+            }
+            var hasHeader = Regex.IsMatch(tableHtml, "<thead", RegexOptions.IgnoreCase) || (rowHeaderFlags.Count > 0 && rowHeaderFlags[0]);
+            var cols = rows.Count > 0 ? rows[0].Length : 0;
+            var normalised = new List<string[]>();
+            foreach (var r in rows) normalised.Add(NormaliseTableRow(new List<string>(r), cols));
+            var node = new ReportNode("table"); node.Set("rows", normalised); node.Set("hasHeader", hasHeader);
+            return node;
+        }
+
+        private static ReportNode Heading(int level, string text, bool html)
+            => new ReportNode("heading").Set("level", (double)level)
+                .Set("runs", html ? HtmlRuns(text) : MarkdownRuns(text));
+
+        private static ReportNode Paragraph(List<TextRun> runs) => new ReportNode("paragraph").Set("runs", runs);
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/ReportModel.cs b/Shared/CIPPSharp/Reporting/ReportModel.cs
new file mode 100644
index 0000000000000..804583170ca89
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/ReportModel.cs
@@ -0,0 +1,138 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text.Json;
+
+namespace CIPP.Reporting
+{
+    /// <summary>An inline run of text with its marks - the shared node the markdown and HTML parsers both emit.</summary>
+    public sealed class TextRun
+    {
+        public string Text { get; set; } = string.Empty;
+        public bool Bold { get; set; }
+        public bool Italic { get; set; }
+        public bool Code { get; set; }
+        public bool Strike { get; set; }
+        public bool Underline { get; set; }
+
+        public TextRun Clone() => new()
+        {
+            Text = Text, Bold = Bold, Italic = Italic, Code = Code, Strike = Strike, Underline = Underline,
+        };
+    }
+
+    /// <summary>
+    /// One component in a report. The declarative unit every report composes and never bypasses:
+    /// a type, its props, and optional children. Built either from the JSON component tree (Report
+    /// Builder blocks / fixed-report output) or synthesised by the markdown/HTML parsers.
+    /// </summary>
+    public sealed class ReportNode
+    {
+        public string Type { get; set; } = string.Empty;
+        public Dictionary<string, object?> Props { get; } = new(StringComparer.OrdinalIgnoreCase);
+        public List<ReportNode> Children { get; } = new();
+
+        public ReportNode() { }
+        public ReportNode(string type) { Type = type; }
+
+        public ReportNode Set(string key, object? value) { Props[key] = value; return this; }
+
+        public string? Str(string key) => Props.TryGetValue(key, out var v) ? v as string : null;
+
+        public bool Bool(string key, bool @default = false)
+            => Props.TryGetValue(key, out var v) && v is bool b ? b : @default;
+
+        public double? Num(string key)
+            => Props.TryGetValue(key, out var v) && v is double d ? d : (double?)null;
+
+        public T? Get<T>(string key) where T : class
+            => Props.TryGetValue(key, out var v) ? v as T : null;
+
+        public List<object?>? ListOf(string key)
+            => Props.TryGetValue(key, out var v) ? v as List<object?> : null;
+
+        // -- JSON parsing --
+        public static List<ReportNode> ParseTree(string? json)
+        {
+            var result = new List<ReportNode>();
+            if (string.IsNullOrWhiteSpace(json)) return result;
+            JsonDocument doc;
+            try { doc = JsonDocument.Parse(json); }
+            catch { return result; }
+            // Disposed once the tree is copied out, so its pooled buffers go back to the pool.
+            using var _ = doc;
+            var root = doc.RootElement;
+            if (root.ValueKind == JsonValueKind.Array)
+            {
+                foreach (var el in root.EnumerateArray())
+                    if (el.ValueKind == JsonValueKind.Object) result.Add(FromElement(el));
+            }
+            else if (root.ValueKind == JsonValueKind.Object)
+            {
+                result.Add(FromElement(root));
+            }
+            return result;
+        }
+
+        private static ReportNode FromElement(JsonElement el)
+        {
+            var node = new ReportNode
+            {
+                Type = el.TryGetProperty("type", out var t) && t.ValueKind == JsonValueKind.String
+                    ? t.GetString()!.ToLowerInvariant()
+                    : string.Empty,
+            };
+            foreach (var prop in el.EnumerateObject())
+            {
+                if (prop.NameEquals("type")) continue;
+                if (prop.NameEquals("children") && prop.Value.ValueKind == JsonValueKind.Array)
+                {
+                    foreach (var child in prop.Value.EnumerateArray())
+                        if (child.ValueKind == JsonValueKind.Object) node.Children.Add(FromElement(child));
+                    continue;
+                }
+                node.Props[prop.Name] = Convert(prop.Value);
+            }
+            return node;
+        }
+
+        private static object? Convert(JsonElement el) => el.ValueKind switch
+        {
+            JsonValueKind.String => el.GetString(),
+            JsonValueKind.True => true,
+            JsonValueKind.False => false,
+            JsonValueKind.Number => el.TryGetDouble(out var d) ? d : 0d,
+            JsonValueKind.Array => ConvertArray(el),
+            JsonValueKind.Object => ConvertObject(el),
+            _ => null,
+        };
+
+        private static List<object?> ConvertArray(JsonElement el)
+        {
+            var list = new List<object?>();
+            foreach (var item in el.EnumerateArray()) list.Add(Convert(item));
+            return list;
+        }
+
+        private static Dictionary<string, object?> ConvertObject(JsonElement el)
+        {
+            var dict = new Dictionary<string, object?>(StringComparer.OrdinalIgnoreCase);
+            foreach (var p in el.EnumerateObject()) dict[p.Name] = Convert(p.Value);
+            return dict;
+        }
+
+        /// <summary>Read a nested object's string field (for stats/chart/progress data rows).</summary>
+        public static string? RowStr(object? row, string key)
+            => row is Dictionary<string, object?> d && d.TryGetValue(key, out var v) ? v?.ToString() : null;
+
+        public static double RowNum(object? row, string key)
+        {
+            if (row is Dictionary<string, object?> d && d.TryGetValue(key, out var v))
+            {
+                if (v is double dd) return dd;
+                if (v is string s && double.TryParse(s, NumberStyles.Any, CultureInfo.InvariantCulture, out var p)) return p;
+            }
+            return 0;
+        }
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/ReportPdf.cs b/Shared/CIPPSharp/Reporting/ReportPdf.cs
new file mode 100644
index 0000000000000..3510b12f3a267
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/ReportPdf.cs
@@ -0,0 +1,585 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text;
+using System.Text.Json;
+using OfficeIMO;
+using OfficeIMO.Pdf;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// Entry point for server-side report rendering. Called from PowerShell as
+    /// <c>[CIPP.Reporting.ReportPdf]::Render(...)</c> (wrapped by ConvertTo-CippReportPdf.ps1).
+    /// Takes the declarative component tree + branding + variables and returns the finished PDF bytes,
+    /// composing the OfficeIMO document from the shared component kit - cover page, then content
+    /// sections carrying header / footer / page numbers / watermark, with hero pages and page breaks
+    /// splitting the flow (buildPageGroups equivalent).
+    /// </summary>
+    public static class ReportPdf
+    {
+        public static byte[] Render(
+            string blocksJson,
+            string brandingJson,
+            string variablesJson,
+            string tenantName,
+            string reportName,
+            string generatedOn,
+            string pageSize = "A4",
+            bool landscape = false,
+            bool chrome = true)
+        {
+            var blocks = ReportNode.ParseTree(blocksJson);
+            var branding = BrandingInput.FromJson(brandingJson);
+            var theme = ReportTheme.Create(branding);
+
+            var variables = ParseVariables(variablesJson);
+            variables["tenantname"] = tenantName ?? "Organization";
+            variables["reportname"] = reportName ?? "Report";
+            variables["reportdate"] = generatedOn ?? string.Empty;
+
+            // A report builder cover block: its fields become the cover variables a fixed report's tree
+            // builder supplies, and the block itself draws nothing.
+            var cover = blocks.Find(b => b.Type == "cover");
+            if (cover != null)
+            {
+                foreach (var (variable, field) in new[] { ("covertitle", "title"), ("coveraccent", "coverAccent"), ("coversubtitle", "subtitle"), ("coverlabel", "coverLabel") })
+                {
+                    var value = cover.Str(field);
+                    if (!string.IsNullOrWhiteSpace(value)) variables[variable] = value;
+                }
+                blocks.RemoveAll(b => b.Type == "cover");
+            }
+
+            var logo = ReportComponents.DecodeImage(branding.Logo);
+            // The cover photo, resolved the way the client's resolveCoverImage did: an uploaded cover wins,
+            // then the stock photo the branding picked ("none" means no cover at all), then the report's
+            // own %coverfallbackimage% (e.g. "/reportImages/soc.jpg"), so a report without configured
+            // branding still gets a cover.
+            var coverImage = ReportComponents.DecodeImage(branding.CoverImage)
+                ?? (branding.CoverStock == "none" ? null
+                    : ReportComponents.DecodeImage(branding.CoverStock)
+                        ?? (variables.TryGetValue("coverfallbackimage", out var coverFallback) ? ReportComponents.DecodeImage(coverFallback) : null));
+            ReportContext Context(byte[]? logoBytes) => new()
+            {
+                Theme = theme,
+                Variables = variables,
+                PageSize = string.IsNullOrWhiteSpace(pageSize) ? "A4" : pageSize,
+                Landscape = landscape,
+                TenantName = tenantName ?? "Organization",
+                ReportName = reportName ?? "Report",
+                GeneratedOn = generatedOn ?? string.Empty,
+                Logo = logoBytes,
+                CoverImage = coverImage,
+            };
+
+            var groups = BuildPageGroups(blocks);
+            // A branding logo the engine cannot embed (a PNG with a bad chunk CRC, an unsupported format)
+            // only surfaces when the document is serialised, not where the logo is placed, so it must not
+            // sink the report: render once more without it. Any other failure still propagates.
+            var watermark = theme.WatermarkEnabled ? DrawableMark(ReportTheme.ApplyWatermark(theme.WatermarkText, variables)) : string.Empty;
+            // The client's mark is a centred text box as wide as the page, so a mark wider than that (its 4pt
+            // letter spacing counted) breaks into lines. OfficeIMO draws one line: it is handed the lines joined,
+            // with room behind them for the line moves LiftWatermark writes in their place.
+            var markLines = ReportComponents.WrapLines(watermark, ReportStyles.ContentWidth(pageSize, landscape) + 2 * ReportStyles.PagePadding, WatermarkSize, bold: true, tracking: 4);
+            if (markLines.Count > 1) watermark = string.Join(" ", markLines) + new string(' ', MarkLineRoom * (markLines.Count - 1));
+            byte[] Finish(PdfDocument doc) => chrome ? LiftWatermark(doc.ToBytes(), watermark, markLines) : doc.ToBytes();
+            try { return Finish(Compose(Context(logo), groups, chrome, watermark)); }
+            catch when (logo is not null) { return Finish(Compose(Context(null), groups, chrome, watermark)); }
+        }
+
+        private static PdfDocument Compose(ReportContext ctx, List<PageGroup> groups, bool chrome, string watermark)
+        {
+            var theme = ctx.Theme;
+            var variables = ctx.Variables;
+            // Branding's configured footer wins; a report's own %footerlabel% is the fallback (client
+            // PageFooter's `label`), so a fixed report still identifies itself when no branding footer is set.
+            var footerText = theme.FooterEnabled
+                ? ReportTheme.ApplyFooter(theme.FooterTemplate, variables)
+                : (variables.TryGetValue("footerlabel", out var fl) ? ReportTheme.ApplyFooter(fl, variables) : string.Empty);
+
+            return PdfDocument.Create(compose =>
+            {
+                // OfficeIMO 3.4 dropped the document-wide Defaults() hook, so the page size, margin and
+                // orientation are applied to every page/section here instead.
+                void ApplyPageDefaults(PdfPageBuilder p)
+                {
+                    p.Size(ResolveSize(ctx.PageSize));
+                    if (ctx.Landscape) p.Landscape();
+                    p.Margin(ReportStyles.PagePadding);
+                }
+
+                // Cover - its own page, no header/footer/watermark. Skipped in chrome-less mode (used by
+                // the component A/B harness and any embedded/preview render that wants only the content).
+                // A cover photo (branding) fills the page behind the drawn cover content.
+                if (chrome)
+                    compose.Page(p =>
+                    {
+                        ApplyPageDefaults(p);
+                        p.Background(ReportComponents.Pdf(ReportColours.White));
+                        if (ctx.CoverImage is { Length: > 0 })
+                        {
+                            try { p.BackgroundImage(ctx.CoverImage, OfficeIMO.Drawing.OfficeImageFit.Cover, 0.5); }
+                            catch { /* an unusable cover photo leaves the plain white cover */ }
+                        }
+                        p.Content(cc => cc.Item(i => ReportComponents.RenderCoverDrawing(ctx, i)));
+                    });
+
+                foreach (var group in groups)
+                {
+                    if (group.Kind == "hero")
+                    {
+                        // Full-bleed divider: a dark page with an optional cover photo behind the big figure,
+                        // no header/footer chrome. The photo is a page background image (edge to edge); the
+                        // text is drawn over it, vertically centred, with the footer note bottom-right.
+                        var heroImage = ReportComponents.DecodeImage(group.Block!.Str("heroImage") ?? group.Block!.Str("backgroundImage"));
+                        compose.Section(p =>
+                        {
+                            ApplyPageDefaults(p);
+                            p.Background(ReportComponents.Pdf(ctx.Theme.Palette["infographicBackground"]));
+                            if (heroImage is { Length: > 0 })
+                            {
+                                try { p.BackgroundImage(heroImage, OfficeIMO.Drawing.OfficeImageFit.Cover, 0.28); }
+                                catch { /* an unusable cover photo leaves the plain dark page */ }
+                            }
+                            // The client's watermarkTextOnDark: the same mark in the divider's text colour and a
+                            // little stronger, since an 8% brand-colour mark disappears on a dark page.
+                            if (!string.IsNullOrEmpty(watermark))
+                                p.Watermark(watermark.ToUpperInvariant(), fontSize: WatermarkSize, color: ReportComponents.Pdf(ctx.Theme.OnInfographic), opacity: 0.12, rotationAngle: DividerWatermarkAngle, bold: true);
+                            p.Content(cc => cc.Item(i => ReportComponents.RenderHeroDrawing(ctx, i, group.Block!)));
+                        });
+                        continue;
+                    }
+                    compose.Section(p =>
+                    {
+                        ApplyPageDefaults(p);
+                        if (chrome) ApplyContentChrome(p, ctx, footerText, watermark);
+                        p.Content(cc => cc.Item(i =>
+                        {
+                            // A titled group (a fixed report's ContentPage) heads with its own title and
+                            // subtitle; the Report Builder path has neither, so it falls back to the report
+                            // name and the generated-on date.
+                            if (chrome) RenderPageHeader(ctx, i, group.Title ?? ctx.ReportName, group.Subtitle ?? ctx.GeneratedOn);
+                            var firstBlock = true;
+                            // Two adjacent half-width charts render side by side in one row; anything else
+                            // (including a lone half-width chart) renders on its own line.
+                            for (var bi = 0; bi < group.Blocks.Count; bi++)
+                            {
+                                var block = group.Blocks[bi];
+                                if (ReportComponents.IsHalfWidthChart(block) && bi + 1 < group.Blocks.Count && ReportComponents.IsHalfWidthChart(group.Blocks[bi + 1]))
+                                {
+                                    ReportComponents.RenderChartPair(ctx, i, block, group.Blocks[bi + 1], firstBlock);
+                                    bi++;
+                                }
+                                else
+                                {
+                                    ReportComponents.RenderBlock(ctx, i, block, firstBlock);
+                                }
+                                firstBlock = false;
+                            }
+                        }));
+                    });
+                }
+            }, BuildOptions());
+        }
+
+        // PDF options carrying the emoji fallback font: the standard fonts have no glyph for any emoji, so a
+        // bundled monochrome symbol/emoji font is registered as a Unicode fallback and OfficeIMO routes each
+        // emoji code point through it (per character - the surrounding text stays in the standard font), in
+        // table cells and paragraphs alike. The report's three status emoji are tinted per run downstream;
+        // everything else renders in the surrounding text colour.
+        private static PdfOptions BuildOptions()
+        {
+            var options = new PdfOptions();
+            if (EmojiFallbacks.Value is { } fallbacks)
+            {
+                options.CompressEmbeddedFonts = true;
+                options.EmbeddedFontFallbacks = fallbacks;
+            }
+            return options;
+        }
+
+        // Built once per process: a candidate copies the ~800 KB font, and OfficeIMO keeps the parsed font per
+        // candidate, so a candidate made per render copied and re-parsed the whole font on every render.
+        // OfficeIMO embeds only the glyphs a given report actually uses, compressed, so a report
+        // gains a few KB, not the whole ~800 KB font. The fallback is scoped to exactly the code
+        // points the font carries above U+00FF (the Latin-1 glyphs it also holds exist only so
+        // OfficeIMO's greedy neighbour-of-an-emoji fallback never lands on an uncovered character),
+        // so ordinary text always stays in the standard font.
+        private static readonly Lazy<PdfEmbeddedFontFallbackSet?> EmojiFallbacks = new(() =>
+        {
+            var font = ReportMarkdown.EmojiFontBytes.Value;
+            var coverage = ReportMarkdown.EmojiCoverage;
+            if (font is not { Length: > 0 } || coverage.Count == 0) return null;
+            var ranges = new OfficeIMO.Drawing.OfficeFontUnicodeRangeSet(CoverageRanges(coverage));
+            return new PdfEmbeddedFontFallbackSet(new[] { new PdfEmbeddedFontFallbackCandidate("CippReportEmoji", font, ranges) });
+        });
+
+        // The coverage set compressed into [start,end] ranges for the fallback scope. The emoji blocks are
+        // scattered, so this coalesces across the smallest gaps until within OfficeIMO's 1..128-range limit.
+        // Widening a range is safe: it only ever includes unassigned/uncovered code points, which Sanitize
+        // (gated on the exact coverage set) never keeps, so no uncovered character is routed to the fallback.
+        private const int MaxFallbackRanges = 128;
+        private static OfficeIMO.Drawing.OfficeFontUnicodeRange[] CoverageRanges(HashSet<int> coverage)
+        {
+            var sorted = new List<int>(coverage);
+            sorted.Sort();
+            var ranges = new List<(int start, int end)>();
+            var start = sorted[0];
+            var prev = sorted[0];
+            for (var k = 1; k < sorted.Count; k++)
+            {
+                if (sorted[k] == prev + 1) { prev = sorted[k]; continue; }
+                ranges.Add((start, prev));
+                start = prev = sorted[k];
+            }
+            ranges.Add((start, prev));
+
+            while (ranges.Count > MaxFallbackRanges)
+            {
+                var mergeAt = 0;
+                var smallestGap = int.MaxValue;
+                for (var k = 0; k < ranges.Count - 1; k++)
+                {
+                    var gap = ranges[k + 1].start - ranges[k].end;
+                    if (gap < smallestGap) { smallestGap = gap; mergeAt = k; }
+                }
+                ranges[mergeAt] = (ranges[mergeAt].start, ranges[mergeAt + 1].end);
+                ranges.RemoveAt(mergeAt + 1);
+            }
+            return ranges.ConvertAll(r => new OfficeIMO.Drawing.OfficeFontUnicodeRange(r.start, r.end)).ToArray();
+        }
+
+        // The styled page header (big title + subtitle + brand rule) that opens each content group,
+        // matching the client's ContentPage header. Rendered as content rather than a running header so
+        // it can carry the brand-coloured rule the running-header API can't draw.
+        private static void RenderPageHeader(ReportContext ctx, PdfContentBuilder item, string? title, string? subtitle)
+        {
+            // Client pageHeader, from the 28pt page top: the 20pt title and 11pt subtitle each on the page's
+            // 14pt line (baseline 0.9x the size under the line top), 8pt between them, then 8pt of padding,
+            // the 1pt brand rule and 14pt under it. OfficeIMO seats every paragraph's first baseline
+            // FlowBaseline under its top, so the space above the title and the title line itself carry the
+            // difference in seats, and the rule's spacing puts it and the content under it where the
+            // client's are.
+            var titleColour = ctx.Theme.Palette["title"];
+            var subtitleColour = ctx.Theme.Palette["subtitle"];
+            var titleText = title ?? ctx.ReportName;
+            Action<PdfParagraphBuilder> titleRun = b => { b.FontSize(ReportStyles.PageTitle); ReportComponents.EmitInline(b, titleText, titleColour, ReportStyles.PageTitle, bold: true); };
+            Action<PdfParagraphBuilder>? subtitleRun = string.IsNullOrEmpty(subtitle) ? null
+                : b => { b.FontSize(ReportStyles.PageSubtitle); ReportComponents.EmitInline(b, subtitle!, subtitleColour, ReportStyles.PageSubtitle); };
+            var subtitleStyle = new PdfParagraphStyle { LineHeight = 14 / ReportStyles.PageSubtitle, SpacingAfter = 0 };
+            var titleSeat = 0.9 * ReportStyles.PageTitle - ReportComponents.FlowBaseline;
+
+            // Client pageHeader: the title block takes the width (flex 1) and the branding logo sits at the
+            // right edge, 30pt tall and top-aligned with the title's line, with no gap between them. Without
+            // a logo the paragraphs flow directly. The title's seat goes in the text column, so the logo
+            // stays at the page top.
+            var logoType = ctx.Logo is { Length: > 0 } ? ReportComponents.ImageContentType(ctx.Logo) : null;
+            var box = logoType is null ? (w: 0.0, h: 0.0) : ReportComponents.LogoBox(ctx.Logo!, 30, 120);
+            // A one-line title sits on the client's 14pt line, which also carries the 8pt down to the
+            // subtitle. The client keeps that 14pt pitch when the title wraps, so its 20pt lines run into
+            // each other; a title too long for one line takes a 1.15 leading here instead.
+            var titleLines = ReportComponents.WrappedLines(ReportMarkdown.Sanitize(titleText), ctx.ContentWidth - box.w, ReportStyles.PageTitle, bold: true);
+            var titleStyle = new PdfParagraphStyle
+            {
+                LineHeight = titleLines > 1 ? 1.15 : (14 + 8 - 0.9 * (ReportStyles.PageTitle - ReportStyles.PageSubtitle)) / ReportStyles.PageTitle,
+                SpacingAfter = 0,
+            };
+            if (logoType is null)
+            {
+                item.Spacer(titleSeat);
+                item.Paragraph(titleRun, PdfAlign.Left, null, titleStyle);
+                if (subtitleRun is not null) item.Paragraph(subtitleRun, PdfAlign.Left, null, subtitleStyle);
+            }
+            else
+            {
+                item.Row(r =>
+                {
+                    r.Gap(0);
+                    r.RelativeColumn(c =>
+                    {
+                        c.Spacer(titleSeat);
+                        c.Paragraph(titleRun, PdfAlign.Left, null, titleStyle);
+                        if (subtitleRun is not null) c.Paragraph(subtitleRun, PdfAlign.Left, null, subtitleStyle);
+                    });
+                    r.FixedColumn(box.w, c => c.Image(ctx.Logo!, box.w, box.h, PdfAlign.Right));
+                });
+            }
+            // Full-width brand rule under the header (HR auto-fits the content width; a fixed-width
+            // rectangle risks exceeding it).
+            item.HR(1, ReportComponents.Pdf(ctx.Theme.Palette["heading"]), spacingBefore: 6.2, spacingAfter: 14);
+        }
+
+        // Client PageFooter: a 20pt box 14pt above the paper edge with a 1pt rule along its top, 5pt of padding
+        // under the rule, the label on the left and a bold "Page N of M" on the right. The page's bottom
+        // padding reserves the box plus 6pt, so the body stops 40pt above the paper edge.
+        private const double FooterInset = 14, FooterHeight = 20, FooterReserve = FooterInset + FooterHeight + 6, PagePaddingTop = 28;
+
+        // `text` cut to fit `width` points at `size` (Helvetica), ending in an ellipsis (1em) when cut.
+        internal static string FitLine(string text, double width, double size)
+        {
+            if (ReportComponents.TextEm(text, bold: false) * size <= width) return text;
+            var n = text.Length;
+            while (n > 0 && (ReportComponents.TextEm(text[..n], bold: false) + 1) * size > width) n--;
+            if (n > 0 && char.IsHighSurrogate(text[n - 1])) n--; // never split an emoji's surrogate pair
+            return text[..n].TrimEnd() + "…";
+        }
+
+        private static void ApplyContentChrome(PdfPageBuilder p, ReportContext ctx, string footerText, string watermark)
+        {
+            // Client content page padding: 28 above (the header, or a continued table), 40 below (the footer).
+            p.Margin(ReportStyles.PagePadding, PagePaddingTop, ReportStyles.PagePadding, FooterReserve);
+            var showText = ctx.Theme.FooterShow && !string.IsNullOrEmpty(footerText);
+            if (showText || ctx.Theme.ShowPageNumbers)
+            {
+                // The label's baseline above the paper edge: under the rule and the padding, 0.9x its size into
+                // the page's 14pt line. OfficeIMO sets every footer zone on one baseline, so the page number
+                // shares it (the client centres its shorter natural line, 3pt lower).
+                var baseline = FooterInset + FooterHeight - 1 - 5 - 0.9 * ReportStyles.FooterText;
+                var w = ctx.ContentWidth;
+                // The rule: a 1pt band at the top of a shape whose foot sits on the footer baseline.
+                var rule = OfficeIMO.Drawing.OfficeShape.Path(w, FooterInset + FooterHeight - baseline,
+                    OfficeIMO.Drawing.OfficePathCommand.MoveTo(0, 0), OfficeIMO.Drawing.OfficePathCommand.LineTo(w, 0),
+                    OfficeIMO.Drawing.OfficePathCommand.LineTo(w, 1), OfficeIMO.Drawing.OfficePathCommand.LineTo(0, 1),
+                    OfficeIMO.Drawing.OfficePathCommand.Close());
+                rule.FillColor = ReportComponents.OC(ReportColours.Line);
+                // The client's page number starts at the left of its 80pt box at the right edge. A zone can only
+                // right-align, so an empty shape after the text fills the rest of the box (sized for one-digit
+                // numbers; OfficeIMO leaves 4pt between the text and the shape).
+                var numberPad = OfficeIMO.Drawing.OfficeShape.Rectangle(80 - 4 - ReportComponents.TextEm("Page 8 of 8", bold: true) * ReportStyles.FooterText, 1);
+                p.Footer(f =>
+                {
+                    f.FontSize(ReportStyles.FooterText).Offset(FooterReserve - baseline);
+                    f.Shape(rule, PdfAlign.Center);
+                    if (ctx.Theme.ShowPageNumbers) f.Shape(numberPad, PdfAlign.Right);
+                    // The client's label wraps beside the page number's 80pt box; a zone would run under it, so a
+                    // label too long for the room left of the box is cut with an ellipsis. The 16pt spare covers
+                    // the number growing left past its box with two- and three-digit page counts.
+                    var text = ReportMarkdown.Sanitize(footerText);
+                    if (ctx.Theme.ShowPageNumbers) text = FitLine(text, w - 80 - 16, ReportStyles.FooterText);
+                    var label = new PdfTextRun(text, color: ReportComponents.Pdf(ctx.Theme.Palette["footer"]), fontSize: ReportStyles.FooterText);
+                    var number = new PdfTextRun(" ", bold: true, color: ReportComponents.Pdf(ReportColours.Faint), fontSize: ReportStyles.FooterText);
+                    PdfTextRun Number(string s) => new(s, bold: true, color: number.Color, fontSize: ReportStyles.FooterText);
+                    f.StyledZones(
+                        showText ? z => z.Run(label) : null,
+                        null,
+                        ctx.Theme.ShowPageNumbers ? z => z.Run(Number("Page ")).CurrentPage(number).Run(Number(" of ")).TotalPages(number) : null);
+                });
+            }
+            // Named on purpose: OfficeIMO's positional order is (text, fontSize, colour, opacity, angle), so
+            // Watermark(text, 0.08, colour) asks for a 0.08pt watermark - drawn, but invisible. The values
+            // mirror the client's watermarkText style: 72pt bold, uppercase, 8% opacity.
+            if (!string.IsNullOrEmpty(watermark))
+                p.Watermark(watermark.ToUpperInvariant(), fontSize: WatermarkSize, color: ReportComponents.Pdf(ctx.Theme.Palette["watermark"]), opacity: 0.08, rotationAngle: WatermarkAngle, bold: true);
+        }
+
+        // The client's mark is rotated -45deg in CSS, rising from bottom left to top right; OfficeIMO turns a
+        // positive angle counter-clockwise, so the same mark is +45 here. The divider's is asked for at 45.05
+        // (the same to the eye) only so LiftWatermark can tell it from a content page's - the client sets the
+        // two on different lines - and is written back at exactly 45.
+        private const double WatermarkSize = 72, WatermarkAngle = 45, DividerWatermarkAngle = 45.05;
+        // Spaces added to a multi-line mark per extra line: 32 bytes of hex, where a line move ("-123.45 -79.2 Td"
+        // and the line's own "<...> Tj" framing, less the space it replaces) needs about 22.
+        private const int MarkLineRoom = 16;
+        private static readonly byte[] WatermarkRotation = Encoding.ASCII.GetBytes("0.707 0.707 -0.707 0.707");
+        private static readonly byte[] DividerWatermarkRotation = Encoding.ASCII.GetBytes("0.706 0.708 -0.708 0.706");
+
+        /// <summary>
+        /// OfficeIMO paints a page watermark before anything else on the page, so every card, panel and
+        /// image covers it, where the client reports drew it over the content. The PDF it writes is
+        /// classic - no object or cross-reference streams - with uncompressed content streams, so the
+        /// watermark's operator block (a self-contained q ... Q group, recognised by its text and its
+        /// 45 degree text matrix) is moved to the end of each page's content stream in place: the same
+        /// bytes in a different order, so no length or offset in the file changes. On the way its text
+        /// matrix is rewritten, space-padded to the same length, to put the mark where the client's is
+        /// (<see cref="PlaceWatermark"/>). A stream the block cannot be found in is left as written.
+        /// </summary>
+        internal static byte[] LiftWatermark(byte[] pdf, string watermark, IReadOnlyList<string> lines)
+        {
+            if (string.IsNullOrEmpty(watermark)) return pdf;
+            var marker = Encoding.ASCII.GetBytes(Hex(watermark) + " Tj");
+            var streamTag = Encoding.ASCII.GetBytes("stream\n");
+            var lengthTag = Encoding.ASCII.GetBytes("/Length ");
+            var open = Encoding.ASCII.GetBytes("q\n");
+            var close = Encoding.ASCII.GetBytes("\nQ\n");
+
+            var at = 0;
+            while ((at = IndexOf(pdf, marker, at, pdf.Length)) >= 0)
+            {
+                var streamAt = LastIndexOf(pdf, streamTag, at);
+                var lengthAt = streamAt < 0 ? -1 : LastIndexOf(pdf, lengthTag, streamAt);
+                if (streamAt < 0 || lengthAt < 0 || streamAt - lengthAt > 64) { at += marker.Length; continue; }
+                var dataStart = streamAt + streamTag.Length;
+                var length = 0;
+                for (var d = lengthAt + lengthTag.Length; d < pdf.Length && pdf[d] >= '0' && pdf[d] <= '9'; d++) length = length * 10 + (pdf[d] - '0');
+                var dataEnd = Math.Min(dataStart + length, pdf.Length);
+
+                // Back to the "q" that opens the watermark's group (at a line start), forward to its "Q".
+                var blockStart = LastIndexOf(pdf, open, at);
+                while (blockStart > dataStart && pdf[blockStart - 1] != '\n') blockStart = LastIndexOf(pdf, open, blockStart);
+                var closeAt = IndexOf(pdf, close, at, dataEnd);
+                if (blockStart < dataStart || closeAt < 0) { at = dataEnd; continue; }
+                var blockEnd = closeAt + close.Length;
+                var rotationAt = IndexOf(pdf, WatermarkRotation, blockStart, blockEnd);
+                var divider = rotationAt < 0;
+                if (divider) rotationAt = IndexOf(pdf, DividerWatermarkRotation, blockStart, blockEnd);
+                if (rotationAt < 0) { at = dataEnd; continue; }
+                PlaceWatermark(pdf, rotationAt, blockEnd, divider, watermark, lines, at, marker.Length);
+
+                var block = pdf[blockStart..blockEnd];
+                // Same length: the block's trailing newline becomes the separator in front of it. The tail
+                // slides down in place (an overlapping span copy is a memmove).
+                pdf.AsSpan(blockEnd, dataEnd - blockEnd).CopyTo(pdf.AsSpan(blockStart));
+                var moved = blockStart + dataEnd - blockEnd;
+                pdf[moved] = (byte)'\n';
+                Buffer.BlockCopy(block, 0, pdf, moved + 1, block.Length - 1);
+                at = dataEnd;
+            }
+            return pdf;
+        }
+
+        /// <summary>
+        /// Moves the mark whose "a b c d e f Tm" operands start at <paramref name="at"/> to the client's place.
+        /// The client centres the text's box on the page and seats the baseline 0.9x the size under its line
+        /// box top; a line box is a content page's inherited 14pt line, or a divider's natural 1.1x line.
+        /// OfficeIMO seats the baseline half the size under the page centre, so the mark moves the difference
+        /// across the text, and 2pt back along it: the client's 4pt letter spacing also trails the last
+        /// letter, which the centring counts. A mark of several lines has its text (at <paramref name="textAt"/>)
+        /// rewritten as one line per <paramref name="lines"/> entry, each centred along the text on its own and
+        /// a Td move of a full 1.1x line down from the last, in the room its padding left. (The client stacks
+        /// a content page's lines on its 14pt line, so 72pt letters overprint; here they read as lines.) The
+        /// stack is centred where the one-line mark sits. Left as written when the operands or the lines will
+        /// not fit.
+        /// </summary>
+        private static void PlaceWatermark(byte[] pdf, int at, int end, bool divider, string watermark, IReadOnlyList<string> lines, int textAt, int textLength)
+        {
+            var tm = IndexOf(pdf, Encoding.ASCII.GetBytes(" Tm"), at, end);
+            var operands = tm < 0 ? Array.Empty<string>() : Encoding.ASCII.GetString(pdf, at, tm - at).Split(' ');
+            if (operands.Length != 6
+                || !double.TryParse(operands[4], NumberStyles.Float, CultureInfo.InvariantCulture, out var e)
+                || !double.TryParse(operands[5], NumberStyles.Float, CultureInfo.InvariantCulture, out var f)) return;
+            var lineBox = divider ? 1.1 * WatermarkSize : 14;
+            var pitch = 1.1 * WatermarkSize;
+            double Width(string s) => ReportComponents.TextEm(s, bold: true) * WatermarkSize;
+            string Num(double v) => v.ToString("0.##", CultureInfo.InvariantCulture);
+
+            byte[]? text = null;
+            if (lines.Count > 1)
+            {
+                var sb = new StringBuilder(Hex(lines[0]) + " Tj");
+                for (var i = 1; i < lines.Count; i++)
+                    sb.Append('\n').Append(Num((Width(lines[i - 1]) - Width(lines[i])) / 2)).Append(' ').Append(Num(-pitch)).Append(" Td ").Append(Hex(lines[i])).Append(" Tj");
+                text = Encoding.ASCII.GetBytes(sb.ToString());
+                if (text.Length > textLength) return;
+            }
+
+            // From OfficeIMO's origin to the first line's, along the text and up across it.
+            var along = (Width(watermark) - Width(lines[0])) / 2 - 2;
+            var up = WatermarkSize / 2 + lineBox / 2 - 0.9 * WatermarkSize + (lines.Count - 1) * pitch / 2;
+            // At 45 degrees the text runs along (k, k) and across it, upwards, is (-k, k) in PDF space.
+            var k = Math.Sqrt(0.5);
+            e += k * (along - up);
+            f += k * (along + up);
+            foreach (var format in new[] { "0.##", "0" })
+            {
+                var matrix = Encoding.ASCII.GetBytes(Encoding.ASCII.GetString(WatermarkRotation) + " "
+                    + e.ToString(format, CultureInfo.InvariantCulture) + " " + f.ToString(format, CultureInfo.InvariantCulture));
+                if (matrix.Length > tm - at) continue;
+                Buffer.BlockCopy(matrix, 0, pdf, at, matrix.Length);
+                Array.Fill(pdf, (byte)' ', at + matrix.Length, tm - at - matrix.Length);
+                if (text is not null)
+                {
+                    Buffer.BlockCopy(text, 0, pdf, textAt, text.Length);
+                    Array.Fill(pdf, (byte)' ', textAt + text.Length, textLength - text.Length);
+                }
+                return;
+            }
+        }
+
+        // A PDF hex string of `s` as OfficeIMO writes the standard fonts' text: one WinAnsi byte a character, so
+        // a curly quote, dash or euro sign (0x80..0x9F) matches the bytes on the page.
+        private static string Hex(string s)
+        {
+            var bytes = new byte[s.Length];
+            for (var i = 0; i < s.Length; i++) bytes[i] = (byte)Math.Max(0, ReportComponents.WinAnsiCode(s[i]));
+            return "<" + Convert.ToHexString(bytes) + ">";
+        }
+
+        // The mark, upper-cased, in the standard Helvetica-Bold it is drawn in. A character with no WinAnsi code
+        // (from %tenantname%, or made by upper-casing, like the Greek capital mu of 'µ') fails the engine's
+        // encoding check and with it the whole report, so it prints as '?', the way the body text prints one.
+        private static string DrawableMark(string text)
+        {
+            var upper = ReportMarkdown.Sanitize(text).ToUpperInvariant();
+            var sb = new StringBuilder(upper.Length);
+            foreach (var ch in upper) sb.Append(ReportComponents.WinAnsiCode(ch) >= 0 ? ch : '?');
+            return sb.ToString();
+        }
+
+        // The first `needle` wholly inside [from, to), or -1.
+        private static int IndexOf(byte[] hay, byte[] needle, int from, int to)
+        {
+            from = Math.Max(0, from);
+            if (to - from < needle.Length) return -1;
+            var i = hay.AsSpan(from, to - from).IndexOf(needle);
+            return i < 0 ? -1 : from + i;
+        }
+
+        // The last `needle` wholly before `before`, or -1.
+        private static int LastIndexOf(byte[] hay, byte[] needle, int before)
+            => before < 0 ? -1 : hay.AsSpan(0, Math.Min(before, hay.Length)).LastIndexOf(needle);
+
+        private sealed class PageGroup
+        {
+            public string Kind = "content"; // content|hero
+            public List<ReportNode> Blocks = new();
+            public ReportNode? Block;
+            public string? Title;    // a fixed report's ContentPage title (null -> report name)
+            public string? Subtitle; // its descriptive subtitle (null -> generated-on date)
+        }
+
+        private static List<PageGroup> BuildPageGroups(List<ReportNode> blocks)
+        {
+            var groups = new List<PageGroup>();
+            var current = new PageGroup();
+            void Flush() { if (current.Blocks.Count > 0) { groups.Add(current); current = new PageGroup { Title = null, Subtitle = null }; } }
+            foreach (var block in blocks)
+            {
+                if (block.Type == "pagebreak") { Flush(); continue; }
+                if (block.Type == "hero") { Flush(); groups.Add(new PageGroup { Kind = "hero", Block = block }); current = new PageGroup(); continue; }
+                // A 'page' block opens a new titled content page (a fixed report's ContentPage).
+                if (block.Type == "page") { Flush(); current.Title = block.Str("title"); current.Subtitle = block.Str("subtitle"); continue; }
+                current.Blocks.Add(block);
+            }
+            Flush();
+            if (groups.Count == 0) groups.Add(new PageGroup());
+            return groups;
+        }
+
+        private static PageSize ResolveSize(string size) => (size ?? "A4").ToUpperInvariant() switch
+        {
+            "LETTER" => PageSizes.Letter,
+            "LEGAL" => PageSizes.Legal,
+            "A3" => PageSizes.A3,
+            "A5" => PageSizes.A5,
+            _ => PageSizes.A4,
+        };
+
+        private static Dictionary<string, string> ParseVariables(string? json)
+        {
+            var dict = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            if (string.IsNullOrWhiteSpace(json)) return dict;
+            try
+            {
+                using var doc = JsonDocument.Parse(json);
+                var root = doc.RootElement;
+                if (root.ValueKind == JsonValueKind.Object)
+                    foreach (var p in root.EnumerateObject())
+                        if (p.Value.ValueKind == JsonValueKind.String) dict[p.Name] = p.Value.GetString()!;
+                        else if (p.Value.ValueKind is JsonValueKind.Number or JsonValueKind.True or JsonValueKind.False) dict[p.Name] = p.Value.ToString();
+            }
+            catch { /* leave empty */ }
+            return dict;
+        }
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/ReportStyles.cs b/Shared/CIPPSharp/Reporting/ReportStyles.cs
new file mode 100644
index 0000000000000..d369a6e47b3b6
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/ReportStyles.cs
@@ -0,0 +1,68 @@
+using System;
+using System.Collections.Generic;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// Layout constants ported from frontend/src/components/CippPdf/reportPdfStyles.js - page metrics,
+    /// paddings and the font sizes the components draw at, so server output matches the client's spacing.
+    /// </summary>
+    public static class ReportStyles
+    {
+        public const double PagePadding = 32;      // margin down each side of a content page
+
+        // Font sizes (points).
+        public const double PageTitle = 20;
+        public const double PageSubtitle = 11;
+        public const double SectionTitle = 14;
+        public const double Body = 9;
+        public const double Heading1 = 16;
+        public const double Heading2 = 14;
+        public const double Heading3 = 12;
+        public const double TableCell = 8;
+        public const double TableHeaderCell = 7;
+        public const double StatusText = 9;
+        public const double BulletText = 9;
+        public const double CodeBlock = 8;
+        public const double FooterText = 7;
+        public const double StatNumber = 20;
+        public const double StatLabel = 7;
+        public const double StatCaption = 7;
+        public const double InfoTitle = 10;
+        public const double InfoText = 8;
+        public const double AlertTitle = 11;
+        public const double AlertText = 9;
+        public const double CoverTitle = 48;
+        public const double CoverSubtitle = 14;
+        public const double CoverLabel = 10;
+
+        private static readonly Dictionary<string, double> PageWidths = new(StringComparer.OrdinalIgnoreCase)
+        {
+            ["A4"] = 595.28, ["LETTER"] = 612, ["LEGAL"] = 612, ["A3"] = 841.89, ["A5"] = 419.53,
+        };
+        private static readonly Dictionary<string, double> PageHeights = new(StringComparer.OrdinalIgnoreCase)
+        {
+            ["A4"] = 841.89, ["LETTER"] = 792, ["LEGAL"] = 1008, ["A3"] = 1190.55, ["A5"] = 595.28,
+        };
+
+        /// <summary>Usable table/content width: paper (long edge if landscape) minus page padding both sides.</summary>
+        public static double ContentWidth(string size, bool landscape)
+        {
+            var key = (size ?? "A4").ToUpperInvariant();
+            var w = PageWidths.TryGetValue(key, out var pw) ? pw : PageWidths["A4"];
+            var h = PageHeights.TryGetValue(key, out var ph) ? ph : PageHeights["A4"];
+            var paper = landscape ? h : w;
+            return paper - PagePadding * 2;
+        }
+
+        /// <summary>Usable content height: paper (short edge if landscape) minus page padding both sides.</summary>
+        public static double ContentHeight(string size, bool landscape)
+        {
+            var key = (size ?? "A4").ToUpperInvariant();
+            var w = PageWidths.TryGetValue(key, out var pw) ? pw : PageWidths["A4"];
+            var h = PageHeights.TryGetValue(key, out var ph) ? ph : PageHeights["A4"];
+            var paper = landscape ? w : h;
+            return paper - PagePadding * 2;
+        }
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/ReportTheme.cs b/Shared/CIPPSharp/Reporting/ReportTheme.cs
new file mode 100644
index 0000000000000..55a1162121b67
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/ReportTheme.cs
@@ -0,0 +1,269 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text.RegularExpressions;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// Server-side port of frontend/src/components/CippPdf/reportTheme.js. The single place a report
+    /// works out what it looks like: two brand colours, readable text on each, a chart series, and the
+    /// footer/watermark configuration. Kept as a faithful 1:1 port so a server-rendered report matches
+    /// the client preview colour-for-colour. Pure (no OfficeIMO dependency) so it is unit-testable
+    /// against the JS values.
+    /// </summary>
+    public static class ReportColours
+    {
+        public const string Danger = "#742A2A";
+        public const string Warning = "#744210";
+        public const string Success = "#22543D";
+        public const string Info = "#2C5282";
+        public const string Ink = "#1A202C";
+        public const string Body = "#2D3748";
+        public const string Muted = "#4A5568";
+        public const string Faint = "#718096";
+        public const string Line = "#E2E8F0";
+        public const string Panel = "#F7FAFC";
+        public const string White = "#FFFFFF";
+        // Callout background tints (match the client InfoBox/AlertBox/ClearBox).
+        public const string AlertBg = "#FFF5F5";
+        public const string OkBg = "#F0FDF4";
+        public const string WarnBg = "#FEF5E7";
+    }
+
+    /// <summary>Colour maths ported from reportTheme.js - hex normalisation, WCAG luminance, mixing.</summary>
+    public static class ColourMath
+    {
+        public const string DefaultBrandColour = "#F77F00";
+        private const double WhiteTextMinContrast = 2.5;
+        private static readonly Regex HexPattern = new("^#?([0-9a-f]{3}|[0-9a-f]{6})$", RegexOptions.IgnoreCase);
+
+        /// <summary>#RGB / #RRGGBB / bare digits -> canonical #RRGGBB, or null if unparseable.</summary>
+        public static string? NormaliseHex(string? value)
+        {
+            if (value is null) return null;
+            var trimmed = value.Trim();
+            if (!HexPattern.IsMatch(trimmed)) return null;
+            var digits = trimmed.Replace("#", string.Empty);
+            if (digits.Length == 3)
+            {
+                var chars = new char[6];
+                for (var i = 0; i < 3; i++) { chars[i * 2] = digits[i]; chars[i * 2 + 1] = digits[i]; }
+                digits = new string(chars);
+            }
+            return "#" + digits.ToUpperInvariant();
+        }
+
+        // hsl(H, S%, L%) - the palette form the dashboard sankeys emit (e.g. "hsl(210, 70%, 50%)"). Commas
+        // or spaces between the three parts; the % on S/L is optional. Anything else returns null.
+        private static readonly Regex HslPattern = new(
+            @"^hsl\(\s*(-?\d+(?:\.\d+)?)\s*[, ]\s*(\d+(?:\.\d+)?)%?\s*[, ]\s*(\d+(?:\.\d+)?)%?\s*\)$",
+            RegexOptions.IgnoreCase);
+
+        private static (int r, int g, int b)? TryHslToRgb(string? value)
+        {
+            if (value is null) return null;
+            var m = HslPattern.Match(value.Trim());
+            if (!m.Success) return null;
+            var h = double.Parse(m.Groups[1].Value, CultureInfo.InvariantCulture);
+            var s = double.Parse(m.Groups[2].Value, CultureInfo.InvariantCulture) / 100.0;
+            var l = double.Parse(m.Groups[3].Value, CultureInfo.InvariantCulture) / 100.0;
+            h = ((h % 360) + 360) % 360 / 360.0;
+            s = Math.Max(0, Math.Min(1, s));
+            l = Math.Max(0, Math.Min(1, l));
+            if (s == 0)
+            {
+                var g = (int)Math.Round(l * 255);
+                return (g, g, g);
+            }
+            var q = l < 0.5 ? l * (1 + s) : l + s - l * s;
+            var p = 2 * l - q;
+            static double Hue(double p, double q, double t)
+            {
+                if (t < 0) t += 1;
+                if (t > 1) t -= 1;
+                if (t < 1.0 / 6) return p + (q - p) * 6 * t;
+                if (t < 1.0 / 2) return q;
+                if (t < 2.0 / 3) return p + (q - p) * (2.0 / 3 - t) * 6;
+                return p;
+            }
+            return (
+                (int)Math.Round(Hue(p, q, h + 1.0 / 3) * 255),
+                (int)Math.Round(Hue(p, q, h) * 255),
+                (int)Math.Round(Hue(p, q, h - 1.0 / 3) * 255));
+        }
+
+        /// <summary>Hex, hsl() (or the default brand colour when unparseable) as 0-255 channels.</summary>
+        public static (int r, int g, int b) ToRgb(string? hex)
+        {
+            // The canonical #RRGGBB every palette entry and constant already is, parsed without the regexes.
+            if (hex is { Length: 7 } && hex[0] == '#'
+                && int.TryParse(hex.AsSpan(1), NumberStyles.AllowHexSpecifier, CultureInfo.InvariantCulture, out var rgb))
+                return ((rgb >> 16) & 0xFF, (rgb >> 8) & 0xFF, rgb & 0xFF);
+            var hsl = TryHslToRgb(hex);
+            if (hsl.HasValue) return hsl.Value;
+            var normalised = NormaliseHex(hex) ?? DefaultBrandColour;
+            var d = normalised.Substring(1);
+            return (
+                int.Parse(d.Substring(0, 2), NumberStyles.HexNumber, CultureInfo.InvariantCulture),
+                int.Parse(d.Substring(2, 2), NumberStyles.HexNumber, CultureInfo.InvariantCulture),
+                int.Parse(d.Substring(4, 2), NumberStyles.HexNumber, CultureInfo.InvariantCulture));
+        }
+
+        private static string ToHex(double r, double g, double b)
+        {
+            static string Ch(double v) => ((int)Math.Max(0, Math.Min(255, Math.Round(v)))).ToString("X2", CultureInfo.InvariantCulture);
+            return "#" + Ch(r) + Ch(g) + Ch(b);
+        }
+
+        private static double RelativeLuminance(string hex)
+        {
+            var (r, g, b) = ToRgb(hex);
+            static double Ch(int value)
+            {
+                var s = value / 255.0;
+                return s <= 0.03928 ? s / 12.92 : Math.Pow((s + 0.055) / 1.055, 2.4);
+            }
+            return 0.2126 * Ch(r) + 0.7152 * Ch(g) + 0.0722 * Ch(b);
+        }
+
+        private static double ContrastRatio(string a, string b)
+        {
+            var la = RelativeLuminance(a);
+            var lb = RelativeLuminance(b);
+            var lighter = Math.Max(la, lb);
+            var darker = Math.Min(la, lb);
+            return (lighter + 0.05) / (darker + 0.05);
+        }
+
+        /// <summary>White on the brand colour where legible, else near-black - matches readableTextOn.</summary>
+        public static string ReadableTextOn(string? background)
+        {
+            var hex = NormaliseHex(background) ?? DefaultBrandColour;
+            return ContrastRatio(hex, ReportColours.White) >= WhiteTextMinContrast ? ReportColours.White : ReportColours.Ink;
+        }
+
+        public static string Mix(string hex, string target, double amount)
+        {
+            var (fr, fg, fb) = ToRgb(hex);
+            var (tr, tg, tb) = ToRgb(target);
+            var ratio = Math.Max(0, Math.Min(1, amount));
+            return ToHex(fr + (tr - fr) * ratio, fg + (tg - fg) * ratio, fb + (tb - fb) * ratio);
+        }
+
+        public static string Lighten(string hex, double amount) => Mix(hex, "#FFFFFF", amount);
+        public static string Darken(string hex, double amount) => Mix(hex, "#000000", amount);
+    }
+
+    /// <summary>One colour role, resolved from branding with a fallback derived from the brand colours.</summary>
+    internal sealed record ColourRole(string Key, string Setting, Func<string, string, string> From);
+
+    public sealed class ReportTheme
+    {
+        public string Primary { get; }
+        public string Secondary { get; }
+        public string OnPrimary { get; }
+        public IReadOnlyDictionary<string, string> Palette { get; }
+        public string OnTable { get; }
+        public string OnInfographic { get; }
+        public IReadOnlyList<string> Series { get; }
+        // Footer
+        public bool FooterShow { get; }
+        public bool FooterEnabled { get; }
+        public string FooterTemplate { get; }
+        public bool ShowPageNumbers { get; }
+        // Watermark
+        public bool WatermarkEnabled { get; }
+        public string WatermarkText { get; }
+        public string CoverFooterText { get; }
+
+        public const int FooterMaxLength = 200;
+        public const int WatermarkMaxLength = 40;
+
+        // Mirrors REPORT_COLOUR_ROLES. `from(primary, secondary)` is the fallback derivation.
+        private static readonly ColourRole[] Roles =
+        {
+            new("chart", "chartColour", (p, _) => p),
+            new("chartAccent", "chartAccentColour", (_, s) => s),
+            new("title", "titleColour", (_, _) => ReportColours.Ink),
+            new("coverText", "coverTextColour", (_, _) => ReportColours.Ink),
+            new("subtitle", "subtitleColour", (_, _) => ReportColours.Muted),
+            new("heading", "headingColour", (p, _) => p),
+            new("body", "bodyColour", (_, _) => ReportColours.Body),
+            new("footer", "footerColour", (_, _) => ReportColours.Faint),
+            new("card", "cardColour", (_, s) => s),
+            new("table", "tableColour", (p, _) => p),
+            new("infographic", "infographicColour", (p, _) => p),
+            new("infographicBackground", "infographicBackgroundColour", (_, _) => "#000000"),
+            new("watermark", "watermarkColour", (p, _) => p),
+        };
+
+        private ReportTheme(BrandingInput b)
+        {
+            Primary = ColourMath.NormaliseHex(b.Colour) ?? ColourMath.DefaultBrandColour;
+            Secondary = ColourMath.NormaliseHex(b.SecondaryColour) ?? Primary;
+            OnPrimary = ColourMath.ReadableTextOn(Primary);
+
+            var palette = new Dictionary<string, string>();
+            foreach (var role in Roles)
+            {
+                var configured = b.RoleColour(role.Setting);
+                palette[role.Key] = ColourMath.NormaliseHex(configured) ?? role.From(Primary, Secondary);
+            }
+            Palette = palette;
+
+            OnTable = ColourMath.ReadableTextOn(palette["table"]);
+            OnInfographic = ColourMath.ReadableTextOn(palette["infographicBackground"]);
+            Series = BuildSeries(palette["chart"], palette["chartAccent"]);
+
+            FooterShow = b.ShowFooter != false;
+            FooterEnabled = b.ShowFooter != false && !string.IsNullOrEmpty(b.FooterText);
+            FooterTemplate = b.FooterText ?? string.Empty;
+            ShowPageNumbers = b.ShowPageNumbers != false;
+            WatermarkEnabled = b.WatermarkEnabled != false && !string.IsNullOrEmpty(b.WatermarkText);
+            WatermarkText = b.WatermarkText ?? string.Empty;
+            CoverFooterText = b.CoverFooterText ?? string.Empty;
+        }
+
+        public static ReportTheme Create(BrandingInput branding) => new(branding);
+
+        private static List<string> BuildSeries(string primary, string secondary)
+        {
+            if (primary == secondary)
+            {
+                return new List<string>
+                {
+                    primary, ColourMath.Lighten(primary, 0.35), ReportColours.Info,
+                    ColourMath.Darken(primary, 0.3), ColourMath.Lighten(primary, 0.65)
+                };
+            }
+            return new List<string>
+            {
+                primary, secondary, ColourMath.Lighten(primary, 0.4),
+                ColourMath.Lighten(secondary, 0.4), ColourMath.Darken(primary, 0.25)
+            };
+        }
+
+        /// <summary>%variable% substitution - case-insensitive, unknown tokens left as written.</summary>
+        public static string ApplyVariables(string? template, IReadOnlyDictionary<string, string> variables)
+        {
+            if (string.IsNullOrEmpty(template)) return string.Empty;
+            var lookup = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+            foreach (var kv in variables) lookup[kv.Key.Trim('%').ToLowerInvariant()] = kv.Value;
+            return Regex.Replace(template, "%([\\w()]+)%", m =>
+                lookup.TryGetValue(m.Groups[1].Value.ToLowerInvariant(), out var v) ? v : m.Value);
+        }
+
+        public static string ApplyFooter(string? template, IReadOnlyDictionary<string, string> variables)
+        {
+            var s = ApplyVariables(template, variables);
+            return s.Length > FooterMaxLength ? s.Substring(0, FooterMaxLength) : s;
+        }
+
+        public static string ApplyWatermark(string? template, IReadOnlyDictionary<string, string> variables)
+        {
+            var s = ApplyVariables(template, variables);
+            return s.Length > WatermarkMaxLength ? s.Substring(0, WatermarkMaxLength) : s;
+        }
+    }
+}
diff --git a/Shared/CIPPSharp/Reporting/TwemojiAssets.cs b/Shared/CIPPSharp/Reporting/TwemojiAssets.cs
new file mode 100644
index 0000000000000..2246917fb30ad
--- /dev/null
+++ b/Shared/CIPPSharp/Reporting/TwemojiAssets.cs
@@ -0,0 +1,95 @@
+using System;
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Text;
+
+namespace CIPP.Reporting
+{
+    /// <summary>
+    /// Resolves an emoji grapheme cluster to its bundled Twemoji colour PNG. The full 72x72 Twemoji set
+    /// ships as individual files under <c>twemoji/</c> beside the assembly (one small file per emoji, so a
+    /// render only touches the handful it embeds). The renderer places each as an inline colour image, the
+    /// way the client's react-pdf reports did - the standard PDF fonts and OfficeIMO's embedding are
+    /// monochrome-only, so this is the only route to colour emoji. Absent, emoji fall back to the bundled
+    /// monochrome font.
+    /// </summary>
+    internal static class TwemojiAssets
+    {
+        private static readonly Lazy<string?> Dir = new(() =>
+        {
+            try
+            {
+                var d = Path.GetDirectoryName(typeof(TwemojiAssets).Assembly.Location);
+                if (string.IsNullOrEmpty(d)) return null;
+                var t = Path.Combine(d, "twemoji");
+                return Directory.Exists(t) ? t : null;
+            }
+            catch { return null; }
+        });
+
+        // The set of available basenames (e.g. "26a0", "1f1fa-1f1f8"), read once, so a lookup is O(1) and
+        // never hits the disk for an emoji we don't ship.
+        private static readonly Lazy<HashSet<string>> Available = new(() =>
+        {
+            var set = new HashSet<string>(StringComparer.Ordinal);
+            var dir = Dir.Value;
+            if (dir is null) return set;
+            try { foreach (var f in Directory.EnumerateFiles(dir, "*.png")) set.Add(Path.GetFileNameWithoutExtension(f)); }
+            catch { }
+            return set;
+        });
+
+        // Bytes read on first use for an emoji and kept (a used emoji is at most ~5 KB; the whole set is
+        // ~4 MB), so a report referencing the same emoji many times reads the file once.
+        private static readonly ConcurrentDictionary<string, byte[]?> Cache = new(StringComparer.Ordinal);
+
+        public static bool Enabled => Dir.Value is not null && Available.Value.Count > 0;
+
+        /// <summary>
+        /// The Twemoji basename for a grapheme cluster (its toCodePoint rule): drop the VS16 emoji-style
+        /// selector unless the cluster is a ZWJ sequence, then join the code points as lowercase hex with
+        /// '-'. Null if the cluster has no drawable code point.
+        /// </summary>
+        public static string? Key(string cluster)
+        {
+            if (string.IsNullOrEmpty(cluster)) return null;
+            var hasZwj = cluster.IndexOf('‍') >= 0;
+            var sb = new StringBuilder();
+            var any = false;
+            for (var i = 0; i < cluster.Length;)
+            {
+                int cp;
+                if (char.IsHighSurrogate(cluster[i]) && i + 1 < cluster.Length && char.IsLowSurrogate(cluster[i + 1]))
+                { cp = char.ConvertToUtf32(cluster[i], cluster[i + 1]); i += 2; }
+                else { cp = cluster[i]; i++; }
+                if (!hasZwj && cp == 0xFE0F) continue;
+                if (any) sb.Append('-');
+                sb.Append(cp.ToString("x", CultureInfo.InvariantCulture));
+                any = true;
+            }
+            return any ? sb.ToString() : null;
+        }
+
+        /// <summary>True when a bundled Twemoji PNG exists for this grapheme cluster.</summary>
+        public static bool Has(string cluster)
+        {
+            if (!Enabled) return false;
+            var k = Key(cluster);
+            return k is not null && Available.Value.Contains(k);
+        }
+
+        /// <summary>The PNG bytes for a grapheme cluster, or null if none is bundled.</summary>
+        public static byte[]? Bytes(string cluster)
+        {
+            var k = Key(cluster);
+            if (k is null || !Available.Value.Contains(k)) return null;
+            return Cache.GetOrAdd(k, key =>
+            {
+                try { return File.ReadAllBytes(Path.Combine(Dir.Value!, key + ".png")); }
+                catch { return null; }
+            });
+        }
+    }
+}
diff --git a/Shared/CIPPSharp/bin/CIPPSharp.dll b/Shared/CIPPSharp/bin/CIPPSharp.dll
index 4b71bbc8b79b0..134aabf16bcd1 100644
Binary files a/Shared/CIPPSharp/bin/CIPPSharp.dll and b/Shared/CIPPSharp/bin/CIPPSharp.dll differ
diff --git a/Shared/CIPPSharp/bin/OfficeIMO.Core.dll b/Shared/CIPPSharp/bin/OfficeIMO.Core.dll
new file mode 100644
index 0000000000000..d5f32f8e633f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/OfficeIMO.Core.dll differ
diff --git a/Shared/CIPPSharp/bin/OfficeIMO.Pdf.dll b/Shared/CIPPSharp/bin/OfficeIMO.Pdf.dll
new file mode 100644
index 0000000000000..744c438e0b72a
Binary files /dev/null and b/Shared/CIPPSharp/bin/OfficeIMO.Pdf.dll differ
diff --git a/Shared/CIPPSharp/bin/emoji-fallback.LICENSE.txt b/Shared/CIPPSharp/bin/emoji-fallback.LICENSE.txt
new file mode 100644
index 0000000000000..4df1087b4fe76
--- /dev/null
+++ b/Shared/CIPPSharp/bin/emoji-fallback.LICENSE.txt
@@ -0,0 +1,305 @@
+emoji-fallback.ttf - third-party font notices
+=============================================
+
+emoji-fallback.ttf (internal family name "CippReportEmoji") is a subsetted, merged
+font used only as a monochrome symbol/emoji fallback by the CIPP server-side PDF
+renderer (backend/Shared/CIPPSharp). It is built from two upstream fonts:
+
+  * Latin-1 and CP1252 punctuation glyphs .... DejaVu Sans (Bitstream Vera / Arev)
+  * Symbol and emoji glyphs (BMP + astral) ... Noto Emoji (SIL Open Font License 1.1)
+
+Only the glyphs the reports may use are included; the family was renamed so it does
+not carry any reserved font name from the upstream projects. The full upstream
+licences follow.
+
+
+================================================================================
+1. DejaVu Sans (Bitstream Vera Fonts Copyright / Arev Fonts Copyright)
+================================================================================
+
+Fonts are (c) Bitstream (see below). DejaVu changes are in public domain.
+Glyphs imported from Arev fonts are (c) Tavmjong Bah (see below)
+
+
+Bitstream Vera Fonts Copyright
+------------------------------
+
+Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is
+a trademark of Bitstream, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of the fonts accompanying this license ("Fonts") and associated
+documentation files (the "Font Software"), to reproduce and distribute the
+Font Software, including without limitation the rights to use, copy, merge,
+publish, distribute, and/or sell copies of the Font Software, and to permit
+persons to whom the Font Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright and trademark notices and this permission notice shall
+be included in all copies of one or more of the Font Software typefaces.
+
+The Font Software may be modified, altered, or added to, and in particular
+the designs of glyphs or characters in the Fonts may be modified and
+additional glyphs or characters may be added to the Fonts, only if the fonts
+are renamed to names not containing either the words "Bitstream" or the word
+"Vera".
+
+This License becomes null and void to the extent applicable to Fonts or Font
+Software that has been modified and is distributed under the "Bitstream
+Vera" names.
+
+The Font Software may be sold as part of a larger software package but no
+copy of one or more of the Font Software typefaces may be sold by itself.
+
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT,
+TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME
+FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING
+ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES,
+WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF
+THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE
+FONT SOFTWARE.
+
+Except as contained in this notice, the names of Gnome, the Gnome
+Foundation, and Bitstream Inc., shall not be used in advertising or
+otherwise to promote the sale, use or other dealings in this Font Software
+without prior written authorization from the Gnome Foundation or Bitstream
+Inc., respectively. For further information, contact: fonts at gnome dot
+org.
+
+Arev Fonts Copyright
+------------------------------
+
+Copyright (c) 2006 by Tavmjong Bah. All Rights Reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the fonts accompanying this license ("Fonts") and
+associated documentation files (the "Font Software"), to reproduce
+and distribute the modifications to the Bitstream Vera Font Software,
+including without limitation the rights to use, copy, merge, publish,
+distribute, and/or sell copies of the Font Software, and to permit
+persons to whom the Font Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright and trademark notices and this permission notice
+shall be included in all copies of one or more of the Font Software
+typefaces.
+
+The Font Software may be modified, altered, or added to, and in
+particular the designs of glyphs or characters in the Fonts may be
+modified and additional glyphs or characters may be added to the
+Fonts, only if the fonts are renamed to names not containing either
+the words "Tavmjong Bah" or the word "Arev".
+
+This License becomes null and void to the extent applicable to Fonts
+or Font Software that has been modified and is distributed under the 
+"Tavmjong Bah Arev" names.
+
+The Font Software may be sold as part of a larger software package but
+no copy of one or more of the Font Software typefaces may be sold by
+itself.
+
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL
+TAVMJONG BAH BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
+
+Except as contained in this notice, the name of Tavmjong Bah shall not
+be used in advertising or otherwise to promote the sale, use or other
+dealings in this Font Software without prior written authorization
+from Tavmjong Bah. For further information, contact: tavmjong @ free
+. fr.
+
+TeX Gyre DJV Math
+-----------------
+Fonts are (c) Bitstream (see below). DejaVu changes are in public domain.
+
+Math extensions done by B. Jackowski, P. Strzelczyk and P. Pianowski
+(on behalf of TeX users groups) are in public domain.
+
+Letters imported from Euler Fraktur from AMSfonts are (c) American
+Mathematical Society (see below).
+Bitstream Vera Fonts Copyright
+Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera
+is a trademark of Bitstream, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of the fonts accompanying this license (“Fonts”) and associated
+documentation
+files (the “Font Software”), to reproduce and distribute the Font Software,
+including without limitation the rights to use, copy, merge, publish,
+distribute,
+and/or sell copies of the Font Software, and to permit persons  to whom
+the Font Software is furnished to do so, subject to the following
+conditions:
+
+The above copyright and trademark notices and this permission notice
+shall be
+included in all copies of one or more of the Font Software typefaces.
+
+The Font Software may be modified, altered, or added to, and in particular
+the designs of glyphs or characters in the Fonts may be modified and
+additional
+glyphs or characters may be added to the Fonts, only if the fonts are
+renamed
+to names not containing either the words “Bitstream” or the word “Vera”.
+
+This License becomes null and void to the extent applicable to Fonts or
+Font Software
+that has been modified and is distributed under the “Bitstream Vera”
+names.
+
+The Font Software may be sold as part of a larger software package but
+no copy
+of one or more of the Font Software typefaces may be sold by itself.
+
+THE FONT SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT,
+TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME
+FOUNDATION
+BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL,
+SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN
+ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR
+INABILITY TO USE
+THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
+Except as contained in this notice, the names of GNOME, the GNOME
+Foundation,
+and Bitstream Inc., shall not be used in advertising or otherwise to promote
+the sale, use or other dealings in this Font Software without prior written
+authorization from the GNOME Foundation or Bitstream Inc., respectively.
+For further information, contact: fonts at gnome dot org.
+
+AMSFonts (v. 2.2) copyright
+
+The PostScript Type 1 implementation of the AMSFonts produced by and
+previously distributed by Blue Sky Research and Y&Y, Inc. are now freely
+available for general use. This has been accomplished through the
+cooperation
+of a consortium of scientific publishers with Blue Sky Research and Y&Y.
+Members of this consortium include:
+
+Elsevier Science IBM Corporation Society for Industrial and Applied
+Mathematics (SIAM) Springer-Verlag American Mathematical Society (AMS)
+
+In order to assure the authenticity of these fonts, copyright will be
+held by
+the American Mathematical Society. This is not meant to restrict in any way
+the legitimate use of the fonts, such as (but not limited to) electronic
+distribution of documents containing these fonts, inclusion of these fonts
+into other public domain or commercial font collections or computer
+applications, use of the outline data to create derivative fonts and/or
+faces, etc. However, the AMS does require that the AMS copyright notice be
+removed from any derivative versions of the fonts which have been altered in
+any way. In addition, to ensure the fidelity of TeX documents using Computer
+Modern fonts, Professor Donald Knuth, creator of the Computer Modern faces,
+has requested that any alterations which yield different font metrics be
+given a different name.
+
+$Id$
+
+
+================================================================================
+2. Noto Emoji (SIL Open Font License, Version 1.1)
+================================================================================
+
+Copyright 2013 Google LLC
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.
diff --git a/Shared/CIPPSharp/bin/emoji-fallback.ttf b/Shared/CIPPSharp/bin/emoji-fallback.ttf
new file mode 100644
index 0000000000000..6df5404593cec
Binary files /dev/null and b/Shared/CIPPSharp/bin/emoji-fallback.ttf differ
diff --git a/Shared/CIPPSharp/bin/reportImages/board.jpg b/Shared/CIPPSharp/bin/reportImages/board.jpg
new file mode 100644
index 0000000000000..7acaef3b6c774
Binary files /dev/null and b/Shared/CIPPSharp/bin/reportImages/board.jpg differ
diff --git a/Shared/CIPPSharp/bin/reportImages/city.jpg b/Shared/CIPPSharp/bin/reportImages/city.jpg
new file mode 100644
index 0000000000000..dd3ba7434cd70
Binary files /dev/null and b/Shared/CIPPSharp/bin/reportImages/city.jpg differ
diff --git a/Shared/CIPPSharp/bin/reportImages/glasses.jpg b/Shared/CIPPSharp/bin/reportImages/glasses.jpg
new file mode 100644
index 0000000000000..4da25c27e61ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/reportImages/glasses.jpg differ
diff --git a/Shared/CIPPSharp/bin/reportImages/laptop.jpg b/Shared/CIPPSharp/bin/reportImages/laptop.jpg
new file mode 100644
index 0000000000000..5d8579553a52a
Binary files /dev/null and b/Shared/CIPPSharp/bin/reportImages/laptop.jpg differ
diff --git a/Shared/CIPPSharp/bin/reportImages/soc.jpg b/Shared/CIPPSharp/bin/reportImages/soc.jpg
new file mode 100644
index 0000000000000..f3e83f78e1be8
Binary files /dev/null and b/Shared/CIPPSharp/bin/reportImages/soc.jpg differ
diff --git a/Shared/CIPPSharp/bin/reportImages/working.jpg b/Shared/CIPPSharp/bin/reportImages/working.jpg
new file mode 100644
index 0000000000000..fdc1903dfc037
Binary files /dev/null and b/Shared/CIPPSharp/bin/reportImages/working.jpg differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f004.png b/Shared/CIPPSharp/bin/twemoji/1f004.png
new file mode 100644
index 0000000000000..93c0fa92caa68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f004.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f0cf.png b/Shared/CIPPSharp/bin/twemoji/1f0cf.png
new file mode 100644
index 0000000000000..5530110afe159
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f0cf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f170.png b/Shared/CIPPSharp/bin/twemoji/1f170.png
new file mode 100644
index 0000000000000..8944eac4ffc57
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f170.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f171.png b/Shared/CIPPSharp/bin/twemoji/1f171.png
new file mode 100644
index 0000000000000..6662ffefc4df7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f171.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f17e.png b/Shared/CIPPSharp/bin/twemoji/1f17e.png
new file mode 100644
index 0000000000000..7d38be20cc7a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f17e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f17f.png b/Shared/CIPPSharp/bin/twemoji/1f17f.png
new file mode 100644
index 0000000000000..afa850c900ea9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f17f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f18e.png b/Shared/CIPPSharp/bin/twemoji/1f18e.png
new file mode 100644
index 0000000000000..0c6879c6997f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f18e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f191.png b/Shared/CIPPSharp/bin/twemoji/1f191.png
new file mode 100644
index 0000000000000..d4cb3afc63c82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f191.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f192.png b/Shared/CIPPSharp/bin/twemoji/1f192.png
new file mode 100644
index 0000000000000..d1920bcc461f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f192.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f193.png b/Shared/CIPPSharp/bin/twemoji/1f193.png
new file mode 100644
index 0000000000000..20c351632c6ae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f193.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f194.png b/Shared/CIPPSharp/bin/twemoji/1f194.png
new file mode 100644
index 0000000000000..d2a9c0ac69a48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f194.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f195.png b/Shared/CIPPSharp/bin/twemoji/1f195.png
new file mode 100644
index 0000000000000..9c0693701c2fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f195.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f196.png b/Shared/CIPPSharp/bin/twemoji/1f196.png
new file mode 100644
index 0000000000000..1676a2b190619
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f196.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f197.png b/Shared/CIPPSharp/bin/twemoji/1f197.png
new file mode 100644
index 0000000000000..90763be7040ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f197.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f198.png b/Shared/CIPPSharp/bin/twemoji/1f198.png
new file mode 100644
index 0000000000000..2dd0eb0440c00
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f198.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f199.png b/Shared/CIPPSharp/bin/twemoji/1f199.png
new file mode 100644
index 0000000000000..177ee60634160
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f199.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f19a.png b/Shared/CIPPSharp/bin/twemoji/1f19a.png
new file mode 100644
index 0000000000000..9f26ffe7f790d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f19a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1e8.png
new file mode 100644
index 0000000000000..8e7a630b924a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1e9.png
new file mode 100644
index 0000000000000..69972dfe8cbfe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ea.png
new file mode 100644
index 0000000000000..11d2bb6e9fa19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1eb.png
new file mode 100644
index 0000000000000..7a37ec27e78a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ec.png
new file mode 100644
index 0000000000000..8602fff488c18
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ee.png
new file mode 100644
index 0000000000000..73f0c20398691
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f1.png
new file mode 100644
index 0000000000000..a6d45735f3ffe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f2.png
new file mode 100644
index 0000000000000..16ef38ae5f683
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f4.png
new file mode 100644
index 0000000000000..934952555e5ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f6.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f6.png
new file mode 100644
index 0000000000000..d21e4bafd2bd7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f7.png
new file mode 100644
index 0000000000000..a7d8a31dd1e1a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f8.png
new file mode 100644
index 0000000000000..a5cdfccbcdaf0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f9.png
new file mode 100644
index 0000000000000..3937efe8408da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fa.png
new file mode 100644
index 0000000000000..84a51806bfe0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fc.png
new file mode 100644
index 0000000000000..e250be924b167
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fd.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fd.png
new file mode 100644
index 0000000000000..a5444fc65eb6a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ff.png
new file mode 100644
index 0000000000000..4f0c1c86789dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1e6.png
new file mode 100644
index 0000000000000..a030394274da6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e6.png
new file mode 100644
index 0000000000000..3ffe114d94804
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e7.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e7.png
new file mode 100644
index 0000000000000..e6fb3edddbc84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e9.png
new file mode 100644
index 0000000000000..c1c933e0920d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ea.png
new file mode 100644
index 0000000000000..93eaaff6925f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1eb.png
new file mode 100644
index 0000000000000..29064ff3762ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ec.png
new file mode 100644
index 0000000000000..0519f963c5584
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ed.png
new file mode 100644
index 0000000000000..28c3ec6f69308
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ee.png
new file mode 100644
index 0000000000000..7133116525ca7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ef.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ef.png
new file mode 100644
index 0000000000000..3ac1d995d17ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f1.png
new file mode 100644
index 0000000000000..aa9bb0689f016
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f2.png
new file mode 100644
index 0000000000000..13531297f2ee8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f3.png
new file mode 100644
index 0000000000000..f8612210646d7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f4.png
new file mode 100644
index 0000000000000..21c555bdd6645
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f6.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f6.png
new file mode 100644
index 0000000000000..be922b0c123bd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f7.png
new file mode 100644
index 0000000000000..642f3a520d289
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f8.png
new file mode 100644
index 0000000000000..f959101b26d33
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f9.png
new file mode 100644
index 0000000000000..ee668fb7daa7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fb.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fb.png
new file mode 100644
index 0000000000000..d3a19fdf81afa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fc.png
new file mode 100644
index 0000000000000..4aeeb130f259c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fe.png
new file mode 100644
index 0000000000000..fc2051bf7ece9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ff.png
new file mode 100644
index 0000000000000..0c23f8075a838
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e7.png b/Shared/CIPPSharp/bin/twemoji/1f1e7.png
new file mode 100644
index 0000000000000..2322e67044f53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e6.png
new file mode 100644
index 0000000000000..fe777da3f59a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e8.png
new file mode 100644
index 0000000000000..f232d7157854b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e9.png
new file mode 100644
index 0000000000000..f0855b273882a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1eb.png
new file mode 100644
index 0000000000000..18a6891661d84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ec.png
new file mode 100644
index 0000000000000..113face1559c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ed.png
new file mode 100644
index 0000000000000..bc50b99e54d05
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ee.png
new file mode 100644
index 0000000000000..e19e84b00d126
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f0.png
new file mode 100644
index 0000000000000..e5ca391482d35
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f1.png
new file mode 100644
index 0000000000000..d4d91d0655819
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f2.png
new file mode 100644
index 0000000000000..457a061631ea2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f3.png
new file mode 100644
index 0000000000000..dcc0fb1aea5a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f4.png
new file mode 100644
index 0000000000000..0d2cf35564409
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f5.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f5.png
new file mode 100644
index 0000000000000..662adc7b32505
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f6.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f6.png
new file mode 100644
index 0000000000000..5626a9fa3733f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f7.png
new file mode 100644
index 0000000000000..69b41acd29f9c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fa.png
new file mode 100644
index 0000000000000..00e3299d6d191
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fb.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fb.png
new file mode 100644
index 0000000000000..88ac363003b0f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fc.png
new file mode 100644
index 0000000000000..83a5a7d22646b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fd.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fd.png
new file mode 100644
index 0000000000000..b6f3608554877
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fe.png
new file mode 100644
index 0000000000000..5c333b07810f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ff.png
new file mode 100644
index 0000000000000..ecad9fdbb5588
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1e8.png
new file mode 100644
index 0000000000000..1683e3206ee54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ea.png
new file mode 100644
index 0000000000000..2933ab89e324d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ec.png
new file mode 100644
index 0000000000000..aee82bade8b7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ef.png b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ef.png
new file mode 100644
index 0000000000000..24602c11d19ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f0.png
new file mode 100644
index 0000000000000..095ff86cae709
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f2.png
new file mode 100644
index 0000000000000..05f78c96474e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f4.png
new file mode 100644
index 0000000000000..4cb2f4ad23177
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ff.png
new file mode 100644
index 0000000000000..8bdb882bd9601
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1e9.png
new file mode 100644
index 0000000000000..641d1641eeb8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1e6.png
new file mode 100644
index 0000000000000..fddf21a1a31de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1e8.png
new file mode 100644
index 0000000000000..05b0a2ace0135
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ea.png
new file mode 100644
index 0000000000000..94d8d464431d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ec.png
new file mode 100644
index 0000000000000..29dfd5bad8ba8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ed.png
new file mode 100644
index 0000000000000..29d07917d0dfb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f7.png
new file mode 100644
index 0000000000000..fd25d0e349174
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f8.png
new file mode 100644
index 0000000000000..5c449da194a22
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f9.png
new file mode 100644
index 0000000000000..4f4e7fc249f74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1fa.png
new file mode 100644
index 0000000000000..4f0b5d7f4f9a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1ea.png
new file mode 100644
index 0000000000000..cb6286fcc49d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1ee.png
new file mode 100644
index 0000000000000..34096f2ca1547
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1ef.png b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1ef.png
new file mode 100644
index 0000000000000..3f4c0e0624434
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f0.png
new file mode 100644
index 0000000000000..5b2ecff4e4e25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f2.png
new file mode 100644
index 0000000000000..0fc25e88f95ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f4.png
new file mode 100644
index 0000000000000..7f8e443512c75
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f7.png
new file mode 100644
index 0000000000000..662adc7b32505
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1eb-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1eb.png
new file mode 100644
index 0000000000000..6d033081a5e34
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e6.png
new file mode 100644
index 0000000000000..6f73a3793b117
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e7.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e7.png
new file mode 100644
index 0000000000000..af56765726593
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e9.png
new file mode 100644
index 0000000000000..66f160e0e7880
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ea.png
new file mode 100644
index 0000000000000..31af12832bada
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1eb.png
new file mode 100644
index 0000000000000..99ff31b2f403d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ec.png
new file mode 100644
index 0000000000000..72ac329c844be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ed.png
new file mode 100644
index 0000000000000..2b19dbdad46f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ee.png
new file mode 100644
index 0000000000000..26d4ef755e97f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f1.png
new file mode 100644
index 0000000000000..5df66b33ec981
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f2.png
new file mode 100644
index 0000000000000..4d1a3b4c12e27
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f3.png
new file mode 100644
index 0000000000000..813c3caa1f086
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f5.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f5.png
new file mode 100644
index 0000000000000..97a3dd9be7295
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f6.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f6.png
new file mode 100644
index 0000000000000..02b7aec5fd4cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f7.png
new file mode 100644
index 0000000000000..0478442a41a84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f8.png
new file mode 100644
index 0000000000000..da4bbff9c6803
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f9.png
new file mode 100644
index 0000000000000..23cec33928b02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fa.png
new file mode 100644
index 0000000000000..75c0945cfe157
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fc.png
new file mode 100644
index 0000000000000..cf8c9416c1c53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fe.png
new file mode 100644
index 0000000000000..2e102fdc8e318
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1ec.png
new file mode 100644
index 0000000000000..f9f35b9928f1c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f0.png
new file mode 100644
index 0000000000000..412b6841f8ff5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f2.png
new file mode 100644
index 0000000000000..9972434a17385
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f3.png
new file mode 100644
index 0000000000000..e1617778cb572
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f7.png
new file mode 100644
index 0000000000000..2dafc9a0925fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f9.png
new file mode 100644
index 0000000000000..afbf0287b65d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1fa.png
new file mode 100644
index 0000000000000..b2f43f77d885f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ed-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1ed.png
new file mode 100644
index 0000000000000..519a4136d38eb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1e8.png
new file mode 100644
index 0000000000000..44cb511f1b129
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1e9.png
new file mode 100644
index 0000000000000..4e8df6473797f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1ea.png
new file mode 100644
index 0000000000000..bbbeada96f24f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f1.png
new file mode 100644
index 0000000000000..6c390c3fe6fed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f2.png
new file mode 100644
index 0000000000000..99304fca91cce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f3.png
new file mode 100644
index 0000000000000..22d2bdfdeda06
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f4.png
new file mode 100644
index 0000000000000..7ef54ae2ad3c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f6.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f6.png
new file mode 100644
index 0000000000000..81de697331eaf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f7.png
new file mode 100644
index 0000000000000..5147905ec90b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f8.png
new file mode 100644
index 0000000000000..349e9efab5046
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f9.png
new file mode 100644
index 0000000000000..2cd1da785e92b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1ee.png
new file mode 100644
index 0000000000000..4a50ebe907ee6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1ea.png
new file mode 100644
index 0000000000000..bc974c12725bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f2.png
new file mode 100644
index 0000000000000..2a48a73a5e043
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f4.png
new file mode 100644
index 0000000000000..5161701b249ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f5.png b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f5.png
new file mode 100644
index 0000000000000..dd515aa06347c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ef-1f1f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ef.png b/Shared/CIPPSharp/bin/twemoji/1f1ef.png
new file mode 100644
index 0000000000000..f52052fadb9ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ea.png
new file mode 100644
index 0000000000000..468ab957ac2c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ec.png
new file mode 100644
index 0000000000000..58f07a7ba6a5e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ed.png
new file mode 100644
index 0000000000000..cf9c1a6649533
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ee.png
new file mode 100644
index 0000000000000..ee10d01349a58
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f2.png
new file mode 100644
index 0000000000000..1035f149a64ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f3.png
new file mode 100644
index 0000000000000..e021417b87fe3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f5.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f5.png
new file mode 100644
index 0000000000000..7e05f75fc60b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f7.png
new file mode 100644
index 0000000000000..8ff7ccd3ffc07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1fc.png
new file mode 100644
index 0000000000000..76f53c2f7fcae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1fe.png
new file mode 100644
index 0000000000000..158d5899b0c25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ff.png
new file mode 100644
index 0000000000000..d7e3401deff25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1f0.png
new file mode 100644
index 0000000000000..00a31cbaeda4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e6.png
new file mode 100644
index 0000000000000..44f5e8da70f37
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e7.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e7.png
new file mode 100644
index 0000000000000..f506228dd623b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e8.png
new file mode 100644
index 0000000000000..1b7e53a8594e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1ee.png
new file mode 100644
index 0000000000000..9a69e9a0481ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f0.png
new file mode 100644
index 0000000000000..8f8d0b3aea806
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f7.png
new file mode 100644
index 0000000000000..8ed6a5a87778e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f8.png
new file mode 100644
index 0000000000000..051b53ab12ae2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f9.png
new file mode 100644
index 0000000000000..69de64e8b1d24
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fa.png
new file mode 100644
index 0000000000000..d7a507d075dca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fb.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fb.png
new file mode 100644
index 0000000000000..5505550928d02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fe.png
new file mode 100644
index 0000000000000..426e9319db6fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1f1.png
new file mode 100644
index 0000000000000..50ba60466f73b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e6.png
new file mode 100644
index 0000000000000..49d5f2f712618
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e8.png
new file mode 100644
index 0000000000000..cc71565d444ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e9.png
new file mode 100644
index 0000000000000..72ab452b4cd68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ea.png
new file mode 100644
index 0000000000000..ed5d0c4198232
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1eb.png
new file mode 100644
index 0000000000000..662adc7b32505
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ec.png
new file mode 100644
index 0000000000000..460babaa5d178
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ed.png
new file mode 100644
index 0000000000000..6b69a8d551a4b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f0.png
new file mode 100644
index 0000000000000..9db397c936869
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f1.png
new file mode 100644
index 0000000000000..d7db7397c124d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f2.png
new file mode 100644
index 0000000000000..d4b642c32775e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f3.png
new file mode 100644
index 0000000000000..7f2225c80b3d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f4.png
new file mode 100644
index 0000000000000..2fe5c8cb83979
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f5.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f5.png
new file mode 100644
index 0000000000000..c9d6d57f641f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f6.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f6.png
new file mode 100644
index 0000000000000..aa46f114c2876
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f7.png
new file mode 100644
index 0000000000000..e9767976cf747
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f8.png
new file mode 100644
index 0000000000000..fd6b759a34e18
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f9.png
new file mode 100644
index 0000000000000..9265b06e1a9ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fa.png
new file mode 100644
index 0000000000000..b48e01b4bbe09
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fb.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fb.png
new file mode 100644
index 0000000000000..c666d7ae6dbe4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fc.png
new file mode 100644
index 0000000000000..e58fe389c8d5f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fd.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fd.png
new file mode 100644
index 0000000000000..61775bf729950
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fe.png
new file mode 100644
index 0000000000000..ee84ec4d6c402
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ff.png
new file mode 100644
index 0000000000000..1a33e0c69efc8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1f2.png
new file mode 100644
index 0000000000000..2539dab47554b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1e6.png
new file mode 100644
index 0000000000000..860139dede408
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1e8.png
new file mode 100644
index 0000000000000..81fa763884616
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ea.png
new file mode 100644
index 0000000000000..1f1dc36221626
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1eb.png
new file mode 100644
index 0000000000000..599da68e6be7d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ec.png
new file mode 100644
index 0000000000000..6cbb424d3d1ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ee.png
new file mode 100644
index 0000000000000..3f14038212ea4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f1.png
new file mode 100644
index 0000000000000..619bf8ce11254
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f4.png
new file mode 100644
index 0000000000000..d75873518c27f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f5.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f5.png
new file mode 100644
index 0000000000000..48acf5f2b79b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f7.png
new file mode 100644
index 0000000000000..1748da9caba2f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1fa.png
new file mode 100644
index 0000000000000..9bd5ec1adafd9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ff.png
new file mode 100644
index 0000000000000..0d193b32693b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1f3.png
new file mode 100644
index 0000000000000..11a883c397cb1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f4-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1f4-1f1f2.png
new file mode 100644
index 0000000000000..41176aa0de965
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f4-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1f4.png
new file mode 100644
index 0000000000000..71ff5a54b282b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1e6.png
new file mode 100644
index 0000000000000..617422984c9b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ea.png
new file mode 100644
index 0000000000000..f7e54091a983c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1eb.png
new file mode 100644
index 0000000000000..f89b75574438b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ec.png
new file mode 100644
index 0000000000000..d75762c30a971
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ed.png
new file mode 100644
index 0000000000000..a0adbef2cffe9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f0.png
new file mode 100644
index 0000000000000..311ca9a14a7b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f1.png
new file mode 100644
index 0000000000000..8d6921db8d190
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f2.png
new file mode 100644
index 0000000000000..357a8631468cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f3.png
new file mode 100644
index 0000000000000..a7ced0f12c2c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f7.png
new file mode 100644
index 0000000000000..867df29d2089c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f8.png
new file mode 100644
index 0000000000000..9756c0427d398
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f9.png
new file mode 100644
index 0000000000000..c359291bd22f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1fc.png
new file mode 100644
index 0000000000000..8a7aea6a9df2e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1fe.png
new file mode 100644
index 0000000000000..8bc9da32bd50c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f5.png b/Shared/CIPPSharp/bin/twemoji/1f1f5.png
new file mode 100644
index 0000000000000..70f7afe0a66e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f6-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1f6-1f1e6.png
new file mode 100644
index 0000000000000..363099051c317
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f6-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f6.png b/Shared/CIPPSharp/bin/twemoji/1f1f6.png
new file mode 100644
index 0000000000000..2628efd2255f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1ea.png
new file mode 100644
index 0000000000000..8010d88dd741b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1f4.png
new file mode 100644
index 0000000000000..ce8f8e86bc3cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1f8.png
new file mode 100644
index 0000000000000..0485b8639a0e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1fa.png
new file mode 100644
index 0000000000000..9af1cb845ec3c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1fc.png
new file mode 100644
index 0000000000000..2802d1a2d7366
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f7-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f7.png
new file mode 100644
index 0000000000000..ecb868c0a1b83
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e6.png
new file mode 100644
index 0000000000000..5f90f43d4ba65
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e7.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e7.png
new file mode 100644
index 0000000000000..385dbaae36d17
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e8.png
new file mode 100644
index 0000000000000..908f6b88e62f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e9.png
new file mode 100644
index 0000000000000..5ef2fd9a6ea04
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ea.png
new file mode 100644
index 0000000000000..2cf2258713574
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ec.png
new file mode 100644
index 0000000000000..454b82a0791c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ed.png
new file mode 100644
index 0000000000000..2d0df5102e761
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ee.png
new file mode 100644
index 0000000000000..86bffaf3135d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ef.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ef.png
new file mode 100644
index 0000000000000..d75873518c27f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f0.png
new file mode 100644
index 0000000000000..276c387e03fe4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f1.png
new file mode 100644
index 0000000000000..de88763d0d2a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f2.png
new file mode 100644
index 0000000000000..ddecba8b9ee0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f3.png
new file mode 100644
index 0000000000000..843bda4187ddd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f4.png
new file mode 100644
index 0000000000000..a4c573da18dde
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f7.png
new file mode 100644
index 0000000000000..77cd1d3bec6c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f8.png
new file mode 100644
index 0000000000000..9cbf721edb790
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f9.png
new file mode 100644
index 0000000000000..f209bcde4d5a8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fb.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fb.png
new file mode 100644
index 0000000000000..333063f39e938
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fd.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fd.png
new file mode 100644
index 0000000000000..72401f5fcd821
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fe.png
new file mode 100644
index 0000000000000..877225169fb68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ff.png
new file mode 100644
index 0000000000000..0cf3fb1d7379e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1f8.png
new file mode 100644
index 0000000000000..7a38fb9fc0b14
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e6.png
new file mode 100644
index 0000000000000..15e4c3e159df9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e8.png
new file mode 100644
index 0000000000000..d3da08b9c7fb0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e9.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e9.png
new file mode 100644
index 0000000000000..77184f4d0600a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1eb.png
new file mode 100644
index 0000000000000..2c17f5e70ac71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ec.png
new file mode 100644
index 0000000000000..d9b238aa189bd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ed.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ed.png
new file mode 100644
index 0000000000000..902f55cabace9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ef.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ef.png
new file mode 100644
index 0000000000000..2fc5e4e9b543c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f0.png
new file mode 100644
index 0000000000000..122903dfe2717
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f1.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f1.png
new file mode 100644
index 0000000000000..2f69d8d3f781b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f2.png
new file mode 100644
index 0000000000000..8e6fbb11c5467
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f3.png
new file mode 100644
index 0000000000000..0838b9330d6f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f4.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f4.png
new file mode 100644
index 0000000000000..6a680b1171e72
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f7.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f7.png
new file mode 100644
index 0000000000000..a80ec23d64af0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f9.png
new file mode 100644
index 0000000000000..7052a392b70e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1fb.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1fb.png
new file mode 100644
index 0000000000000..44880afa7b570
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1fc.png
new file mode 100644
index 0000000000000..d5d14aed27627
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ff.png
new file mode 100644
index 0000000000000..87c990d625167
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1f9.png
new file mode 100644
index 0000000000000..a3faa0db6da35
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1e6.png
new file mode 100644
index 0000000000000..81db6c222ef5d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1ec.png
new file mode 100644
index 0000000000000..f560449896302
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f2.png
new file mode 100644
index 0000000000000..6d18cb7088ce6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f3.png
new file mode 100644
index 0000000000000..ea7fc4c7d7aff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f8.png
new file mode 100644
index 0000000000000..0ba064250ea04
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1fe.png
new file mode 100644
index 0000000000000..aa981ca3815f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1ff.png
new file mode 100644
index 0000000000000..ae196dd4594b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa-1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1fa.png
new file mode 100644
index 0000000000000..95651c65e4b20
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1e6.png
new file mode 100644
index 0000000000000..f0fe36f9ad91e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1e8.png b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1e8.png
new file mode 100644
index 0000000000000..234bf65ada557
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ea.png
new file mode 100644
index 0000000000000..70a249fec65e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ec.png b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ec.png
new file mode 100644
index 0000000000000..72017181c943b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ee.png b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ee.png
new file mode 100644
index 0000000000000..0feb6aebed1c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1f3.png b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1f3.png
new file mode 100644
index 0000000000000..5282bd4343c50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1fa.png b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1fa.png
new file mode 100644
index 0000000000000..6047a7bf46615
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb-1f1fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fb.png b/Shared/CIPPSharp/bin/twemoji/1f1fb.png
new file mode 100644
index 0000000000000..f431931f67851
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fc-1f1eb.png b/Shared/CIPPSharp/bin/twemoji/1f1fc-1f1eb.png
new file mode 100644
index 0000000000000..15746dad014e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fc-1f1eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fc-1f1f8.png b/Shared/CIPPSharp/bin/twemoji/1f1fc-1f1f8.png
new file mode 100644
index 0000000000000..5356f6d468b0b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fc-1f1f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1fc.png
new file mode 100644
index 0000000000000..b9c56ae2ef82c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fd-1f1f0.png b/Shared/CIPPSharp/bin/twemoji/1f1fd-1f1f0.png
new file mode 100644
index 0000000000000..043e9b514db92
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fd-1f1f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fd.png b/Shared/CIPPSharp/bin/twemoji/1f1fd.png
new file mode 100644
index 0000000000000..328a53365fb82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fe-1f1ea.png b/Shared/CIPPSharp/bin/twemoji/1f1fe-1f1ea.png
new file mode 100644
index 0000000000000..e858bb2c19363
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fe-1f1ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fe-1f1f9.png b/Shared/CIPPSharp/bin/twemoji/1f1fe-1f1f9.png
new file mode 100644
index 0000000000000..642b133c08900
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fe-1f1f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1fe.png b/Shared/CIPPSharp/bin/twemoji/1f1fe.png
new file mode 100644
index 0000000000000..a1518ab3fa44c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1e6.png b/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1e6.png
new file mode 100644
index 0000000000000..4535007787dda
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1f2.png b/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1f2.png
new file mode 100644
index 0000000000000..6283325081029
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1fc.png b/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1fc.png
new file mode 100644
index 0000000000000..d87fd6ac15e53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ff-1f1fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f1ff.png b/Shared/CIPPSharp/bin/twemoji/1f1ff.png
new file mode 100644
index 0000000000000..090d1bc408100
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f1ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f201.png b/Shared/CIPPSharp/bin/twemoji/1f201.png
new file mode 100644
index 0000000000000..31952eaf9e81e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f201.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f202.png b/Shared/CIPPSharp/bin/twemoji/1f202.png
new file mode 100644
index 0000000000000..d12881eda2af7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f202.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f21a.png b/Shared/CIPPSharp/bin/twemoji/1f21a.png
new file mode 100644
index 0000000000000..671699d6fefa1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f21a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f22f.png b/Shared/CIPPSharp/bin/twemoji/1f22f.png
new file mode 100644
index 0000000000000..b07ad0826a0b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f22f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f232.png b/Shared/CIPPSharp/bin/twemoji/1f232.png
new file mode 100644
index 0000000000000..37ad941cf460c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f232.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f233.png b/Shared/CIPPSharp/bin/twemoji/1f233.png
new file mode 100644
index 0000000000000..9dc7c35f14d85
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f233.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f234.png b/Shared/CIPPSharp/bin/twemoji/1f234.png
new file mode 100644
index 0000000000000..5217963f44e6c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f234.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f235.png b/Shared/CIPPSharp/bin/twemoji/1f235.png
new file mode 100644
index 0000000000000..2ef4e02c813cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f235.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f236.png b/Shared/CIPPSharp/bin/twemoji/1f236.png
new file mode 100644
index 0000000000000..503ca0f3114a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f236.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f237.png b/Shared/CIPPSharp/bin/twemoji/1f237.png
new file mode 100644
index 0000000000000..a8a13729c4377
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f237.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f238.png b/Shared/CIPPSharp/bin/twemoji/1f238.png
new file mode 100644
index 0000000000000..c85c702091aab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f238.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f239.png b/Shared/CIPPSharp/bin/twemoji/1f239.png
new file mode 100644
index 0000000000000..338aded4e92ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f239.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f23a.png b/Shared/CIPPSharp/bin/twemoji/1f23a.png
new file mode 100644
index 0000000000000..de3f1aa9083aa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f23a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f250.png b/Shared/CIPPSharp/bin/twemoji/1f250.png
new file mode 100644
index 0000000000000..be414e9e1cbcc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f250.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f251.png b/Shared/CIPPSharp/bin/twemoji/1f251.png
new file mode 100644
index 0000000000000..bc0802fcc43ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f251.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f300.png b/Shared/CIPPSharp/bin/twemoji/1f300.png
new file mode 100644
index 0000000000000..12726261ee738
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f300.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f301.png b/Shared/CIPPSharp/bin/twemoji/1f301.png
new file mode 100644
index 0000000000000..aef27ad589570
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f301.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f302.png b/Shared/CIPPSharp/bin/twemoji/1f302.png
new file mode 100644
index 0000000000000..803de0a38c0a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f302.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f303.png b/Shared/CIPPSharp/bin/twemoji/1f303.png
new file mode 100644
index 0000000000000..8eb0c12b662af
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f303.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f304.png b/Shared/CIPPSharp/bin/twemoji/1f304.png
new file mode 100644
index 0000000000000..ab061858b849e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f304.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f305.png b/Shared/CIPPSharp/bin/twemoji/1f305.png
new file mode 100644
index 0000000000000..eda7cbee49826
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f305.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f306.png b/Shared/CIPPSharp/bin/twemoji/1f306.png
new file mode 100644
index 0000000000000..768e2d22d9501
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f306.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f307.png b/Shared/CIPPSharp/bin/twemoji/1f307.png
new file mode 100644
index 0000000000000..f0cc2745d8e91
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f307.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f308.png b/Shared/CIPPSharp/bin/twemoji/1f308.png
new file mode 100644
index 0000000000000..9952a393eb2ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f308.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f309.png b/Shared/CIPPSharp/bin/twemoji/1f309.png
new file mode 100644
index 0000000000000..8e1d3a50c43d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f309.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f30a.png b/Shared/CIPPSharp/bin/twemoji/1f30a.png
new file mode 100644
index 0000000000000..f29f044ed55da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f30a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f30b.png b/Shared/CIPPSharp/bin/twemoji/1f30b.png
new file mode 100644
index 0000000000000..4c220af1d8514
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f30b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f30c.png b/Shared/CIPPSharp/bin/twemoji/1f30c.png
new file mode 100644
index 0000000000000..9c3f134ad6807
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f30c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f30d.png b/Shared/CIPPSharp/bin/twemoji/1f30d.png
new file mode 100644
index 0000000000000..b5f62c3310f7a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f30d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f30e.png b/Shared/CIPPSharp/bin/twemoji/1f30e.png
new file mode 100644
index 0000000000000..d74ff449d5930
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f30e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f30f.png b/Shared/CIPPSharp/bin/twemoji/1f30f.png
new file mode 100644
index 0000000000000..66c4bed3c37c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f30f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f310.png b/Shared/CIPPSharp/bin/twemoji/1f310.png
new file mode 100644
index 0000000000000..faf027d8d1b0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f310.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f311.png b/Shared/CIPPSharp/bin/twemoji/1f311.png
new file mode 100644
index 0000000000000..b4be1870e096e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f311.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f312.png b/Shared/CIPPSharp/bin/twemoji/1f312.png
new file mode 100644
index 0000000000000..1f2d7a1df12ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f312.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f313.png b/Shared/CIPPSharp/bin/twemoji/1f313.png
new file mode 100644
index 0000000000000..2e4ee20bb381a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f313.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f314.png b/Shared/CIPPSharp/bin/twemoji/1f314.png
new file mode 100644
index 0000000000000..63dda718aeef3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f314.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f315.png b/Shared/CIPPSharp/bin/twemoji/1f315.png
new file mode 100644
index 0000000000000..b7aea1a0307ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f315.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f316.png b/Shared/CIPPSharp/bin/twemoji/1f316.png
new file mode 100644
index 0000000000000..3d08d8dba7d4e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f316.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f317.png b/Shared/CIPPSharp/bin/twemoji/1f317.png
new file mode 100644
index 0000000000000..fb799d0353853
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f317.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f318.png b/Shared/CIPPSharp/bin/twemoji/1f318.png
new file mode 100644
index 0000000000000..d16ee12ac2b21
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f318.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f319.png b/Shared/CIPPSharp/bin/twemoji/1f319.png
new file mode 100644
index 0000000000000..51c101ff962c3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f319.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f31a.png b/Shared/CIPPSharp/bin/twemoji/1f31a.png
new file mode 100644
index 0000000000000..e5857351e5047
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f31a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f31b.png b/Shared/CIPPSharp/bin/twemoji/1f31b.png
new file mode 100644
index 0000000000000..2d974fda649c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f31b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f31c.png b/Shared/CIPPSharp/bin/twemoji/1f31c.png
new file mode 100644
index 0000000000000..9538a024c2f3f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f31c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f31d.png b/Shared/CIPPSharp/bin/twemoji/1f31d.png
new file mode 100644
index 0000000000000..02ceca4380465
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f31d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f31e.png b/Shared/CIPPSharp/bin/twemoji/1f31e.png
new file mode 100644
index 0000000000000..4a928c085ea9a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f31e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f31f.png b/Shared/CIPPSharp/bin/twemoji/1f31f.png
new file mode 100644
index 0000000000000..3d5fce4a43149
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f31f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f320.png b/Shared/CIPPSharp/bin/twemoji/1f320.png
new file mode 100644
index 0000000000000..7a97429ff7316
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f320.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f321.png b/Shared/CIPPSharp/bin/twemoji/1f321.png
new file mode 100644
index 0000000000000..ea557a7fd0a55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f321.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f324.png b/Shared/CIPPSharp/bin/twemoji/1f324.png
new file mode 100644
index 0000000000000..61c53ff910853
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f324.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f325.png b/Shared/CIPPSharp/bin/twemoji/1f325.png
new file mode 100644
index 0000000000000..93a39d508369c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f325.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f326.png b/Shared/CIPPSharp/bin/twemoji/1f326.png
new file mode 100644
index 0000000000000..e0ebf7437d788
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f326.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f327.png b/Shared/CIPPSharp/bin/twemoji/1f327.png
new file mode 100644
index 0000000000000..950061b3597c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f327.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f328.png b/Shared/CIPPSharp/bin/twemoji/1f328.png
new file mode 100644
index 0000000000000..51f7b80cc7108
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f328.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f329.png b/Shared/CIPPSharp/bin/twemoji/1f329.png
new file mode 100644
index 0000000000000..0d6a16b34491f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f329.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f32a.png b/Shared/CIPPSharp/bin/twemoji/1f32a.png
new file mode 100644
index 0000000000000..1f304d4d111c3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f32a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f32b.png b/Shared/CIPPSharp/bin/twemoji/1f32b.png
new file mode 100644
index 0000000000000..a51e486b3390d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f32b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f32c.png b/Shared/CIPPSharp/bin/twemoji/1f32c.png
new file mode 100644
index 0000000000000..89a0f5c8754e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f32c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f32d.png b/Shared/CIPPSharp/bin/twemoji/1f32d.png
new file mode 100644
index 0000000000000..ef0758877e3d6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f32d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f32e.png b/Shared/CIPPSharp/bin/twemoji/1f32e.png
new file mode 100644
index 0000000000000..4080bd101418a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f32e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f32f.png b/Shared/CIPPSharp/bin/twemoji/1f32f.png
new file mode 100644
index 0000000000000..6e2327063ab4b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f32f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f330.png b/Shared/CIPPSharp/bin/twemoji/1f330.png
new file mode 100644
index 0000000000000..06ce776154e31
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f330.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f331.png b/Shared/CIPPSharp/bin/twemoji/1f331.png
new file mode 100644
index 0000000000000..57aaddb55cb56
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f331.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f332.png b/Shared/CIPPSharp/bin/twemoji/1f332.png
new file mode 100644
index 0000000000000..f9ca66ff0a59d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f332.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f333.png b/Shared/CIPPSharp/bin/twemoji/1f333.png
new file mode 100644
index 0000000000000..0d51f232e34f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f333.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f334.png b/Shared/CIPPSharp/bin/twemoji/1f334.png
new file mode 100644
index 0000000000000..325ed94d16d3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f334.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f335.png b/Shared/CIPPSharp/bin/twemoji/1f335.png
new file mode 100644
index 0000000000000..76c5096d17bf2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f335.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f336.png b/Shared/CIPPSharp/bin/twemoji/1f336.png
new file mode 100644
index 0000000000000..b0e51a9d28fcf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f336.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f337.png b/Shared/CIPPSharp/bin/twemoji/1f337.png
new file mode 100644
index 0000000000000..a0b89f798638c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f337.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f338.png b/Shared/CIPPSharp/bin/twemoji/1f338.png
new file mode 100644
index 0000000000000..3983b94fb242a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f338.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f339.png b/Shared/CIPPSharp/bin/twemoji/1f339.png
new file mode 100644
index 0000000000000..27608f3e61d5f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f339.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f33a.png b/Shared/CIPPSharp/bin/twemoji/1f33a.png
new file mode 100644
index 0000000000000..955d1f1c685e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f33a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f33b.png b/Shared/CIPPSharp/bin/twemoji/1f33b.png
new file mode 100644
index 0000000000000..7770c79ae2e24
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f33b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f33c.png b/Shared/CIPPSharp/bin/twemoji/1f33c.png
new file mode 100644
index 0000000000000..12f5ce461f3f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f33c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f33d.png b/Shared/CIPPSharp/bin/twemoji/1f33d.png
new file mode 100644
index 0000000000000..5f1d62b10a8b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f33d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f33e.png
new file mode 100644
index 0000000000000..5899de351b741
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f33f.png b/Shared/CIPPSharp/bin/twemoji/1f33f.png
new file mode 100644
index 0000000000000..72a53fe94df84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f33f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f340.png b/Shared/CIPPSharp/bin/twemoji/1f340.png
new file mode 100644
index 0000000000000..265e245a963d0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f340.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f341.png b/Shared/CIPPSharp/bin/twemoji/1f341.png
new file mode 100644
index 0000000000000..3eadf4bcfa0b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f341.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f342.png b/Shared/CIPPSharp/bin/twemoji/1f342.png
new file mode 100644
index 0000000000000..dcdc17b80d6de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f342.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f343.png b/Shared/CIPPSharp/bin/twemoji/1f343.png
new file mode 100644
index 0000000000000..51abe6c6abdcb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f343.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f344-200d-1f7eb.png b/Shared/CIPPSharp/bin/twemoji/1f344-200d-1f7eb.png
new file mode 100644
index 0000000000000..686fc42bb0e82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f344-200d-1f7eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f344.png b/Shared/CIPPSharp/bin/twemoji/1f344.png
new file mode 100644
index 0000000000000..80402a0cc1101
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f344.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f345.png b/Shared/CIPPSharp/bin/twemoji/1f345.png
new file mode 100644
index 0000000000000..93eaaae6ef4e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f345.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f346.png b/Shared/CIPPSharp/bin/twemoji/1f346.png
new file mode 100644
index 0000000000000..83f1ffabd32b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f346.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f347.png b/Shared/CIPPSharp/bin/twemoji/1f347.png
new file mode 100644
index 0000000000000..c5f99b4d8f9ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f347.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f348.png b/Shared/CIPPSharp/bin/twemoji/1f348.png
new file mode 100644
index 0000000000000..8072ee1eb7326
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f348.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f349.png b/Shared/CIPPSharp/bin/twemoji/1f349.png
new file mode 100644
index 0000000000000..9c23902148428
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f349.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f34a.png b/Shared/CIPPSharp/bin/twemoji/1f34a.png
new file mode 100644
index 0000000000000..bb250acc926ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f34a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f34b-200d-1f7e9.png b/Shared/CIPPSharp/bin/twemoji/1f34b-200d-1f7e9.png
new file mode 100644
index 0000000000000..9274d36cea7a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f34b-200d-1f7e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f34b.png b/Shared/CIPPSharp/bin/twemoji/1f34b.png
new file mode 100644
index 0000000000000..78b6f953d0e8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f34b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f34c.png b/Shared/CIPPSharp/bin/twemoji/1f34c.png
new file mode 100644
index 0000000000000..9a0f2c5731ecd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f34c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f34d.png b/Shared/CIPPSharp/bin/twemoji/1f34d.png
new file mode 100644
index 0000000000000..949edeab1f2d6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f34d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f34e.png b/Shared/CIPPSharp/bin/twemoji/1f34e.png
new file mode 100644
index 0000000000000..a5c4892329caf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f34e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f34f.png b/Shared/CIPPSharp/bin/twemoji/1f34f.png
new file mode 100644
index 0000000000000..ac7be3e39f65d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f34f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f350.png b/Shared/CIPPSharp/bin/twemoji/1f350.png
new file mode 100644
index 0000000000000..0f578599be414
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f350.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f351.png b/Shared/CIPPSharp/bin/twemoji/1f351.png
new file mode 100644
index 0000000000000..32e026cb1afa5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f351.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f352.png b/Shared/CIPPSharp/bin/twemoji/1f352.png
new file mode 100644
index 0000000000000..ecd2e564aff9e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f352.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f353.png b/Shared/CIPPSharp/bin/twemoji/1f353.png
new file mode 100644
index 0000000000000..ac2454a4c610f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f353.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f354.png b/Shared/CIPPSharp/bin/twemoji/1f354.png
new file mode 100644
index 0000000000000..c6e7e93b5655b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f354.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f355.png b/Shared/CIPPSharp/bin/twemoji/1f355.png
new file mode 100644
index 0000000000000..eaefc58a9faeb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f355.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f356.png b/Shared/CIPPSharp/bin/twemoji/1f356.png
new file mode 100644
index 0000000000000..7fd839b48a882
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f356.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f357.png b/Shared/CIPPSharp/bin/twemoji/1f357.png
new file mode 100644
index 0000000000000..a32c8a6af483a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f357.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f358.png b/Shared/CIPPSharp/bin/twemoji/1f358.png
new file mode 100644
index 0000000000000..e4cd7588a2e13
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f358.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f359.png b/Shared/CIPPSharp/bin/twemoji/1f359.png
new file mode 100644
index 0000000000000..d294d1175590c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f359.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f35a.png b/Shared/CIPPSharp/bin/twemoji/1f35a.png
new file mode 100644
index 0000000000000..a0ff523cec934
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f35a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f35b.png b/Shared/CIPPSharp/bin/twemoji/1f35b.png
new file mode 100644
index 0000000000000..0826dca835aca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f35b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f35c.png b/Shared/CIPPSharp/bin/twemoji/1f35c.png
new file mode 100644
index 0000000000000..cc6233e3360b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f35c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f35d.png b/Shared/CIPPSharp/bin/twemoji/1f35d.png
new file mode 100644
index 0000000000000..d03a14d2a4127
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f35d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f35e.png b/Shared/CIPPSharp/bin/twemoji/1f35e.png
new file mode 100644
index 0000000000000..04dd14e8ad94d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f35e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f35f.png b/Shared/CIPPSharp/bin/twemoji/1f35f.png
new file mode 100644
index 0000000000000..b61e6bc73aecb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f35f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f360.png b/Shared/CIPPSharp/bin/twemoji/1f360.png
new file mode 100644
index 0000000000000..9efde9879b814
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f360.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f361.png b/Shared/CIPPSharp/bin/twemoji/1f361.png
new file mode 100644
index 0000000000000..90c6fa1d0e074
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f361.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f362.png b/Shared/CIPPSharp/bin/twemoji/1f362.png
new file mode 100644
index 0000000000000..db1343958b9ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f362.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f363.png b/Shared/CIPPSharp/bin/twemoji/1f363.png
new file mode 100644
index 0000000000000..5c703ff7c76af
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f363.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f364.png b/Shared/CIPPSharp/bin/twemoji/1f364.png
new file mode 100644
index 0000000000000..b1797f11f5945
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f364.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f365.png b/Shared/CIPPSharp/bin/twemoji/1f365.png
new file mode 100644
index 0000000000000..b98a7419caeb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f365.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f366.png b/Shared/CIPPSharp/bin/twemoji/1f366.png
new file mode 100644
index 0000000000000..b1ac28633337d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f366.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f367.png b/Shared/CIPPSharp/bin/twemoji/1f367.png
new file mode 100644
index 0000000000000..70860c53a8915
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f367.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f368.png b/Shared/CIPPSharp/bin/twemoji/1f368.png
new file mode 100644
index 0000000000000..f142b35f99990
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f368.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f369.png b/Shared/CIPPSharp/bin/twemoji/1f369.png
new file mode 100644
index 0000000000000..647f504a6932a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f369.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f36a.png b/Shared/CIPPSharp/bin/twemoji/1f36a.png
new file mode 100644
index 0000000000000..074da613082b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f36a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f36b.png b/Shared/CIPPSharp/bin/twemoji/1f36b.png
new file mode 100644
index 0000000000000..2f7e59bbbd5e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f36b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f36c.png b/Shared/CIPPSharp/bin/twemoji/1f36c.png
new file mode 100644
index 0000000000000..de50bdd580677
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f36c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f36d.png b/Shared/CIPPSharp/bin/twemoji/1f36d.png
new file mode 100644
index 0000000000000..d87f8e1f4f6d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f36d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f36e.png b/Shared/CIPPSharp/bin/twemoji/1f36e.png
new file mode 100644
index 0000000000000..50a3ef8bfcd5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f36e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f36f.png b/Shared/CIPPSharp/bin/twemoji/1f36f.png
new file mode 100644
index 0000000000000..8b283f880b30b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f36f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f370.png b/Shared/CIPPSharp/bin/twemoji/1f370.png
new file mode 100644
index 0000000000000..f9b848bec093b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f370.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f371.png b/Shared/CIPPSharp/bin/twemoji/1f371.png
new file mode 100644
index 0000000000000..fde795df59e0c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f371.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f372.png b/Shared/CIPPSharp/bin/twemoji/1f372.png
new file mode 100644
index 0000000000000..22775a2c2f4fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f372.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f373.png b/Shared/CIPPSharp/bin/twemoji/1f373.png
new file mode 100644
index 0000000000000..6fba00ca3e982
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f374.png b/Shared/CIPPSharp/bin/twemoji/1f374.png
new file mode 100644
index 0000000000000..1e8b70d3046dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f374.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f375.png b/Shared/CIPPSharp/bin/twemoji/1f375.png
new file mode 100644
index 0000000000000..3cd74cd95d0f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f375.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f376.png b/Shared/CIPPSharp/bin/twemoji/1f376.png
new file mode 100644
index 0000000000000..db30dd22017c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f376.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f377.png b/Shared/CIPPSharp/bin/twemoji/1f377.png
new file mode 100644
index 0000000000000..94d9830518d73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f377.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f378.png b/Shared/CIPPSharp/bin/twemoji/1f378.png
new file mode 100644
index 0000000000000..d6e4c8da5ff8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f378.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f379.png b/Shared/CIPPSharp/bin/twemoji/1f379.png
new file mode 100644
index 0000000000000..40f93365e274e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f379.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f37a.png b/Shared/CIPPSharp/bin/twemoji/1f37a.png
new file mode 100644
index 0000000000000..80de88052b8cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f37a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f37b.png b/Shared/CIPPSharp/bin/twemoji/1f37b.png
new file mode 100644
index 0000000000000..ad7800d64b419
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f37b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f37c.png
new file mode 100644
index 0000000000000..4493e2b56b5ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f37d.png b/Shared/CIPPSharp/bin/twemoji/1f37d.png
new file mode 100644
index 0000000000000..191c4e41a55fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f37d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f37e.png b/Shared/CIPPSharp/bin/twemoji/1f37e.png
new file mode 100644
index 0000000000000..2342f1bdec175
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f37e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f37f.png b/Shared/CIPPSharp/bin/twemoji/1f37f.png
new file mode 100644
index 0000000000000..7708b1f109db8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f37f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f380.png b/Shared/CIPPSharp/bin/twemoji/1f380.png
new file mode 100644
index 0000000000000..3b6663d918dd5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f380.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f381.png b/Shared/CIPPSharp/bin/twemoji/1f381.png
new file mode 100644
index 0000000000000..af0b07e48b048
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f381.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f382.png b/Shared/CIPPSharp/bin/twemoji/1f382.png
new file mode 100644
index 0000000000000..54a6232020414
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f382.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f383.png b/Shared/CIPPSharp/bin/twemoji/1f383.png
new file mode 100644
index 0000000000000..3e68cb5290750
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f383.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f384.png b/Shared/CIPPSharp/bin/twemoji/1f384.png
new file mode 100644
index 0000000000000..9e3e83a853f09
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f385-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fb.png
new file mode 100644
index 0000000000000..ae26f1ffc0ad5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f385-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fc.png
new file mode 100644
index 0000000000000..ae1e9a8eeff50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f385-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fd.png
new file mode 100644
index 0000000000000..3cd9a5135178d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f385-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fe.png
new file mode 100644
index 0000000000000..bbb8796fdbd58
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f385-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f385-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f385-1f3ff.png
new file mode 100644
index 0000000000000..1432544fc2c5f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f385-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f385.png b/Shared/CIPPSharp/bin/twemoji/1f385.png
new file mode 100644
index 0000000000000..44e75755f2198
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f385.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f386.png b/Shared/CIPPSharp/bin/twemoji/1f386.png
new file mode 100644
index 0000000000000..68d7bf45cb4f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f386.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f387.png b/Shared/CIPPSharp/bin/twemoji/1f387.png
new file mode 100644
index 0000000000000..bfc84671ca49d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f387.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f388.png b/Shared/CIPPSharp/bin/twemoji/1f388.png
new file mode 100644
index 0000000000000..f003fbea2ec8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f388.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f389.png b/Shared/CIPPSharp/bin/twemoji/1f389.png
new file mode 100644
index 0000000000000..863661cd75397
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f389.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f38a.png b/Shared/CIPPSharp/bin/twemoji/1f38a.png
new file mode 100644
index 0000000000000..234935a7ada76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f38a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f38b.png b/Shared/CIPPSharp/bin/twemoji/1f38b.png
new file mode 100644
index 0000000000000..8fe41cf130956
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f38b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f38c.png b/Shared/CIPPSharp/bin/twemoji/1f38c.png
new file mode 100644
index 0000000000000..e65ed9a0f6361
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f38c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f38d.png b/Shared/CIPPSharp/bin/twemoji/1f38d.png
new file mode 100644
index 0000000000000..df1fec8f64205
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f38d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f38e.png b/Shared/CIPPSharp/bin/twemoji/1f38e.png
new file mode 100644
index 0000000000000..d026c999891c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f38e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f38f.png b/Shared/CIPPSharp/bin/twemoji/1f38f.png
new file mode 100644
index 0000000000000..4371ba79e9713
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f38f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f390.png b/Shared/CIPPSharp/bin/twemoji/1f390.png
new file mode 100644
index 0000000000000..78b2db1878e40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f390.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f391.png b/Shared/CIPPSharp/bin/twemoji/1f391.png
new file mode 100644
index 0000000000000..a2dfd88db1c89
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f391.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f392.png b/Shared/CIPPSharp/bin/twemoji/1f392.png
new file mode 100644
index 0000000000000..c064023730657
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f392.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f393.png b/Shared/CIPPSharp/bin/twemoji/1f393.png
new file mode 100644
index 0000000000000..09d4757afc88a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f396.png b/Shared/CIPPSharp/bin/twemoji/1f396.png
new file mode 100644
index 0000000000000..42a8e1f92f822
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f396.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f397.png b/Shared/CIPPSharp/bin/twemoji/1f397.png
new file mode 100644
index 0000000000000..b40fb3fd3b165
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f397.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f399.png b/Shared/CIPPSharp/bin/twemoji/1f399.png
new file mode 100644
index 0000000000000..1af0e3a7a5ef4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f399.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f39a.png b/Shared/CIPPSharp/bin/twemoji/1f39a.png
new file mode 100644
index 0000000000000..9b013eed6a05d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f39a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f39b.png b/Shared/CIPPSharp/bin/twemoji/1f39b.png
new file mode 100644
index 0000000000000..deeeec9307b66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f39b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f39e.png b/Shared/CIPPSharp/bin/twemoji/1f39e.png
new file mode 100644
index 0000000000000..431b759e643fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f39e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f39f.png b/Shared/CIPPSharp/bin/twemoji/1f39f.png
new file mode 100644
index 0000000000000..d79c8e5d475dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f39f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a0.png b/Shared/CIPPSharp/bin/twemoji/1f3a0.png
new file mode 100644
index 0000000000000..41fb66baaa99c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a1.png b/Shared/CIPPSharp/bin/twemoji/1f3a1.png
new file mode 100644
index 0000000000000..ea4a06a5800ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a2.png b/Shared/CIPPSharp/bin/twemoji/1f3a2.png
new file mode 100644
index 0000000000000..a881d3ee24cb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a3.png b/Shared/CIPPSharp/bin/twemoji/1f3a3.png
new file mode 100644
index 0000000000000..aa7b3e9b74dbf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f3a4.png
new file mode 100644
index 0000000000000..51e8d9063e631
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a5.png b/Shared/CIPPSharp/bin/twemoji/1f3a5.png
new file mode 100644
index 0000000000000..5c990159ff06f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a6.png b/Shared/CIPPSharp/bin/twemoji/1f3a6.png
new file mode 100644
index 0000000000000..7d22c83f7b69b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a7.png b/Shared/CIPPSharp/bin/twemoji/1f3a7.png
new file mode 100644
index 0000000000000..847afe56c82fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f3a8.png
new file mode 100644
index 0000000000000..1dda3e0c6ef66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3a9.png b/Shared/CIPPSharp/bin/twemoji/1f3a9.png
new file mode 100644
index 0000000000000..6698169056144
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3a9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3aa.png b/Shared/CIPPSharp/bin/twemoji/1f3aa.png
new file mode 100644
index 0000000000000..685c18bfb0fb4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3aa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ab.png b/Shared/CIPPSharp/bin/twemoji/1f3ab.png
new file mode 100644
index 0000000000000..072235f16e60c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ac.png b/Shared/CIPPSharp/bin/twemoji/1f3ac.png
new file mode 100644
index 0000000000000..3a45826402247
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ac.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ad.png b/Shared/CIPPSharp/bin/twemoji/1f3ad.png
new file mode 100644
index 0000000000000..a84cd97a9c410
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ad.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ae.png b/Shared/CIPPSharp/bin/twemoji/1f3ae.png
new file mode 100644
index 0000000000000..10b366c9fe05c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ae.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3af.png b/Shared/CIPPSharp/bin/twemoji/1f3af.png
new file mode 100644
index 0000000000000..d96b850d3a1a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b0.png b/Shared/CIPPSharp/bin/twemoji/1f3b0.png
new file mode 100644
index 0000000000000..0e7ef1bea1550
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b1.png b/Shared/CIPPSharp/bin/twemoji/1f3b1.png
new file mode 100644
index 0000000000000..4905297389c51
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b2.png b/Shared/CIPPSharp/bin/twemoji/1f3b2.png
new file mode 100644
index 0000000000000..c70ee4822c0f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b3.png b/Shared/CIPPSharp/bin/twemoji/1f3b3.png
new file mode 100644
index 0000000000000..d8705bf55c080
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b4.png b/Shared/CIPPSharp/bin/twemoji/1f3b4.png
new file mode 100644
index 0000000000000..d6935e19be8b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b5.png b/Shared/CIPPSharp/bin/twemoji/1f3b5.png
new file mode 100644
index 0000000000000..dde36d4f98582
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b6.png b/Shared/CIPPSharp/bin/twemoji/1f3b6.png
new file mode 100644
index 0000000000000..75b6f53721fa7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b7.png b/Shared/CIPPSharp/bin/twemoji/1f3b7.png
new file mode 100644
index 0000000000000..a87468ef84035
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b8.png b/Shared/CIPPSharp/bin/twemoji/1f3b8.png
new file mode 100644
index 0000000000000..9e8daae5de33d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3b9.png b/Shared/CIPPSharp/bin/twemoji/1f3b9.png
new file mode 100644
index 0000000000000..39d91fa106005
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3b9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ba.png b/Shared/CIPPSharp/bin/twemoji/1f3ba.png
new file mode 100644
index 0000000000000..493a9aa33be55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ba.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3bb.png b/Shared/CIPPSharp/bin/twemoji/1f3bb.png
new file mode 100644
index 0000000000000..d14c4272acf13
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3bc.png b/Shared/CIPPSharp/bin/twemoji/1f3bc.png
new file mode 100644
index 0000000000000..9362582b993e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3bd.png b/Shared/CIPPSharp/bin/twemoji/1f3bd.png
new file mode 100644
index 0000000000000..970d4167f4d12
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3be.png b/Shared/CIPPSharp/bin/twemoji/1f3be.png
new file mode 100644
index 0000000000000..6eb3a19dc991f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3be.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3bf.png b/Shared/CIPPSharp/bin/twemoji/1f3bf.png
new file mode 100644
index 0000000000000..c5f5037702720
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3bf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c0.png b/Shared/CIPPSharp/bin/twemoji/1f3c0.png
new file mode 100644
index 0000000000000..144a5d6acc980
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c1.png b/Shared/CIPPSharp/bin/twemoji/1f3c1.png
new file mode 100644
index 0000000000000..31d2215af1325
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fb.png
new file mode 100644
index 0000000000000..c5f299d31317b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fc.png
new file mode 100644
index 0000000000000..33a3c3177033d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fd.png
new file mode 100644
index 0000000000000..bc172a919f500
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fe.png
new file mode 100644
index 0000000000000..c8800a85d8428
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3ff.png
new file mode 100644
index 0000000000000..f7c766fc07b60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c2-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c2.png b/Shared/CIPPSharp/bin/twemoji/1f3c2.png
new file mode 100644
index 0000000000000..4b1baa0376764
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..5adbc60cb63e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1f2be9ceaa683
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..f67e35b532353
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5490f5eb8ba1a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..0cd3ec5a7a9d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb.png
new file mode 100644
index 0000000000000..d412329c358b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..a661d7093fdfd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..88151f6e4a2fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..6639fe6d7f112
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..21b944bcd4deb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..7b9c0defd005b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc.png
new file mode 100644
index 0000000000000..1e4be4df88f12
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..717287b7b3a10
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..df2f77de89eb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..8821eaf0b0641
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..200677994c96d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..5e355999db691
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd.png
new file mode 100644
index 0000000000000..949de3d358a61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..69d7ad6c59d97
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..565f91af86af4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..7df41b4e66068
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4965c7bfd078b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..ad3a74c2b2801
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe.png
new file mode 100644
index 0000000000000..c4eedcb9e190b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..fc2e409c56513
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1fe6d0da10500
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..361ae58052131
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..eead2a81060d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..2127e12c079a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff.png
new file mode 100644
index 0000000000000..9cfc207a2aac9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..fbb55ba641e2c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..03bfd1f6f7695
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..eeef753526da9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9f4092dc07a88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..ba7ddf603dd20
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c3.png b/Shared/CIPPSharp/bin/twemoji/1f3c3.png
new file mode 100644
index 0000000000000..065711254121b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c9877834d2d60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..818f97682d91f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb.png
new file mode 100644
index 0000000000000..483a0737f4e07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7f60894535e6b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..dfa13101f5e06
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc.png
new file mode 100644
index 0000000000000..ad55c3b4b8b00
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..6044602f24c81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d0c5918e95822
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd.png
new file mode 100644
index 0000000000000..84672394fd16c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..db8f4ee6131c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..db6ce1687d40e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe.png
new file mode 100644
index 0000000000000..736316e609d08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..45a3620fc01cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f863def125709
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff.png
new file mode 100644
index 0000000000000..4f3f5b216cf6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c11a60b08be37
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3c4-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..82ffd6cb5a41a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c4.png b/Shared/CIPPSharp/bin/twemoji/1f3c4.png
new file mode 100644
index 0000000000000..5f0626a59b975
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c5.png b/Shared/CIPPSharp/bin/twemoji/1f3c5.png
new file mode 100644
index 0000000000000..b19a9ac56de50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c6.png b/Shared/CIPPSharp/bin/twemoji/1f3c6.png
new file mode 100644
index 0000000000000..cd4438f90e405
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fb.png
new file mode 100644
index 0000000000000..67053c98fdecb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fc.png
new file mode 100644
index 0000000000000..83eed6ee1a0f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fd.png
new file mode 100644
index 0000000000000..79d25a9411fd9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fe.png
new file mode 100644
index 0000000000000..70a05d74b4950
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3ff.png
new file mode 100644
index 0000000000000..be6aa30fcdf20
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c7-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c7.png b/Shared/CIPPSharp/bin/twemoji/1f3c7.png
new file mode 100644
index 0000000000000..904d7ea3865fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c8.png b/Shared/CIPPSharp/bin/twemoji/1f3c8.png
new file mode 100644
index 0000000000000..4ff4d5e43a88e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3c9.png b/Shared/CIPPSharp/bin/twemoji/1f3c9.png
new file mode 100644
index 0000000000000..1d533f99d68cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3c9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3c424f3fc735a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d303f285b8510
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb.png
new file mode 100644
index 0000000000000..6d020a4d05d61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1b3c39293ef51
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4da544a7b6b7a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc.png
new file mode 100644
index 0000000000000..b14a6b19a4b50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ed8eab168284f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..487bf485079dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd.png
new file mode 100644
index 0000000000000..76026bed759c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bd1d02a4a6ded
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1e605881619e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe.png
new file mode 100644
index 0000000000000..d40f61b1b7206
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c7bd85610ad12
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a9dd7d3dc8e15
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff.png
new file mode 100644
index 0000000000000..95eac61bcc98f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5f3f0483fccd9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3ca-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f2c1433306cd2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ca.png b/Shared/CIPPSharp/bin/twemoji/1f3ca.png
new file mode 100644
index 0000000000000..c2896f43cc306
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ca.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..df2b83f1e36fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..660634c312091
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb.png
new file mode 100644
index 0000000000000..2955cf95e635b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..647848baaa4ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4ed8a9b2f6259
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc.png
new file mode 100644
index 0000000000000..2a9af4a4c0c3e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c6e02767865a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..18216413f2674
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd.png
new file mode 100644
index 0000000000000..4be445c6d70ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..94a62125fa37e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8ceeb5ef3eda9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe.png
new file mode 100644
index 0000000000000..3c05ac275ae2d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..4e0d6d8df576c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6e500d5cdb04a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff.png
new file mode 100644
index 0000000000000..3b4b183bea008
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-fe0f-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-fe0f-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1478cc88ba73a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-fe0f-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb-fe0f-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cb-fe0f-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..876096a509baf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb-fe0f-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cb.png b/Shared/CIPPSharp/bin/twemoji/1f3cb.png
new file mode 100644
index 0000000000000..dcdf5fd270094
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1c176850f4b71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a6d86bbe18c62
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb.png
new file mode 100644
index 0000000000000..ada62af9cea81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e1be1ec2549a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d480b6bce168b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc.png
new file mode 100644
index 0000000000000..7aba672350710
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a31793fcd3e4c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..29bae8f98ab5a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd.png
new file mode 100644
index 0000000000000..cd31ce995d92c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f8eb7fabd56b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f7dcada7af98f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe.png
new file mode 100644
index 0000000000000..811b8bf83d8d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1381b5fea47cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5d005621e17b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff.png
new file mode 100644
index 0000000000000..77024416bc8fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-fe0f-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-fe0f-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..92f4457bda7f7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-fe0f-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc-fe0f-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3cc-fe0f-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..cda196e7eb5ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc-fe0f-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cc.png b/Shared/CIPPSharp/bin/twemoji/1f3cc.png
new file mode 100644
index 0000000000000..5816219995b38
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cd.png b/Shared/CIPPSharp/bin/twemoji/1f3cd.png
new file mode 100644
index 0000000000000..ac675cf4a04d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ce.png b/Shared/CIPPSharp/bin/twemoji/1f3ce.png
new file mode 100644
index 0000000000000..732ab9ff2ff1e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ce.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3cf.png b/Shared/CIPPSharp/bin/twemoji/1f3cf.png
new file mode 100644
index 0000000000000..dd330cb80c5b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3cf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d0.png b/Shared/CIPPSharp/bin/twemoji/1f3d0.png
new file mode 100644
index 0000000000000..5836514c037b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d1.png b/Shared/CIPPSharp/bin/twemoji/1f3d1.png
new file mode 100644
index 0000000000000..a663a0ca6ee1a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d2.png b/Shared/CIPPSharp/bin/twemoji/1f3d2.png
new file mode 100644
index 0000000000000..3f7b86896c6c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d3.png b/Shared/CIPPSharp/bin/twemoji/1f3d3.png
new file mode 100644
index 0000000000000..6d5a36dbf34c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d4.png b/Shared/CIPPSharp/bin/twemoji/1f3d4.png
new file mode 100644
index 0000000000000..a177f1bad2772
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d5.png b/Shared/CIPPSharp/bin/twemoji/1f3d5.png
new file mode 100644
index 0000000000000..73d9df795c248
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d6.png b/Shared/CIPPSharp/bin/twemoji/1f3d6.png
new file mode 100644
index 0000000000000..19cf9ce91671d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d7.png b/Shared/CIPPSharp/bin/twemoji/1f3d7.png
new file mode 100644
index 0000000000000..0c6e9dffe5d02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d8.png b/Shared/CIPPSharp/bin/twemoji/1f3d8.png
new file mode 100644
index 0000000000000..b4b3bf2eb3a02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3d9.png b/Shared/CIPPSharp/bin/twemoji/1f3d9.png
new file mode 100644
index 0000000000000..048591245ffec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3d9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3da.png b/Shared/CIPPSharp/bin/twemoji/1f3da.png
new file mode 100644
index 0000000000000..feb0a214650dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3da.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3db.png b/Shared/CIPPSharp/bin/twemoji/1f3db.png
new file mode 100644
index 0000000000000..e49f54e847393
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3db.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3dc.png b/Shared/CIPPSharp/bin/twemoji/1f3dc.png
new file mode 100644
index 0000000000000..7775db168d536
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3dc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3dd.png b/Shared/CIPPSharp/bin/twemoji/1f3dd.png
new file mode 100644
index 0000000000000..c8a6edaab0828
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3dd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3de.png b/Shared/CIPPSharp/bin/twemoji/1f3de.png
new file mode 100644
index 0000000000000..478bacc9c394d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3de.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3df.png b/Shared/CIPPSharp/bin/twemoji/1f3df.png
new file mode 100644
index 0000000000000..cef6dead0cbed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3df.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e0.png b/Shared/CIPPSharp/bin/twemoji/1f3e0.png
new file mode 100644
index 0000000000000..a804a62786da3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e1.png b/Shared/CIPPSharp/bin/twemoji/1f3e1.png
new file mode 100644
index 0000000000000..e8eb761a95cbb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e2.png b/Shared/CIPPSharp/bin/twemoji/1f3e2.png
new file mode 100644
index 0000000000000..0ad23d8b052a9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e3.png b/Shared/CIPPSharp/bin/twemoji/1f3e3.png
new file mode 100644
index 0000000000000..da0982b011ced
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e4.png b/Shared/CIPPSharp/bin/twemoji/1f3e4.png
new file mode 100644
index 0000000000000..e1ff2da6365ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e5.png b/Shared/CIPPSharp/bin/twemoji/1f3e5.png
new file mode 100644
index 0000000000000..b038bb58ebb29
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e6.png b/Shared/CIPPSharp/bin/twemoji/1f3e6.png
new file mode 100644
index 0000000000000..011412337e3b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e7.png b/Shared/CIPPSharp/bin/twemoji/1f3e7.png
new file mode 100644
index 0000000000000..1e36fefdbd05e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e8.png b/Shared/CIPPSharp/bin/twemoji/1f3e8.png
new file mode 100644
index 0000000000000..646fe6e42e879
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3e9.png b/Shared/CIPPSharp/bin/twemoji/1f3e9.png
new file mode 100644
index 0000000000000..6c789fc22a952
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ea.png b/Shared/CIPPSharp/bin/twemoji/1f3ea.png
new file mode 100644
index 0000000000000..bb84d3e665870
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f3eb.png
new file mode 100644
index 0000000000000..ae15884cc2cbe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ec.png b/Shared/CIPPSharp/bin/twemoji/1f3ec.png
new file mode 100644
index 0000000000000..5c94977ebd583
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f3ed.png
new file mode 100644
index 0000000000000..555c8a7ed5081
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ee.png b/Shared/CIPPSharp/bin/twemoji/1f3ee.png
new file mode 100644
index 0000000000000..a6e883285de65
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ef.png b/Shared/CIPPSharp/bin/twemoji/1f3ef.png
new file mode 100644
index 0000000000000..3819a53812a20
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f0.png b/Shared/CIPPSharp/bin/twemoji/1f3f0.png
new file mode 100644
index 0000000000000..78bc6200ca80b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f3-fe0f-200d-1f308.png b/Shared/CIPPSharp/bin/twemoji/1f3f3-fe0f-200d-1f308.png
new file mode 100644
index 0000000000000..a79b58c8c1e1c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f3-fe0f-200d-1f308.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f3-fe0f-200d-26a7-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3f3-fe0f-200d-26a7-fe0f.png
new file mode 100644
index 0000000000000..8994b2d055939
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f3-fe0f-200d-26a7-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f3.png b/Shared/CIPPSharp/bin/twemoji/1f3f3.png
new file mode 100644
index 0000000000000..49317273b4b71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f4-200d-2620-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f3f4-200d-2620-fe0f.png
new file mode 100644
index 0000000000000..f5fc239943f3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f4-200d-2620-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0065-e006e-e0067-e007f.png b/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0065-e006e-e0067-e007f.png
new file mode 100644
index 0000000000000..fcdd94aa9ddd0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0065-e006e-e0067-e007f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0073-e0063-e0074-e007f.png b/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0073-e0063-e0074-e007f.png
new file mode 100644
index 0000000000000..05a827ffd0181
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0073-e0063-e0074-e007f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0077-e006c-e0073-e007f.png b/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0077-e006c-e0073-e007f.png
new file mode 100644
index 0000000000000..0370dbf4329e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f4-e0067-e0062-e0077-e006c-e0073-e007f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f4.png b/Shared/CIPPSharp/bin/twemoji/1f3f4.png
new file mode 100644
index 0000000000000..71a7af8304961
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f5.png b/Shared/CIPPSharp/bin/twemoji/1f3f5.png
new file mode 100644
index 0000000000000..0ba33a90519b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f7.png b/Shared/CIPPSharp/bin/twemoji/1f3f7.png
new file mode 100644
index 0000000000000..355b9e375daa6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f8.png b/Shared/CIPPSharp/bin/twemoji/1f3f8.png
new file mode 100644
index 0000000000000..1e0a95a1805fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3f9.png b/Shared/CIPPSharp/bin/twemoji/1f3f9.png
new file mode 100644
index 0000000000000..87dea7a59485f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3fa.png b/Shared/CIPPSharp/bin/twemoji/1f3fa.png
new file mode 100644
index 0000000000000..83caa8d10814d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f3fb.png
new file mode 100644
index 0000000000000..84f81dfcfb533
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f3fc.png
new file mode 100644
index 0000000000000..e9e39e53fdf58
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f3fd.png
new file mode 100644
index 0000000000000..661cfc2e58d74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f3fe.png
new file mode 100644
index 0000000000000..5001b8017d0fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f3ff.png
new file mode 100644
index 0000000000000..bc2c6e58fb8e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f400.png b/Shared/CIPPSharp/bin/twemoji/1f400.png
new file mode 100644
index 0000000000000..a2150f2d3b930
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f400.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f401.png b/Shared/CIPPSharp/bin/twemoji/1f401.png
new file mode 100644
index 0000000000000..e2509b0729957
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f401.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f402.png b/Shared/CIPPSharp/bin/twemoji/1f402.png
new file mode 100644
index 0000000000000..e20bd7d42b797
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f402.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f403.png b/Shared/CIPPSharp/bin/twemoji/1f403.png
new file mode 100644
index 0000000000000..ced075f6af9e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f403.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f404.png b/Shared/CIPPSharp/bin/twemoji/1f404.png
new file mode 100644
index 0000000000000..bb0e16c3c36c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f404.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f405.png b/Shared/CIPPSharp/bin/twemoji/1f405.png
new file mode 100644
index 0000000000000..eb20e615c52ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f405.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f406.png b/Shared/CIPPSharp/bin/twemoji/1f406.png
new file mode 100644
index 0000000000000..2f019b86e5df8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f406.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f407.png b/Shared/CIPPSharp/bin/twemoji/1f407.png
new file mode 100644
index 0000000000000..afbdaf3b0d422
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f407.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f408-200d-2b1b.png b/Shared/CIPPSharp/bin/twemoji/1f408-200d-2b1b.png
new file mode 100644
index 0000000000000..b8fe4db9e294e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f408-200d-2b1b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f408.png b/Shared/CIPPSharp/bin/twemoji/1f408.png
new file mode 100644
index 0000000000000..f92e1aad845b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f408.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f409.png b/Shared/CIPPSharp/bin/twemoji/1f409.png
new file mode 100644
index 0000000000000..824e37d940b26
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f409.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f40a.png b/Shared/CIPPSharp/bin/twemoji/1f40a.png
new file mode 100644
index 0000000000000..8e15d44959cc1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f40a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f40b.png b/Shared/CIPPSharp/bin/twemoji/1f40b.png
new file mode 100644
index 0000000000000..c103c6ef3864b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f40b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f40c.png b/Shared/CIPPSharp/bin/twemoji/1f40c.png
new file mode 100644
index 0000000000000..898bdd1b192ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f40c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f40d.png b/Shared/CIPPSharp/bin/twemoji/1f40d.png
new file mode 100644
index 0000000000000..920bc69382c55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f40d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f40e.png b/Shared/CIPPSharp/bin/twemoji/1f40e.png
new file mode 100644
index 0000000000000..dc91a0d91ff4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f40e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f40f.png b/Shared/CIPPSharp/bin/twemoji/1f40f.png
new file mode 100644
index 0000000000000..96380f1497147
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f40f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f410.png b/Shared/CIPPSharp/bin/twemoji/1f410.png
new file mode 100644
index 0000000000000..696e91c93a721
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f410.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f411.png b/Shared/CIPPSharp/bin/twemoji/1f411.png
new file mode 100644
index 0000000000000..f803dd80b80b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f411.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f412.png b/Shared/CIPPSharp/bin/twemoji/1f412.png
new file mode 100644
index 0000000000000..cf52ab1518ffc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f412.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f413.png b/Shared/CIPPSharp/bin/twemoji/1f413.png
new file mode 100644
index 0000000000000..61a94d4729388
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f413.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f414.png b/Shared/CIPPSharp/bin/twemoji/1f414.png
new file mode 100644
index 0000000000000..b6cfed1f66820
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f414.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f415-200d-1f9ba.png b/Shared/CIPPSharp/bin/twemoji/1f415-200d-1f9ba.png
new file mode 100644
index 0000000000000..f09349e64ed54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f415-200d-1f9ba.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f415.png b/Shared/CIPPSharp/bin/twemoji/1f415.png
new file mode 100644
index 0000000000000..7c869c487a031
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f415.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f416.png b/Shared/CIPPSharp/bin/twemoji/1f416.png
new file mode 100644
index 0000000000000..1bb3b6e5bc6a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f416.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f417.png b/Shared/CIPPSharp/bin/twemoji/1f417.png
new file mode 100644
index 0000000000000..049f5bc9d1bea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f417.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f418.png b/Shared/CIPPSharp/bin/twemoji/1f418.png
new file mode 100644
index 0000000000000..ebc666dce32f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f418.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f419.png b/Shared/CIPPSharp/bin/twemoji/1f419.png
new file mode 100644
index 0000000000000..c90c5f4d2368d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f419.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f41a.png b/Shared/CIPPSharp/bin/twemoji/1f41a.png
new file mode 100644
index 0000000000000..496e7a814618f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f41a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f41b.png b/Shared/CIPPSharp/bin/twemoji/1f41b.png
new file mode 100644
index 0000000000000..6010258f4aed3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f41b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f41c.png b/Shared/CIPPSharp/bin/twemoji/1f41c.png
new file mode 100644
index 0000000000000..268571bb0711a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f41c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f41d.png b/Shared/CIPPSharp/bin/twemoji/1f41d.png
new file mode 100644
index 0000000000000..2440295b91ff9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f41d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f41e.png b/Shared/CIPPSharp/bin/twemoji/1f41e.png
new file mode 100644
index 0000000000000..f605bd5d22ce4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f41e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f41f.png b/Shared/CIPPSharp/bin/twemoji/1f41f.png
new file mode 100644
index 0000000000000..1d6e90fa6936d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f41f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f420.png b/Shared/CIPPSharp/bin/twemoji/1f420.png
new file mode 100644
index 0000000000000..5f1e2e5e8eee2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f420.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f421.png b/Shared/CIPPSharp/bin/twemoji/1f421.png
new file mode 100644
index 0000000000000..1dc9bd9a0e407
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f421.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f422.png b/Shared/CIPPSharp/bin/twemoji/1f422.png
new file mode 100644
index 0000000000000..5253638fea3b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f422.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f423.png b/Shared/CIPPSharp/bin/twemoji/1f423.png
new file mode 100644
index 0000000000000..23b0dd1bf4b0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f423.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f424.png b/Shared/CIPPSharp/bin/twemoji/1f424.png
new file mode 100644
index 0000000000000..bd87c6fac35f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f424.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f425.png b/Shared/CIPPSharp/bin/twemoji/1f425.png
new file mode 100644
index 0000000000000..66e7b973b18a9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f425.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f426-200d-1f525.png b/Shared/CIPPSharp/bin/twemoji/1f426-200d-1f525.png
new file mode 100644
index 0000000000000..28d17bc160c1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f426-200d-1f525.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f426-200d-2b1b.png b/Shared/CIPPSharp/bin/twemoji/1f426-200d-2b1b.png
new file mode 100644
index 0000000000000..c3e1865175345
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f426-200d-2b1b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f426.png b/Shared/CIPPSharp/bin/twemoji/1f426.png
new file mode 100644
index 0000000000000..d129ac778f1cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f426.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f427.png b/Shared/CIPPSharp/bin/twemoji/1f427.png
new file mode 100644
index 0000000000000..2ee0dbc6ae0a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f427.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f428.png b/Shared/CIPPSharp/bin/twemoji/1f428.png
new file mode 100644
index 0000000000000..0c2ae778a75e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f428.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f429.png b/Shared/CIPPSharp/bin/twemoji/1f429.png
new file mode 100644
index 0000000000000..ebc9aef972f60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f429.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f42a.png b/Shared/CIPPSharp/bin/twemoji/1f42a.png
new file mode 100644
index 0000000000000..4ede95a2aa38b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f42a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f42b.png b/Shared/CIPPSharp/bin/twemoji/1f42b.png
new file mode 100644
index 0000000000000..af4a976b32102
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f42b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f42c.png b/Shared/CIPPSharp/bin/twemoji/1f42c.png
new file mode 100644
index 0000000000000..86b97d8a3cfbd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f42c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f42d.png b/Shared/CIPPSharp/bin/twemoji/1f42d.png
new file mode 100644
index 0000000000000..fa31afc1b0c9e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f42d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f42e.png b/Shared/CIPPSharp/bin/twemoji/1f42e.png
new file mode 100644
index 0000000000000..c872a5fe67eae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f42e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f42f.png b/Shared/CIPPSharp/bin/twemoji/1f42f.png
new file mode 100644
index 0000000000000..cb9915252d66b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f42f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f430.png b/Shared/CIPPSharp/bin/twemoji/1f430.png
new file mode 100644
index 0000000000000..2397ddd337236
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f430.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f431.png b/Shared/CIPPSharp/bin/twemoji/1f431.png
new file mode 100644
index 0000000000000..292aff7841b64
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f431.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f432.png b/Shared/CIPPSharp/bin/twemoji/1f432.png
new file mode 100644
index 0000000000000..88a42e2fba677
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f432.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f433.png b/Shared/CIPPSharp/bin/twemoji/1f433.png
new file mode 100644
index 0000000000000..1bae0fc3a2c10
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f433.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f434.png b/Shared/CIPPSharp/bin/twemoji/1f434.png
new file mode 100644
index 0000000000000..79d0ba1ee5396
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f434.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f435.png b/Shared/CIPPSharp/bin/twemoji/1f435.png
new file mode 100644
index 0000000000000..780034d553977
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f435.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f436.png b/Shared/CIPPSharp/bin/twemoji/1f436.png
new file mode 100644
index 0000000000000..a4c07a081f6b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f436.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f437.png b/Shared/CIPPSharp/bin/twemoji/1f437.png
new file mode 100644
index 0000000000000..1c9215aae2a93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f437.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f438.png b/Shared/CIPPSharp/bin/twemoji/1f438.png
new file mode 100644
index 0000000000000..9f6185698316b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f438.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f439.png b/Shared/CIPPSharp/bin/twemoji/1f439.png
new file mode 100644
index 0000000000000..70812112441d7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f439.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f43a.png b/Shared/CIPPSharp/bin/twemoji/1f43a.png
new file mode 100644
index 0000000000000..8f676db32dd3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f43a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f43b-200d-2744-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f43b-200d-2744-fe0f.png
new file mode 100644
index 0000000000000..ac27142489bfd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f43b-200d-2744-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f43b.png b/Shared/CIPPSharp/bin/twemoji/1f43b.png
new file mode 100644
index 0000000000000..726115f19eba5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f43b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f43c.png b/Shared/CIPPSharp/bin/twemoji/1f43c.png
new file mode 100644
index 0000000000000..e3995ee9389c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f43c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f43d.png b/Shared/CIPPSharp/bin/twemoji/1f43d.png
new file mode 100644
index 0000000000000..1aee7931c026e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f43d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f43e.png b/Shared/CIPPSharp/bin/twemoji/1f43e.png
new file mode 100644
index 0000000000000..2c6266d248ccf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f43e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f43f.png b/Shared/CIPPSharp/bin/twemoji/1f43f.png
new file mode 100644
index 0000000000000..4e284b89bb1a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f43f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f440.png b/Shared/CIPPSharp/bin/twemoji/1f440.png
new file mode 100644
index 0000000000000..1b3d0daf01db9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f440.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f441-200d-1f5e8.png b/Shared/CIPPSharp/bin/twemoji/1f441-200d-1f5e8.png
new file mode 100644
index 0000000000000..515c73a477638
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f441-200d-1f5e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f441.png b/Shared/CIPPSharp/bin/twemoji/1f441.png
new file mode 100644
index 0000000000000..9a59d28b09179
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f441.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f442-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fb.png
new file mode 100644
index 0000000000000..80566ef86f267
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f442-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fc.png
new file mode 100644
index 0000000000000..a926069af7af0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f442-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fd.png
new file mode 100644
index 0000000000000..89f758f3bf141
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f442-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fe.png
new file mode 100644
index 0000000000000..997fbb346eda3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f442-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f442-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f442-1f3ff.png
new file mode 100644
index 0000000000000..1b6842c5d88d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f442-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f442.png b/Shared/CIPPSharp/bin/twemoji/1f442.png
new file mode 100644
index 0000000000000..d8e2ad76e2b96
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f442.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f443-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fb.png
new file mode 100644
index 0000000000000..6aea7ccc76a37
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f443-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fc.png
new file mode 100644
index 0000000000000..76dcb3d7b6864
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f443-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fd.png
new file mode 100644
index 0000000000000..c3a48df0723fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f443-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fe.png
new file mode 100644
index 0000000000000..946fd2b33083c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f443-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f443-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f443-1f3ff.png
new file mode 100644
index 0000000000000..492fdc35d5084
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f443-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f443.png b/Shared/CIPPSharp/bin/twemoji/1f443.png
new file mode 100644
index 0000000000000..ece7bb8dd8df7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f443.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f444.png b/Shared/CIPPSharp/bin/twemoji/1f444.png
new file mode 100644
index 0000000000000..16dbe112fe0de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f444.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f445.png b/Shared/CIPPSharp/bin/twemoji/1f445.png
new file mode 100644
index 0000000000000..441866f0a7296
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f445.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f446-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fb.png
new file mode 100644
index 0000000000000..024353211d855
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f446-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fc.png
new file mode 100644
index 0000000000000..8fe07a76f14af
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f446-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fd.png
new file mode 100644
index 0000000000000..7e795d6695522
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f446-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fe.png
new file mode 100644
index 0000000000000..c3b63731787ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f446-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f446-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f446-1f3ff.png
new file mode 100644
index 0000000000000..9df30a7730c11
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f446-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f446.png b/Shared/CIPPSharp/bin/twemoji/1f446.png
new file mode 100644
index 0000000000000..8a5dfb10b0c3e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f446.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f447-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fb.png
new file mode 100644
index 0000000000000..9b87944e1c7ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f447-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fc.png
new file mode 100644
index 0000000000000..05da2e0ef6319
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f447-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fd.png
new file mode 100644
index 0000000000000..cf8393f05700e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f447-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fe.png
new file mode 100644
index 0000000000000..3daf8e0c06564
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f447-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f447-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f447-1f3ff.png
new file mode 100644
index 0000000000000..54ee9d9be2962
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f447-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f447.png b/Shared/CIPPSharp/bin/twemoji/1f447.png
new file mode 100644
index 0000000000000..b5d06ca53bd05
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f447.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f448-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fb.png
new file mode 100644
index 0000000000000..576a0f3f21933
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f448-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fc.png
new file mode 100644
index 0000000000000..08ecf7e6d55ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f448-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fd.png
new file mode 100644
index 0000000000000..c5b5a71402de6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f448-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fe.png
new file mode 100644
index 0000000000000..f1ed6f7a212a8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f448-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f448-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f448-1f3ff.png
new file mode 100644
index 0000000000000..89821cd39535a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f448-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f448.png b/Shared/CIPPSharp/bin/twemoji/1f448.png
new file mode 100644
index 0000000000000..441c2f819a8e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f448.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f449-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fb.png
new file mode 100644
index 0000000000000..82ea57957b0ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f449-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fc.png
new file mode 100644
index 0000000000000..31c5fa365eaf0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f449-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fd.png
new file mode 100644
index 0000000000000..ee0081eb16587
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f449-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fe.png
new file mode 100644
index 0000000000000..a8aa2f34395a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f449-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f449-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f449-1f3ff.png
new file mode 100644
index 0000000000000..2b72da33b1641
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f449-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f449.png b/Shared/CIPPSharp/bin/twemoji/1f449.png
new file mode 100644
index 0000000000000..85c300aaa8671
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f449.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fb.png
new file mode 100644
index 0000000000000..90bffd8278eed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fc.png
new file mode 100644
index 0000000000000..f800eabcea0a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fd.png
new file mode 100644
index 0000000000000..d9de1ad26d2fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fe.png
new file mode 100644
index 0000000000000..029c1b3bc3962
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44a-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3ff.png
new file mode 100644
index 0000000000000..4ad7a4a646f8d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44a-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44a.png b/Shared/CIPPSharp/bin/twemoji/1f44a.png
new file mode 100644
index 0000000000000..264880fd86ce2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fb.png
new file mode 100644
index 0000000000000..8dd2c95e3603c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fc.png
new file mode 100644
index 0000000000000..4d983cd4d8c07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fd.png
new file mode 100644
index 0000000000000..478ee389fb344
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fe.png
new file mode 100644
index 0000000000000..cba0b2d9a4cfc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44b-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3ff.png
new file mode 100644
index 0000000000000..34c61982dc9c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44b-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44b.png b/Shared/CIPPSharp/bin/twemoji/1f44b.png
new file mode 100644
index 0000000000000..250e857fb77ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fb.png
new file mode 100644
index 0000000000000..f93153c582b8e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fc.png
new file mode 100644
index 0000000000000..68e450716d13d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fd.png
new file mode 100644
index 0000000000000..869d982cb0ffe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fe.png
new file mode 100644
index 0000000000000..b3d2e82631052
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3ff.png
new file mode 100644
index 0000000000000..f0c6a8cf2bfdd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44c.png b/Shared/CIPPSharp/bin/twemoji/1f44c.png
new file mode 100644
index 0000000000000..6a7b8976930cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fb.png
new file mode 100644
index 0000000000000..ceab0da2e2785
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fc.png
new file mode 100644
index 0000000000000..e78a835459850
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fd.png
new file mode 100644
index 0000000000000..56a60600deb47
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fe.png
new file mode 100644
index 0000000000000..14a8eb91ad640
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44d-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3ff.png
new file mode 100644
index 0000000000000..6fddfe1058958
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44d-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44d.png b/Shared/CIPPSharp/bin/twemoji/1f44d.png
new file mode 100644
index 0000000000000..51b8c75bb9ee4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fb.png
new file mode 100644
index 0000000000000..48e16a253bf2f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fc.png
new file mode 100644
index 0000000000000..8fdb6a12792b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fd.png
new file mode 100644
index 0000000000000..1f7ff2b13a14b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fe.png
new file mode 100644
index 0000000000000..f971e494a34d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44e-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3ff.png
new file mode 100644
index 0000000000000..62f23f40d8ad1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44e-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44e.png b/Shared/CIPPSharp/bin/twemoji/1f44e.png
new file mode 100644
index 0000000000000..3801fe8f3e288
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fb.png
new file mode 100644
index 0000000000000..4194338799fd0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fc.png
new file mode 100644
index 0000000000000..28f2ab971625c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fd.png
new file mode 100644
index 0000000000000..aef3c3398fe6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fe.png
new file mode 100644
index 0000000000000..7d64a24db5bf1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44f-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3ff.png
new file mode 100644
index 0000000000000..389765736a402
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44f-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f44f.png b/Shared/CIPPSharp/bin/twemoji/1f44f.png
new file mode 100644
index 0000000000000..8512b44bfef73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f44f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f450-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fb.png
new file mode 100644
index 0000000000000..d049c494181b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f450-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fc.png
new file mode 100644
index 0000000000000..95155ca5d5a7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f450-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fd.png
new file mode 100644
index 0000000000000..44a91e54085fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f450-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fe.png
new file mode 100644
index 0000000000000..cb7c763be0f5e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f450-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f450-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f450-1f3ff.png
new file mode 100644
index 0000000000000..8fe0efb743bcf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f450-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f450.png b/Shared/CIPPSharp/bin/twemoji/1f450.png
new file mode 100644
index 0000000000000..43b0021baf8ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f450.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f451.png b/Shared/CIPPSharp/bin/twemoji/1f451.png
new file mode 100644
index 0000000000000..ee8792481e33b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f451.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f452.png b/Shared/CIPPSharp/bin/twemoji/1f452.png
new file mode 100644
index 0000000000000..ae6e88c2bc40f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f452.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f453.png b/Shared/CIPPSharp/bin/twemoji/1f453.png
new file mode 100644
index 0000000000000..2808766313a4a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f453.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f454.png b/Shared/CIPPSharp/bin/twemoji/1f454.png
new file mode 100644
index 0000000000000..08d920fa1276d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f454.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f455.png b/Shared/CIPPSharp/bin/twemoji/1f455.png
new file mode 100644
index 0000000000000..1dc1d91d407e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f455.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f456.png b/Shared/CIPPSharp/bin/twemoji/1f456.png
new file mode 100644
index 0000000000000..44713902ee9eb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f456.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f457.png b/Shared/CIPPSharp/bin/twemoji/1f457.png
new file mode 100644
index 0000000000000..40ee78e104171
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f457.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f458.png b/Shared/CIPPSharp/bin/twemoji/1f458.png
new file mode 100644
index 0000000000000..b4fd087b12c92
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f458.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f459.png b/Shared/CIPPSharp/bin/twemoji/1f459.png
new file mode 100644
index 0000000000000..3892a929400f7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f459.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f45a.png b/Shared/CIPPSharp/bin/twemoji/1f45a.png
new file mode 100644
index 0000000000000..721cfdc2383b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f45a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f45b.png b/Shared/CIPPSharp/bin/twemoji/1f45b.png
new file mode 100644
index 0000000000000..13037d8f335c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f45b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f45c.png b/Shared/CIPPSharp/bin/twemoji/1f45c.png
new file mode 100644
index 0000000000000..61e490910bcb5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f45c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f45d.png b/Shared/CIPPSharp/bin/twemoji/1f45d.png
new file mode 100644
index 0000000000000..1e7e71461961d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f45d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f45e.png b/Shared/CIPPSharp/bin/twemoji/1f45e.png
new file mode 100644
index 0000000000000..87cbf8a1f84c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f45e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f45f.png b/Shared/CIPPSharp/bin/twemoji/1f45f.png
new file mode 100644
index 0000000000000..fe7db6fb74fba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f45f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f460.png b/Shared/CIPPSharp/bin/twemoji/1f460.png
new file mode 100644
index 0000000000000..02325941a2f0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f460.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f461.png b/Shared/CIPPSharp/bin/twemoji/1f461.png
new file mode 100644
index 0000000000000..806fd1cf1e334
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f461.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f462.png b/Shared/CIPPSharp/bin/twemoji/1f462.png
new file mode 100644
index 0000000000000..91d298e0f70dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f462.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f463.png b/Shared/CIPPSharp/bin/twemoji/1f463.png
new file mode 100644
index 0000000000000..0e2b87e7910a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f463.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f464.png b/Shared/CIPPSharp/bin/twemoji/1f464.png
new file mode 100644
index 0000000000000..df64d95cc0f3f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f464.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f465.png b/Shared/CIPPSharp/bin/twemoji/1f465.png
new file mode 100644
index 0000000000000..b907898cf4cce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f465.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f466-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fb.png
new file mode 100644
index 0000000000000..30ee0fb9981d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f466-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fc.png
new file mode 100644
index 0000000000000..219c8a3eded2b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f466-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fd.png
new file mode 100644
index 0000000000000..fb2d105c548b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f466-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fe.png
new file mode 100644
index 0000000000000..a0a1895f0951a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f466-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f466-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f466-1f3ff.png
new file mode 100644
index 0000000000000..89edbdaadf657
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f466-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f466.png b/Shared/CIPPSharp/bin/twemoji/1f466.png
new file mode 100644
index 0000000000000..aca7839400837
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f467-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fb.png
new file mode 100644
index 0000000000000..959d55e664bc8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f467-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fc.png
new file mode 100644
index 0000000000000..a6276570cea44
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f467-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fd.png
new file mode 100644
index 0000000000000..c5bba797731a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f467-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fe.png
new file mode 100644
index 0000000000000..0509f75b123d0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f467-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f467-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f467-1f3ff.png
new file mode 100644
index 0000000000000..c97e91ac4d823
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f467-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f467.png b/Shared/CIPPSharp/bin/twemoji/1f467.png
new file mode 100644
index 0000000000000..c7199f6d469d7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f33e.png
new file mode 100644
index 0000000000000..b28cdb8332e53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f373.png
new file mode 100644
index 0000000000000..23bace9784a88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f37c.png
new file mode 100644
index 0000000000000..808c0f5e6c134
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f384.png
new file mode 100644
index 0000000000000..ae26f1ffc0ad5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f393.png
new file mode 100644
index 0000000000000..3e1eb365c2e06
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3a4.png
new file mode 100644
index 0000000000000..95948a7fc7490
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3a8.png
new file mode 100644
index 0000000000000..d0da93939aa3f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3eb.png
new file mode 100644
index 0000000000000..68789803d7bd0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3ed.png
new file mode 100644
index 0000000000000..7df79d4d234f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..d5723b4680d45
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..ae7201179231c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..856cd76bba8b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..0b8849b3205e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f430-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f4bb.png
new file mode 100644
index 0000000000000..e027f55c4876c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f4bc.png
new file mode 100644
index 0000000000000..df0c1a7d370ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f527.png
new file mode 100644
index 0000000000000..285e33166953e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f52c.png
new file mode 100644
index 0000000000000..b5eaf0503730c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f680.png
new file mode 100644
index 0000000000000..4d448a6483fe8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f692.png
new file mode 100644
index 0000000000000..a8f2467ea17c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..ee0e2ec974888
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..4a1df9db541e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..59d86c8ed7b3c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..0c87327c47a30
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..7df47a7f0ed4f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9af.png
new file mode 100644
index 0000000000000..8c67c0be0f5e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b0.png
new file mode 100644
index 0000000000000..dac8c82948186
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b1.png
new file mode 100644
index 0000000000000..04735fd5c91bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b2.png
new file mode 100644
index 0000000000000..f3f3aeee9e024
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b3.png
new file mode 100644
index 0000000000000..95b8518cd5f6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..d33d0e1d31289
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bc.png
new file mode 100644
index 0000000000000..ebde69b480f7f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..d14c99f404acb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bd.png
new file mode 100644
index 0000000000000..51320cf7c82ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..e2b39368758ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..6683d6d10051e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..cf0c689b1a99f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..2da0f40f9fdda
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-1faef-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..bd6e8f55d43ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..f2f4294516991
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..6dc6627855cb6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..8290495a65403
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..b9262d870f930
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..0531846ca3b76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..fa219506ffcf2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..c91e948cce39b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..b12316d2e3fba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..4ff97b2f4d1ce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..bc4bbde38ce76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..843df4d0b0f21
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..c25225e4fc6f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb.png
new file mode 100644
index 0000000000000..2c36824e37595
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f33e.png
new file mode 100644
index 0000000000000..5361fb1e76e79
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f373.png
new file mode 100644
index 0000000000000..43a434563a8b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f37c.png
new file mode 100644
index 0000000000000..17fcdd4524ecb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f384.png
new file mode 100644
index 0000000000000..ae1e9a8eeff50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f393.png
new file mode 100644
index 0000000000000..77f968f1c8711
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3a4.png
new file mode 100644
index 0000000000000..52980df4eb178
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3a8.png
new file mode 100644
index 0000000000000..2aee77b79a9a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3eb.png
new file mode 100644
index 0000000000000..b88314d2f12a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3ed.png
new file mode 100644
index 0000000000000..3105701468fcc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..44b8547308c71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..daab9e8443895
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..f6ad5be908a94
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..6acafda3fe58f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f430-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f4bb.png
new file mode 100644
index 0000000000000..4cfa537593c14
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f4bc.png
new file mode 100644
index 0000000000000..65123e0f06d08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f527.png
new file mode 100644
index 0000000000000..415644a4139e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f52c.png
new file mode 100644
index 0000000000000..56f0e8bf793b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f680.png
new file mode 100644
index 0000000000000..3d45cf40fd418
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f692.png
new file mode 100644
index 0000000000000..b9322dd0ee9d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..f72fc9e1d4165
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..95c78cf0f1b61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..0775407fd1697
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..23be878bb357d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..cb061b5a49387
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9af.png
new file mode 100644
index 0000000000000..41b92ea7fc38d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b0.png
new file mode 100644
index 0000000000000..5344a5eb83e1a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b1.png
new file mode 100644
index 0000000000000..555c452173b2c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b2.png
new file mode 100644
index 0000000000000..dcd774d5f30d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b3.png
new file mode 100644
index 0000000000000..3ac9f2a521822
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..77e5cba3b084e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bc.png
new file mode 100644
index 0000000000000..b25df4a150382
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..c0e847b4b7ca1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bd.png
new file mode 100644
index 0000000000000..969888b99d874
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..77cb9f076219b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..aa2a2b5278ccf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..ad859d9171957
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..61df548a3ddf8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-1faef-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..ee4b0b2276add
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..df34a740ac4e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..a6b365c661f4c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..d268d0385a9dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..9c3cbdc838d9a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..23983683671a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..7c247fb4a3612
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..24e5d43fd5029
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..bca840789ebc7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..649b70d1905e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..7649e7a3e3552
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..563216eb4ba39
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..752afb85884f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc.png
new file mode 100644
index 0000000000000..a5197a24d530a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f33e.png
new file mode 100644
index 0000000000000..433b19cf994d0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f373.png
new file mode 100644
index 0000000000000..a04904eeeaf5e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f37c.png
new file mode 100644
index 0000000000000..798c17a2c7d85
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f384.png
new file mode 100644
index 0000000000000..3cd9a5135178d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f393.png
new file mode 100644
index 0000000000000..d48c7cf19a6a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3a4.png
new file mode 100644
index 0000000000000..22ed9b589a8e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3a8.png
new file mode 100644
index 0000000000000..cb83a98819e76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3eb.png
new file mode 100644
index 0000000000000..8980a62fec833
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3ed.png
new file mode 100644
index 0000000000000..2244d972a8382
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..c7d268e958a16
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..1483cf28cacd5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..292841f53645a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..027ff75a510d6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f430-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f4bb.png
new file mode 100644
index 0000000000000..36c104087624b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f4bc.png
new file mode 100644
index 0000000000000..65475b2de69fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f527.png
new file mode 100644
index 0000000000000..09e4853df7ae4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f52c.png
new file mode 100644
index 0000000000000..9c670b2c4cc1d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f680.png
new file mode 100644
index 0000000000000..9e911eca584f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f692.png
new file mode 100644
index 0000000000000..c7cef26f4c748
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..3a85784d201b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..eeca65ba76abc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..6e802288da7be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..f71b54bae5248
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..2b5be13773dd5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9af.png
new file mode 100644
index 0000000000000..542dde3a9e632
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b0.png
new file mode 100644
index 0000000000000..d30e0010a0858
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b1.png
new file mode 100644
index 0000000000000..a50bcdb773732
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b2.png
new file mode 100644
index 0000000000000..7f8c9c0343888
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b3.png
new file mode 100644
index 0000000000000..d9ab3d622c129
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..2bc64e0fd20c2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bc.png
new file mode 100644
index 0000000000000..cd6f3ee38bd28
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..7dc045a999bd9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bd.png
new file mode 100644
index 0000000000000..bea6fd5f8ffb8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..f699015030c68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..1fdcbb1346b5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..628d12bdfc156
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..564efcef26c2e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-1faef-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..43c4697839756
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..5ba5b8635fef3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..6ed640ab1ef07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..b6c8a1110f88e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..92f4a52f4cdfb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..651837977e0c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..6b72c3a5e575c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..546203a463f2a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..b101259ad4872
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..bef3788ae07cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..529c3e6041c03
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..59617840ca304
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..8cb73c6954e1e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd.png
new file mode 100644
index 0000000000000..e4aea99247867
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f33e.png
new file mode 100644
index 0000000000000..4288e466d1fec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f373.png
new file mode 100644
index 0000000000000..cbccc305efd54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f37c.png
new file mode 100644
index 0000000000000..daa4a1bd54a61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f384.png
new file mode 100644
index 0000000000000..bbb8796fdbd58
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f393.png
new file mode 100644
index 0000000000000..b6ea714bc6c29
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3a4.png
new file mode 100644
index 0000000000000..c354254bd6afe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3a8.png
new file mode 100644
index 0000000000000..6aeda931f884f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3eb.png
new file mode 100644
index 0000000000000..ab2aa4994dc99
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3ed.png
new file mode 100644
index 0000000000000..421a07faa9306
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..101335825129d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..b4c1656bba20a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..f5c53c78b6157
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..7a4967afcd023
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f430-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f4bb.png
new file mode 100644
index 0000000000000..a9e8269bd4734
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f4bc.png
new file mode 100644
index 0000000000000..767ad37fdbecc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f527.png
new file mode 100644
index 0000000000000..f1793d24f4db8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f52c.png
new file mode 100644
index 0000000000000..39830d40784ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f680.png
new file mode 100644
index 0000000000000..a19a44cb6ef6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f692.png
new file mode 100644
index 0000000000000..d6eb28613d606
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..7e58b7fb33b50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..c4c0bb7c27364
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..1c87ac47956e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..9acfab532a0b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..26cef5b0cae88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9af.png
new file mode 100644
index 0000000000000..ea907f31fbea5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b0.png
new file mode 100644
index 0000000000000..e1e44448e9f95
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b1.png
new file mode 100644
index 0000000000000..1cd00e7767884
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b2.png
new file mode 100644
index 0000000000000..686089b88a6e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b3.png
new file mode 100644
index 0000000000000..3820783ba8e80
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..018067b5e1c3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bc.png
new file mode 100644
index 0000000000000..4c01fea875068
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..755178050b831
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bd.png
new file mode 100644
index 0000000000000..4d89035705faf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..5a387dc6d240d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..30ffaceeb68be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..9c681ae0ae9c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..640b009979057
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-1faef-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..7bbd95a8155b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..46dfbd0f1e928
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..f51a7bb099232
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..da5c2ec02b59a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..619e0c9dc2798
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..ee52f49cf5c0e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..50d9c522f883f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..da404b418229c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..9b1088d2dcadf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..4bafa7449decd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..4ad28a205b1f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..e2e60de7f0a1b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..06844e2d3248b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe.png
new file mode 100644
index 0000000000000..98fd811ee3350
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f33e.png
new file mode 100644
index 0000000000000..017942bcd6c0f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f373.png
new file mode 100644
index 0000000000000..8bd27337325ae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f37c.png
new file mode 100644
index 0000000000000..8e30073f4f98b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f384.png
new file mode 100644
index 0000000000000..1432544fc2c5f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f393.png
new file mode 100644
index 0000000000000..ef973d59b6fa7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3a4.png
new file mode 100644
index 0000000000000..839463e530fdc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3a8.png
new file mode 100644
index 0000000000000..494c966bd74e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3eb.png
new file mode 100644
index 0000000000000..6687d31166bb4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3ed.png
new file mode 100644
index 0000000000000..581f0ac8d5fb8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..224ae5ac20553
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..c66437155915d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..eebad7bd4f3f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..aed1e1d21dab2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f430-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f4bb.png
new file mode 100644
index 0000000000000..475e95e11b86c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f4bc.png
new file mode 100644
index 0000000000000..ce338cf323756
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f527.png
new file mode 100644
index 0000000000000..89f704df67da5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f52c.png
new file mode 100644
index 0000000000000..2b592b89dabf1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f680.png
new file mode 100644
index 0000000000000..c307fce21ccc9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f692.png
new file mode 100644
index 0000000000000..fa5f4e772c8e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..99feb8229beb7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..2ec63cdce3f2c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..6d7f9a24dfa88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..d7faf9293bd00
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..e0745cb85819d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9af.png
new file mode 100644
index 0000000000000..fd675d90c30ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b0.png
new file mode 100644
index 0000000000000..59c95dcd28801
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b1.png
new file mode 100644
index 0000000000000..d3f13d397923a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b2.png
new file mode 100644
index 0000000000000..4948d260302fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b3.png
new file mode 100644
index 0000000000000..b66b396f69422
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..26c5f1a7633aa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bc.png
new file mode 100644
index 0000000000000..bdcdcd1cdec0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..f00b8bfc8c1b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bd.png
new file mode 100644
index 0000000000000..041fd9f5b9246
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..33eb81a295e8e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..d399b89ac4a3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..6fba156c7832d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..521e770d2ef6a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-1faef-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..98c9f1b28e8cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..ec57bb7631d61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..76e27a6cfa530
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..0c837fe51f5be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..e53c5b5ab0191
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..8217fadc48082
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..7f6849e4be959
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..62bce01c72999
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..534a9fd574cb4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..64d4c1c1f7e05
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..7e4cf9dff4e05
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..7afaeaf87cbb7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..741c39ca2438d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff.png
new file mode 100644
index 0000000000000..94443e7b543d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f33e.png
new file mode 100644
index 0000000000000..7d7bc9383423e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f373.png
new file mode 100644
index 0000000000000..370414efa8ad1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f37c.png
new file mode 100644
index 0000000000000..38c86b659031f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f384.png
new file mode 100644
index 0000000000000..44e75755f2198
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f393.png
new file mode 100644
index 0000000000000..9cd13fdc726ce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3a4.png
new file mode 100644
index 0000000000000..e45c0323b4674
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3a8.png
new file mode 100644
index 0000000000000..00af96eb897ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3eb.png
new file mode 100644
index 0000000000000..fd1fd2a4f5c72
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3ed.png
new file mode 100644
index 0000000000000..e934a5ada3b27
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f466-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f466-200d-1f466.png
new file mode 100644
index 0000000000000..ee87fb5f672c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f466-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f466.png
new file mode 100644
index 0000000000000..4b0224ae1c0c2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467-200d-1f466.png
new file mode 100644
index 0000000000000..ddcd333322d4e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467-200d-1f467.png
new file mode 100644
index 0000000000000..879886f6880e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467.png
new file mode 100644
index 0000000000000..0a6f96ba17ce4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f466-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f466-200d-1f466.png
new file mode 100644
index 0000000000000..1b698206b04dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f466-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f466.png
new file mode 100644
index 0000000000000..d4b9231acc8db
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467-200d-1f466.png
new file mode 100644
index 0000000000000..e5bea54b6a8b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467-200d-1f467.png
new file mode 100644
index 0000000000000..b7a8e9a30aa6b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467.png
new file mode 100644
index 0000000000000..d2cbee8fe2c0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f468-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f466-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f466-200d-1f466.png
new file mode 100644
index 0000000000000..dffdd9cc80b60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f466-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f466.png
new file mode 100644
index 0000000000000..40d006d2ca559
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467-200d-1f466.png
new file mode 100644
index 0000000000000..7eb04555c31b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467-200d-1f467.png
new file mode 100644
index 0000000000000..d3571fa447ee4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467.png
new file mode 100644
index 0000000000000..73fc6e578e506
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f469-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f4bb.png
new file mode 100644
index 0000000000000..b55ddcb360d08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f4bc.png
new file mode 100644
index 0000000000000..9b1e7dd16742f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f527.png
new file mode 100644
index 0000000000000..d731a12c7cc59
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f52c.png
new file mode 100644
index 0000000000000..10d2db918ce42
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f680.png
new file mode 100644
index 0000000000000..698e909a12539
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f692.png
new file mode 100644
index 0000000000000..07fa090b4f48d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..2ea3def5988bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9af.png
new file mode 100644
index 0000000000000..3672517803851
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b0.png
new file mode 100644
index 0000000000000..4d5ef0e8408e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b1.png
new file mode 100644
index 0000000000000..36afa4fe95fd3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b2.png
new file mode 100644
index 0000000000000..8e3a83850644a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b3.png
new file mode 100644
index 0000000000000..8886449b99a9f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..57aa99a13ecb4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bc.png
new file mode 100644
index 0000000000000..d7110f072acf7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..62c0228551382
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bd.png
new file mode 100644
index 0000000000000..ce9c939e7c5b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..0155f25b7b035
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..ffba6a5cc3c47
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..9f7bbb145f039
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-2764-fe0f-200d-1f468.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2764-fe0f-200d-1f468.png
new file mode 100644
index 0000000000000..c332da0d55696
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2764-fe0f-200d-1f468.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468-200d-2764-fe0f-200d-1f48b-200d-1f468.png b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2764-fe0f-200d-1f48b-200d-1f468.png
new file mode 100644
index 0000000000000..619116ee22b49
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468-200d-2764-fe0f-200d-1f48b-200d-1f468.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f468.png b/Shared/CIPPSharp/bin/twemoji/1f468.png
new file mode 100644
index 0000000000000..8ebc6be4ae307
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f468.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f33e.png
new file mode 100644
index 0000000000000..01336cf2b676c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f373.png
new file mode 100644
index 0000000000000..f2772df0d66a9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f37c.png
new file mode 100644
index 0000000000000..f14e525bd5de7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f384.png
new file mode 100644
index 0000000000000..6d3c340692069
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f393.png
new file mode 100644
index 0000000000000..b8dda6f8c96a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3a4.png
new file mode 100644
index 0000000000000..ebeac884bd583
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3a8.png
new file mode 100644
index 0000000000000..a8130c1f2eff8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3eb.png
new file mode 100644
index 0000000000000..ec83c4c826f28
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3ed.png
new file mode 100644
index 0000000000000..8f8f9062a39e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..b67c2aa3e3293
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..01c5669455912
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..ec00b0c12a0b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..0af5779799d23
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f430-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f4bb.png
new file mode 100644
index 0000000000000..1b4de1c454703
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f4bc.png
new file mode 100644
index 0000000000000..c48aabe00b37a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f527.png
new file mode 100644
index 0000000000000..0bdb1bb66bbe9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f52c.png
new file mode 100644
index 0000000000000..3af32eeddbed6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f680.png
new file mode 100644
index 0000000000000..3279782af1ee0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f692.png
new file mode 100644
index 0000000000000..81148034d9881
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..04d54b11f6506
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..634db3cf5feae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..89c6c6dfe273e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..a93dbebd069d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..5e77313428033
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..41834dd9ff00c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..72a9f81285ec7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..68bf8a6891584
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f91d-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..508c94ee334eb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9af.png
new file mode 100644
index 0000000000000..3e532dbcddd12
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b0.png
new file mode 100644
index 0000000000000..189c8458f5cde
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b1.png
new file mode 100644
index 0000000000000..3a9bee7f4e3df
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b2.png
new file mode 100644
index 0000000000000..9c6334028b2d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b3.png
new file mode 100644
index 0000000000000..d7ba9dd493a15
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..fa28f7e63fe74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bc.png
new file mode 100644
index 0000000000000..840f5d1d377a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..181b8a343ed50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bd.png
new file mode 100644
index 0000000000000..5d3b083b4c952
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..c05962ed3de31
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..905963c4151cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..76c7111bc810e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..130de56844bb6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-1faef-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..57c7ce71e131b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..0b91b7b5da45e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..52f3f5ac251d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..6abeec5e11900
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..68839e31531bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..d7b5854e88178
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..4df2de094c9c2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..ea30ee71595e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..b75ca49c728f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..684f958f46125
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..f7c8955059a0b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..d1d44f460f71f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..2b42948594491
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..eeeb5612db598
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..cc49c8299c680
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..248c9382f55a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..fb9b86989eb48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..96a9871423c0c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..dcd0954ff5c4c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..91df6227b37b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..fbafff818e9ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..98e2a42003a3e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..fc113be7c25a9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb.png
new file mode 100644
index 0000000000000..6fe70fb42acdb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f33e.png
new file mode 100644
index 0000000000000..fdd72768298f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f373.png
new file mode 100644
index 0000000000000..b49e21297604a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f37c.png
new file mode 100644
index 0000000000000..be4de07d79684
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f384.png
new file mode 100644
index 0000000000000..52c9ba810d3b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f393.png
new file mode 100644
index 0000000000000..83fcaee79db19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3a4.png
new file mode 100644
index 0000000000000..376945c0f4cb0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3a8.png
new file mode 100644
index 0000000000000..c60866bbc3014
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3eb.png
new file mode 100644
index 0000000000000..77f9248f4fc71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3ed.png
new file mode 100644
index 0000000000000..9c1e189d53db8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..e53f02c435cb2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..d52df03f2d020
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..5f9421ea161e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..272c6a4cc8cf0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f430-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f4bb.png
new file mode 100644
index 0000000000000..8d5d19e6923d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f4bc.png
new file mode 100644
index 0000000000000..464266db06b68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f527.png
new file mode 100644
index 0000000000000..a7227fa9050c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f52c.png
new file mode 100644
index 0000000000000..98c2b0578b2be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f680.png
new file mode 100644
index 0000000000000..ac9ae0e67d271
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f692.png
new file mode 100644
index 0000000000000..b68993e5251de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..abb332bb8783c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..5f6a93568f0aa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..a00d6d7da8670
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..94502bbc28b55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..f1580c23ed282
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..d73b98c43377e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..a356909601d27
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..377891fd05c81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f91d-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..24307e3447cbf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9af.png
new file mode 100644
index 0000000000000..598edf8d97757
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b0.png
new file mode 100644
index 0000000000000..d4453666b3517
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b1.png
new file mode 100644
index 0000000000000..00e006de0f57b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b2.png
new file mode 100644
index 0000000000000..47ef56b31a16e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b3.png
new file mode 100644
index 0000000000000..30aece94502c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..9015d7aa92407
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bc.png
new file mode 100644
index 0000000000000..1522085332909
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..c69fa8d6fa68e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bd.png
new file mode 100644
index 0000000000000..3b739dacfc421
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..06abad9fb6348
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..20bd3a1f7d098
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..dd85f783780fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..91c559c2dc4c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-1faef-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..256743387ebfa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..44a0942517b1a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..afe2b71eddd66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..31285f92fe9cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..521cde1def838
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..3feae07a6b85d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..49c1c5d66dd72
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..c2a3bc4a718dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..349fcbde31e34
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..f8ad5951da211
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..453036d7302a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..c1db221991c82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..2355698dc5903
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..e4364650ef659
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..dc588d402d7f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..6fcaba167284d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..9947bd58653ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..389c1ff7bd914
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..6c5c51161b681
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..5dca5078ecb74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..d94389a658836
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..37d3eedb0e2ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..a5b00492ceeac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc.png
new file mode 100644
index 0000000000000..ef30b5b50fc54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f33e.png
new file mode 100644
index 0000000000000..ab863a38dd1d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f373.png
new file mode 100644
index 0000000000000..d8cb7162537cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f37c.png
new file mode 100644
index 0000000000000..f6380c01cf08c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f384.png
new file mode 100644
index 0000000000000..9651385708daf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f393.png
new file mode 100644
index 0000000000000..1d75113f5c7bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3a4.png
new file mode 100644
index 0000000000000..aeee09c4353ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3a8.png
new file mode 100644
index 0000000000000..dc3d89a35ec5e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3eb.png
new file mode 100644
index 0000000000000..5d78b83432483
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3ed.png
new file mode 100644
index 0000000000000..1b5be523ba0d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..8a6e9357a59ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..a3552fc01556f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..5e366f800aa40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..1d3e4248627b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f430-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f4bb.png
new file mode 100644
index 0000000000000..4ee8b25a584e1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f4bc.png
new file mode 100644
index 0000000000000..24b42f4d30175
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f527.png
new file mode 100644
index 0000000000000..30a610ea22918
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f52c.png
new file mode 100644
index 0000000000000..240e843f7c6be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f680.png
new file mode 100644
index 0000000000000..e8bc3b12e6242
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f692.png
new file mode 100644
index 0000000000000..4ca5e00308169
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..7db467b58a7c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..59bf91323077c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..9cf571019156c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..ad588fcd75fba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..64a48c6aa5bf9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..9068a99a0ef63
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..d705ac79cec8d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..792b28361db3b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f91d-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..cf27ce73fc717
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9af.png
new file mode 100644
index 0000000000000..71a6adab9cda2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b0.png
new file mode 100644
index 0000000000000..36b5bbd70f5e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b1.png
new file mode 100644
index 0000000000000..82049eb799d69
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b2.png
new file mode 100644
index 0000000000000..c66fd3fdd19f7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b3.png
new file mode 100644
index 0000000000000..6feda96ac2ff7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..d4512140e9ee1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bc.png
new file mode 100644
index 0000000000000..9ff345026ea85
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..53f022c09312f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bd.png
new file mode 100644
index 0000000000000..432260e9bbb82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..d1aa282fc0c42
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..3bc22f22d4cac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..e98018a5df1e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..2b8fe5916d214
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-1faef-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..ccf237ccb2e97
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..6f56b22ae25f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..45c0a24913966
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..206e1a5623b82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..02bd684d583c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..d54a5b4f5f30f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..c6cdea3693b1d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..0d822f8189468
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..f606a06bd2811
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..7fcb5a963b382
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..c113409044657
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..e6966af61ac27
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..33337f36c061e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..0ee1621a52e08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..11982d12a5f60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..ea319f30e3541
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..80a370409fc5d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..510571ddce6ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..3126c6c1af9f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..98fab6f963954
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..99f90fb6f4f78
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..b25ef75e8a9eb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..d735157eb7807
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd.png
new file mode 100644
index 0000000000000..c5f68bae0f56d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f33e.png
new file mode 100644
index 0000000000000..520a84bdb8047
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f373.png
new file mode 100644
index 0000000000000..00860e85eebd3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f37c.png
new file mode 100644
index 0000000000000..2941a44c5effb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f384.png
new file mode 100644
index 0000000000000..3ec0c5686e2e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f393.png
new file mode 100644
index 0000000000000..5740309845974
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3a4.png
new file mode 100644
index 0000000000000..3897fa2d2a667
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3a8.png
new file mode 100644
index 0000000000000..5521daed8aee1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3eb.png
new file mode 100644
index 0000000000000..362323f42c4bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3ed.png
new file mode 100644
index 0000000000000..0dc2e09e25a63
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..f592eeab624a9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..b4ef338e68df8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..acf8a2ca52976
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..575912acacb7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f430-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f4bb.png
new file mode 100644
index 0000000000000..6107c8305fe4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f4bc.png
new file mode 100644
index 0000000000000..b4a3d21965870
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f527.png
new file mode 100644
index 0000000000000..45ef04294dfc6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f52c.png
new file mode 100644
index 0000000000000..d808b83cdfdf0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f680.png
new file mode 100644
index 0000000000000..b81db8a6a91cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f692.png
new file mode 100644
index 0000000000000..e8ebea98adae0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..96bab42fe3f2b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..ec63a8daf9273
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..e28c33145bde3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..4a44a039d269d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..97a1b798aeb66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..88eb58af4bf26
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..09992c848d422
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..2865b2d0cca88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f91d-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..1865c5c0fd1f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9af.png
new file mode 100644
index 0000000000000..1a868a9429f0b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b0.png
new file mode 100644
index 0000000000000..ea95260345b18
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b1.png
new file mode 100644
index 0000000000000..fcfa7dd7a3a80
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b2.png
new file mode 100644
index 0000000000000..7b8d469877a7a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b3.png
new file mode 100644
index 0000000000000..2adad8ef1cf47
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..1c2053756d577
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bc.png
new file mode 100644
index 0000000000000..b2f38a46194da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..11d7be87cdd21
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bd.png
new file mode 100644
index 0000000000000..31f9f77e3a158
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..77f75ac71168c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..237b9c0b7fbf0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..fb48616f580b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..5f54ba5545e4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-1faef-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..1e54df038dd25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..717291843456d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..c07612d8a731c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..39ad0efe9685d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..8d9e5ee9a2d30
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..7aebfc0948c23
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..e1a35a7716404
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..ef0e889fe62ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..13955c52816a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..673dff419900b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..8e965d3e4086d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..dfaeda2a7de3f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..4137f157b9661
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..be6712935f18c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..d12011600da50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..3457dd389fd8a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..34c45bcee9c8e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..74e69f5ad2e51
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..3cdcd5d25dd73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..a2e182d2308a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..3a0cbc15619d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..c919434ea4d5c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..60acfb5941d9f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe.png
new file mode 100644
index 0000000000000..294369061f2f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f33e.png
new file mode 100644
index 0000000000000..7e6a26f7d3eb7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f373.png
new file mode 100644
index 0000000000000..6bc9ea8a92812
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f37c.png
new file mode 100644
index 0000000000000..519d8e43accb3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f384.png
new file mode 100644
index 0000000000000..f86966be832c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f393.png
new file mode 100644
index 0000000000000..60292568c134b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3a4.png
new file mode 100644
index 0000000000000..91976880edd54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3a8.png
new file mode 100644
index 0000000000000..1217f191a7272
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3eb.png
new file mode 100644
index 0000000000000..b8cae5d44ea03
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3ed.png
new file mode 100644
index 0000000000000..e93b848a3cd32
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..4f633e5974a0e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..98cf5a1172e97
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..2ea21e9292d7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..6f0aaa14a08fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f430-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f4bb.png
new file mode 100644
index 0000000000000..0bfedd67cd790
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f4bc.png
new file mode 100644
index 0000000000000..81b90ae238f32
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f527.png
new file mode 100644
index 0000000000000..a03fdb747083e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f52c.png
new file mode 100644
index 0000000000000..bddc3c88f2b7a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f680.png
new file mode 100644
index 0000000000000..e2609e7f214c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f692.png
new file mode 100644
index 0000000000000..a41c8c3f18286
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..b09e52c1df9f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..52b1a7faf382b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..06fb17dbcefd7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..a55b2981f5658
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..0354f5130e155
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..a0be380ae8cc6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..4328159c2e006
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..80d7e7fa78c81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f91d-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..7d0996217593c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9af.png
new file mode 100644
index 0000000000000..cd03b2dd09abc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b0.png
new file mode 100644
index 0000000000000..805814296d430
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b1.png
new file mode 100644
index 0000000000000..7ae6c1ff7c1fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b2.png
new file mode 100644
index 0000000000000..ced00feafd0a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b3.png
new file mode 100644
index 0000000000000..fdc58db65eb81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..8fd25c2b63353
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bc.png
new file mode 100644
index 0000000000000..0b0320ccc284e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..1b821c0540a49
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bd.png
new file mode 100644
index 0000000000000..9af884f32e71c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..99fbcb06a4e67
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..a5e4fd21ac6f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..a324ec8c9a544
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..56779c0a96d66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-1faef-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..16435b24c1f8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..b3651d1e90600
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..798cd2a8be777
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..3012fc53ba505
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..c2d672ca471ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..63b6d1058fa55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..7fb5c124d7855
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..e796b055f23cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..a95a138db5386
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..8a6ae7b04d8be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..eba466bf620c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..db682f62ebfa6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..4890f4668743c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png
new file mode 100644
index 0000000000000..0468d7bf376ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png
new file mode 100644
index 0000000000000..0bead8d1bc828
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png
new file mode 100644
index 0000000000000..187f23270ab88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png
new file mode 100644
index 0000000000000..9f920bdd86fc7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png
new file mode 100644
index 0000000000000..de2699dc8f8d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f468-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png
new file mode 100644
index 0000000000000..48b888bca271b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png
new file mode 100644
index 0000000000000..cb68cc6a4cf02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png
new file mode 100644
index 0000000000000..aa06a8bcb20ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png
new file mode 100644
index 0000000000000..1f7a610e30bea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png
new file mode 100644
index 0000000000000..663dc3885c7da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff.png
new file mode 100644
index 0000000000000..3d2c2262011f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f33e.png
new file mode 100644
index 0000000000000..039da46e99809
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f373.png
new file mode 100644
index 0000000000000..6a2f087204a5c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f37c.png
new file mode 100644
index 0000000000000..aadeca6076c7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f384.png
new file mode 100644
index 0000000000000..56dc794884bbb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f393.png
new file mode 100644
index 0000000000000..86f0cefe9a984
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3a4.png
new file mode 100644
index 0000000000000..06d534d439ac9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3a8.png
new file mode 100644
index 0000000000000..7c50ca6ca4d87
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3eb.png
new file mode 100644
index 0000000000000..b4a6c798afa3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3ed.png
new file mode 100644
index 0000000000000..c3a0396c115ae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f466-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f466-200d-1f466.png
new file mode 100644
index 0000000000000..a5dc61401abab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f466-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f466.png
new file mode 100644
index 0000000000000..9dd4a0fb62fea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467-200d-1f466.png
new file mode 100644
index 0000000000000..b0b4723200597
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467-200d-1f467.png
new file mode 100644
index 0000000000000..6f77e1fdfb3ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467.png
new file mode 100644
index 0000000000000..972cf4b4b72c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f466-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f466-200d-1f466.png
new file mode 100644
index 0000000000000..00372fcf3c193
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f466-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f466.png
new file mode 100644
index 0000000000000..0cbbd882902b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467-200d-1f466.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467-200d-1f466.png
new file mode 100644
index 0000000000000..ea533a05a1029
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467-200d-1f466.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467-200d-1f467.png
new file mode 100644
index 0000000000000..d58eb387aa60a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467.png
new file mode 100644
index 0000000000000..057cab2e44b78
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f469-200d-1f467.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f4bb.png
new file mode 100644
index 0000000000000..b9471c2dc6c1e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f4bc.png
new file mode 100644
index 0000000000000..1646ce6498a1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f527.png
new file mode 100644
index 0000000000000..95e2c6589b021
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f52c.png
new file mode 100644
index 0000000000000..af9c4fe71fca6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f680.png
new file mode 100644
index 0000000000000..d1a0dc9c643cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f692.png
new file mode 100644
index 0000000000000..282f50cb478c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..e020a5abd1ad0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9af.png
new file mode 100644
index 0000000000000..4c2c23eb6654c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b0.png
new file mode 100644
index 0000000000000..373c1c537b75c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b1.png
new file mode 100644
index 0000000000000..80ca4a5c3bbf7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b2.png
new file mode 100644
index 0000000000000..2fe69f9458c7f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b3.png
new file mode 100644
index 0000000000000..98de2e9c3ebf8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..f977c402fbbdc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bc.png
new file mode 100644
index 0000000000000..8f9a994642c29
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..5c3783fce9430
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bd.png
new file mode 100644
index 0000000000000..23b365ddc0dda
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..c33e27829f93c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..65e7b72694f25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..ccb503b8b27cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f468.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f468.png
new file mode 100644
index 0000000000000..d559bec4b400a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f468.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f469.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f469.png
new file mode 100644
index 0000000000000..42400b469b05c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f469.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f48b-200d-1f468.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f48b-200d-1f468.png
new file mode 100644
index 0000000000000..bced8de9f4ca5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f48b-200d-1f468.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f48b-200d-1f469.png b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f48b-200d-1f469.png
new file mode 100644
index 0000000000000..8055e53c7b72c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469-200d-2764-fe0f-200d-1f48b-200d-1f469.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f469.png b/Shared/CIPPSharp/bin/twemoji/1f469.png
new file mode 100644
index 0000000000000..918d94f8a470f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f469.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46a.png b/Shared/CIPPSharp/bin/twemoji/1f46a.png
new file mode 100644
index 0000000000000..d11a22ec6e3ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fb.png
new file mode 100644
index 0000000000000..c82b331ae02e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fc.png
new file mode 100644
index 0000000000000..d756e1a64e654
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fd.png
new file mode 100644
index 0000000000000..bd6315f21b6a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fe.png
new file mode 100644
index 0000000000000..75c3f3391ca1e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46b-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3ff.png
new file mode 100644
index 0000000000000..8d46caeacb891
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46b-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46b.png b/Shared/CIPPSharp/bin/twemoji/1f46b.png
new file mode 100644
index 0000000000000..dd41b77856b37
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fb.png
new file mode 100644
index 0000000000000..7a7105d5ce8b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fc.png
new file mode 100644
index 0000000000000..f3f01894ec97e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fd.png
new file mode 100644
index 0000000000000..5a3839e45db0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fe.png
new file mode 100644
index 0000000000000..c24f08b025a48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3ff.png
new file mode 100644
index 0000000000000..2b04da70d3ac1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46c.png b/Shared/CIPPSharp/bin/twemoji/1f46c.png
new file mode 100644
index 0000000000000..63649e2bc1522
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fb.png
new file mode 100644
index 0000000000000..9eb93c9b3500d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fc.png
new file mode 100644
index 0000000000000..51a33eebf409b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fd.png
new file mode 100644
index 0000000000000..47ade250696de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fe.png
new file mode 100644
index 0000000000000..1ac7b9e6ce955
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46d-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3ff.png
new file mode 100644
index 0000000000000..bc5432db845b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46d-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46d.png b/Shared/CIPPSharp/bin/twemoji/1f46d.png
new file mode 100644
index 0000000000000..5dbc59dacb2ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3a6da267e636b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..70042a6aa0ee8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb.png
new file mode 100644
index 0000000000000..0c8e6410c46b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..6175b1d664095
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..7a8fda8766e2c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc.png
new file mode 100644
index 0000000000000..7b5c5252cddcd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8e2c504b4d07a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..33f8980e71340
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd.png
new file mode 100644
index 0000000000000..f9e093e9f48d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..df3dad6aacf76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..2baa54ab5a56a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe.png
new file mode 100644
index 0000000000000..8275ab3b11701
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..9098ad285043c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e31a033ba38f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff.png
new file mode 100644
index 0000000000000..5e0e1f1d9a6f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..13ed498d63958
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46e-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..acd2111f6164e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46e.png b/Shared/CIPPSharp/bin/twemoji/1f46e.png
new file mode 100644
index 0000000000000..7093bb3cd61b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3f3ca7501eb8c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c3e5b8dd33c09
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb.png
new file mode 100644
index 0000000000000..7ff623d60714f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..0c0b35c151997
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..59121b11a1d89
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc.png
new file mode 100644
index 0000000000000..30442cbaf31ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1bd8515100efa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..89980b0c13866
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd.png
new file mode 100644
index 0000000000000..4aa486889dae4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..db6c77f19f953
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f2cd5c54ba083
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe.png
new file mode 100644
index 0000000000000..e006614e2098f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..0925233ef7b2a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c2cbf77778ecf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff.png
new file mode 100644
index 0000000000000..12be93bb2ed69
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e71b3cc1c0e43
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f46f-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..13fb047fb53a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f46f.png b/Shared/CIPPSharp/bin/twemoji/1f46f.png
new file mode 100644
index 0000000000000..5b84d390400ae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f46f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e3a5d3ff7c673
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..af472a42b30f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb.png
new file mode 100644
index 0000000000000..c28329b037a3a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b054d60fafee0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..954b610ce3549
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc.png
new file mode 100644
index 0000000000000..c231a438c5939
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..29159df5f2b84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..39a13a4b27aac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd.png
new file mode 100644
index 0000000000000..5dcec53626b05
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bf45ade5f3a4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f7691ee7c8d1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe.png
new file mode 100644
index 0000000000000..0f8a2fb28a8ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..86e4a38016b2d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..464cd6cc44034
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff.png
new file mode 100644
index 0000000000000..9e7cff0276856
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dafe0b4746140
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f470-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..278ac8d861868
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f470.png b/Shared/CIPPSharp/bin/twemoji/1f470.png
new file mode 100644
index 0000000000000..3adfd123ed71c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f470.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..06e54a10b7899
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9da7e3f7fb64d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb.png
new file mode 100644
index 0000000000000..9a9dbe92eb77c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..0f58537be863d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..7ff9efd4dab8e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc.png
new file mode 100644
index 0000000000000..01319fe8423be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..377a236450c0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5780e5eb278bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd.png
new file mode 100644
index 0000000000000..e28275a14bf24
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e5856a3a9081e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..60694c689fb50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe.png
new file mode 100644
index 0000000000000..599b7ba9d9a55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..15a0886ea905c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..91e94883a8c8d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff.png
new file mode 100644
index 0000000000000..56bd2f00406e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..59f40b86e377a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f471-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d4c3407b5c756
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f471.png b/Shared/CIPPSharp/bin/twemoji/1f471.png
new file mode 100644
index 0000000000000..2825ca0ec1b92
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f471.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f472-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fb.png
new file mode 100644
index 0000000000000..7330ddb3926d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f472-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fc.png
new file mode 100644
index 0000000000000..46758f8e86133
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f472-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fd.png
new file mode 100644
index 0000000000000..ff468047329da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f472-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fe.png
new file mode 100644
index 0000000000000..a8e65ba81d969
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f472-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f472-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f472-1f3ff.png
new file mode 100644
index 0000000000000..ade1565c18926
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f472-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f472.png b/Shared/CIPPSharp/bin/twemoji/1f472.png
new file mode 100644
index 0000000000000..818c6fac4baba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f472.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..255fa6adba73b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..42453c6fdb217
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb.png
new file mode 100644
index 0000000000000..44096010ca10f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..2c6fc0b44ec8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5b6257f79d3c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc.png
new file mode 100644
index 0000000000000..9287f432ac2a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5114a3f61c7df
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5bb1f8422a9f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd.png
new file mode 100644
index 0000000000000..64ec778f7c3ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dc8229ff0bf60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a7a297c7958d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe.png
new file mode 100644
index 0000000000000..bd69b7bfeae2f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..455c763e58352
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4cb5d7dd524fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff.png
new file mode 100644
index 0000000000000..89e31c4bbbe92
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..102b138b6da5c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f473-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..81b794e3ede54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f473.png b/Shared/CIPPSharp/bin/twemoji/1f473.png
new file mode 100644
index 0000000000000..793d62fa6c780
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f473.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f474-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fb.png
new file mode 100644
index 0000000000000..75647b8dbc58e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f474-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fc.png
new file mode 100644
index 0000000000000..35d32ce14ecf9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f474-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fd.png
new file mode 100644
index 0000000000000..2bed5c60485bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f474-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fe.png
new file mode 100644
index 0000000000000..6b70028287272
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f474-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f474-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f474-1f3ff.png
new file mode 100644
index 0000000000000..2fb3fb1ce1a0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f474-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f474.png b/Shared/CIPPSharp/bin/twemoji/1f474.png
new file mode 100644
index 0000000000000..5650d2b0c2cab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f474.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f475-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fb.png
new file mode 100644
index 0000000000000..dda546263e114
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f475-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fc.png
new file mode 100644
index 0000000000000..a73b9f647fd06
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f475-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fd.png
new file mode 100644
index 0000000000000..fe04b280e9bd7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f475-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fe.png
new file mode 100644
index 0000000000000..f2ecc405563aa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f475-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f475-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f475-1f3ff.png
new file mode 100644
index 0000000000000..d10982f3999c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f475-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f475.png b/Shared/CIPPSharp/bin/twemoji/1f475.png
new file mode 100644
index 0000000000000..e9d04f9e69f9f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f475.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f476-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fb.png
new file mode 100644
index 0000000000000..949fd809cb7dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f476-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fc.png
new file mode 100644
index 0000000000000..d06f285a2ce8c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f476-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fd.png
new file mode 100644
index 0000000000000..4da9b776d77c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f476-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fe.png
new file mode 100644
index 0000000000000..14f78b00e9e06
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f476-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f476-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f476-1f3ff.png
new file mode 100644
index 0000000000000..2008c1726d698
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f476-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f476.png b/Shared/CIPPSharp/bin/twemoji/1f476.png
new file mode 100644
index 0000000000000..f093e36bb925b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f476.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..abb56fda88cb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..25f1238cf00e1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb.png
new file mode 100644
index 0000000000000..069befedd333e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f01d7faf54ad3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..03035e37c5490
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc.png
new file mode 100644
index 0000000000000..aa57d0135217c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a9a62219119f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1475fc9949aa9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd.png
new file mode 100644
index 0000000000000..3c96be1b8d5ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..72172594edeb6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..2083c8be7c4be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe.png
new file mode 100644
index 0000000000000..72ea66cb29912
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c818e20b45c68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..627ad314175f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff.png
new file mode 100644
index 0000000000000..3b934e5d11b91
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5a3ed34ad4322
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f477-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fe6733ec0cb9b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f477.png b/Shared/CIPPSharp/bin/twemoji/1f477.png
new file mode 100644
index 0000000000000..49aef2f63671e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f477.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f478-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fb.png
new file mode 100644
index 0000000000000..4caae554c83cf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f478-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fc.png
new file mode 100644
index 0000000000000..ad2322790680c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f478-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fd.png
new file mode 100644
index 0000000000000..61dcaca7b9358
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f478-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fe.png
new file mode 100644
index 0000000000000..71c963faed01a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f478-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f478-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f478-1f3ff.png
new file mode 100644
index 0000000000000..7579ff1914fba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f478-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f478.png b/Shared/CIPPSharp/bin/twemoji/1f478.png
new file mode 100644
index 0000000000000..6542a8d9b0896
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f478.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f479.png b/Shared/CIPPSharp/bin/twemoji/1f479.png
new file mode 100644
index 0000000000000..e9ca4c6f3ac30
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f479.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47a.png b/Shared/CIPPSharp/bin/twemoji/1f47a.png
new file mode 100644
index 0000000000000..a479705e10500
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47b.png b/Shared/CIPPSharp/bin/twemoji/1f47b.png
new file mode 100644
index 0000000000000..93eebb055c7e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fb.png
new file mode 100644
index 0000000000000..161df6e791bd4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fc.png
new file mode 100644
index 0000000000000..e72aa44c898f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fd.png
new file mode 100644
index 0000000000000..0cd969ba94b1b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fe.png
new file mode 100644
index 0000000000000..e82ae008cb878
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3ff.png
new file mode 100644
index 0000000000000..ecf1950186554
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47c.png b/Shared/CIPPSharp/bin/twemoji/1f47c.png
new file mode 100644
index 0000000000000..584cd15d4d703
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47d.png b/Shared/CIPPSharp/bin/twemoji/1f47d.png
new file mode 100644
index 0000000000000..e722644aa2013
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47e.png b/Shared/CIPPSharp/bin/twemoji/1f47e.png
new file mode 100644
index 0000000000000..043e4950ac329
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f47f.png b/Shared/CIPPSharp/bin/twemoji/1f47f.png
new file mode 100644
index 0000000000000..5bc58b3ddddf9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f47f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f480.png b/Shared/CIPPSharp/bin/twemoji/1f480.png
new file mode 100644
index 0000000000000..e9f9e7fc455a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f480.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..6ff67d24b7bfe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9477058016f68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb.png
new file mode 100644
index 0000000000000..24d5128f903a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..2198601817690
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0242604a638f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc.png
new file mode 100644
index 0000000000000..96fb262c30df9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..22a5d00a30875
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ec70756513aeb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd.png
new file mode 100644
index 0000000000000..115223a816fe1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1bfc1fdb6749c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ace710f49d8a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe.png
new file mode 100644
index 0000000000000..668de97a58064
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f475567604c61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..92611e20142c2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff.png
new file mode 100644
index 0000000000000..440c65c5ebf0c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1669256349fe0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f481-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0c1369ab732bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f481.png b/Shared/CIPPSharp/bin/twemoji/1f481.png
new file mode 100644
index 0000000000000..eca519992a254
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f481.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..757e031bc4033
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..7769d5353719b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb.png
new file mode 100644
index 0000000000000..73e15cdfb1981
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..52bb7244e29d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1664fa8df56f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc.png
new file mode 100644
index 0000000000000..df444ad5774ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..20ceadf907313
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5cf7987069367
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd.png
new file mode 100644
index 0000000000000..9cafd1242b1cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..78671ba2d3379
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..37e92ac881e28
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe.png
new file mode 100644
index 0000000000000..0324eed397c60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f2e824f8affe1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6d658ba383bd0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff.png
new file mode 100644
index 0000000000000..23fcb9b4b988c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..db3181a9e1fdf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f482-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..954eee8342926
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f482.png b/Shared/CIPPSharp/bin/twemoji/1f482.png
new file mode 100644
index 0000000000000..b5a7d423ac35c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f482.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f483-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fb.png
new file mode 100644
index 0000000000000..ec9955f575727
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f483-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fc.png
new file mode 100644
index 0000000000000..e1768ae610d18
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f483-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fd.png
new file mode 100644
index 0000000000000..885fc7edb2d46
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f483-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fe.png
new file mode 100644
index 0000000000000..824b1cdad4d48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f483-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f483-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f483-1f3ff.png
new file mode 100644
index 0000000000000..2288e55a257c3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f483-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f483.png b/Shared/CIPPSharp/bin/twemoji/1f483.png
new file mode 100644
index 0000000000000..758c9b077da15
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f483.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f484.png b/Shared/CIPPSharp/bin/twemoji/1f484.png
new file mode 100644
index 0000000000000..6427cf477a394
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f484.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f485-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fb.png
new file mode 100644
index 0000000000000..94c08c55def90
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f485-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fc.png
new file mode 100644
index 0000000000000..46c13f0da2afb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f485-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fd.png
new file mode 100644
index 0000000000000..dc23af78440e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f485-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fe.png
new file mode 100644
index 0000000000000..1b964408433a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f485-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f485-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f485-1f3ff.png
new file mode 100644
index 0000000000000..32d637ccf3c96
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f485-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f485.png b/Shared/CIPPSharp/bin/twemoji/1f485.png
new file mode 100644
index 0000000000000..cba5a05fcf3eb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f485.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..9358a2510a6db
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..3e1a5eafb67bd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb.png
new file mode 100644
index 0000000000000..7efac7579fb77
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..82f2f6a48dad3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..734dce274e132
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc.png
new file mode 100644
index 0000000000000..a021bd20501b1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f95d2d1349f2f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5a43d75899280
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd.png
new file mode 100644
index 0000000000000..e4ebf9678b3f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..efd42dbadba9d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0225d35992b42
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe.png
new file mode 100644
index 0000000000000..e64dde84c430a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dae49c589d538
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..31e00a02efab3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff.png
new file mode 100644
index 0000000000000..cb742c724669e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8c4b5524186d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f486-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..428e9688d8353
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f486.png b/Shared/CIPPSharp/bin/twemoji/1f486.png
new file mode 100644
index 0000000000000..20eac93bc84d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f486.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d43b5be2867ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..28a8f358739f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb.png
new file mode 100644
index 0000000000000..7d257dfd55567
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..268ed6a121b30
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..99e8cf9544670
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc.png
new file mode 100644
index 0000000000000..c85ad00c528b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7b8a067c08df8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ea5d33fa13b6e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd.png
new file mode 100644
index 0000000000000..6210438abfdd4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5a6ce144d8257
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..b3c78959de122
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe.png
new file mode 100644
index 0000000000000..b02ae7a6145f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..0a8e1f3b49bb4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fa980f2467b15
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff.png
new file mode 100644
index 0000000000000..720901ada392f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..acd8162d19fd5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f487-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8b290f6dc25f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f487.png b/Shared/CIPPSharp/bin/twemoji/1f487.png
new file mode 100644
index 0000000000000..029cb0b6d561d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f487.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f488.png b/Shared/CIPPSharp/bin/twemoji/1f488.png
new file mode 100644
index 0000000000000..5c19ed5067de6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f488.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f489.png b/Shared/CIPPSharp/bin/twemoji/1f489.png
new file mode 100644
index 0000000000000..5f2d305e7c40b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f489.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48a.png b/Shared/CIPPSharp/bin/twemoji/1f48a.png
new file mode 100644
index 0000000000000..81b7fe1b57734
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48b.png b/Shared/CIPPSharp/bin/twemoji/1f48b.png
new file mode 100644
index 0000000000000..5feb59b18c12a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48c.png b/Shared/CIPPSharp/bin/twemoji/1f48c.png
new file mode 100644
index 0000000000000..a79d3c1579dd7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48d.png b/Shared/CIPPSharp/bin/twemoji/1f48d.png
new file mode 100644
index 0000000000000..f9a1fce4f1e07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48e.png b/Shared/CIPPSharp/bin/twemoji/1f48e.png
new file mode 100644
index 0000000000000..7eca5b21c842a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fb.png
new file mode 100644
index 0000000000000..d2ee5c4d778d7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fc.png
new file mode 100644
index 0000000000000..ccee0497c4334
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fd.png
new file mode 100644
index 0000000000000..15709e5651e5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fe.png
new file mode 100644
index 0000000000000..96ac2ef4f18c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48f-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3ff.png
new file mode 100644
index 0000000000000..461bc796326ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48f-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f48f.png b/Shared/CIPPSharp/bin/twemoji/1f48f.png
new file mode 100644
index 0000000000000..0774078e9583b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f48f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f490.png b/Shared/CIPPSharp/bin/twemoji/1f490.png
new file mode 100644
index 0000000000000..79bdf474e6a04
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f490.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f491-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fb.png
new file mode 100644
index 0000000000000..1d6c1bfc670ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f491-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fc.png
new file mode 100644
index 0000000000000..f11a685fe8242
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f491-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fd.png
new file mode 100644
index 0000000000000..f2e3534bd3bb8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f491-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fe.png
new file mode 100644
index 0000000000000..5cf2c2f1484f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f491-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f491-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f491-1f3ff.png
new file mode 100644
index 0000000000000..b5231a51fef81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f491-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f491.png b/Shared/CIPPSharp/bin/twemoji/1f491.png
new file mode 100644
index 0000000000000..066d5dfcb9371
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f491.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f492.png b/Shared/CIPPSharp/bin/twemoji/1f492.png
new file mode 100644
index 0000000000000..386d58d1046cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f492.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f493.png b/Shared/CIPPSharp/bin/twemoji/1f493.png
new file mode 100644
index 0000000000000..33b8aa93d4bc1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f493.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f494.png b/Shared/CIPPSharp/bin/twemoji/1f494.png
new file mode 100644
index 0000000000000..5af54e5f15770
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f494.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f495.png b/Shared/CIPPSharp/bin/twemoji/1f495.png
new file mode 100644
index 0000000000000..bffc24e976de2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f495.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f496.png b/Shared/CIPPSharp/bin/twemoji/1f496.png
new file mode 100644
index 0000000000000..48e0216c617c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f496.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f497.png b/Shared/CIPPSharp/bin/twemoji/1f497.png
new file mode 100644
index 0000000000000..591c9bf24489e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f497.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f498.png b/Shared/CIPPSharp/bin/twemoji/1f498.png
new file mode 100644
index 0000000000000..ad41943b5422a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f498.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f499.png b/Shared/CIPPSharp/bin/twemoji/1f499.png
new file mode 100644
index 0000000000000..736bc85cae281
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f499.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f49a.png b/Shared/CIPPSharp/bin/twemoji/1f49a.png
new file mode 100644
index 0000000000000..b8bf54c3202a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f49a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f49b.png b/Shared/CIPPSharp/bin/twemoji/1f49b.png
new file mode 100644
index 0000000000000..215fb3c6e014f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f49b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f49c.png b/Shared/CIPPSharp/bin/twemoji/1f49c.png
new file mode 100644
index 0000000000000..c68892cc281de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f49c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f49d.png b/Shared/CIPPSharp/bin/twemoji/1f49d.png
new file mode 100644
index 0000000000000..35c270742a7e1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f49d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f49e.png b/Shared/CIPPSharp/bin/twemoji/1f49e.png
new file mode 100644
index 0000000000000..a85936255c901
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f49e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f49f.png b/Shared/CIPPSharp/bin/twemoji/1f49f.png
new file mode 100644
index 0000000000000..f0369314984a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f49f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a0.png b/Shared/CIPPSharp/bin/twemoji/1f4a0.png
new file mode 100644
index 0000000000000..3e22818d4ad76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a1.png b/Shared/CIPPSharp/bin/twemoji/1f4a1.png
new file mode 100644
index 0000000000000..ae01adac42078
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a2.png b/Shared/CIPPSharp/bin/twemoji/1f4a2.png
new file mode 100644
index 0000000000000..0630d37eca7a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a3.png b/Shared/CIPPSharp/bin/twemoji/1f4a3.png
new file mode 100644
index 0000000000000..af90401f42b93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a4.png b/Shared/CIPPSharp/bin/twemoji/1f4a4.png
new file mode 100644
index 0000000000000..0b3671fb5e091
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a5.png b/Shared/CIPPSharp/bin/twemoji/1f4a5.png
new file mode 100644
index 0000000000000..8bf99d6434e9b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a6.png b/Shared/CIPPSharp/bin/twemoji/1f4a6.png
new file mode 100644
index 0000000000000..6bec97d0c0952
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a7.png b/Shared/CIPPSharp/bin/twemoji/1f4a7.png
new file mode 100644
index 0000000000000..c3398a2d090a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a8.png b/Shared/CIPPSharp/bin/twemoji/1f4a8.png
new file mode 100644
index 0000000000000..d9b0016b0e20f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4a9.png b/Shared/CIPPSharp/bin/twemoji/1f4a9.png
new file mode 100644
index 0000000000000..bf8eac64dae19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4a9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fb.png
new file mode 100644
index 0000000000000..16769e9787474
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fc.png
new file mode 100644
index 0000000000000..3d70cd4ba9caf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fd.png
new file mode 100644
index 0000000000000..8f734365ebe18
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fe.png
new file mode 100644
index 0000000000000..6fe4ff8cafacd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3ff.png
new file mode 100644
index 0000000000000..1ce1f149e8fa9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4aa-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4aa.png b/Shared/CIPPSharp/bin/twemoji/1f4aa.png
new file mode 100644
index 0000000000000..ff53dfc3dc6d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4aa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ab.png b/Shared/CIPPSharp/bin/twemoji/1f4ab.png
new file mode 100644
index 0000000000000..87a7b7eab40cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ac.png b/Shared/CIPPSharp/bin/twemoji/1f4ac.png
new file mode 100644
index 0000000000000..62a11b6dcb66a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ac.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ad.png b/Shared/CIPPSharp/bin/twemoji/1f4ad.png
new file mode 100644
index 0000000000000..f31b04629430d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ad.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ae.png b/Shared/CIPPSharp/bin/twemoji/1f4ae.png
new file mode 100644
index 0000000000000..bbad8a9e34e42
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ae.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4af.png b/Shared/CIPPSharp/bin/twemoji/1f4af.png
new file mode 100644
index 0000000000000..6a8fb87e7c5b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b0.png b/Shared/CIPPSharp/bin/twemoji/1f4b0.png
new file mode 100644
index 0000000000000..8b2e49b8599f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b1.png b/Shared/CIPPSharp/bin/twemoji/1f4b1.png
new file mode 100644
index 0000000000000..967a03177e516
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b2.png b/Shared/CIPPSharp/bin/twemoji/1f4b2.png
new file mode 100644
index 0000000000000..e3bf117999cbe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b3.png b/Shared/CIPPSharp/bin/twemoji/1f4b3.png
new file mode 100644
index 0000000000000..4f5b6dcf832ae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b4.png b/Shared/CIPPSharp/bin/twemoji/1f4b4.png
new file mode 100644
index 0000000000000..d9a37b469945c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b5.png b/Shared/CIPPSharp/bin/twemoji/1f4b5.png
new file mode 100644
index 0000000000000..4f29d43c5256d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b6.png b/Shared/CIPPSharp/bin/twemoji/1f4b6.png
new file mode 100644
index 0000000000000..b393e772a3ebb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b7.png b/Shared/CIPPSharp/bin/twemoji/1f4b7.png
new file mode 100644
index 0000000000000..d48d889d232cf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b8.png b/Shared/CIPPSharp/bin/twemoji/1f4b8.png
new file mode 100644
index 0000000000000..4ede47ad1e012
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4b9.png b/Shared/CIPPSharp/bin/twemoji/1f4b9.png
new file mode 100644
index 0000000000000..29ed4d39ccf61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4b9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ba.png b/Shared/CIPPSharp/bin/twemoji/1f4ba.png
new file mode 100644
index 0000000000000..fd029b0f56eac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ba.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f4bb.png
new file mode 100644
index 0000000000000..9d295ffe22655
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f4bc.png
new file mode 100644
index 0000000000000..08670c075aa69
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4bd.png b/Shared/CIPPSharp/bin/twemoji/1f4bd.png
new file mode 100644
index 0000000000000..460752a2dc3f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4be.png b/Shared/CIPPSharp/bin/twemoji/1f4be.png
new file mode 100644
index 0000000000000..fc9746b7bf5ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4be.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4bf.png b/Shared/CIPPSharp/bin/twemoji/1f4bf.png
new file mode 100644
index 0000000000000..319a0f68a4d37
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4bf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c0.png b/Shared/CIPPSharp/bin/twemoji/1f4c0.png
new file mode 100644
index 0000000000000..64f792e404eb0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c1.png b/Shared/CIPPSharp/bin/twemoji/1f4c1.png
new file mode 100644
index 0000000000000..92b1b50bca6c2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c2.png b/Shared/CIPPSharp/bin/twemoji/1f4c2.png
new file mode 100644
index 0000000000000..5a7f53bc8f23e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c3.png b/Shared/CIPPSharp/bin/twemoji/1f4c3.png
new file mode 100644
index 0000000000000..4c4d33a65b2ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c4.png b/Shared/CIPPSharp/bin/twemoji/1f4c4.png
new file mode 100644
index 0000000000000..c868e03bb6154
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c5.png b/Shared/CIPPSharp/bin/twemoji/1f4c5.png
new file mode 100644
index 0000000000000..6ad723c46277b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c6.png b/Shared/CIPPSharp/bin/twemoji/1f4c6.png
new file mode 100644
index 0000000000000..32054b032a798
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c7.png b/Shared/CIPPSharp/bin/twemoji/1f4c7.png
new file mode 100644
index 0000000000000..cd17bac8944e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c8.png b/Shared/CIPPSharp/bin/twemoji/1f4c8.png
new file mode 100644
index 0000000000000..8ff6e47cfa670
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4c9.png b/Shared/CIPPSharp/bin/twemoji/1f4c9.png
new file mode 100644
index 0000000000000..aa190e8236521
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4c9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ca.png b/Shared/CIPPSharp/bin/twemoji/1f4ca.png
new file mode 100644
index 0000000000000..c449d4cc189cf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ca.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4cb.png b/Shared/CIPPSharp/bin/twemoji/1f4cb.png
new file mode 100644
index 0000000000000..9a2a5559fd6e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4cb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4cc.png b/Shared/CIPPSharp/bin/twemoji/1f4cc.png
new file mode 100644
index 0000000000000..f442f25924f33
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4cc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4cd.png b/Shared/CIPPSharp/bin/twemoji/1f4cd.png
new file mode 100644
index 0000000000000..81a54135c3c18
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4cd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ce.png b/Shared/CIPPSharp/bin/twemoji/1f4ce.png
new file mode 100644
index 0000000000000..bab2f94fa8759
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ce.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4cf.png b/Shared/CIPPSharp/bin/twemoji/1f4cf.png
new file mode 100644
index 0000000000000..aae172cb5ba82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4cf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d0.png b/Shared/CIPPSharp/bin/twemoji/1f4d0.png
new file mode 100644
index 0000000000000..ccc5b2cd7b4b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d1.png b/Shared/CIPPSharp/bin/twemoji/1f4d1.png
new file mode 100644
index 0000000000000..d3e85665fa01d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d2.png b/Shared/CIPPSharp/bin/twemoji/1f4d2.png
new file mode 100644
index 0000000000000..d4ba357a59771
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d3.png b/Shared/CIPPSharp/bin/twemoji/1f4d3.png
new file mode 100644
index 0000000000000..3e4482daa9ccf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d4.png b/Shared/CIPPSharp/bin/twemoji/1f4d4.png
new file mode 100644
index 0000000000000..fa299b384f760
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d5.png b/Shared/CIPPSharp/bin/twemoji/1f4d5.png
new file mode 100644
index 0000000000000..0acd2bbc5064c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d6.png b/Shared/CIPPSharp/bin/twemoji/1f4d6.png
new file mode 100644
index 0000000000000..4a839711c0746
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d7.png b/Shared/CIPPSharp/bin/twemoji/1f4d7.png
new file mode 100644
index 0000000000000..dec65326de7d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d8.png b/Shared/CIPPSharp/bin/twemoji/1f4d8.png
new file mode 100644
index 0000000000000..f4eecca91b1e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4d9.png b/Shared/CIPPSharp/bin/twemoji/1f4d9.png
new file mode 100644
index 0000000000000..08f81464d4361
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4d9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4da.png b/Shared/CIPPSharp/bin/twemoji/1f4da.png
new file mode 100644
index 0000000000000..cdcbcb8efce3c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4da.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4db.png b/Shared/CIPPSharp/bin/twemoji/1f4db.png
new file mode 100644
index 0000000000000..fc4a0e50feec7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4db.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4dc.png b/Shared/CIPPSharp/bin/twemoji/1f4dc.png
new file mode 100644
index 0000000000000..9126fd0cd96e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4dc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4dd.png b/Shared/CIPPSharp/bin/twemoji/1f4dd.png
new file mode 100644
index 0000000000000..0f953e52a049d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4dd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4de.png b/Shared/CIPPSharp/bin/twemoji/1f4de.png
new file mode 100644
index 0000000000000..cb3e2d71a6991
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4de.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4df.png b/Shared/CIPPSharp/bin/twemoji/1f4df.png
new file mode 100644
index 0000000000000..ac6ae4ce9a2cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4df.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e0.png b/Shared/CIPPSharp/bin/twemoji/1f4e0.png
new file mode 100644
index 0000000000000..c9b62aca2f82f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e1.png b/Shared/CIPPSharp/bin/twemoji/1f4e1.png
new file mode 100644
index 0000000000000..c1b86f723f7cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e2.png b/Shared/CIPPSharp/bin/twemoji/1f4e2.png
new file mode 100644
index 0000000000000..7cdddf23e7b0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e3.png b/Shared/CIPPSharp/bin/twemoji/1f4e3.png
new file mode 100644
index 0000000000000..aa253356319fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e4.png b/Shared/CIPPSharp/bin/twemoji/1f4e4.png
new file mode 100644
index 0000000000000..246875f21d330
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e5.png b/Shared/CIPPSharp/bin/twemoji/1f4e5.png
new file mode 100644
index 0000000000000..7588c05d1778d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e6.png b/Shared/CIPPSharp/bin/twemoji/1f4e6.png
new file mode 100644
index 0000000000000..7e2bab3d03522
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e7.png b/Shared/CIPPSharp/bin/twemoji/1f4e7.png
new file mode 100644
index 0000000000000..9974eca3ba556
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e8.png b/Shared/CIPPSharp/bin/twemoji/1f4e8.png
new file mode 100644
index 0000000000000..e710181235758
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4e9.png b/Shared/CIPPSharp/bin/twemoji/1f4e9.png
new file mode 100644
index 0000000000000..2a40f0ad75e8d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ea.png b/Shared/CIPPSharp/bin/twemoji/1f4ea.png
new file mode 100644
index 0000000000000..374256b336c6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4eb.png b/Shared/CIPPSharp/bin/twemoji/1f4eb.png
new file mode 100644
index 0000000000000..8896b0e280a96
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ec.png b/Shared/CIPPSharp/bin/twemoji/1f4ec.png
new file mode 100644
index 0000000000000..0e20c2ad00ba2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ed.png b/Shared/CIPPSharp/bin/twemoji/1f4ed.png
new file mode 100644
index 0000000000000..36d5b729e462a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ee.png b/Shared/CIPPSharp/bin/twemoji/1f4ee.png
new file mode 100644
index 0000000000000..ce53f3998b461
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ef.png b/Shared/CIPPSharp/bin/twemoji/1f4ef.png
new file mode 100644
index 0000000000000..d999826a78eb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f0.png b/Shared/CIPPSharp/bin/twemoji/1f4f0.png
new file mode 100644
index 0000000000000..644645b3db429
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f1.png b/Shared/CIPPSharp/bin/twemoji/1f4f1.png
new file mode 100644
index 0000000000000..f44861b91b94b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f2.png b/Shared/CIPPSharp/bin/twemoji/1f4f2.png
new file mode 100644
index 0000000000000..67556774870d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f3.png b/Shared/CIPPSharp/bin/twemoji/1f4f3.png
new file mode 100644
index 0000000000000..c332ca7aa6001
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f4.png b/Shared/CIPPSharp/bin/twemoji/1f4f4.png
new file mode 100644
index 0000000000000..abc1b821bee19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f5.png b/Shared/CIPPSharp/bin/twemoji/1f4f5.png
new file mode 100644
index 0000000000000..f4e538d8c6579
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f6.png b/Shared/CIPPSharp/bin/twemoji/1f4f6.png
new file mode 100644
index 0000000000000..f4f93cfdc77f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f7.png b/Shared/CIPPSharp/bin/twemoji/1f4f7.png
new file mode 100644
index 0000000000000..246f692dac7ce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f8.png b/Shared/CIPPSharp/bin/twemoji/1f4f8.png
new file mode 100644
index 0000000000000..591257f3ee870
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4f9.png b/Shared/CIPPSharp/bin/twemoji/1f4f9.png
new file mode 100644
index 0000000000000..8ee4f62766e17
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4fa.png b/Shared/CIPPSharp/bin/twemoji/1f4fa.png
new file mode 100644
index 0000000000000..54d39eb43922d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4fb.png b/Shared/CIPPSharp/bin/twemoji/1f4fb.png
new file mode 100644
index 0000000000000..9609bbef83910
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4fc.png b/Shared/CIPPSharp/bin/twemoji/1f4fc.png
new file mode 100644
index 0000000000000..aca48416a791e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4fd.png b/Shared/CIPPSharp/bin/twemoji/1f4fd.png
new file mode 100644
index 0000000000000..f2dcfad6a50fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f4ff.png b/Shared/CIPPSharp/bin/twemoji/1f4ff.png
new file mode 100644
index 0000000000000..be750c49dac9f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f4ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f500.png b/Shared/CIPPSharp/bin/twemoji/1f500.png
new file mode 100644
index 0000000000000..fbe6dd1270f39
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f500.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f501.png b/Shared/CIPPSharp/bin/twemoji/1f501.png
new file mode 100644
index 0000000000000..a2ae9a301f2b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f501.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f502.png b/Shared/CIPPSharp/bin/twemoji/1f502.png
new file mode 100644
index 0000000000000..a8a0ce467b3f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f502.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f503.png b/Shared/CIPPSharp/bin/twemoji/1f503.png
new file mode 100644
index 0000000000000..a955030f54956
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f503.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f504.png b/Shared/CIPPSharp/bin/twemoji/1f504.png
new file mode 100644
index 0000000000000..62af6feb54aea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f504.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f505.png b/Shared/CIPPSharp/bin/twemoji/1f505.png
new file mode 100644
index 0000000000000..5a2249c2604f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f505.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f506.png b/Shared/CIPPSharp/bin/twemoji/1f506.png
new file mode 100644
index 0000000000000..f84a19af53f15
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f506.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f507.png b/Shared/CIPPSharp/bin/twemoji/1f507.png
new file mode 100644
index 0000000000000..425ea54f07b91
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f507.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f508.png b/Shared/CIPPSharp/bin/twemoji/1f508.png
new file mode 100644
index 0000000000000..727fc474d0cb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f508.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f509.png b/Shared/CIPPSharp/bin/twemoji/1f509.png
new file mode 100644
index 0000000000000..dd3b69384daec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f509.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f50a.png b/Shared/CIPPSharp/bin/twemoji/1f50a.png
new file mode 100644
index 0000000000000..16a3b36e06840
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f50a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f50b.png b/Shared/CIPPSharp/bin/twemoji/1f50b.png
new file mode 100644
index 0000000000000..ea11270323735
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f50b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f50c.png b/Shared/CIPPSharp/bin/twemoji/1f50c.png
new file mode 100644
index 0000000000000..fa12e63965caf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f50c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f50d.png b/Shared/CIPPSharp/bin/twemoji/1f50d.png
new file mode 100644
index 0000000000000..da93723dd7b06
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f50d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f50e.png b/Shared/CIPPSharp/bin/twemoji/1f50e.png
new file mode 100644
index 0000000000000..af8a137dad2bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f50e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f50f.png b/Shared/CIPPSharp/bin/twemoji/1f50f.png
new file mode 100644
index 0000000000000..9651c38488ec7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f50f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f510.png b/Shared/CIPPSharp/bin/twemoji/1f510.png
new file mode 100644
index 0000000000000..e1366af45e995
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f510.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f511.png b/Shared/CIPPSharp/bin/twemoji/1f511.png
new file mode 100644
index 0000000000000..7b1d7807ddaac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f511.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f512.png b/Shared/CIPPSharp/bin/twemoji/1f512.png
new file mode 100644
index 0000000000000..b5d9e2334e29e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f512.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f513.png b/Shared/CIPPSharp/bin/twemoji/1f513.png
new file mode 100644
index 0000000000000..2b69f8f94340c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f513.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f514.png b/Shared/CIPPSharp/bin/twemoji/1f514.png
new file mode 100644
index 0000000000000..6626232b615e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f514.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f515.png b/Shared/CIPPSharp/bin/twemoji/1f515.png
new file mode 100644
index 0000000000000..d4ae2ec14fc76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f515.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f516.png b/Shared/CIPPSharp/bin/twemoji/1f516.png
new file mode 100644
index 0000000000000..d11e540ad2dbb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f516.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f517.png b/Shared/CIPPSharp/bin/twemoji/1f517.png
new file mode 100644
index 0000000000000..76618cb5bc952
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f517.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f518.png b/Shared/CIPPSharp/bin/twemoji/1f518.png
new file mode 100644
index 0000000000000..49d062b28a65f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f518.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f519.png b/Shared/CIPPSharp/bin/twemoji/1f519.png
new file mode 100644
index 0000000000000..97707411bf9b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f519.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f51a.png b/Shared/CIPPSharp/bin/twemoji/1f51a.png
new file mode 100644
index 0000000000000..f399acb0356c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f51a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f51b.png b/Shared/CIPPSharp/bin/twemoji/1f51b.png
new file mode 100644
index 0000000000000..6aaaa73b26d86
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f51b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f51c.png b/Shared/CIPPSharp/bin/twemoji/1f51c.png
new file mode 100644
index 0000000000000..35fddd633e5ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f51c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f51d.png b/Shared/CIPPSharp/bin/twemoji/1f51d.png
new file mode 100644
index 0000000000000..9a7fe01181e1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f51d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f51e.png b/Shared/CIPPSharp/bin/twemoji/1f51e.png
new file mode 100644
index 0000000000000..ea100db7f2ef2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f51e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f51f.png b/Shared/CIPPSharp/bin/twemoji/1f51f.png
new file mode 100644
index 0000000000000..bc4b0fd18b24b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f51f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f520.png b/Shared/CIPPSharp/bin/twemoji/1f520.png
new file mode 100644
index 0000000000000..9da0bed608d7d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f520.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f521.png b/Shared/CIPPSharp/bin/twemoji/1f521.png
new file mode 100644
index 0000000000000..e808e12e5e5c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f521.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f522.png b/Shared/CIPPSharp/bin/twemoji/1f522.png
new file mode 100644
index 0000000000000..84c2082306023
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f522.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f523.png b/Shared/CIPPSharp/bin/twemoji/1f523.png
new file mode 100644
index 0000000000000..fa2d4ec815b2e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f523.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f524.png b/Shared/CIPPSharp/bin/twemoji/1f524.png
new file mode 100644
index 0000000000000..2b187cadfd83f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f524.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f525.png b/Shared/CIPPSharp/bin/twemoji/1f525.png
new file mode 100644
index 0000000000000..717523f17e680
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f525.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f526.png b/Shared/CIPPSharp/bin/twemoji/1f526.png
new file mode 100644
index 0000000000000..d071d1c986a12
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f526.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f527.png b/Shared/CIPPSharp/bin/twemoji/1f527.png
new file mode 100644
index 0000000000000..f16a78613d5d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f528.png b/Shared/CIPPSharp/bin/twemoji/1f528.png
new file mode 100644
index 0000000000000..d76ec56de0275
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f528.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f529.png b/Shared/CIPPSharp/bin/twemoji/1f529.png
new file mode 100644
index 0000000000000..346e985869697
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f529.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f52a.png b/Shared/CIPPSharp/bin/twemoji/1f52a.png
new file mode 100644
index 0000000000000..79cfa347a5ad2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f52a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f52b.png b/Shared/CIPPSharp/bin/twemoji/1f52b.png
new file mode 100644
index 0000000000000..e3f5d67061cc8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f52b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f52c.png
new file mode 100644
index 0000000000000..5136b7767f9b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f52d.png b/Shared/CIPPSharp/bin/twemoji/1f52d.png
new file mode 100644
index 0000000000000..f180454c6c97a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f52d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f52e.png b/Shared/CIPPSharp/bin/twemoji/1f52e.png
new file mode 100644
index 0000000000000..a8abfb842c233
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f52e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f52f.png b/Shared/CIPPSharp/bin/twemoji/1f52f.png
new file mode 100644
index 0000000000000..b6f1d4f896ca8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f52f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f530.png b/Shared/CIPPSharp/bin/twemoji/1f530.png
new file mode 100644
index 0000000000000..f45bbca7ee05b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f530.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f531.png b/Shared/CIPPSharp/bin/twemoji/1f531.png
new file mode 100644
index 0000000000000..fea3585283167
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f531.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f532.png b/Shared/CIPPSharp/bin/twemoji/1f532.png
new file mode 100644
index 0000000000000..87392a4ea9667
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f532.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f533.png b/Shared/CIPPSharp/bin/twemoji/1f533.png
new file mode 100644
index 0000000000000..cff774c98812c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f533.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f534.png b/Shared/CIPPSharp/bin/twemoji/1f534.png
new file mode 100644
index 0000000000000..721075df18dc4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f534.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f535.png b/Shared/CIPPSharp/bin/twemoji/1f535.png
new file mode 100644
index 0000000000000..de9927d965e40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f535.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f536.png b/Shared/CIPPSharp/bin/twemoji/1f536.png
new file mode 100644
index 0000000000000..d808f65499934
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f536.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f537.png b/Shared/CIPPSharp/bin/twemoji/1f537.png
new file mode 100644
index 0000000000000..9c2363d71b909
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f537.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f538.png b/Shared/CIPPSharp/bin/twemoji/1f538.png
new file mode 100644
index 0000000000000..02eab512a7529
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f538.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f539.png b/Shared/CIPPSharp/bin/twemoji/1f539.png
new file mode 100644
index 0000000000000..89ce677201f85
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f539.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f53a.png b/Shared/CIPPSharp/bin/twemoji/1f53a.png
new file mode 100644
index 0000000000000..470f3d3748131
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f53a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f53b.png b/Shared/CIPPSharp/bin/twemoji/1f53b.png
new file mode 100644
index 0000000000000..ece2885060908
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f53b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f53c.png b/Shared/CIPPSharp/bin/twemoji/1f53c.png
new file mode 100644
index 0000000000000..7c78843ecdca4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f53c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f53d.png b/Shared/CIPPSharp/bin/twemoji/1f53d.png
new file mode 100644
index 0000000000000..70b308b6ca954
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f53d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f549.png b/Shared/CIPPSharp/bin/twemoji/1f549.png
new file mode 100644
index 0000000000000..eb644f25ca56e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f549.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f54a.png b/Shared/CIPPSharp/bin/twemoji/1f54a.png
new file mode 100644
index 0000000000000..0676697ba31ae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f54a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f54b.png b/Shared/CIPPSharp/bin/twemoji/1f54b.png
new file mode 100644
index 0000000000000..89899e709db36
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f54b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f54c.png b/Shared/CIPPSharp/bin/twemoji/1f54c.png
new file mode 100644
index 0000000000000..0ffb68aa444a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f54c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f54d.png b/Shared/CIPPSharp/bin/twemoji/1f54d.png
new file mode 100644
index 0000000000000..d5c15756f344a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f54d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f54e.png b/Shared/CIPPSharp/bin/twemoji/1f54e.png
new file mode 100644
index 0000000000000..4e031b2e13698
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f54e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f550.png b/Shared/CIPPSharp/bin/twemoji/1f550.png
new file mode 100644
index 0000000000000..4fd13e3d50c20
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f550.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f551.png b/Shared/CIPPSharp/bin/twemoji/1f551.png
new file mode 100644
index 0000000000000..14fa3f30f40cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f551.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f552.png b/Shared/CIPPSharp/bin/twemoji/1f552.png
new file mode 100644
index 0000000000000..354da1a39889e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f552.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f553.png b/Shared/CIPPSharp/bin/twemoji/1f553.png
new file mode 100644
index 0000000000000..4c6107313b753
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f553.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f554.png b/Shared/CIPPSharp/bin/twemoji/1f554.png
new file mode 100644
index 0000000000000..07c7e8ffc947e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f554.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f555.png b/Shared/CIPPSharp/bin/twemoji/1f555.png
new file mode 100644
index 0000000000000..71a04ff4ba882
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f555.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f556.png b/Shared/CIPPSharp/bin/twemoji/1f556.png
new file mode 100644
index 0000000000000..72a0b9a48bafb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f556.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f557.png b/Shared/CIPPSharp/bin/twemoji/1f557.png
new file mode 100644
index 0000000000000..bb9753cc8a39d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f557.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f558.png b/Shared/CIPPSharp/bin/twemoji/1f558.png
new file mode 100644
index 0000000000000..70d5adbeee98a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f558.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f559.png b/Shared/CIPPSharp/bin/twemoji/1f559.png
new file mode 100644
index 0000000000000..25e6dabf0ac1d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f559.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f55a.png b/Shared/CIPPSharp/bin/twemoji/1f55a.png
new file mode 100644
index 0000000000000..51c70f80c8e43
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f55a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f55b.png b/Shared/CIPPSharp/bin/twemoji/1f55b.png
new file mode 100644
index 0000000000000..1b58527cf52f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f55b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f55c.png b/Shared/CIPPSharp/bin/twemoji/1f55c.png
new file mode 100644
index 0000000000000..741b630a75d80
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f55c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f55d.png b/Shared/CIPPSharp/bin/twemoji/1f55d.png
new file mode 100644
index 0000000000000..58a1af0d56806
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f55d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f55e.png b/Shared/CIPPSharp/bin/twemoji/1f55e.png
new file mode 100644
index 0000000000000..112d5c452c644
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f55e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f55f.png b/Shared/CIPPSharp/bin/twemoji/1f55f.png
new file mode 100644
index 0000000000000..14ddea9f30742
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f55f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f560.png b/Shared/CIPPSharp/bin/twemoji/1f560.png
new file mode 100644
index 0000000000000..b30c623abd0a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f560.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f561.png b/Shared/CIPPSharp/bin/twemoji/1f561.png
new file mode 100644
index 0000000000000..2753c64c5445c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f561.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f562.png b/Shared/CIPPSharp/bin/twemoji/1f562.png
new file mode 100644
index 0000000000000..a4e4cb5dbb89d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f562.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f563.png b/Shared/CIPPSharp/bin/twemoji/1f563.png
new file mode 100644
index 0000000000000..ca7e45feab57e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f563.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f564.png b/Shared/CIPPSharp/bin/twemoji/1f564.png
new file mode 100644
index 0000000000000..9c3582dafeabc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f564.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f565.png b/Shared/CIPPSharp/bin/twemoji/1f565.png
new file mode 100644
index 0000000000000..f8af392f87f56
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f565.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f566.png b/Shared/CIPPSharp/bin/twemoji/1f566.png
new file mode 100644
index 0000000000000..c4134e8e5a3da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f566.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f567.png b/Shared/CIPPSharp/bin/twemoji/1f567.png
new file mode 100644
index 0000000000000..9e6bb465eeb8d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f567.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f56f.png b/Shared/CIPPSharp/bin/twemoji/1f56f.png
new file mode 100644
index 0000000000000..5b48a36fa5528
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f56f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f570.png b/Shared/CIPPSharp/bin/twemoji/1f570.png
new file mode 100644
index 0000000000000..583feb4ef4075
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f570.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f573.png b/Shared/CIPPSharp/bin/twemoji/1f573.png
new file mode 100644
index 0000000000000..5ebed95d62c5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f573.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1eedd74c0ae02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c4070ba337c8f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb.png
new file mode 100644
index 0000000000000..ecce7bca8ec07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..806f043fc346d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..525ff09c0a66f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc.png
new file mode 100644
index 0000000000000..205c9a42cbfc5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..15e65ab440c54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..17b4804701671
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd.png
new file mode 100644
index 0000000000000..b0b9ccd2c8750
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..98d11b84e782c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5814bfc6efd48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe.png
new file mode 100644
index 0000000000000..18db02ee44739
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..4359b4c44bffd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5da1f05658969
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff.png
new file mode 100644
index 0000000000000..01f734fe8d443
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-fe0f-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-fe0f-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ddfa42524c047
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-fe0f-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574-fe0f-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f574-fe0f-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..83de6d644628c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574-fe0f-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f574.png b/Shared/CIPPSharp/bin/twemoji/1f574.png
new file mode 100644
index 0000000000000..d947a641ce21c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f574.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7b0a67f84150d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..edbb1f1fdddb6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb.png
new file mode 100644
index 0000000000000..28c11bef71ad1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dc84904de2d87
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..64d1e806878ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc.png
new file mode 100644
index 0000000000000..f5163334f12cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c5d9838c2f616
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1656142df600d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd.png
new file mode 100644
index 0000000000000..ed52180925abd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1c3f9edfa97da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f275f195c9edd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe.png
new file mode 100644
index 0000000000000..20715fbb024e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bcd5fbb8873ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0a9f8373aa89f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff.png
new file mode 100644
index 0000000000000..d625b611e15dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-fe0f-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-fe0f-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dd3d5f0db040e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-fe0f-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575-fe0f-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f575-fe0f-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8ed60e2b51f80
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575-fe0f-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f575.png b/Shared/CIPPSharp/bin/twemoji/1f575.png
new file mode 100644
index 0000000000000..26e5ed1afc411
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f575.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f576.png b/Shared/CIPPSharp/bin/twemoji/1f576.png
new file mode 100644
index 0000000000000..70cd5c81deb34
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f576.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f577.png b/Shared/CIPPSharp/bin/twemoji/1f577.png
new file mode 100644
index 0000000000000..475377b870978
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f577.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f578.png b/Shared/CIPPSharp/bin/twemoji/1f578.png
new file mode 100644
index 0000000000000..7b5fbf60155f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f578.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f579.png b/Shared/CIPPSharp/bin/twemoji/1f579.png
new file mode 100644
index 0000000000000..6dbd77dc377e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f579.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fb.png
new file mode 100644
index 0000000000000..62de0e07417fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fc.png
new file mode 100644
index 0000000000000..f3640871fcb79
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fd.png
new file mode 100644
index 0000000000000..f39461bd91453
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fe.png
new file mode 100644
index 0000000000000..f99b43ba5aed3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f57a-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3ff.png
new file mode 100644
index 0000000000000..477ecad66636b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f57a-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f57a.png b/Shared/CIPPSharp/bin/twemoji/1f57a.png
new file mode 100644
index 0000000000000..12499df34fd35
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f57a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f587.png b/Shared/CIPPSharp/bin/twemoji/1f587.png
new file mode 100644
index 0000000000000..048cde6fb8a0f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f587.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f58a.png b/Shared/CIPPSharp/bin/twemoji/1f58a.png
new file mode 100644
index 0000000000000..178fd352f3fc4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f58a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f58b.png b/Shared/CIPPSharp/bin/twemoji/1f58b.png
new file mode 100644
index 0000000000000..f996037a2f73d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f58b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f58c.png b/Shared/CIPPSharp/bin/twemoji/1f58c.png
new file mode 100644
index 0000000000000..dc9fbae60fdaf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f58c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f58d.png b/Shared/CIPPSharp/bin/twemoji/1f58d.png
new file mode 100644
index 0000000000000..ffa2e36762943
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f58d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f590-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fb.png
new file mode 100644
index 0000000000000..3d0a6dc228ee2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f590-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fc.png
new file mode 100644
index 0000000000000..ada57e3d89684
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f590-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fd.png
new file mode 100644
index 0000000000000..297c12b450533
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f590-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fe.png
new file mode 100644
index 0000000000000..043d7551e35ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f590-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f590-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f590-1f3ff.png
new file mode 100644
index 0000000000000..09b7feaaa79e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f590-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f590.png b/Shared/CIPPSharp/bin/twemoji/1f590.png
new file mode 100644
index 0000000000000..6e03235070cf7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f590.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f595-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fb.png
new file mode 100644
index 0000000000000..396d2f521e5f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f595-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fc.png
new file mode 100644
index 0000000000000..c7e4024287dd4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f595-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fd.png
new file mode 100644
index 0000000000000..dacfe5cd79df4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f595-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fe.png
new file mode 100644
index 0000000000000..8af84e4b73712
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f595-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f595-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f595-1f3ff.png
new file mode 100644
index 0000000000000..036298512cb0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f595-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f595.png b/Shared/CIPPSharp/bin/twemoji/1f595.png
new file mode 100644
index 0000000000000..9b5de31144a01
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f595.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f596-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fb.png
new file mode 100644
index 0000000000000..467aef7e49ed6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f596-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fc.png
new file mode 100644
index 0000000000000..60b9be3931857
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f596-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fd.png
new file mode 100644
index 0000000000000..36ba32915cd41
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f596-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fe.png
new file mode 100644
index 0000000000000..07db6dba3d1b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f596-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f596-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f596-1f3ff.png
new file mode 100644
index 0000000000000..59a79e6def098
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f596-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f596.png b/Shared/CIPPSharp/bin/twemoji/1f596.png
new file mode 100644
index 0000000000000..0778c7bc57bf7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f596.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5a4.png b/Shared/CIPPSharp/bin/twemoji/1f5a4.png
new file mode 100644
index 0000000000000..39b91ddf20643
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5a5.png b/Shared/CIPPSharp/bin/twemoji/1f5a5.png
new file mode 100644
index 0000000000000..ac11f31e76a2f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5a5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5a8.png b/Shared/CIPPSharp/bin/twemoji/1f5a8.png
new file mode 100644
index 0000000000000..094e0d57b4301
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5b1.png b/Shared/CIPPSharp/bin/twemoji/1f5b1.png
new file mode 100644
index 0000000000000..a8c2b82f502cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5b2.png b/Shared/CIPPSharp/bin/twemoji/1f5b2.png
new file mode 100644
index 0000000000000..62a462eda2cce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5bc.png b/Shared/CIPPSharp/bin/twemoji/1f5bc.png
new file mode 100644
index 0000000000000..0f22c74fc4cb6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5c2.png b/Shared/CIPPSharp/bin/twemoji/1f5c2.png
new file mode 100644
index 0000000000000..9a75e28dfef63
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5c2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5c3.png b/Shared/CIPPSharp/bin/twemoji/1f5c3.png
new file mode 100644
index 0000000000000..b4a283d9348c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5c3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5c4.png b/Shared/CIPPSharp/bin/twemoji/1f5c4.png
new file mode 100644
index 0000000000000..9b19e2e8a2ddb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5c4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5d1.png b/Shared/CIPPSharp/bin/twemoji/1f5d1.png
new file mode 100644
index 0000000000000..bdd43bc6e0870
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5d1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5d2.png b/Shared/CIPPSharp/bin/twemoji/1f5d2.png
new file mode 100644
index 0000000000000..b77006699cda8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5d3.png b/Shared/CIPPSharp/bin/twemoji/1f5d3.png
new file mode 100644
index 0000000000000..72e526929f1ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5d3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5dc.png b/Shared/CIPPSharp/bin/twemoji/1f5dc.png
new file mode 100644
index 0000000000000..35702a97c5eb1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5dc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5dd.png b/Shared/CIPPSharp/bin/twemoji/1f5dd.png
new file mode 100644
index 0000000000000..2a6bb2d8824d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5dd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5de.png b/Shared/CIPPSharp/bin/twemoji/1f5de.png
new file mode 100644
index 0000000000000..f32e9860ad5db
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5de.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5e1.png b/Shared/CIPPSharp/bin/twemoji/1f5e1.png
new file mode 100644
index 0000000000000..19328e1e26289
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5e1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5e3.png b/Shared/CIPPSharp/bin/twemoji/1f5e3.png
new file mode 100644
index 0000000000000..b98f4fffeb7d6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5e8.png b/Shared/CIPPSharp/bin/twemoji/1f5e8.png
new file mode 100644
index 0000000000000..ee9daef15ebb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5ef.png b/Shared/CIPPSharp/bin/twemoji/1f5ef.png
new file mode 100644
index 0000000000000..ea4f27ae7240e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5f3.png b/Shared/CIPPSharp/bin/twemoji/1f5f3.png
new file mode 100644
index 0000000000000..c9cabef7e26b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5fa.png b/Shared/CIPPSharp/bin/twemoji/1f5fa.png
new file mode 100644
index 0000000000000..c03959d257e02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5fb.png b/Shared/CIPPSharp/bin/twemoji/1f5fb.png
new file mode 100644
index 0000000000000..ee42aa786f056
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5fc.png b/Shared/CIPPSharp/bin/twemoji/1f5fc.png
new file mode 100644
index 0000000000000..b33cacb9008af
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5fd.png b/Shared/CIPPSharp/bin/twemoji/1f5fd.png
new file mode 100644
index 0000000000000..1d3dd5a3b5621
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5fe.png b/Shared/CIPPSharp/bin/twemoji/1f5fe.png
new file mode 100644
index 0000000000000..b223c92c0bc78
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f5ff.png b/Shared/CIPPSharp/bin/twemoji/1f5ff.png
new file mode 100644
index 0000000000000..09b71d9ea26b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f5ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f600.png b/Shared/CIPPSharp/bin/twemoji/1f600.png
new file mode 100644
index 0000000000000..e1cca7d00cf1b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f600.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f601.png b/Shared/CIPPSharp/bin/twemoji/1f601.png
new file mode 100644
index 0000000000000..3a73f9d906720
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f601.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f602.png b/Shared/CIPPSharp/bin/twemoji/1f602.png
new file mode 100644
index 0000000000000..e1113e8e3ff02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f602.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f603.png b/Shared/CIPPSharp/bin/twemoji/1f603.png
new file mode 100644
index 0000000000000..e24b685f611d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f603.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f604.png b/Shared/CIPPSharp/bin/twemoji/1f604.png
new file mode 100644
index 0000000000000..e032945e68535
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f604.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f605.png b/Shared/CIPPSharp/bin/twemoji/1f605.png
new file mode 100644
index 0000000000000..bfc7c287f5c0b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f605.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f606.png b/Shared/CIPPSharp/bin/twemoji/1f606.png
new file mode 100644
index 0000000000000..ac4797ee40d08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f606.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f607.png b/Shared/CIPPSharp/bin/twemoji/1f607.png
new file mode 100644
index 0000000000000..def2c98d281c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f607.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f608.png b/Shared/CIPPSharp/bin/twemoji/1f608.png
new file mode 100644
index 0000000000000..3e1a54cd1085e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f608.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f609.png b/Shared/CIPPSharp/bin/twemoji/1f609.png
new file mode 100644
index 0000000000000..703a50e098636
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f609.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f60a.png b/Shared/CIPPSharp/bin/twemoji/1f60a.png
new file mode 100644
index 0000000000000..8a5b034e057c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f60a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f60b.png b/Shared/CIPPSharp/bin/twemoji/1f60b.png
new file mode 100644
index 0000000000000..4a71524d15e7d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f60b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f60c.png b/Shared/CIPPSharp/bin/twemoji/1f60c.png
new file mode 100644
index 0000000000000..4fb75cffec782
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f60c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f60d.png b/Shared/CIPPSharp/bin/twemoji/1f60d.png
new file mode 100644
index 0000000000000..0d4f15ee1b4a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f60d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f60e.png b/Shared/CIPPSharp/bin/twemoji/1f60e.png
new file mode 100644
index 0000000000000..1a0560df6d34b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f60e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f60f.png b/Shared/CIPPSharp/bin/twemoji/1f60f.png
new file mode 100644
index 0000000000000..4fca129f12df1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f60f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f610.png b/Shared/CIPPSharp/bin/twemoji/1f610.png
new file mode 100644
index 0000000000000..17628f9534539
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f610.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f611.png b/Shared/CIPPSharp/bin/twemoji/1f611.png
new file mode 100644
index 0000000000000..fda6326aff6a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f611.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f612.png b/Shared/CIPPSharp/bin/twemoji/1f612.png
new file mode 100644
index 0000000000000..53c52ecd317df
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f612.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f613.png b/Shared/CIPPSharp/bin/twemoji/1f613.png
new file mode 100644
index 0000000000000..325ce9e7ca339
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f613.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f614.png b/Shared/CIPPSharp/bin/twemoji/1f614.png
new file mode 100644
index 0000000000000..1357dd9c7a181
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f614.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f615.png b/Shared/CIPPSharp/bin/twemoji/1f615.png
new file mode 100644
index 0000000000000..02cd1fe2d319e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f615.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f616.png b/Shared/CIPPSharp/bin/twemoji/1f616.png
new file mode 100644
index 0000000000000..37221bd16cab5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f616.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f617.png b/Shared/CIPPSharp/bin/twemoji/1f617.png
new file mode 100644
index 0000000000000..22c9bd93b5719
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f617.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f618.png b/Shared/CIPPSharp/bin/twemoji/1f618.png
new file mode 100644
index 0000000000000..7aa39d71dbca0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f618.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f619.png b/Shared/CIPPSharp/bin/twemoji/1f619.png
new file mode 100644
index 0000000000000..011863813857e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f619.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f61a.png b/Shared/CIPPSharp/bin/twemoji/1f61a.png
new file mode 100644
index 0000000000000..3ee01547c3458
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f61a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f61b.png b/Shared/CIPPSharp/bin/twemoji/1f61b.png
new file mode 100644
index 0000000000000..79806b1272434
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f61b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f61c.png b/Shared/CIPPSharp/bin/twemoji/1f61c.png
new file mode 100644
index 0000000000000..8aeab47c625b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f61c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f61d.png b/Shared/CIPPSharp/bin/twemoji/1f61d.png
new file mode 100644
index 0000000000000..abd9e150ceace
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f61d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f61e.png b/Shared/CIPPSharp/bin/twemoji/1f61e.png
new file mode 100644
index 0000000000000..f23431b81bdb2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f61e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f61f.png b/Shared/CIPPSharp/bin/twemoji/1f61f.png
new file mode 100644
index 0000000000000..b0f9051901a4f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f61f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f620.png b/Shared/CIPPSharp/bin/twemoji/1f620.png
new file mode 100644
index 0000000000000..31ecddc81570f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f620.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f621.png b/Shared/CIPPSharp/bin/twemoji/1f621.png
new file mode 100644
index 0000000000000..3921022f590ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f621.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f622.png b/Shared/CIPPSharp/bin/twemoji/1f622.png
new file mode 100644
index 0000000000000..4b8f0e943ddaa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f622.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f623.png b/Shared/CIPPSharp/bin/twemoji/1f623.png
new file mode 100644
index 0000000000000..007139dc3a1a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f623.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f624.png b/Shared/CIPPSharp/bin/twemoji/1f624.png
new file mode 100644
index 0000000000000..6847184123aa5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f624.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f625.png b/Shared/CIPPSharp/bin/twemoji/1f625.png
new file mode 100644
index 0000000000000..c4c4a2a3675da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f625.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f626.png b/Shared/CIPPSharp/bin/twemoji/1f626.png
new file mode 100644
index 0000000000000..1e97bcc4ac181
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f626.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f627.png b/Shared/CIPPSharp/bin/twemoji/1f627.png
new file mode 100644
index 0000000000000..28ce280730510
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f627.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f628.png b/Shared/CIPPSharp/bin/twemoji/1f628.png
new file mode 100644
index 0000000000000..f32b0a4ef2bd0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f628.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f629.png b/Shared/CIPPSharp/bin/twemoji/1f629.png
new file mode 100644
index 0000000000000..2ceecc05a8a5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f629.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f62a.png b/Shared/CIPPSharp/bin/twemoji/1f62a.png
new file mode 100644
index 0000000000000..1a0d7d5767af0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f62a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f62b.png b/Shared/CIPPSharp/bin/twemoji/1f62b.png
new file mode 100644
index 0000000000000..db9edc1eb7fd1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f62b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f62c.png b/Shared/CIPPSharp/bin/twemoji/1f62c.png
new file mode 100644
index 0000000000000..24619b8a60b6d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f62c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f62d.png b/Shared/CIPPSharp/bin/twemoji/1f62d.png
new file mode 100644
index 0000000000000..554edf044f483
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f62d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f62e-200d-1f4a8.png b/Shared/CIPPSharp/bin/twemoji/1f62e-200d-1f4a8.png
new file mode 100644
index 0000000000000..37db70540a88f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f62e-200d-1f4a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f62e.png b/Shared/CIPPSharp/bin/twemoji/1f62e.png
new file mode 100644
index 0000000000000..45820be674069
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f62e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f62f.png b/Shared/CIPPSharp/bin/twemoji/1f62f.png
new file mode 100644
index 0000000000000..11433a2c6486b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f62f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f630.png b/Shared/CIPPSharp/bin/twemoji/1f630.png
new file mode 100644
index 0000000000000..248ec17673269
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f630.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f631.png b/Shared/CIPPSharp/bin/twemoji/1f631.png
new file mode 100644
index 0000000000000..fa3debccac1b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f631.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f632.png b/Shared/CIPPSharp/bin/twemoji/1f632.png
new file mode 100644
index 0000000000000..dd4fa0c0005ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f632.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f633.png b/Shared/CIPPSharp/bin/twemoji/1f633.png
new file mode 100644
index 0000000000000..47093b1bfe8d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f633.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f634.png b/Shared/CIPPSharp/bin/twemoji/1f634.png
new file mode 100644
index 0000000000000..4c3806dea524e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f634.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f635-200d-1f4ab.png b/Shared/CIPPSharp/bin/twemoji/1f635-200d-1f4ab.png
new file mode 100644
index 0000000000000..f2ad9dc1f96b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f635-200d-1f4ab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f635.png b/Shared/CIPPSharp/bin/twemoji/1f635.png
new file mode 100644
index 0000000000000..3db251c49c66e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f635.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f636-200d-1f32b-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f636-200d-1f32b-fe0f.png
new file mode 100644
index 0000000000000..74bf63d50a4d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f636-200d-1f32b-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f636.png b/Shared/CIPPSharp/bin/twemoji/1f636.png
new file mode 100644
index 0000000000000..4d7d903a2b13c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f636.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f637.png b/Shared/CIPPSharp/bin/twemoji/1f637.png
new file mode 100644
index 0000000000000..5197ce37cd8c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f637.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f638.png b/Shared/CIPPSharp/bin/twemoji/1f638.png
new file mode 100644
index 0000000000000..538ff46e5b977
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f638.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f639.png b/Shared/CIPPSharp/bin/twemoji/1f639.png
new file mode 100644
index 0000000000000..7ff22eae37acb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f639.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f63a.png b/Shared/CIPPSharp/bin/twemoji/1f63a.png
new file mode 100644
index 0000000000000..3ca61cd602d04
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f63a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f63b.png b/Shared/CIPPSharp/bin/twemoji/1f63b.png
new file mode 100644
index 0000000000000..13e14f016e1f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f63b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f63c.png b/Shared/CIPPSharp/bin/twemoji/1f63c.png
new file mode 100644
index 0000000000000..9d4ceee4afe64
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f63c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f63d.png b/Shared/CIPPSharp/bin/twemoji/1f63d.png
new file mode 100644
index 0000000000000..966fed00b5ed2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f63d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f63e.png b/Shared/CIPPSharp/bin/twemoji/1f63e.png
new file mode 100644
index 0000000000000..d702c14440994
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f63e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f63f.png b/Shared/CIPPSharp/bin/twemoji/1f63f.png
new file mode 100644
index 0000000000000..84ade17f33caf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f63f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f640.png b/Shared/CIPPSharp/bin/twemoji/1f640.png
new file mode 100644
index 0000000000000..410cf816c7a63
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f640.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f641.png b/Shared/CIPPSharp/bin/twemoji/1f641.png
new file mode 100644
index 0000000000000..68cf4d4a4f8da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f641.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f642-200d-2194-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f642-200d-2194-fe0f.png
new file mode 100644
index 0000000000000..da7be189112b1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f642-200d-2194-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f642-200d-2195-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f642-200d-2195-fe0f.png
new file mode 100644
index 0000000000000..88a87de226323
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f642-200d-2195-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f642.png b/Shared/CIPPSharp/bin/twemoji/1f642.png
new file mode 100644
index 0000000000000..d6ece8222873e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f642.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f643.png b/Shared/CIPPSharp/bin/twemoji/1f643.png
new file mode 100644
index 0000000000000..6c5f72b5ff5e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f643.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f644.png b/Shared/CIPPSharp/bin/twemoji/1f644.png
new file mode 100644
index 0000000000000..1bafe2a637587
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f644.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..4b0d4a0c62abf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..afe0d607d1cb3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb.png
new file mode 100644
index 0000000000000..240633eef6896
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..218e57ff69673
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..3d6161b286094
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc.png
new file mode 100644
index 0000000000000..fc2b550d70e6c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..9bd6857bfba73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8168441f3d3fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd.png
new file mode 100644
index 0000000000000..6daf870413f32
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..da0411f8c2a6e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..efc545851aab1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe.png
new file mode 100644
index 0000000000000..7b0fc547fac1b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3ae6ff4e2f8e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..91768e526c696
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff.png
new file mode 100644
index 0000000000000..6fd9efc5a5456
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a38f17ea8e49d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f645-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0edacb01b016c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f645.png b/Shared/CIPPSharp/bin/twemoji/1f645.png
new file mode 100644
index 0000000000000..fe42663a8bf1d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f645.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1376c0ec36b37
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1bb39d024b799
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb.png
new file mode 100644
index 0000000000000..334ad0555cacc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3f04847ff3ec7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fc62d9984f738
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc.png
new file mode 100644
index 0000000000000..017a2e7fd0d81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..29d4d5b2608bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6d5ca67efb76c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd.png
new file mode 100644
index 0000000000000..f7bdeaca232db
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e4352cee82f63
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0cd923a9bf7e0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe.png
new file mode 100644
index 0000000000000..7c92b35ecc3c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7bc47ebdc7877
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4f885b074606f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff.png
new file mode 100644
index 0000000000000..9193addc3a3d0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5b18034ac1493
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f646-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..94d87d8c284d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f646.png b/Shared/CIPPSharp/bin/twemoji/1f646.png
new file mode 100644
index 0000000000000..1ece1c7f28d3a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f646.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bc5c50a3c1d48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f42ce72a94758
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb.png
new file mode 100644
index 0000000000000..8519432cf9df7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d0461b3447695
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..50015401cbf44
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc.png
new file mode 100644
index 0000000000000..5038aeaaf2262
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..24b8cfb810daf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..eeebeda8400cf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd.png
new file mode 100644
index 0000000000000..38389ed31d8c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..21d7688242a49
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..90f1d16f6c402
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe.png
new file mode 100644
index 0000000000000..9b5f7135b6ad7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..2c192cb641f42
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f97b23935f30b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff.png
new file mode 100644
index 0000000000000..561024107a9d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bee0cd77fa498
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f647-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1c7a05baa5afc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f647.png b/Shared/CIPPSharp/bin/twemoji/1f647.png
new file mode 100644
index 0000000000000..7f926955602da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f647.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f648.png b/Shared/CIPPSharp/bin/twemoji/1f648.png
new file mode 100644
index 0000000000000..d9866c9042692
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f648.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f649.png b/Shared/CIPPSharp/bin/twemoji/1f649.png
new file mode 100644
index 0000000000000..284cf9b4b5965
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f649.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64a.png b/Shared/CIPPSharp/bin/twemoji/1f64a.png
new file mode 100644
index 0000000000000..ab35f405a983b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bfadf8f909920
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c3eaf18d18c73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb.png
new file mode 100644
index 0000000000000..97439b7bb58b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c12537b10207b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..dffc95b68559c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc.png
new file mode 100644
index 0000000000000..b2ec6e1f4a57b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..431daae49a8c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ff577874e7d66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd.png
new file mode 100644
index 0000000000000..92c0e793b68d7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f21a1cbbd23bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8423ab2f7d8a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe.png
new file mode 100644
index 0000000000000..59c34dba7bdac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..328e2c5adb5aa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..be3fe243b6628
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff.png
new file mode 100644
index 0000000000000..113a5d95dbef8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d66bfa3f12e4f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64b-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a7ac68aeed0fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64b.png b/Shared/CIPPSharp/bin/twemoji/1f64b.png
new file mode 100644
index 0000000000000..ca3aef07e099b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fb.png
new file mode 100644
index 0000000000000..6933625595106
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fc.png
new file mode 100644
index 0000000000000..d1499a4f3a6a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fd.png
new file mode 100644
index 0000000000000..aff7790bcde7b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fe.png
new file mode 100644
index 0000000000000..1b91f8b02f847
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3ff.png
new file mode 100644
index 0000000000000..bbec83c35a866
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64c.png b/Shared/CIPPSharp/bin/twemoji/1f64c.png
new file mode 100644
index 0000000000000..e634507a0b42e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..aae352d056c93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..418bca4b98456
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb.png
new file mode 100644
index 0000000000000..840ddde7d2909
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1ddc7df17da76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..aa2ce5703ca92
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc.png
new file mode 100644
index 0000000000000..820ebabf805da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..611f5abc71b9d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6de21884062db
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd.png
new file mode 100644
index 0000000000000..196cb444d11c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f9be0f0f0271b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..7e7117d633d02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe.png
new file mode 100644
index 0000000000000..eb07daabbe8e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a79fe542dc26b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..b20da5f07d623
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff.png
new file mode 100644
index 0000000000000..d9ef12d0d1747
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8ecf1966beea9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64d-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f4cc4acc15688
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64d.png b/Shared/CIPPSharp/bin/twemoji/1f64d.png
new file mode 100644
index 0000000000000..1d58cfe9291f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..86dd895a359b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f13a8093a977c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb.png
new file mode 100644
index 0000000000000..fb498d23d25b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..75f03ce985c0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..87b6e6ce872e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc.png
new file mode 100644
index 0000000000000..30189f4383201
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3d1528deceb07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ed75c900a30c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd.png
new file mode 100644
index 0000000000000..e515a7128359f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a8b0388daa6f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..75dfe960168c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe.png
new file mode 100644
index 0000000000000..a60b07cc801a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c293681fb6ab3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fd5365cad3f63
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff.png
new file mode 100644
index 0000000000000..1a746f3f77920
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..72da6530d09f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f64e-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4c6b4298da1ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64e.png b/Shared/CIPPSharp/bin/twemoji/1f64e.png
new file mode 100644
index 0000000000000..92a455969cb2d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fb.png
new file mode 100644
index 0000000000000..25dfbd62cac7b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fc.png
new file mode 100644
index 0000000000000..c7025799ad74a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fd.png
new file mode 100644
index 0000000000000..4f8982c45982b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fe.png
new file mode 100644
index 0000000000000..ab440bb60b39d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64f-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3ff.png
new file mode 100644
index 0000000000000..6274a14cc0b9b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64f-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f64f.png b/Shared/CIPPSharp/bin/twemoji/1f64f.png
new file mode 100644
index 0000000000000..b18f35a7f6efb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f64f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f680.png b/Shared/CIPPSharp/bin/twemoji/1f680.png
new file mode 100644
index 0000000000000..ee6a88ac73940
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f681.png b/Shared/CIPPSharp/bin/twemoji/1f681.png
new file mode 100644
index 0000000000000..10796dfb777ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f681.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f682.png b/Shared/CIPPSharp/bin/twemoji/1f682.png
new file mode 100644
index 0000000000000..00d6b1c86c553
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f682.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f683.png b/Shared/CIPPSharp/bin/twemoji/1f683.png
new file mode 100644
index 0000000000000..d563d35b6452e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f683.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f684.png b/Shared/CIPPSharp/bin/twemoji/1f684.png
new file mode 100644
index 0000000000000..826875f7b41f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f684.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f685.png b/Shared/CIPPSharp/bin/twemoji/1f685.png
new file mode 100644
index 0000000000000..ae356c6d62ba4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f685.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f686.png b/Shared/CIPPSharp/bin/twemoji/1f686.png
new file mode 100644
index 0000000000000..c74aa912a704b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f686.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f687.png b/Shared/CIPPSharp/bin/twemoji/1f687.png
new file mode 100644
index 0000000000000..d4614c14510df
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f687.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f688.png b/Shared/CIPPSharp/bin/twemoji/1f688.png
new file mode 100644
index 0000000000000..26aa866540996
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f688.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f689.png b/Shared/CIPPSharp/bin/twemoji/1f689.png
new file mode 100644
index 0000000000000..596d8d614240f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f689.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f68a.png b/Shared/CIPPSharp/bin/twemoji/1f68a.png
new file mode 100644
index 0000000000000..9d51921680f90
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f68a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f68b.png b/Shared/CIPPSharp/bin/twemoji/1f68b.png
new file mode 100644
index 0000000000000..f497e46674343
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f68b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f68c.png b/Shared/CIPPSharp/bin/twemoji/1f68c.png
new file mode 100644
index 0000000000000..4a900b4da048c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f68c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f68d.png b/Shared/CIPPSharp/bin/twemoji/1f68d.png
new file mode 100644
index 0000000000000..078be9ba71db0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f68d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f68e.png b/Shared/CIPPSharp/bin/twemoji/1f68e.png
new file mode 100644
index 0000000000000..cc5a24037f3c2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f68e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f68f.png b/Shared/CIPPSharp/bin/twemoji/1f68f.png
new file mode 100644
index 0000000000000..06a7892894f94
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f68f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f690.png b/Shared/CIPPSharp/bin/twemoji/1f690.png
new file mode 100644
index 0000000000000..ee8318b525fa1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f690.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f691.png b/Shared/CIPPSharp/bin/twemoji/1f691.png
new file mode 100644
index 0000000000000..154fafae93933
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f691.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f692.png b/Shared/CIPPSharp/bin/twemoji/1f692.png
new file mode 100644
index 0000000000000..c8bef7b865dce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f693.png b/Shared/CIPPSharp/bin/twemoji/1f693.png
new file mode 100644
index 0000000000000..97428b4083d28
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f693.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f694.png b/Shared/CIPPSharp/bin/twemoji/1f694.png
new file mode 100644
index 0000000000000..53e8067028571
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f694.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f695.png b/Shared/CIPPSharp/bin/twemoji/1f695.png
new file mode 100644
index 0000000000000..118ac470c352e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f695.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f696.png b/Shared/CIPPSharp/bin/twemoji/1f696.png
new file mode 100644
index 0000000000000..116b2b4364ae2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f696.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f697.png b/Shared/CIPPSharp/bin/twemoji/1f697.png
new file mode 100644
index 0000000000000..fb0f6c86b69ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f697.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f698.png b/Shared/CIPPSharp/bin/twemoji/1f698.png
new file mode 100644
index 0000000000000..666ed7e01399a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f698.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f699.png b/Shared/CIPPSharp/bin/twemoji/1f699.png
new file mode 100644
index 0000000000000..4563409213798
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f699.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f69a.png b/Shared/CIPPSharp/bin/twemoji/1f69a.png
new file mode 100644
index 0000000000000..2fadb0a18628a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f69a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f69b.png b/Shared/CIPPSharp/bin/twemoji/1f69b.png
new file mode 100644
index 0000000000000..883f792ec1890
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f69b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f69c.png b/Shared/CIPPSharp/bin/twemoji/1f69c.png
new file mode 100644
index 0000000000000..715c1511d51b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f69c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f69d.png b/Shared/CIPPSharp/bin/twemoji/1f69d.png
new file mode 100644
index 0000000000000..ce6a1c79b5a96
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f69d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f69e.png b/Shared/CIPPSharp/bin/twemoji/1f69e.png
new file mode 100644
index 0000000000000..255b5fcb84b35
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f69e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f69f.png b/Shared/CIPPSharp/bin/twemoji/1f69f.png
new file mode 100644
index 0000000000000..5615e3b760c84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f69f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a0.png b/Shared/CIPPSharp/bin/twemoji/1f6a0.png
new file mode 100644
index 0000000000000..b0b508ab6b92d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a1.png b/Shared/CIPPSharp/bin/twemoji/1f6a1.png
new file mode 100644
index 0000000000000..4c45163e0a713
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a2.png b/Shared/CIPPSharp/bin/twemoji/1f6a2.png
new file mode 100644
index 0000000000000..aba0f76e00bb7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fde490bb6e1dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..18b201b803f71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb.png
new file mode 100644
index 0000000000000..9bdd60106914f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..16884b8eec89c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8e9d27becc4cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc.png
new file mode 100644
index 0000000000000..ad8126e2e7ef8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c58930f5904a8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e543a176de629
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd.png
new file mode 100644
index 0000000000000..7cb95e5edaa9e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..179b248bff552
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fc992c215ec56
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe.png
new file mode 100644
index 0000000000000..44d884e57d069
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3624440360bbc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..846573e3e21d6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff.png
new file mode 100644
index 0000000000000..270c275c45728
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..21e1468e9d1bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6a3-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..34cc521527ef9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a3.png b/Shared/CIPPSharp/bin/twemoji/1f6a3.png
new file mode 100644
index 0000000000000..405d114bfd35d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a4.png b/Shared/CIPPSharp/bin/twemoji/1f6a4.png
new file mode 100644
index 0000000000000..2fea9d256f70d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a5.png b/Shared/CIPPSharp/bin/twemoji/1f6a5.png
new file mode 100644
index 0000000000000..82e222ae62c36
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a6.png b/Shared/CIPPSharp/bin/twemoji/1f6a6.png
new file mode 100644
index 0000000000000..0596ab3523556
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a7.png b/Shared/CIPPSharp/bin/twemoji/1f6a7.png
new file mode 100644
index 0000000000000..b4e63faff15a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a8.png b/Shared/CIPPSharp/bin/twemoji/1f6a8.png
new file mode 100644
index 0000000000000..170218b147721
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6a9.png b/Shared/CIPPSharp/bin/twemoji/1f6a9.png
new file mode 100644
index 0000000000000..aa650d6dcbd95
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6a9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6aa.png b/Shared/CIPPSharp/bin/twemoji/1f6aa.png
new file mode 100644
index 0000000000000..2ac4b18b0a954
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6aa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6ab.png b/Shared/CIPPSharp/bin/twemoji/1f6ab.png
new file mode 100644
index 0000000000000..43aba4d3fded7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6ab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6ac.png b/Shared/CIPPSharp/bin/twemoji/1f6ac.png
new file mode 100644
index 0000000000000..ec1b357237648
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6ac.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6ad.png b/Shared/CIPPSharp/bin/twemoji/1f6ad.png
new file mode 100644
index 0000000000000..f1e1bc17c0d97
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6ad.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6ae.png b/Shared/CIPPSharp/bin/twemoji/1f6ae.png
new file mode 100644
index 0000000000000..5636443371688
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6ae.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6af.png b/Shared/CIPPSharp/bin/twemoji/1f6af.png
new file mode 100644
index 0000000000000..eb0b0ab56fb5d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b0.png b/Shared/CIPPSharp/bin/twemoji/1f6b0.png
new file mode 100644
index 0000000000000..e50afb54b4844
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b1.png b/Shared/CIPPSharp/bin/twemoji/1f6b1.png
new file mode 100644
index 0000000000000..41ee54ab9e55d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b2.png b/Shared/CIPPSharp/bin/twemoji/1f6b2.png
new file mode 100644
index 0000000000000..3c3b5f88bc7b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b3.png b/Shared/CIPPSharp/bin/twemoji/1f6b3.png
new file mode 100644
index 0000000000000..9d911de7f8330
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..df15a18afe9de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..cd2a021e340fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb.png
new file mode 100644
index 0000000000000..ed9418f8ea781
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ab2991777e74b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..626267467e84f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc.png
new file mode 100644
index 0000000000000..227b23c301a7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..76f60cd6ff520
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fa5a581e59ce3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd.png
new file mode 100644
index 0000000000000..5dd31d7f10360
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..6df286ef52e6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a5f0d7353f01e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe.png
new file mode 100644
index 0000000000000..542172dd065f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fdb0747c81133
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f6824bd060856
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff.png
new file mode 100644
index 0000000000000..154ced30da869
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bf9729e40c5fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b4-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4e20da34720b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b4.png b/Shared/CIPPSharp/bin/twemoji/1f6b4.png
new file mode 100644
index 0000000000000..740460a5c4550
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..acf76d55ab72f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..80193f2b1802a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb.png
new file mode 100644
index 0000000000000..f11d9b0e9f261
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..2015da4886a42
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..858838777c2f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc.png
new file mode 100644
index 0000000000000..d64e9126c5f7c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..781b6363f8fc4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0fa06e5e27853
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd.png
new file mode 100644
index 0000000000000..cdbec9bce3967
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b016fd04f891a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..35783c0b1d94b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe.png
new file mode 100644
index 0000000000000..b47ec8684395c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8d48bcbad7717
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..99cd3437b23c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff.png
new file mode 100644
index 0000000000000..77b5a67ebb573
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..442571a93ace1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b5-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1a65cdaecbfe0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b5.png b/Shared/CIPPSharp/bin/twemoji/1f6b5.png
new file mode 100644
index 0000000000000..a19fca05b936a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..9242fe8b4d36f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8adb675c408c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..648d6df1ff2b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..21de68e56d82f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..44c8ebfba7848
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb.png
new file mode 100644
index 0000000000000..dedfe0def169f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..dad007501aaa3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..83393cbbb8281
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..648c7cea59a26
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ad530e7e56d75
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..0e906c7847f04
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc.png
new file mode 100644
index 0000000000000..7e9f7f2742bf4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..423d9d5386309
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a02b5596e6375
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..67d234dfc7e49
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4ec1ab50c9bb3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..4da7831d0ecbd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd.png
new file mode 100644
index 0000000000000..e4cef4018c448
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..cecc609b1b761
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1a7393e143acc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..b001149131920
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8d60431ecd95b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..5ca6ce8d9e697
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe.png
new file mode 100644
index 0000000000000..1713d959fb954
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..bc135e6c3caab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..4c15c76936ca2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..cd564b41a0a3e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4bc174b72465a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..fd81af89a27c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff.png
new file mode 100644
index 0000000000000..f3719b6d06c0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..ea8ac23cd748d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..33f0cf7414f03
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..61384241d12c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..59d7673e2b083
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..d83236e9bef73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b6.png b/Shared/CIPPSharp/bin/twemoji/1f6b6.png
new file mode 100644
index 0000000000000..a45b3db78f134
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b7.png b/Shared/CIPPSharp/bin/twemoji/1f6b7.png
new file mode 100644
index 0000000000000..92bfa62a9982d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b8.png b/Shared/CIPPSharp/bin/twemoji/1f6b8.png
new file mode 100644
index 0000000000000..72ff572c64155
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6b9.png b/Shared/CIPPSharp/bin/twemoji/1f6b9.png
new file mode 100644
index 0000000000000..ea42e7ff64919
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6b9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6ba.png b/Shared/CIPPSharp/bin/twemoji/1f6ba.png
new file mode 100644
index 0000000000000..636d05b632003
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6ba.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6bb.png b/Shared/CIPPSharp/bin/twemoji/1f6bb.png
new file mode 100644
index 0000000000000..7bb19365e90b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6bc.png b/Shared/CIPPSharp/bin/twemoji/1f6bc.png
new file mode 100644
index 0000000000000..4195611226294
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6bd.png b/Shared/CIPPSharp/bin/twemoji/1f6bd.png
new file mode 100644
index 0000000000000..a85e96567c4bd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6be.png b/Shared/CIPPSharp/bin/twemoji/1f6be.png
new file mode 100644
index 0000000000000..9583065733812
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6be.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6bf.png b/Shared/CIPPSharp/bin/twemoji/1f6bf.png
new file mode 100644
index 0000000000000..59619c4bba449
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6bf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fb.png
new file mode 100644
index 0000000000000..88d871a4f4431
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fc.png
new file mode 100644
index 0000000000000..9f43d609db592
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fd.png
new file mode 100644
index 0000000000000..437bfe94b0efe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fe.png
new file mode 100644
index 0000000000000..1ded3eccaac61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3ff.png
new file mode 100644
index 0000000000000..4e030ad13d554
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c0-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c0.png b/Shared/CIPPSharp/bin/twemoji/1f6c0.png
new file mode 100644
index 0000000000000..476a0c174b1ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c1.png b/Shared/CIPPSharp/bin/twemoji/1f6c1.png
new file mode 100644
index 0000000000000..cac11d9aa10da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c2.png b/Shared/CIPPSharp/bin/twemoji/1f6c2.png
new file mode 100644
index 0000000000000..f3ded0a810d8a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c3.png b/Shared/CIPPSharp/bin/twemoji/1f6c3.png
new file mode 100644
index 0000000000000..b065c8d0da9e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c4.png b/Shared/CIPPSharp/bin/twemoji/1f6c4.png
new file mode 100644
index 0000000000000..6c15f41ed7c27
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6c5.png b/Shared/CIPPSharp/bin/twemoji/1f6c5.png
new file mode 100644
index 0000000000000..755c5ca8e377b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6c5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cb.png b/Shared/CIPPSharp/bin/twemoji/1f6cb.png
new file mode 100644
index 0000000000000..2634ec310dbbf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fb.png
new file mode 100644
index 0000000000000..1f9e71fc43117
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fc.png
new file mode 100644
index 0000000000000..bf38c8114a292
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fd.png
new file mode 100644
index 0000000000000..c1e9c14341a76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fe.png
new file mode 100644
index 0000000000000..8764e991d0139
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3ff.png
new file mode 100644
index 0000000000000..3e02dc6ddb431
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cc-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cc.png b/Shared/CIPPSharp/bin/twemoji/1f6cc.png
new file mode 100644
index 0000000000000..432262ecafb66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cd.png b/Shared/CIPPSharp/bin/twemoji/1f6cd.png
new file mode 100644
index 0000000000000..6fd9e6bbe44ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6ce.png b/Shared/CIPPSharp/bin/twemoji/1f6ce.png
new file mode 100644
index 0000000000000..82d49dab57f5c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6ce.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6cf.png b/Shared/CIPPSharp/bin/twemoji/1f6cf.png
new file mode 100644
index 0000000000000..5b2a2b641f18c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6cf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6d0.png b/Shared/CIPPSharp/bin/twemoji/1f6d0.png
new file mode 100644
index 0000000000000..c064314c8b185
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6d0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6d1.png b/Shared/CIPPSharp/bin/twemoji/1f6d1.png
new file mode 100644
index 0000000000000..583f00dfd63c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6d1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6d2.png b/Shared/CIPPSharp/bin/twemoji/1f6d2.png
new file mode 100644
index 0000000000000..1ca32e8330469
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6d5.png b/Shared/CIPPSharp/bin/twemoji/1f6d5.png
new file mode 100644
index 0000000000000..2c20004e8adfe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6d5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6d6.png b/Shared/CIPPSharp/bin/twemoji/1f6d6.png
new file mode 100644
index 0000000000000..16e300625eb7c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6d6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6d7.png b/Shared/CIPPSharp/bin/twemoji/1f6d7.png
new file mode 100644
index 0000000000000..4670711dd63f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6d7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6d8.png b/Shared/CIPPSharp/bin/twemoji/1f6d8.png
new file mode 100644
index 0000000000000..cb1c69dc5217d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6d8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6dc.png b/Shared/CIPPSharp/bin/twemoji/1f6dc.png
new file mode 100644
index 0000000000000..3aad5d590df9b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6dc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6dd.png b/Shared/CIPPSharp/bin/twemoji/1f6dd.png
new file mode 100644
index 0000000000000..a74dd95ae4133
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6dd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6de.png b/Shared/CIPPSharp/bin/twemoji/1f6de.png
new file mode 100644
index 0000000000000..13e845b4a733a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6de.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6df.png b/Shared/CIPPSharp/bin/twemoji/1f6df.png
new file mode 100644
index 0000000000000..6bab85229c2cf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6df.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6e0.png b/Shared/CIPPSharp/bin/twemoji/1f6e0.png
new file mode 100644
index 0000000000000..6b64d3a11cacb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6e0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6e1.png b/Shared/CIPPSharp/bin/twemoji/1f6e1.png
new file mode 100644
index 0000000000000..b29d246639cf0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6e1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6e2.png b/Shared/CIPPSharp/bin/twemoji/1f6e2.png
new file mode 100644
index 0000000000000..32b10f1aa3df8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6e2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6e3.png b/Shared/CIPPSharp/bin/twemoji/1f6e3.png
new file mode 100644
index 0000000000000..50d3dca2b1f9b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6e4.png b/Shared/CIPPSharp/bin/twemoji/1f6e4.png
new file mode 100644
index 0000000000000..fa1547075c49d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6e4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6e5.png b/Shared/CIPPSharp/bin/twemoji/1f6e5.png
new file mode 100644
index 0000000000000..c573cb3d6c435
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6e5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6e9.png b/Shared/CIPPSharp/bin/twemoji/1f6e9.png
new file mode 100644
index 0000000000000..ee9cfe1837966
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6eb.png b/Shared/CIPPSharp/bin/twemoji/1f6eb.png
new file mode 100644
index 0000000000000..34531e823cdee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6ec.png b/Shared/CIPPSharp/bin/twemoji/1f6ec.png
new file mode 100644
index 0000000000000..f44f5c295e798
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f0.png b/Shared/CIPPSharp/bin/twemoji/1f6f0.png
new file mode 100644
index 0000000000000..d834f7b8988dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f3.png b/Shared/CIPPSharp/bin/twemoji/1f6f3.png
new file mode 100644
index 0000000000000..8f0be1dedd5d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f4.png b/Shared/CIPPSharp/bin/twemoji/1f6f4.png
new file mode 100644
index 0000000000000..bbd247acbaf1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f5.png b/Shared/CIPPSharp/bin/twemoji/1f6f5.png
new file mode 100644
index 0000000000000..436efa3629faa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f6.png b/Shared/CIPPSharp/bin/twemoji/1f6f6.png
new file mode 100644
index 0000000000000..99b6c1bbca529
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f7.png b/Shared/CIPPSharp/bin/twemoji/1f6f7.png
new file mode 100644
index 0000000000000..e0f5eb7ee9ab2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f8.png b/Shared/CIPPSharp/bin/twemoji/1f6f8.png
new file mode 100644
index 0000000000000..ae7b217a2fa40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6f9.png b/Shared/CIPPSharp/bin/twemoji/1f6f9.png
new file mode 100644
index 0000000000000..142b14d8d749d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6fa.png b/Shared/CIPPSharp/bin/twemoji/1f6fa.png
new file mode 100644
index 0000000000000..a0157fb73562e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6fb.png b/Shared/CIPPSharp/bin/twemoji/1f6fb.png
new file mode 100644
index 0000000000000..2bc271a7fd5ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f6fc.png b/Shared/CIPPSharp/bin/twemoji/1f6fc.png
new file mode 100644
index 0000000000000..ba95b2eafa391
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f6fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e0.png b/Shared/CIPPSharp/bin/twemoji/1f7e0.png
new file mode 100644
index 0000000000000..006dfd73c181e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e1.png b/Shared/CIPPSharp/bin/twemoji/1f7e1.png
new file mode 100644
index 0000000000000..16b1609ced254
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e2.png b/Shared/CIPPSharp/bin/twemoji/1f7e2.png
new file mode 100644
index 0000000000000..8b267199d7c02
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e3.png b/Shared/CIPPSharp/bin/twemoji/1f7e3.png
new file mode 100644
index 0000000000000..194709defa0ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e4.png b/Shared/CIPPSharp/bin/twemoji/1f7e4.png
new file mode 100644
index 0000000000000..57d9f46b04b2c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e5.png b/Shared/CIPPSharp/bin/twemoji/1f7e5.png
new file mode 100644
index 0000000000000..efd984d1b4bae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e6.png b/Shared/CIPPSharp/bin/twemoji/1f7e6.png
new file mode 100644
index 0000000000000..11304dd310255
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e7.png b/Shared/CIPPSharp/bin/twemoji/1f7e7.png
new file mode 100644
index 0000000000000..5d987f7b4de38
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e8.png b/Shared/CIPPSharp/bin/twemoji/1f7e8.png
new file mode 100644
index 0000000000000..a55b13e71767c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7e9.png b/Shared/CIPPSharp/bin/twemoji/1f7e9.png
new file mode 100644
index 0000000000000..87fca3dd4b9b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7ea.png b/Shared/CIPPSharp/bin/twemoji/1f7ea.png
new file mode 100644
index 0000000000000..2d15d4790715e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7eb.png b/Shared/CIPPSharp/bin/twemoji/1f7eb.png
new file mode 100644
index 0000000000000..859afd69aedbe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f7f0.png b/Shared/CIPPSharp/bin/twemoji/1f7f0.png
new file mode 100644
index 0000000000000..cc01767c2ea71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f7f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fb.png
new file mode 100644
index 0000000000000..1efddf99b9c95
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fc.png
new file mode 100644
index 0000000000000..884ed0dacf0a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fd.png
new file mode 100644
index 0000000000000..00e0258211440
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fe.png
new file mode 100644
index 0000000000000..83de986a93f09
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3ff.png
new file mode 100644
index 0000000000000..fb4a3faa21487
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90c.png b/Shared/CIPPSharp/bin/twemoji/1f90c.png
new file mode 100644
index 0000000000000..0fe8b356e2704
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90d.png b/Shared/CIPPSharp/bin/twemoji/1f90d.png
new file mode 100644
index 0000000000000..38b3ed8eb403b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90e.png b/Shared/CIPPSharp/bin/twemoji/1f90e.png
new file mode 100644
index 0000000000000..f33e827de9949
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fb.png
new file mode 100644
index 0000000000000..23eb251ded272
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fc.png
new file mode 100644
index 0000000000000..bb45b10f51936
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fd.png
new file mode 100644
index 0000000000000..f733bfbaa533b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fe.png
new file mode 100644
index 0000000000000..156da313b37bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90f-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3ff.png
new file mode 100644
index 0000000000000..883f5c79f8e3b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90f-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f90f.png b/Shared/CIPPSharp/bin/twemoji/1f90f.png
new file mode 100644
index 0000000000000..a463f0d583101
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f90f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f910.png b/Shared/CIPPSharp/bin/twemoji/1f910.png
new file mode 100644
index 0000000000000..8badd1278faef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f910.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f911.png b/Shared/CIPPSharp/bin/twemoji/1f911.png
new file mode 100644
index 0000000000000..e392e769dda1e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f911.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f912.png b/Shared/CIPPSharp/bin/twemoji/1f912.png
new file mode 100644
index 0000000000000..79d49eb0a641e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f912.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f913.png b/Shared/CIPPSharp/bin/twemoji/1f913.png
new file mode 100644
index 0000000000000..2e231e4e365e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f913.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f914.png b/Shared/CIPPSharp/bin/twemoji/1f914.png
new file mode 100644
index 0000000000000..354f5a14e28b1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f914.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f915.png b/Shared/CIPPSharp/bin/twemoji/1f915.png
new file mode 100644
index 0000000000000..c8ff29266551e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f915.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f916.png b/Shared/CIPPSharp/bin/twemoji/1f916.png
new file mode 100644
index 0000000000000..3be87d30c7630
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f916.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f917.png b/Shared/CIPPSharp/bin/twemoji/1f917.png
new file mode 100644
index 0000000000000..6d0f049fac033
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f917.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f918-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fb.png
new file mode 100644
index 0000000000000..e29d0ef48c8b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f918-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fc.png
new file mode 100644
index 0000000000000..1e4ffa69931eb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f918-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fd.png
new file mode 100644
index 0000000000000..e672efd740729
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f918-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fe.png
new file mode 100644
index 0000000000000..9203c6e77147a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f918-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f918-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f918-1f3ff.png
new file mode 100644
index 0000000000000..a0803dbff43f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f918-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f918.png b/Shared/CIPPSharp/bin/twemoji/1f918.png
new file mode 100644
index 0000000000000..47144764c718b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f918.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f919-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fb.png
new file mode 100644
index 0000000000000..2c7675b58c5ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f919-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fc.png
new file mode 100644
index 0000000000000..1389cf46ca200
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f919-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fd.png
new file mode 100644
index 0000000000000..7a20f3039dfaa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f919-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fe.png
new file mode 100644
index 0000000000000..eac1f18e77570
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f919-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f919-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f919-1f3ff.png
new file mode 100644
index 0000000000000..7b82fed4604c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f919-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f919.png b/Shared/CIPPSharp/bin/twemoji/1f919.png
new file mode 100644
index 0000000000000..6a4dcb42deddf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f919.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fb.png
new file mode 100644
index 0000000000000..e23d29d97c22f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fc.png
new file mode 100644
index 0000000000000..18afbc05ec8ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fd.png
new file mode 100644
index 0000000000000..bce5db45dc2e1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fe.png
new file mode 100644
index 0000000000000..b5c4c4aebedc5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91a-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3ff.png
new file mode 100644
index 0000000000000..d1fe817445b9b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91a-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91a.png b/Shared/CIPPSharp/bin/twemoji/1f91a.png
new file mode 100644
index 0000000000000..6de21fb3f442a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fb.png
new file mode 100644
index 0000000000000..ad304c95dbc18
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fc.png
new file mode 100644
index 0000000000000..54c768aff741b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fd.png
new file mode 100644
index 0000000000000..0abece218b47f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fe.png
new file mode 100644
index 0000000000000..b24da132a9f1c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91b-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3ff.png
new file mode 100644
index 0000000000000..465964a9d5ab6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91b-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91b.png b/Shared/CIPPSharp/bin/twemoji/1f91b.png
new file mode 100644
index 0000000000000..0f44a9f4e802a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fb.png
new file mode 100644
index 0000000000000..ac7cb248de8c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fc.png
new file mode 100644
index 0000000000000..6227854be5246
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fd.png
new file mode 100644
index 0000000000000..d3c6ac0d0d6bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fe.png
new file mode 100644
index 0000000000000..84f3b032b360e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3ff.png
new file mode 100644
index 0000000000000..e8d3ee01d4f55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91c.png b/Shared/CIPPSharp/bin/twemoji/1f91c.png
new file mode 100644
index 0000000000000..13ac5dd272c62
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fb.png
new file mode 100644
index 0000000000000..0f3d86ba4ec8a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fc.png
new file mode 100644
index 0000000000000..ef404f8d7150b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fd.png
new file mode 100644
index 0000000000000..ea4b53b28d2ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fe.png
new file mode 100644
index 0000000000000..5e8363b6ea1be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91d-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3ff.png
new file mode 100644
index 0000000000000..9e1eafb6eb09a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91d-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91d.png b/Shared/CIPPSharp/bin/twemoji/1f91d.png
new file mode 100644
index 0000000000000..c1cc9d069d405
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fb.png
new file mode 100644
index 0000000000000..e29a32222f538
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fc.png
new file mode 100644
index 0000000000000..17c89bdd22961
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fd.png
new file mode 100644
index 0000000000000..0f279d866052d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fe.png
new file mode 100644
index 0000000000000..3a01379cb09e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91e-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3ff.png
new file mode 100644
index 0000000000000..282f833165f68
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91e-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91e.png b/Shared/CIPPSharp/bin/twemoji/1f91e.png
new file mode 100644
index 0000000000000..94d8e3a6823c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fb.png
new file mode 100644
index 0000000000000..050f9e1a851ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fc.png
new file mode 100644
index 0000000000000..e1af8d68aa0cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fd.png
new file mode 100644
index 0000000000000..f8b4ec3eb582f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fe.png
new file mode 100644
index 0000000000000..abd0c9887330c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91f-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3ff.png
new file mode 100644
index 0000000000000..fd5e2f43150bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91f-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f91f.png b/Shared/CIPPSharp/bin/twemoji/1f91f.png
new file mode 100644
index 0000000000000..c9dd359430ddd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f91f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f920.png b/Shared/CIPPSharp/bin/twemoji/1f920.png
new file mode 100644
index 0000000000000..179af9fc12a91
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f920.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f921.png b/Shared/CIPPSharp/bin/twemoji/1f921.png
new file mode 100644
index 0000000000000..befcd928f3bfb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f921.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f922.png b/Shared/CIPPSharp/bin/twemoji/1f922.png
new file mode 100644
index 0000000000000..726e07a71017f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f922.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f923.png b/Shared/CIPPSharp/bin/twemoji/1f923.png
new file mode 100644
index 0000000000000..06419921d4e57
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f923.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f924.png b/Shared/CIPPSharp/bin/twemoji/1f924.png
new file mode 100644
index 0000000000000..47733cd9f294f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f924.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f925.png b/Shared/CIPPSharp/bin/twemoji/1f925.png
new file mode 100644
index 0000000000000..98fc0890126dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f925.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ff6832f23e7d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9a880d0691bb1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb.png
new file mode 100644
index 0000000000000..1d4cc4a41a563
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fc54044bc9396
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..bc32acf9a1426
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc.png
new file mode 100644
index 0000000000000..2628d2c6b505c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dd51cfd963676
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8b4e34a454652
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd.png
new file mode 100644
index 0000000000000..4ca0440921fc7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..756403023f9c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ed371a16824ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe.png
new file mode 100644
index 0000000000000..c3c67ec5fb95e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..622d19c8e8776
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4ff960412db84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff.png
new file mode 100644
index 0000000000000..8cb2827b70528
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bd2226b024e44
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f926-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1ca028b734bd4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f926.png b/Shared/CIPPSharp/bin/twemoji/1f926.png
new file mode 100644
index 0000000000000..0e5111fa633ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f926.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f927.png b/Shared/CIPPSharp/bin/twemoji/1f927.png
new file mode 100644
index 0000000000000..c5b524ec6c176
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f927.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f928.png b/Shared/CIPPSharp/bin/twemoji/1f928.png
new file mode 100644
index 0000000000000..db22dd7d2f330
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f928.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f929.png b/Shared/CIPPSharp/bin/twemoji/1f929.png
new file mode 100644
index 0000000000000..dc94d7d914901
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f929.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f92a.png b/Shared/CIPPSharp/bin/twemoji/1f92a.png
new file mode 100644
index 0000000000000..bf2d10381a9d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f92a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f92b.png b/Shared/CIPPSharp/bin/twemoji/1f92b.png
new file mode 100644
index 0000000000000..3808dd3553a4e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f92b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f92c.png b/Shared/CIPPSharp/bin/twemoji/1f92c.png
new file mode 100644
index 0000000000000..5cde0c98da18a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f92c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f92d.png b/Shared/CIPPSharp/bin/twemoji/1f92d.png
new file mode 100644
index 0000000000000..6cc00cc7937b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f92d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f92e.png b/Shared/CIPPSharp/bin/twemoji/1f92e.png
new file mode 100644
index 0000000000000..47ddebaa9b457
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f92e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f92f.png b/Shared/CIPPSharp/bin/twemoji/1f92f.png
new file mode 100644
index 0000000000000..a6ea47ee3f6c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f92f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f930-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fb.png
new file mode 100644
index 0000000000000..6caaf2e865966
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f930-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fc.png
new file mode 100644
index 0000000000000..31a45c3ca477e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f930-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fd.png
new file mode 100644
index 0000000000000..93f4a2a5a996a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f930-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fe.png
new file mode 100644
index 0000000000000..11fc34f553ebc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f930-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f930-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f930-1f3ff.png
new file mode 100644
index 0000000000000..42cd09c285e53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f930-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f930.png b/Shared/CIPPSharp/bin/twemoji/1f930.png
new file mode 100644
index 0000000000000..685a2e7ec5077
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f930.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f931-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fb.png
new file mode 100644
index 0000000000000..b129c3fdabbcf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f931-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fc.png
new file mode 100644
index 0000000000000..8bdeb62553932
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f931-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fd.png
new file mode 100644
index 0000000000000..c721900959a21
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f931-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fe.png
new file mode 100644
index 0000000000000..ec6060b74bfe2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f931-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f931-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f931-1f3ff.png
new file mode 100644
index 0000000000000..eed8063463e5f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f931-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f931.png b/Shared/CIPPSharp/bin/twemoji/1f931.png
new file mode 100644
index 0000000000000..dba766f9a0478
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f931.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f932-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fb.png
new file mode 100644
index 0000000000000..535047e4aca13
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f932-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fc.png
new file mode 100644
index 0000000000000..205f7b7fb07f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f932-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fd.png
new file mode 100644
index 0000000000000..92fbfe3b253e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f932-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fe.png
new file mode 100644
index 0000000000000..5b363bfa9c906
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f932-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f932-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f932-1f3ff.png
new file mode 100644
index 0000000000000..7cc2755df5793
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f932-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f932.png b/Shared/CIPPSharp/bin/twemoji/1f932.png
new file mode 100644
index 0000000000000..711417518980e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f932.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f933-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fb.png
new file mode 100644
index 0000000000000..b117100ef6f92
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f933-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fc.png
new file mode 100644
index 0000000000000..4b9373c58402e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f933-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fd.png
new file mode 100644
index 0000000000000..929b6b942a32a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f933-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fe.png
new file mode 100644
index 0000000000000..1308327dd8348
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f933-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f933-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f933-1f3ff.png
new file mode 100644
index 0000000000000..549c6e4e9ceb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f933-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f933.png b/Shared/CIPPSharp/bin/twemoji/1f933.png
new file mode 100644
index 0000000000000..f5eb251cbf4f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f933.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f934-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fb.png
new file mode 100644
index 0000000000000..ebc44218ad616
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f934-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fc.png
new file mode 100644
index 0000000000000..fe8fe2230b6e5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f934-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fd.png
new file mode 100644
index 0000000000000..d2c58410be23c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f934-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fe.png
new file mode 100644
index 0000000000000..9079fe487642b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f934-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f934-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f934-1f3ff.png
new file mode 100644
index 0000000000000..1a781d825acaf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f934-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f934.png b/Shared/CIPPSharp/bin/twemoji/1f934.png
new file mode 100644
index 0000000000000..9527136fa7f96
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f934.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..981df10b9eb53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..22f79e5263ffc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb.png
new file mode 100644
index 0000000000000..fb2c50915604d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5f7d09f6a9daa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..3f636db81d357
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc.png
new file mode 100644
index 0000000000000..03f5023e4e69e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..6a7726db161cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a631877785a9d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd.png
new file mode 100644
index 0000000000000..a3675888b528d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..95a815eab43cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..2d3166fe0cbef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe.png
new file mode 100644
index 0000000000000..5133d6d9d1c5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..693097e5c015f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..340d98fc1891b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff.png
new file mode 100644
index 0000000000000..17ff9f3f75f4f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fad0f83bcea66
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f935-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f5e421bd3a81c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f935.png b/Shared/CIPPSharp/bin/twemoji/1f935.png
new file mode 100644
index 0000000000000..cc67ef424686d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f935.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f936-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fb.png
new file mode 100644
index 0000000000000..6d3c340692069
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f936-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fc.png
new file mode 100644
index 0000000000000..52c9ba810d3b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f936-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fd.png
new file mode 100644
index 0000000000000..9651385708daf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f936-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fe.png
new file mode 100644
index 0000000000000..3ec0c5686e2e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f936-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f936-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f936-1f3ff.png
new file mode 100644
index 0000000000000..f86966be832c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f936-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f936.png b/Shared/CIPPSharp/bin/twemoji/1f936.png
new file mode 100644
index 0000000000000..56dc794884bbb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f936.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..35d2519be0aaf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6f4807fb97289
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb.png
new file mode 100644
index 0000000000000..8f8b579da179d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d0f463f708996
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c882436eba111
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc.png
new file mode 100644
index 0000000000000..622a19295bc40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d839134f897ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..b73d2c5e05fb3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd.png
new file mode 100644
index 0000000000000..eed23a44b7024
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b773e32d4c92a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..48b8959adca07
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe.png
new file mode 100644
index 0000000000000..5490832285614
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..4b1468dac2a8f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e9df52e5cb40f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff.png
new file mode 100644
index 0000000000000..4fd0d85d9c946
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..00f36c6b2b30b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f937-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4e4c51d0154d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f937.png b/Shared/CIPPSharp/bin/twemoji/1f937.png
new file mode 100644
index 0000000000000..92b5575c35264
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f937.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..734e052c7433a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d1ac33c3e78bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb.png
new file mode 100644
index 0000000000000..e993855704802
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..9dd74e26a6cb0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ccfa25496cb2d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc.png
new file mode 100644
index 0000000000000..a44b98416e8e1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..71061064d56d6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..006782472b045
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd.png
new file mode 100644
index 0000000000000..c2cb4e7918021
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b727f95c9c126
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..34c246667a329
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe.png
new file mode 100644
index 0000000000000..6c02fd65d14a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..4b1bf03787354
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fe77b725e497a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff.png
new file mode 100644
index 0000000000000..8c5919fd80f08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dfe3070597bb8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f938-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e783fe7489622
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f938.png b/Shared/CIPPSharp/bin/twemoji/1f938.png
new file mode 100644
index 0000000000000..00dc8f42144b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f938.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8840e5587f029
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d4c8c6cdf9533
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb.png
new file mode 100644
index 0000000000000..253b8b880cefd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..22770625fbf3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f075c7d1c86cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc.png
new file mode 100644
index 0000000000000..1056ad88eda55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..21b04a87ef013
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..95bc0a860124b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd.png
new file mode 100644
index 0000000000000..1498c77f4fa98
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..aa8e325bd62b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c038dd8bff299
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe.png
new file mode 100644
index 0000000000000..618dc1697bbcd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..461600ba195da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ae2401b480cc1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff.png
new file mode 100644
index 0000000000000..02222272ad403
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..482bf46dece0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f939-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..555d35ccd939b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f939.png b/Shared/CIPPSharp/bin/twemoji/1f939.png
new file mode 100644
index 0000000000000..04e2c586eee7f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f939.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93a.png b/Shared/CIPPSharp/bin/twemoji/1f93a.png
new file mode 100644
index 0000000000000..0781fdab5001b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b11efe803dc48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..20270806faed9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb.png
new file mode 100644
index 0000000000000..6eec184f7da17
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..92974fd9b0a21
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..76fecae1da266
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc.png
new file mode 100644
index 0000000000000..9adfffd496437
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..762e0b417b59e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0a93155c4eb2b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd.png
new file mode 100644
index 0000000000000..e3bf239bbb6ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..310597da1bbba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e456ab89bbae2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe.png
new file mode 100644
index 0000000000000..1f9fc47dc11fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5a6f0991f5a47
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1a9879a927048
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff.png
new file mode 100644
index 0000000000000..c795ec3cd81c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8f51f00fc2112
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93c-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..259c87e7c196a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93c.png b/Shared/CIPPSharp/bin/twemoji/1f93c.png
new file mode 100644
index 0000000000000..3d50b96c0ddbb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3633cb03dc8ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8a61156f8ec30
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb.png
new file mode 100644
index 0000000000000..5a2a755ef7914
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1b7ec16a5e562
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..501bd5783f3ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc.png
new file mode 100644
index 0000000000000..8f3ac54526e8e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b905b42090907
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..db5c1f7925266
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd.png
new file mode 100644
index 0000000000000..9b533b2b1353d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..94d2f5741454d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0325893b3d153
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe.png
new file mode 100644
index 0000000000000..41a3d6071f66d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fb287729a0f34
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..b4e89e7530c58
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff.png
new file mode 100644
index 0000000000000..5e1d803049be9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..db9a6451a4a92
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93d-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..b0c8a9e3646a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93d.png b/Shared/CIPPSharp/bin/twemoji/1f93d.png
new file mode 100644
index 0000000000000..86dfb8be12736
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e08716d150094
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..00466fd8dbd70
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb.png
new file mode 100644
index 0000000000000..b4705b5f6909a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a1d7c67c33693
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..bb1ad889fd6a8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc.png
new file mode 100644
index 0000000000000..a2297db9662ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3340792ec2095
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f3f33a03dc6e1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd.png
new file mode 100644
index 0000000000000..6e83120bd797c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..33ce2ea00c7a8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..bd4593bba3d13
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe.png
new file mode 100644
index 0000000000000..e9e6d6a78790e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ee6a7a8efab0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..b7042235b0ec4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff.png
new file mode 100644
index 0000000000000..f723f73a47976
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..daacbb25136b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f93e-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a87ffc0128deb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93e.png b/Shared/CIPPSharp/bin/twemoji/1f93e.png
new file mode 100644
index 0000000000000..f5db924d0b598
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f93f.png b/Shared/CIPPSharp/bin/twemoji/1f93f.png
new file mode 100644
index 0000000000000..8bf1de49a7772
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f93f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f940.png b/Shared/CIPPSharp/bin/twemoji/1f940.png
new file mode 100644
index 0000000000000..9390ebfcbcf29
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f940.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f941.png b/Shared/CIPPSharp/bin/twemoji/1f941.png
new file mode 100644
index 0000000000000..19c427bdfd6a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f941.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f942.png b/Shared/CIPPSharp/bin/twemoji/1f942.png
new file mode 100644
index 0000000000000..4801c68fd6e97
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f942.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f943.png b/Shared/CIPPSharp/bin/twemoji/1f943.png
new file mode 100644
index 0000000000000..a495095feb3e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f943.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f944.png b/Shared/CIPPSharp/bin/twemoji/1f944.png
new file mode 100644
index 0000000000000..1c418ebd9fc83
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f944.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f945.png b/Shared/CIPPSharp/bin/twemoji/1f945.png
new file mode 100644
index 0000000000000..fb5aeffcfa189
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f945.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f947.png b/Shared/CIPPSharp/bin/twemoji/1f947.png
new file mode 100644
index 0000000000000..7f1df40486123
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f947.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f948.png b/Shared/CIPPSharp/bin/twemoji/1f948.png
new file mode 100644
index 0000000000000..d451fd52d13e6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f948.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f949.png b/Shared/CIPPSharp/bin/twemoji/1f949.png
new file mode 100644
index 0000000000000..f5c87e3cb0cd2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f949.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f94a.png b/Shared/CIPPSharp/bin/twemoji/1f94a.png
new file mode 100644
index 0000000000000..4f5f0333bd1c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f94a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f94b.png b/Shared/CIPPSharp/bin/twemoji/1f94b.png
new file mode 100644
index 0000000000000..30fee1e368892
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f94b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f94c.png b/Shared/CIPPSharp/bin/twemoji/1f94c.png
new file mode 100644
index 0000000000000..65228c2db8c95
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f94c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f94d.png b/Shared/CIPPSharp/bin/twemoji/1f94d.png
new file mode 100644
index 0000000000000..8202c8b34b0bd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f94d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f94e.png b/Shared/CIPPSharp/bin/twemoji/1f94e.png
new file mode 100644
index 0000000000000..b78c695486a73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f94e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f94f.png b/Shared/CIPPSharp/bin/twemoji/1f94f.png
new file mode 100644
index 0000000000000..ef34259ead12a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f94f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f950.png b/Shared/CIPPSharp/bin/twemoji/1f950.png
new file mode 100644
index 0000000000000..3788e1bd4310a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f950.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f951.png b/Shared/CIPPSharp/bin/twemoji/1f951.png
new file mode 100644
index 0000000000000..2af5fc6bdf523
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f951.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f952.png b/Shared/CIPPSharp/bin/twemoji/1f952.png
new file mode 100644
index 0000000000000..1bac31e5cd653
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f952.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f953.png b/Shared/CIPPSharp/bin/twemoji/1f953.png
new file mode 100644
index 0000000000000..6b2418e79ab48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f953.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f954.png b/Shared/CIPPSharp/bin/twemoji/1f954.png
new file mode 100644
index 0000000000000..bf3d9b9c47924
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f954.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f955.png b/Shared/CIPPSharp/bin/twemoji/1f955.png
new file mode 100644
index 0000000000000..831d63911c841
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f955.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f956.png b/Shared/CIPPSharp/bin/twemoji/1f956.png
new file mode 100644
index 0000000000000..0b9cc251bc32d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f956.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f957.png b/Shared/CIPPSharp/bin/twemoji/1f957.png
new file mode 100644
index 0000000000000..f255f4d6eca5a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f957.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f958.png b/Shared/CIPPSharp/bin/twemoji/1f958.png
new file mode 100644
index 0000000000000..39b64e069e8cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f958.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f959.png b/Shared/CIPPSharp/bin/twemoji/1f959.png
new file mode 100644
index 0000000000000..f3377b938221c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f959.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f95a.png b/Shared/CIPPSharp/bin/twemoji/1f95a.png
new file mode 100644
index 0000000000000..6d03b79044469
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f95a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f95b.png b/Shared/CIPPSharp/bin/twemoji/1f95b.png
new file mode 100644
index 0000000000000..234419e003979
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f95b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f95c.png b/Shared/CIPPSharp/bin/twemoji/1f95c.png
new file mode 100644
index 0000000000000..e8f17a1a9718e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f95c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f95d.png b/Shared/CIPPSharp/bin/twemoji/1f95d.png
new file mode 100644
index 0000000000000..3ba423b22f6dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f95d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f95e.png b/Shared/CIPPSharp/bin/twemoji/1f95e.png
new file mode 100644
index 0000000000000..6bcded7237fa7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f95e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f95f.png b/Shared/CIPPSharp/bin/twemoji/1f95f.png
new file mode 100644
index 0000000000000..82136b8ef46af
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f95f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f960.png b/Shared/CIPPSharp/bin/twemoji/1f960.png
new file mode 100644
index 0000000000000..a1e8958af75b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f960.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f961.png b/Shared/CIPPSharp/bin/twemoji/1f961.png
new file mode 100644
index 0000000000000..20d855496983d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f961.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f962.png b/Shared/CIPPSharp/bin/twemoji/1f962.png
new file mode 100644
index 0000000000000..8284c128febb6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f962.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f963.png b/Shared/CIPPSharp/bin/twemoji/1f963.png
new file mode 100644
index 0000000000000..2905488376d13
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f963.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f964.png b/Shared/CIPPSharp/bin/twemoji/1f964.png
new file mode 100644
index 0000000000000..f65704ebfda16
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f964.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f965.png b/Shared/CIPPSharp/bin/twemoji/1f965.png
new file mode 100644
index 0000000000000..e92e8d403d02c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f965.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f966.png b/Shared/CIPPSharp/bin/twemoji/1f966.png
new file mode 100644
index 0000000000000..24b0d3d5276e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f966.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f967.png b/Shared/CIPPSharp/bin/twemoji/1f967.png
new file mode 100644
index 0000000000000..1d17609efb628
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f967.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f968.png b/Shared/CIPPSharp/bin/twemoji/1f968.png
new file mode 100644
index 0000000000000..94fac17b41261
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f968.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f969.png b/Shared/CIPPSharp/bin/twemoji/1f969.png
new file mode 100644
index 0000000000000..5eab36462155a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f969.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f96a.png b/Shared/CIPPSharp/bin/twemoji/1f96a.png
new file mode 100644
index 0000000000000..a0a6a6da27f82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f96a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f96b.png b/Shared/CIPPSharp/bin/twemoji/1f96b.png
new file mode 100644
index 0000000000000..01d7649d2d6fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f96b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f96c.png b/Shared/CIPPSharp/bin/twemoji/1f96c.png
new file mode 100644
index 0000000000000..8487529df17dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f96c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f96d.png b/Shared/CIPPSharp/bin/twemoji/1f96d.png
new file mode 100644
index 0000000000000..57e84dea3c5ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f96d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f96e.png b/Shared/CIPPSharp/bin/twemoji/1f96e.png
new file mode 100644
index 0000000000000..991c3b4f1cacb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f96e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f96f.png b/Shared/CIPPSharp/bin/twemoji/1f96f.png
new file mode 100644
index 0000000000000..99312be2fe89a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f96f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f970.png b/Shared/CIPPSharp/bin/twemoji/1f970.png
new file mode 100644
index 0000000000000..0c9466ce77140
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f970.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f971.png b/Shared/CIPPSharp/bin/twemoji/1f971.png
new file mode 100644
index 0000000000000..8c12578bf680e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f971.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f972.png b/Shared/CIPPSharp/bin/twemoji/1f972.png
new file mode 100644
index 0000000000000..c799f4bbfa12c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f972.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f973.png b/Shared/CIPPSharp/bin/twemoji/1f973.png
new file mode 100644
index 0000000000000..cf02521cccc06
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f973.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f974.png b/Shared/CIPPSharp/bin/twemoji/1f974.png
new file mode 100644
index 0000000000000..3c4a112bec673
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f974.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f975.png b/Shared/CIPPSharp/bin/twemoji/1f975.png
new file mode 100644
index 0000000000000..2ed695a3621f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f975.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f976.png b/Shared/CIPPSharp/bin/twemoji/1f976.png
new file mode 100644
index 0000000000000..6d14820c56f93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f976.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f977-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fb.png
new file mode 100644
index 0000000000000..1382f448f32b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f977-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fc.png
new file mode 100644
index 0000000000000..f61b5a5ecc251
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f977-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fd.png
new file mode 100644
index 0000000000000..b1a6a3a2214c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f977-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fe.png
new file mode 100644
index 0000000000000..820a3ee6cefc3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f977-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f977-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f977-1f3ff.png
new file mode 100644
index 0000000000000..c67b540ab2646
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f977-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f977.png b/Shared/CIPPSharp/bin/twemoji/1f977.png
new file mode 100644
index 0000000000000..63f3e16bb235f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f977.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f978.png b/Shared/CIPPSharp/bin/twemoji/1f978.png
new file mode 100644
index 0000000000000..390b7e4e165ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f978.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f979.png b/Shared/CIPPSharp/bin/twemoji/1f979.png
new file mode 100644
index 0000000000000..d109b16453276
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f979.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f97a.png b/Shared/CIPPSharp/bin/twemoji/1f97a.png
new file mode 100644
index 0000000000000..b1cc8fb71eeff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f97a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f97b.png b/Shared/CIPPSharp/bin/twemoji/1f97b.png
new file mode 100644
index 0000000000000..37e499fb768ec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f97b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f97c.png b/Shared/CIPPSharp/bin/twemoji/1f97c.png
new file mode 100644
index 0000000000000..b6ed6b935f64f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f97c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f97d.png b/Shared/CIPPSharp/bin/twemoji/1f97d.png
new file mode 100644
index 0000000000000..b4d3c40abc75f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f97d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f97e.png b/Shared/CIPPSharp/bin/twemoji/1f97e.png
new file mode 100644
index 0000000000000..1e97c61b01baf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f97e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f97f.png b/Shared/CIPPSharp/bin/twemoji/1f97f.png
new file mode 100644
index 0000000000000..fded27f57422b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f97f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f980.png b/Shared/CIPPSharp/bin/twemoji/1f980.png
new file mode 100644
index 0000000000000..915354ca2f584
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f980.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f981.png b/Shared/CIPPSharp/bin/twemoji/1f981.png
new file mode 100644
index 0000000000000..07ca6147bd76b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f981.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f982.png b/Shared/CIPPSharp/bin/twemoji/1f982.png
new file mode 100644
index 0000000000000..767cf550d0cf3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f982.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f983.png b/Shared/CIPPSharp/bin/twemoji/1f983.png
new file mode 100644
index 0000000000000..2113718e6bc3f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f983.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f984.png b/Shared/CIPPSharp/bin/twemoji/1f984.png
new file mode 100644
index 0000000000000..0e3279c7bd90d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f984.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f985.png b/Shared/CIPPSharp/bin/twemoji/1f985.png
new file mode 100644
index 0000000000000..c8869604fb377
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f985.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f986.png b/Shared/CIPPSharp/bin/twemoji/1f986.png
new file mode 100644
index 0000000000000..d4e995eedc754
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f986.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f987.png b/Shared/CIPPSharp/bin/twemoji/1f987.png
new file mode 100644
index 0000000000000..e0375fb6604d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f987.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f988.png b/Shared/CIPPSharp/bin/twemoji/1f988.png
new file mode 100644
index 0000000000000..88ccc81e3010b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f988.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f989.png b/Shared/CIPPSharp/bin/twemoji/1f989.png
new file mode 100644
index 0000000000000..6bc9c7af427ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f989.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f98a.png b/Shared/CIPPSharp/bin/twemoji/1f98a.png
new file mode 100644
index 0000000000000..7f6e50a802828
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f98a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f98b.png b/Shared/CIPPSharp/bin/twemoji/1f98b.png
new file mode 100644
index 0000000000000..3d17d9810714f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f98b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f98c.png b/Shared/CIPPSharp/bin/twemoji/1f98c.png
new file mode 100644
index 0000000000000..06b32f6f4b81e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f98c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f98d.png b/Shared/CIPPSharp/bin/twemoji/1f98d.png
new file mode 100644
index 0000000000000..bd02ff4d3671e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f98d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f98e.png b/Shared/CIPPSharp/bin/twemoji/1f98e.png
new file mode 100644
index 0000000000000..dc7b02827262c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f98e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f98f.png b/Shared/CIPPSharp/bin/twemoji/1f98f.png
new file mode 100644
index 0000000000000..9b43bbf25b270
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f98f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f990.png b/Shared/CIPPSharp/bin/twemoji/1f990.png
new file mode 100644
index 0000000000000..f48ec33e62a4b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f990.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f991.png b/Shared/CIPPSharp/bin/twemoji/1f991.png
new file mode 100644
index 0000000000000..8e1aa1e27a5a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f991.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f992.png b/Shared/CIPPSharp/bin/twemoji/1f992.png
new file mode 100644
index 0000000000000..731f72fac9e5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f992.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f993.png b/Shared/CIPPSharp/bin/twemoji/1f993.png
new file mode 100644
index 0000000000000..4c080f3006fbd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f993.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f994.png b/Shared/CIPPSharp/bin/twemoji/1f994.png
new file mode 100644
index 0000000000000..489827231b0f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f994.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f995.png b/Shared/CIPPSharp/bin/twemoji/1f995.png
new file mode 100644
index 0000000000000..b58a3179e3110
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f995.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f996.png b/Shared/CIPPSharp/bin/twemoji/1f996.png
new file mode 100644
index 0000000000000..ed7927dd3fbb0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f996.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f997.png b/Shared/CIPPSharp/bin/twemoji/1f997.png
new file mode 100644
index 0000000000000..481034afa2fbc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f997.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f998.png b/Shared/CIPPSharp/bin/twemoji/1f998.png
new file mode 100644
index 0000000000000..c14c89466d9e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f998.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f999.png b/Shared/CIPPSharp/bin/twemoji/1f999.png
new file mode 100644
index 0000000000000..d43ae19ae10a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f999.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f99a.png b/Shared/CIPPSharp/bin/twemoji/1f99a.png
new file mode 100644
index 0000000000000..59602cdcf0eef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f99a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f99b.png b/Shared/CIPPSharp/bin/twemoji/1f99b.png
new file mode 100644
index 0000000000000..747f4136f4ca9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f99b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f99c.png b/Shared/CIPPSharp/bin/twemoji/1f99c.png
new file mode 100644
index 0000000000000..4630636a20c54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f99c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f99d.png b/Shared/CIPPSharp/bin/twemoji/1f99d.png
new file mode 100644
index 0000000000000..759c064422ebf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f99d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f99e.png b/Shared/CIPPSharp/bin/twemoji/1f99e.png
new file mode 100644
index 0000000000000..5312cade843a9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f99e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f99f.png b/Shared/CIPPSharp/bin/twemoji/1f99f.png
new file mode 100644
index 0000000000000..fe18c2a6ec80a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f99f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a0.png b/Shared/CIPPSharp/bin/twemoji/1f9a0.png
new file mode 100644
index 0000000000000..bdd887e1d5331
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a1.png b/Shared/CIPPSharp/bin/twemoji/1f9a1.png
new file mode 100644
index 0000000000000..858196e8f60a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a2.png b/Shared/CIPPSharp/bin/twemoji/1f9a2.png
new file mode 100644
index 0000000000000..58af7f508688b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a3.png b/Shared/CIPPSharp/bin/twemoji/1f9a3.png
new file mode 100644
index 0000000000000..94c8998c79bf3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a4.png b/Shared/CIPPSharp/bin/twemoji/1f9a4.png
new file mode 100644
index 0000000000000..160cc563da7e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a5.png b/Shared/CIPPSharp/bin/twemoji/1f9a5.png
new file mode 100644
index 0000000000000..2bb0545286202
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a6.png b/Shared/CIPPSharp/bin/twemoji/1f9a6.png
new file mode 100644
index 0000000000000..fb3e07085f76b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a7.png b/Shared/CIPPSharp/bin/twemoji/1f9a7.png
new file mode 100644
index 0000000000000..17d26498bbbb1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a8.png b/Shared/CIPPSharp/bin/twemoji/1f9a8.png
new file mode 100644
index 0000000000000..d342d560c8570
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9a9.png b/Shared/CIPPSharp/bin/twemoji/1f9a9.png
new file mode 100644
index 0000000000000..0ee76f3240500
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9a9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9aa.png b/Shared/CIPPSharp/bin/twemoji/1f9aa.png
new file mode 100644
index 0000000000000..5649bbfad47f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9aa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ab.png b/Shared/CIPPSharp/bin/twemoji/1f9ab.png
new file mode 100644
index 0000000000000..11839911b1666
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ac.png b/Shared/CIPPSharp/bin/twemoji/1f9ac.png
new file mode 100644
index 0000000000000..744a814ec6eb1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ac.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ad.png b/Shared/CIPPSharp/bin/twemoji/1f9ad.png
new file mode 100644
index 0000000000000..1dc20feef0bbd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ad.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ae.png b/Shared/CIPPSharp/bin/twemoji/1f9ae.png
new file mode 100644
index 0000000000000..0bf6ca9eb67cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ae.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f9af.png
new file mode 100644
index 0000000000000..d09b2846c7f39
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f9b0.png
new file mode 100644
index 0000000000000..ae61441680cb6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f9b1.png
new file mode 100644
index 0000000000000..8b79646863198
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f9b2.png
new file mode 100644
index 0000000000000..34022c6b980ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f9b3.png
new file mode 100644
index 0000000000000..e062ea9d5259f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b4.png b/Shared/CIPPSharp/bin/twemoji/1f9b4.png
new file mode 100644
index 0000000000000..92062ac853695
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fb.png
new file mode 100644
index 0000000000000..3dd05b71fe5a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fc.png
new file mode 100644
index 0000000000000..3678ebea22ec1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fd.png
new file mode 100644
index 0000000000000..7a8be7e7ca00f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fe.png
new file mode 100644
index 0000000000000..7488b0c298f76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3ff.png
new file mode 100644
index 0000000000000..498f404c67f19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b5-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b5.png b/Shared/CIPPSharp/bin/twemoji/1f9b5.png
new file mode 100644
index 0000000000000..b0087b49269ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fb.png
new file mode 100644
index 0000000000000..628899a81ccaf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fc.png
new file mode 100644
index 0000000000000..fc3afc3a82011
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fd.png
new file mode 100644
index 0000000000000..195ae0d0e8362
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fe.png
new file mode 100644
index 0000000000000..cabdb40e08591
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3ff.png
new file mode 100644
index 0000000000000..47fcee6b93de0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b6-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b6.png b/Shared/CIPPSharp/bin/twemoji/1f9b6.png
new file mode 100644
index 0000000000000..ed57c2bd9c066
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b7.png b/Shared/CIPPSharp/bin/twemoji/1f9b7.png
new file mode 100644
index 0000000000000..f5d32ea7137c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7caf678b32604
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d5354946f14bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb.png
new file mode 100644
index 0000000000000..c9928c9e29539
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..835b3120565ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9afb6294cf67c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc.png
new file mode 100644
index 0000000000000..4db64c4f109b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..510ef57152301
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a5917aadc92e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd.png
new file mode 100644
index 0000000000000..55dad3c658c63
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ba21b3c465f6c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..75fa8b4fc9367
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe.png
new file mode 100644
index 0000000000000..01e4f882e9b5b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..9a2cbb400bcb3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fc34c480bccd2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff.png
new file mode 100644
index 0000000000000..698ee383c0f4c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5f91609e83a4b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b8-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5d825059fc7c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b8.png b/Shared/CIPPSharp/bin/twemoji/1f9b8.png
new file mode 100644
index 0000000000000..d79cfc97d87e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..21759f8a77580
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e1553453f0803
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb.png
new file mode 100644
index 0000000000000..f2ca77d3e69ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..2baaab958be2b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..11c63297c0294
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc.png
new file mode 100644
index 0000000000000..a96d25be0fa7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..50b0ff7364a55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..3bf15398a2c8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd.png
new file mode 100644
index 0000000000000..d8f77eaf9b0a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..80bd13c9be466
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..08803cba0f183
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe.png
new file mode 100644
index 0000000000000..3a6cbde1e7e48
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bbdcd028e8658
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0f0b10435c8b5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff.png
new file mode 100644
index 0000000000000..1397c3f592fed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e28243484de27
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9b9-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..7b58aaba6dcd4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9b9.png b/Shared/CIPPSharp/bin/twemoji/1f9b9.png
new file mode 100644
index 0000000000000..f86bd6bd8c53d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9b9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ba.png b/Shared/CIPPSharp/bin/twemoji/1f9ba.png
new file mode 100644
index 0000000000000..f1b86e164d6ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ba.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fb.png
new file mode 100644
index 0000000000000..a2bcf4355b179
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fc.png
new file mode 100644
index 0000000000000..0b9053353431e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fd.png
new file mode 100644
index 0000000000000..ba898631dfbba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fe.png
new file mode 100644
index 0000000000000..b019addc1e847
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3ff.png
new file mode 100644
index 0000000000000..8a37cc0f60474
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bb-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bb.png b/Shared/CIPPSharp/bin/twemoji/1f9bb.png
new file mode 100644
index 0000000000000..492632f175d2f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f9bc.png
new file mode 100644
index 0000000000000..eea4289378abd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f9bd.png
new file mode 100644
index 0000000000000..c56f257680e16
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9be.png b/Shared/CIPPSharp/bin/twemoji/1f9be.png
new file mode 100644
index 0000000000000..d758cf5bb70ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9be.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9bf.png b/Shared/CIPPSharp/bin/twemoji/1f9bf.png
new file mode 100644
index 0000000000000..9c0fed3c903f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9bf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c0.png b/Shared/CIPPSharp/bin/twemoji/1f9c0.png
new file mode 100644
index 0000000000000..4f88fa06df403
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c1.png b/Shared/CIPPSharp/bin/twemoji/1f9c1.png
new file mode 100644
index 0000000000000..39ad36c04304a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c2.png b/Shared/CIPPSharp/bin/twemoji/1f9c2.png
new file mode 100644
index 0000000000000..053367714a2b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c3.png b/Shared/CIPPSharp/bin/twemoji/1f9c3.png
new file mode 100644
index 0000000000000..fce80c8232ddd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c4.png b/Shared/CIPPSharp/bin/twemoji/1f9c4.png
new file mode 100644
index 0000000000000..65c307104e659
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c5.png b/Shared/CIPPSharp/bin/twemoji/1f9c5.png
new file mode 100644
index 0000000000000..73e1fea8efaef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c6.png b/Shared/CIPPSharp/bin/twemoji/1f9c6.png
new file mode 100644
index 0000000000000..98fafac5d4508
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c7.png b/Shared/CIPPSharp/bin/twemoji/1f9c7.png
new file mode 100644
index 0000000000000..8696bf4b90486
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c8.png b/Shared/CIPPSharp/bin/twemoji/1f9c8.png
new file mode 100644
index 0000000000000..a5d5528001678
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9c9.png b/Shared/CIPPSharp/bin/twemoji/1f9c9.png
new file mode 100644
index 0000000000000..9523074ce096a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9c9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ca.png b/Shared/CIPPSharp/bin/twemoji/1f9ca.png
new file mode 100644
index 0000000000000..57b37162bbb4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ca.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cb.png b/Shared/CIPPSharp/bin/twemoji/1f9cb.png
new file mode 100644
index 0000000000000..3fbdf464077ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cc.png b/Shared/CIPPSharp/bin/twemoji/1f9cc.png
new file mode 100644
index 0000000000000..86a1a90f56347
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..03a420f91d366
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d1fe8a515422c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb.png
new file mode 100644
index 0000000000000..ef9ca45c9b408
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d9cc52106519c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d01f6d3ed7330
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc.png
new file mode 100644
index 0000000000000..bc4fa44c30274
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8019d6c65144c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..16c5908cda094
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd.png
new file mode 100644
index 0000000000000..6ec42816a070d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..334f947251948
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..3ba70f7fbe0c3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe.png
new file mode 100644
index 0000000000000..24a5bc2094a4a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..15b740272d1c6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0c68629a7a67e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff.png
new file mode 100644
index 0000000000000..62f92a01a0e12
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fb6bbc852e6e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..af90767fed7c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cd.png b/Shared/CIPPSharp/bin/twemoji/1f9cd.png
new file mode 100644
index 0000000000000..092bc94cfa261
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..15435fa1e89cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..84b1932a222dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..4c3951ab8735b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..88ac6639ffad8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..304c2e1c579d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb.png
new file mode 100644
index 0000000000000..e0709b9cc72ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..45e11b9ee5ef8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f9703876f85b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..bbf8fc067efbb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c13fba6b9be9f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..88e52c6bff7b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc.png
new file mode 100644
index 0000000000000..a009cd3d02c1c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..04ddfe6d2f73d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fff814de355a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..97c3cd6a667f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1e94283e0bb30
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..192d58f13cf77
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd.png
new file mode 100644
index 0000000000000..bee23dd367511
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..e192507d3cde3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ea9b468cd55fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..241c001316dd7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..37167a9517c72
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..e4c2c62961781
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe.png
new file mode 100644
index 0000000000000..38d173fbaee4a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..6d45e67e594da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a08af4741e074
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..2290a39f7ffec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e0b00f3c7f2d0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..933cd847ccd5a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff.png
new file mode 100644
index 0000000000000..903927bf3e404
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2640-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2640-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..f663666173ac1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2640-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3fc023d8c8dd8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2642-fe0f-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2642-fe0f-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..7dc7c1eff5e6a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2642-fe0f-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..3fffc15dd70b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..fe7d99ddcd00c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ce.png b/Shared/CIPPSharp/bin/twemoji/1f9ce.png
new file mode 100644
index 0000000000000..d59df78e5a426
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ce.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..add2f37e13c15
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..49c176d765408
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb.png
new file mode 100644
index 0000000000000..e323f4d6020c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..04e20bfabcd10
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..597c758ad8c11
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc.png
new file mode 100644
index 0000000000000..6c520175a12d6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..189eadc66599d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9201ed2c38ad5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd.png
new file mode 100644
index 0000000000000..6819537224462
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..6ad5401b20aec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ef77e24e5c5c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe.png
new file mode 100644
index 0000000000000..b9f5a2e2b3458
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7402f46bbf345
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c603479f2c085
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff.png
new file mode 100644
index 0000000000000..9e0b55eee1054
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..36c5770c17f0e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9cf-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..86d326cc5f945
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9cf.png b/Shared/CIPPSharp/bin/twemoji/1f9cf.png
new file mode 100644
index 0000000000000..0af9d1827da67
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9cf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d0.png b/Shared/CIPPSharp/bin/twemoji/1f9d0.png
new file mode 100644
index 0000000000000..33b85f47a0622
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f33e.png
new file mode 100644
index 0000000000000..e5a3b549bdd98
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f373.png
new file mode 100644
index 0000000000000..eb9beba629d04
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f37c.png
new file mode 100644
index 0000000000000..4932c45b65550
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f384.png
new file mode 100644
index 0000000000000..172f05ce7b6e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f393.png
new file mode 100644
index 0000000000000..04a6808924484
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3a4.png
new file mode 100644
index 0000000000000..0c7b34b6a2ef1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3a8.png
new file mode 100644
index 0000000000000..477eb7b768712
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3eb.png
new file mode 100644
index 0000000000000..f4af417b4a062
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3ed.png
new file mode 100644
index 0000000000000..cd118e602fa71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..4425b12748859
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..6302b329d26e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..9cd9c1311f284
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..556bd0790be77
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f430-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f4bb.png
new file mode 100644
index 0000000000000..dd92bca709b32
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f4bc.png
new file mode 100644
index 0000000000000..b579f983e742b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f527.png
new file mode 100644
index 0000000000000..98b9e863b14ce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f52c.png
new file mode 100644
index 0000000000000..c1124158a7c10
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f680.png
new file mode 100644
index 0000000000000..78c64474ab296
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f692.png
new file mode 100644
index 0000000000000..dde98a30dd7a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..68770f73c8125
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..634f7a4466037
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..50859462f4828
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..b231dd826d5f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..9e3ed2aeb25b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f91d-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..1eb7c3a6ca7bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9af.png
new file mode 100644
index 0000000000000..503ee1560521a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b0.png
new file mode 100644
index 0000000000000..ced2e66c4819a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b1.png
new file mode 100644
index 0000000000000..2b50eecf35dcc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b2.png
new file mode 100644
index 0000000000000..88e6ecb323bec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b3.png
new file mode 100644
index 0000000000000..1e07f773a05c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..10965c626fe67
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bc.png
new file mode 100644
index 0000000000000..503975f062cb9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..861868c27b4ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bd.png
new file mode 100644
index 0000000000000..33b5c740c9fee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1fa70.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1fa70.png
new file mode 100644
index 0000000000000..1f3871ed25423
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1fa70.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..f38875ae4b3aa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..4485e23da3b4f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..0ccf2d14e7173
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..d0ca8151fff16
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-1faef-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..11ed16166b49c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..7831dd8e1503e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..ad7873dabe2e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..24471dfbf450b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..69cb7fdab5808
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..4aaa6add7e2a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..347575b4eea86
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..0ce8aca1fcc91
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..33ecddcd697ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..ae01e0416eab3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..22ff8e141d856
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb-200d-2764-fe0f-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..31093adbc466c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f33e.png
new file mode 100644
index 0000000000000..905e04f98f4af
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f373.png
new file mode 100644
index 0000000000000..d6042efa39109
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f37c.png
new file mode 100644
index 0000000000000..46af1cc5f4df9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f384.png
new file mode 100644
index 0000000000000..a25be0e159f72
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f393.png
new file mode 100644
index 0000000000000..f1052bb5858fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3a4.png
new file mode 100644
index 0000000000000..03f3eec5d6b0c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3a8.png
new file mode 100644
index 0000000000000..37811e394ec2e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3eb.png
new file mode 100644
index 0000000000000..b43288fa3c497
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3ed.png
new file mode 100644
index 0000000000000..c13227b4deb7d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..6b87b5b99abff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..588d952f4b517
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..6e197a0920daf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..64c16132536ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f430-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f4bb.png
new file mode 100644
index 0000000000000..17a367469837b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f4bc.png
new file mode 100644
index 0000000000000..8451d350461d7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f527.png
new file mode 100644
index 0000000000000..63d8a78a93d30
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f52c.png
new file mode 100644
index 0000000000000..4c6a6f2669de0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f680.png
new file mode 100644
index 0000000000000..162c4d9a48f4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f692.png
new file mode 100644
index 0000000000000..fc28a8c1692c2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..ee80b1d08356b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..b3d999a8c477d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..c2573b70952cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..d641e2375f47e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..2a29c96ef41c3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f91d-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..0e6e25d10e590
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9af.png
new file mode 100644
index 0000000000000..870d4453e5d91
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b0.png
new file mode 100644
index 0000000000000..0a951625f380d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b1.png
new file mode 100644
index 0000000000000..d1cea53bb0f3c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b2.png
new file mode 100644
index 0000000000000..1065c6bf4b1e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b3.png
new file mode 100644
index 0000000000000..4c2b85a3fcc7f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..21a7b2a277a90
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bc.png
new file mode 100644
index 0000000000000..31a737e825a99
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..fb00706183aab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bd.png
new file mode 100644
index 0000000000000..18255458fb51c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1fa70.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1fa70.png
new file mode 100644
index 0000000000000..97a389864ef82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1fa70.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..39253f10583b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..50ece6238aaa9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..6c3268bb52ee5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..31833145fd31c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-1faef-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..722e6e6b20907
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..21ec0e9c5bfd5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..1e1a9ffeea64f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..5ddf4016f7d2a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..a38e6a28c3849
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..9908e3b8939a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..b4f5862b11f01
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..e20d7ad764fcb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..49a1b8d104584
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..12a7abc495ef3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..66e9e117b25a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc-200d-2764-fe0f-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..d3451581d13ea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f33e.png
new file mode 100644
index 0000000000000..444160826b0d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f373.png
new file mode 100644
index 0000000000000..5fb0463a0ff84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f37c.png
new file mode 100644
index 0000000000000..478a66ddc3d98
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f384.png
new file mode 100644
index 0000000000000..9c7db219b5eed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f393.png
new file mode 100644
index 0000000000000..d7414dd375dc3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3a4.png
new file mode 100644
index 0000000000000..d0f9741456892
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3a8.png
new file mode 100644
index 0000000000000..e8ef80d7f5835
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3eb.png
new file mode 100644
index 0000000000000..027833aa9c988
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3ed.png
new file mode 100644
index 0000000000000..010030d665864
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..6bc78a1a1d56e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..456768e03d2d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..7e920f665bc9d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..94255c30b5564
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f430-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f4bb.png
new file mode 100644
index 0000000000000..0852cc01d35f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f4bc.png
new file mode 100644
index 0000000000000..95f6a939acecc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f527.png
new file mode 100644
index 0000000000000..ca32388149f58
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f52c.png
new file mode 100644
index 0000000000000..5ae8cccb5d74f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f680.png
new file mode 100644
index 0000000000000..d50c65013980d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f692.png
new file mode 100644
index 0000000000000..79f3dbaa0e486
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..5b2f725e1dd0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..229c18d1c5d34
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..c6fcaea042d0b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..ac99a2c1fb04c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..2f80d05c55ac5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f91d-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..eaa2fa2d2824a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9af.png
new file mode 100644
index 0000000000000..260507ef51c7d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b0.png
new file mode 100644
index 0000000000000..f11dff11902f5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b1.png
new file mode 100644
index 0000000000000..37587d5ffd331
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b2.png
new file mode 100644
index 0000000000000..609b41b7b2920
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b3.png
new file mode 100644
index 0000000000000..36b16487e21a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..deadeed5ebc12
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bc.png
new file mode 100644
index 0000000000000..93d2a824bb8fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..336fe8e45b818
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bd.png
new file mode 100644
index 0000000000000..f5b5e63864eac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1fa70.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1fa70.png
new file mode 100644
index 0000000000000..a74c7d1c2ad4e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1fa70.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..b8a6c0f9e7895
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..adb93513e338d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..a07f0eb3af77f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..b3b4c2255b438
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-1faef-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..ef513a7eae791
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..e708c2eac2019
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..99c6821d34a88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..34379c5b55434
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..e3d1daff2f43f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..6ff7a617395ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..4f75a98d3c2e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..3267a3e3c6de4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..328e976a1252c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..8e18df2441909
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..c0e4c46d88544
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd-200d-2764-fe0f-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..3c51e01439d2c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f33e.png
new file mode 100644
index 0000000000000..ce18ce0c803e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f373.png
new file mode 100644
index 0000000000000..f92bb8033f4e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f37c.png
new file mode 100644
index 0000000000000..f6e6621922720
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f384.png
new file mode 100644
index 0000000000000..d7480e725432d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f393.png
new file mode 100644
index 0000000000000..c7393d59b247d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3a4.png
new file mode 100644
index 0000000000000..5b5ffcae3d8e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3a8.png
new file mode 100644
index 0000000000000..f3501b34d81d0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3eb.png
new file mode 100644
index 0000000000000..6767d97ff79ef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3ed.png
new file mode 100644
index 0000000000000..1e83f20f0337d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..7310bd7ac63d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..4755128de42b2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..5da6d1cbdc6d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..d86870d9d6100
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f430-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f4bb.png
new file mode 100644
index 0000000000000..6f851f76f1e5d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f4bc.png
new file mode 100644
index 0000000000000..1da65d87d99a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f527.png
new file mode 100644
index 0000000000000..688a909eb8638
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f52c.png
new file mode 100644
index 0000000000000..4a78ea9b2d7bd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f680.png
new file mode 100644
index 0000000000000..092fc992c8935
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f692.png
new file mode 100644
index 0000000000000..cb0e4b2bea5be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..dd29f84c4b852
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..b538426680a53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..794b1aab4dd29
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..bdab9fc73008b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..eae74722705c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f91d-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..4272c29cdb58a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9af.png
new file mode 100644
index 0000000000000..b383c54427707
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b0.png
new file mode 100644
index 0000000000000..7781c29ecb8f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b1.png
new file mode 100644
index 0000000000000..7de0d4e436077
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b2.png
new file mode 100644
index 0000000000000..25c78ed087c3c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b3.png
new file mode 100644
index 0000000000000..2fb82858f15ff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..6c3940b3a50e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bc.png
new file mode 100644
index 0000000000000..51a7fcba73a2f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..0dbdac7e7f4dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bd.png
new file mode 100644
index 0000000000000..72f5aa062ead9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1fa70.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1fa70.png
new file mode 100644
index 0000000000000..ef731916e8f9c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1fa70.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..5d2ce4a6eb033
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..6e9e5b9a8f24c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..e5b21b6fe16dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..af6ea963f16b1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-1faef-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..d54a125058199
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..05b2b8ee13514
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..97da172e2d7d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..c35b92e85aab7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..ddec3e7cf4aa3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..465f60dd8ad9c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..376180f70d1a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..8d4e9808af340
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..3926831f610e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..4d9e7c989b535
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..ce3d818725f54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe-200d-2764-fe0f-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..f3f7e0c4a6b40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f33e.png
new file mode 100644
index 0000000000000..7ee88d8fe7a26
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f373.png
new file mode 100644
index 0000000000000..1060299cccaf8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f37c.png
new file mode 100644
index 0000000000000..03ccea351b4fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f384.png
new file mode 100644
index 0000000000000..a3d6e659dda3e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f393.png
new file mode 100644
index 0000000000000..c906f18e888a9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3a4.png
new file mode 100644
index 0000000000000..6ab09a25f7d72
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3a8.png
new file mode 100644
index 0000000000000..0388084caa526
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3eb.png
new file mode 100644
index 0000000000000..13df8d2cdedfb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3ed.png
new file mode 100644
index 0000000000000..d4b3ee56e4bac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..060153e50a54b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..6a3a35f70f16d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..1071e4df9fab0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..7fb02d5e18ba7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f430-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f4bb.png
new file mode 100644
index 0000000000000..de2819894bed2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f4bc.png
new file mode 100644
index 0000000000000..73a8e53a20c3b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f527.png
new file mode 100644
index 0000000000000..5d098b9841cb2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f52c.png
new file mode 100644
index 0000000000000..db4b9d41c864d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f680.png
new file mode 100644
index 0000000000000..846be56c12cca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f692.png
new file mode 100644
index 0000000000000..82e051a7a0e25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..476f100c7dbcd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..887480f09908c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..dbafdf9d3d6e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..6e80a36548aac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..c0350e92e8e1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f91d-200d-1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..c6914bea2299b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9af.png
new file mode 100644
index 0000000000000..f2fcce1e25b17
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b0.png
new file mode 100644
index 0000000000000..81a7caa55102a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b1.png
new file mode 100644
index 0000000000000..1cb908c735956
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b2.png
new file mode 100644
index 0000000000000..6a5e8b0494d93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b3.png
new file mode 100644
index 0000000000000..a4772fea5accb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..4eeddc4a1a911
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bc.png
new file mode 100644
index 0000000000000..fc99dd988a36e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..5de8f6f988991
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bd.png
new file mode 100644
index 0000000000000..6c8e92b295b99
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1fa70.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1fa70.png
new file mode 100644
index 0000000000000..d3e3fbe9a0b81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1fa70.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..e253c130a422a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..95d6d34e579ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..fe5b5b6e0ead6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..e9786cdd029f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-1faef-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..8f95ec023c8eb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..1b2c484452398
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..a504160f7ca14
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..14ced38a1f4a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..dc796c6d7b545
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..3403518fd8dea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..60702d908d26b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f48b-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fb.png
new file mode 100644
index 0000000000000..a470e99e2a0da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fc.png
new file mode 100644
index 0000000000000..b2e7f1652cba2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fd.png
new file mode 100644
index 0000000000000..01644ff1f32d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fe.png
new file mode 100644
index 0000000000000..0fd86e7846c54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff-200d-2764-fe0f-200d-1f9d1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff.png
new file mode 100644
index 0000000000000..dac06fdee0c7f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f33e.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f33e.png
new file mode 100644
index 0000000000000..62757b900b2a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f33e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f373.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f373.png
new file mode 100644
index 0000000000000..4d6f90161d579
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f373.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f37c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f37c.png
new file mode 100644
index 0000000000000..4e67b21b906da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f37c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f384.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f384.png
new file mode 100644
index 0000000000000..1c723c878f9d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f384.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f393.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f393.png
new file mode 100644
index 0000000000000..4b6421a8b2974
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f393.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3a4.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3a4.png
new file mode 100644
index 0000000000000..b4b56c95b7c2d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3a4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3a8.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3a8.png
new file mode 100644
index 0000000000000..890cc7f17275c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3a8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3eb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3eb.png
new file mode 100644
index 0000000000000..e0dc2f5979d54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3ed.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3ed.png
new file mode 100644
index 0000000000000..1a7e218139f3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f3ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f4bb.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f4bb.png
new file mode 100644
index 0000000000000..6dfefc0fdf39f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f4bb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f4bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f4bc.png
new file mode 100644
index 0000000000000..15706836392b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f4bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f527.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f527.png
new file mode 100644
index 0000000000000..bdaf652be20fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f527.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f52c.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f52c.png
new file mode 100644
index 0000000000000..9d71dc21020a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f52c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f680.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f680.png
new file mode 100644
index 0000000000000..e9221ddb4df11
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f680.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f692.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f692.png
new file mode 100644
index 0000000000000..c84c8137685e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f91d-200d-1f9d1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f91d-200d-1f9d1.png
new file mode 100644
index 0000000000000..38916c55b13c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f91d-200d-1f9d1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9af-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9af-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..c02145edc747f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9af-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9af.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9af.png
new file mode 100644
index 0000000000000..e160612831817
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9af.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b0.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b0.png
new file mode 100644
index 0000000000000..363fd9c8ab966
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b1.png
new file mode 100644
index 0000000000000..8c809f1436375
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b2.png
new file mode 100644
index 0000000000000..e939a1115ba95
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b3.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b3.png
new file mode 100644
index 0000000000000..241b5446cdd26
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9b3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bc-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bc-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..831528469db50
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bc-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bc.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bc.png
new file mode 100644
index 0000000000000..a372a8e3d5bff
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bd-200d-27a1-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bd-200d-27a1-fe0f.png
new file mode 100644
index 0000000000000..181a3e1646eed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bd-200d-27a1-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bd.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bd.png
new file mode 100644
index 0000000000000..3fdadab5e9473
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d1-200d-1f9d2-200d-1f9d2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d1-200d-1f9d2-200d-1f9d2.png
new file mode 100644
index 0000000000000..983f56fe3c863
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d1-200d-1f9d2-200d-1f9d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d1-200d-1f9d2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d1-200d-1f9d2.png
new file mode 100644
index 0000000000000..07ea11eb2b9ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d1-200d-1f9d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d2-200d-1f9d2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d2-200d-1f9d2.png
new file mode 100644
index 0000000000000..badab11cb323d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d2-200d-1f9d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d2.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d2.png
new file mode 100644
index 0000000000000..e2d9cb653032d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1f9d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1fa70.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1fa70.png
new file mode 100644
index 0000000000000..9c9b964123f6c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-1fa70.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2695-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2695-fe0f.png
new file mode 100644
index 0000000000000..354e2124a00a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2695-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2696-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2696-fe0f.png
new file mode 100644
index 0000000000000..8d9409d37e830
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2696-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2708-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2708-fe0f.png
new file mode 100644
index 0000000000000..78c4b3738a148
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1-200d-2708-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d1.png b/Shared/CIPPSharp/bin/twemoji/1f9d1.png
new file mode 100644
index 0000000000000..13ad8a69b9235
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fb.png
new file mode 100644
index 0000000000000..3176891d09d04
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fc.png
new file mode 100644
index 0000000000000..85c9853939eda
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fd.png
new file mode 100644
index 0000000000000..5eedce05af29e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fe.png
new file mode 100644
index 0000000000000..0931b2dbcac37
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3ff.png
new file mode 100644
index 0000000000000..c02a87e427743
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d2-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d2.png b/Shared/CIPPSharp/bin/twemoji/1f9d2.png
new file mode 100644
index 0000000000000..d64876b9b06fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fb.png
new file mode 100644
index 0000000000000..0d031a08182fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fc.png
new file mode 100644
index 0000000000000..c2213380b5aaf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fd.png
new file mode 100644
index 0000000000000..0c56feac0f612
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fe.png
new file mode 100644
index 0000000000000..c98423b5ce7a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3ff.png
new file mode 100644
index 0000000000000..de458e297f2f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d3-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d3.png b/Shared/CIPPSharp/bin/twemoji/1f9d3.png
new file mode 100644
index 0000000000000..627b9e7fac783
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d5ae81abe28b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8e23bc93eaaeb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb.png
new file mode 100644
index 0000000000000..454efbfea29a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c39f5cf001416
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..2d2c904ca4501
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc.png
new file mode 100644
index 0000000000000..0930537c4e624
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a26157d65a714
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..714fa370758f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd.png
new file mode 100644
index 0000000000000..1eaf4e67ee971
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..574a2aa6d354f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4fcd67ee865c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe.png
new file mode 100644
index 0000000000000..0587ba6ac272f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..38e64542f39b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..16810f8a501cf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff.png
new file mode 100644
index 0000000000000..92b8857f57d88
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..78c10b31d59b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d4-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c764ff644b5b0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d4.png b/Shared/CIPPSharp/bin/twemoji/1f9d4.png
new file mode 100644
index 0000000000000..44e8c0d6c01f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fb.png
new file mode 100644
index 0000000000000..1d643e0c3b339
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fc.png
new file mode 100644
index 0000000000000..852b0a92b31f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fd.png
new file mode 100644
index 0000000000000..b48e2fc6a600e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fe.png
new file mode 100644
index 0000000000000..3c9d4ff33797b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3ff.png
new file mode 100644
index 0000000000000..36415f4ccf937
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d5-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d5.png b/Shared/CIPPSharp/bin/twemoji/1f9d5.png
new file mode 100644
index 0000000000000..b39adcda35c6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..1ac4aaf56c4a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c7651ed3e8107
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb.png
new file mode 100644
index 0000000000000..01e7bad7405fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..33b55698a37a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..bb99429b95186
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc.png
new file mode 100644
index 0000000000000..190adb4568648
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..44314fb495ac9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..79c0bc65ed2c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd.png
new file mode 100644
index 0000000000000..bb170269ea59e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..4b4add48ccaed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1d1672d71fdf5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe.png
new file mode 100644
index 0000000000000..3e065c0af8aa3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..77414996715a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ed8c3944c6547
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff.png
new file mode 100644
index 0000000000000..d846549152dd9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3fa739ab64db8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d6-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a9a4c5ea92543
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d6.png b/Shared/CIPPSharp/bin/twemoji/1f9d6.png
new file mode 100644
index 0000000000000..3a2ec06ddf601
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..fecf90a7871a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c19285100ba46
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb.png
new file mode 100644
index 0000000000000..ff9d0fbbe859b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..215e18e2d4589
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9e8196c2878a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc.png
new file mode 100644
index 0000000000000..31bf0347f7060
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7d9396ce124b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a0255f24b08d3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd.png
new file mode 100644
index 0000000000000..67efea29f351b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..5408afcd71d7b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ed01df66b1199
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe.png
new file mode 100644
index 0000000000000..79708dd24c2a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ab88bd1d31e62
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..480fcf1ef2936
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff.png
new file mode 100644
index 0000000000000..c61785e2a06f7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b336b14d56e1d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d7-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6ad10ec4c2a57
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d7.png b/Shared/CIPPSharp/bin/twemoji/1f9d7.png
new file mode 100644
index 0000000000000..1303a54aaf8bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..996741f9e3246
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..002357d71a713
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb.png
new file mode 100644
index 0000000000000..fea8e8ba70221
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..dfa69c8ab6757
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e1606adc4ca74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc.png
new file mode 100644
index 0000000000000..074040204164a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..95dbb2d16d836
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9cc179ecdb565
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd.png
new file mode 100644
index 0000000000000..35f2252ba4234
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..ff022df7face8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9460caacb9ffa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe.png
new file mode 100644
index 0000000000000..facdd8e06e1f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..714c8f1893fc4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..005bab6b5ae70
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff.png
new file mode 100644
index 0000000000000..6781bf78ddf71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d9189351d8436
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d8-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0840aa1b534ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d8.png b/Shared/CIPPSharp/bin/twemoji/1f9d8.png
new file mode 100644
index 0000000000000..64cd7e2eb871c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..a90901839e869
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9bf271911c838
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb.png
new file mode 100644
index 0000000000000..90d1a887de8d7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..53e07504dd9dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4c787f5bea1de
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc.png
new file mode 100644
index 0000000000000..00e895ef0f09c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..2a7dcc21f2e3d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..96d8c88219c71
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd.png
new file mode 100644
index 0000000000000..b233884387d1c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e640bf2c5b2f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..2b66defd30b0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe.png
new file mode 100644
index 0000000000000..f9c021873a359
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..84fc554366514
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..3de49207214ad
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff.png
new file mode 100644
index 0000000000000..8abf6646a49db
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..747397c39ad4a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9d9-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d12c1e60521be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9d9.png b/Shared/CIPPSharp/bin/twemoji/1f9d9.png
new file mode 100644
index 0000000000000..4dd9aa577a155
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9d9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3ebb1908913d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4aef2a3eb7d53
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb.png
new file mode 100644
index 0000000000000..71865d80d2c5e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3a3a4a4ec19cb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..2f3566584c926
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc.png
new file mode 100644
index 0000000000000..696a9bfd9b065
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..be21165139de6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fa1b8242c7bd9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd.png
new file mode 100644
index 0000000000000..a6c48dd4acec0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..6469a079f114b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..e0990049f1d29
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe.png
new file mode 100644
index 0000000000000..05e51d2d79a1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..47181d6fc32b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..5fa6356ac588d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff.png
new file mode 100644
index 0000000000000..b2a3b83da08fb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..b4a1e9a4f9502
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9da-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..9f79ec16355c1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9da.png b/Shared/CIPPSharp/bin/twemoji/1f9da.png
new file mode 100644
index 0000000000000..2922c2e4cf541
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9da.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3a43c52fe4968
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..76fe5ede4e201
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb.png
new file mode 100644
index 0000000000000..e9d81f660d8aa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f958045cd700b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..08af30c85d729
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc.png
new file mode 100644
index 0000000000000..c3bdf523608c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7a1bea782fd19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fad2b7f9efb62
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd.png
new file mode 100644
index 0000000000000..1cdbc1e63edb2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..51d63cd18ec0d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..755de90ce1f77
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe.png
new file mode 100644
index 0000000000000..8c7f62beb8eea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..3fc9f4dfcc7d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..39424839cd4cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff.png
new file mode 100644
index 0000000000000..a04d300a7556a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8d43714750d6b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9db-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c1a60bc419326
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9db.png b/Shared/CIPPSharp/bin/twemoji/1f9db.png
new file mode 100644
index 0000000000000..f9153f654a750
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9db.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..249ce2ba67cbc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..8f32dd45e8a24
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb.png
new file mode 100644
index 0000000000000..2d1664f6d072e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..8bf8de385aa52
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..14e0c8955ca74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc.png
new file mode 100644
index 0000000000000..0cf2d6b73a36e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c7278e3d3d114
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d2dd2bb0478f3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd.png
new file mode 100644
index 0000000000000..463649c3ebb38
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f702433ea4f79
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fa34d60d7ea45
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe.png
new file mode 100644
index 0000000000000..12010a147d332
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7a67a9391a502
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1f179ea14573c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff.png
new file mode 100644
index 0000000000000..c2aa65ca26ccf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..566588215cee8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..c80e8cc2d79d2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dc.png b/Shared/CIPPSharp/bin/twemoji/1f9dc.png
new file mode 100644
index 0000000000000..ec922212345c4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..bd6d562bc4667
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..ac432895118bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb.png
new file mode 100644
index 0000000000000..0e6c18962f62c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..c88fe43de884c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..1c9b4b55a2a5a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc.png
new file mode 100644
index 0000000000000..c5d5474092ae3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..73b25fb960d75
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..d368a17828526
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd.png
new file mode 100644
index 0000000000000..1a9ca7f33ee32
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..f89356ef0f212
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6d1e04557120f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe.png
new file mode 100644
index 0000000000000..dd598986ac3b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..0aa3e71dabde1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..de1e6d07997b4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff.png
new file mode 100644
index 0000000000000..d8dc2f0d6e6d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..84e8ab03a2b78
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9dd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..f838ee82bbe60
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9dd.png b/Shared/CIPPSharp/bin/twemoji/1f9dd.png
new file mode 100644
index 0000000000000..c830d709e6981
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9dd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9de-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9de-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..d1a5608de922d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9de-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9de-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9de-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..0e30daa256a19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9de-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9de.png b/Shared/CIPPSharp/bin/twemoji/1f9de.png
new file mode 100644
index 0000000000000..34942f18070f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9de.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9df-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9df-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..cdaa255dc5199
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9df-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9df-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/1f9df-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..6065e11af6379
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9df-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9df.png b/Shared/CIPPSharp/bin/twemoji/1f9df.png
new file mode 100644
index 0000000000000..fda1ab48b54a3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9df.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e0.png b/Shared/CIPPSharp/bin/twemoji/1f9e0.png
new file mode 100644
index 0000000000000..dd5cd23be820a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e1.png b/Shared/CIPPSharp/bin/twemoji/1f9e1.png
new file mode 100644
index 0000000000000..a3ba1c2735d3a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e2.png b/Shared/CIPPSharp/bin/twemoji/1f9e2.png
new file mode 100644
index 0000000000000..1441df8c83894
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e3.png b/Shared/CIPPSharp/bin/twemoji/1f9e3.png
new file mode 100644
index 0000000000000..0faf6627c9c97
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e4.png b/Shared/CIPPSharp/bin/twemoji/1f9e4.png
new file mode 100644
index 0000000000000..ba0a2af68ba9d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e5.png b/Shared/CIPPSharp/bin/twemoji/1f9e5.png
new file mode 100644
index 0000000000000..4219af9b0c106
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e6.png b/Shared/CIPPSharp/bin/twemoji/1f9e6.png
new file mode 100644
index 0000000000000..924c9530983d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e7.png b/Shared/CIPPSharp/bin/twemoji/1f9e7.png
new file mode 100644
index 0000000000000..8b7941d1b59fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e8.png b/Shared/CIPPSharp/bin/twemoji/1f9e8.png
new file mode 100644
index 0000000000000..6dc6b7e04c57d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9e9.png b/Shared/CIPPSharp/bin/twemoji/1f9e9.png
new file mode 100644
index 0000000000000..9a3e7fa3bc9ce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ea.png b/Shared/CIPPSharp/bin/twemoji/1f9ea.png
new file mode 100644
index 0000000000000..d083b76ff6793
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9eb.png b/Shared/CIPPSharp/bin/twemoji/1f9eb.png
new file mode 100644
index 0000000000000..f48fdb32d6ce0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ec.png b/Shared/CIPPSharp/bin/twemoji/1f9ec.png
new file mode 100644
index 0000000000000..1fa93207d632b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ed.png b/Shared/CIPPSharp/bin/twemoji/1f9ed.png
new file mode 100644
index 0000000000000..ff199d4822b23
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ee.png b/Shared/CIPPSharp/bin/twemoji/1f9ee.png
new file mode 100644
index 0000000000000..e56e558529728
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ef.png b/Shared/CIPPSharp/bin/twemoji/1f9ef.png
new file mode 100644
index 0000000000000..f05d9276a18b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f0.png b/Shared/CIPPSharp/bin/twemoji/1f9f0.png
new file mode 100644
index 0000000000000..f66bd60df4782
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f1.png b/Shared/CIPPSharp/bin/twemoji/1f9f1.png
new file mode 100644
index 0000000000000..764830aeddfdd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f2.png b/Shared/CIPPSharp/bin/twemoji/1f9f2.png
new file mode 100644
index 0000000000000..f6366085d340a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f3.png b/Shared/CIPPSharp/bin/twemoji/1f9f3.png
new file mode 100644
index 0000000000000..f907616056c84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f4.png b/Shared/CIPPSharp/bin/twemoji/1f9f4.png
new file mode 100644
index 0000000000000..2fb947682a1c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f5.png b/Shared/CIPPSharp/bin/twemoji/1f9f5.png
new file mode 100644
index 0000000000000..0e26993b84935
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f6.png b/Shared/CIPPSharp/bin/twemoji/1f9f6.png
new file mode 100644
index 0000000000000..005e38061f984
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f7.png b/Shared/CIPPSharp/bin/twemoji/1f9f7.png
new file mode 100644
index 0000000000000..b15166e2ab557
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f8.png b/Shared/CIPPSharp/bin/twemoji/1f9f8.png
new file mode 100644
index 0000000000000..4ba5b7bb59627
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9f9.png b/Shared/CIPPSharp/bin/twemoji/1f9f9.png
new file mode 100644
index 0000000000000..13176f55f1a69
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9fa.png b/Shared/CIPPSharp/bin/twemoji/1f9fa.png
new file mode 100644
index 0000000000000..696476ff6deab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9fb.png b/Shared/CIPPSharp/bin/twemoji/1f9fb.png
new file mode 100644
index 0000000000000..1a12083201021
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9fc.png b/Shared/CIPPSharp/bin/twemoji/1f9fc.png
new file mode 100644
index 0000000000000..3432ebceb1648
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9fd.png b/Shared/CIPPSharp/bin/twemoji/1f9fd.png
new file mode 100644
index 0000000000000..8f810b2395d94
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9fe.png b/Shared/CIPPSharp/bin/twemoji/1f9fe.png
new file mode 100644
index 0000000000000..15408be776a76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1f9ff.png b/Shared/CIPPSharp/bin/twemoji/1f9ff.png
new file mode 100644
index 0000000000000..a5e55b990fc65
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1f9ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa70.png b/Shared/CIPPSharp/bin/twemoji/1fa70.png
new file mode 100644
index 0000000000000..4d57413ddb35b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa70.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa71.png b/Shared/CIPPSharp/bin/twemoji/1fa71.png
new file mode 100644
index 0000000000000..af41879e3d1f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa71.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa72.png b/Shared/CIPPSharp/bin/twemoji/1fa72.png
new file mode 100644
index 0000000000000..0a360084769d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa72.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa73.png b/Shared/CIPPSharp/bin/twemoji/1fa73.png
new file mode 100644
index 0000000000000..f1adff3ee6c19
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa73.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa74.png b/Shared/CIPPSharp/bin/twemoji/1fa74.png
new file mode 100644
index 0000000000000..f7b078b069f89
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa74.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa75.png b/Shared/CIPPSharp/bin/twemoji/1fa75.png
new file mode 100644
index 0000000000000..ce47cefb93b05
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa75.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa76.png b/Shared/CIPPSharp/bin/twemoji/1fa76.png
new file mode 100644
index 0000000000000..7a4d48186c7cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa76.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa77.png b/Shared/CIPPSharp/bin/twemoji/1fa77.png
new file mode 100644
index 0000000000000..094d80077d8b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa77.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa78.png b/Shared/CIPPSharp/bin/twemoji/1fa78.png
new file mode 100644
index 0000000000000..62aaa0f4cd8dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa78.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa79.png b/Shared/CIPPSharp/bin/twemoji/1fa79.png
new file mode 100644
index 0000000000000..edb23981a4a93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa79.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa7a.png b/Shared/CIPPSharp/bin/twemoji/1fa7a.png
new file mode 100644
index 0000000000000..edb930715cd74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa7a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa7b.png b/Shared/CIPPSharp/bin/twemoji/1fa7b.png
new file mode 100644
index 0000000000000..f25e24dcbecd7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa7b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa7c.png b/Shared/CIPPSharp/bin/twemoji/1fa7c.png
new file mode 100644
index 0000000000000..2c6fb77e12247
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa7c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa80.png b/Shared/CIPPSharp/bin/twemoji/1fa80.png
new file mode 100644
index 0000000000000..5ae5a9d03a319
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa80.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa81.png b/Shared/CIPPSharp/bin/twemoji/1fa81.png
new file mode 100644
index 0000000000000..07bcb5503f1e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa81.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa82.png b/Shared/CIPPSharp/bin/twemoji/1fa82.png
new file mode 100644
index 0000000000000..246aab9b1b62b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa82.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa83.png b/Shared/CIPPSharp/bin/twemoji/1fa83.png
new file mode 100644
index 0000000000000..8cbd6b7cfff25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa83.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa84.png b/Shared/CIPPSharp/bin/twemoji/1fa84.png
new file mode 100644
index 0000000000000..73649cbd14534
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa84.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa85.png b/Shared/CIPPSharp/bin/twemoji/1fa85.png
new file mode 100644
index 0000000000000..e97835b0c99e9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa85.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa86.png b/Shared/CIPPSharp/bin/twemoji/1fa86.png
new file mode 100644
index 0000000000000..5181a4ef2be76
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa86.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa87.png b/Shared/CIPPSharp/bin/twemoji/1fa87.png
new file mode 100644
index 0000000000000..23350ca48c1e8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa87.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa88.png b/Shared/CIPPSharp/bin/twemoji/1fa88.png
new file mode 100644
index 0000000000000..b2f88ca8c8c8a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa88.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa89.png b/Shared/CIPPSharp/bin/twemoji/1fa89.png
new file mode 100644
index 0000000000000..afa917b4d9414
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa89.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa8a.png b/Shared/CIPPSharp/bin/twemoji/1fa8a.png
new file mode 100644
index 0000000000000..4c8e3c10735bc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa8a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa8e.png b/Shared/CIPPSharp/bin/twemoji/1fa8e.png
new file mode 100644
index 0000000000000..ba190bcde4be8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa8e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa8f.png b/Shared/CIPPSharp/bin/twemoji/1fa8f.png
new file mode 100644
index 0000000000000..a31c0536fcbd5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa8f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa90.png b/Shared/CIPPSharp/bin/twemoji/1fa90.png
new file mode 100644
index 0000000000000..e0f5af293425f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa90.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa91.png b/Shared/CIPPSharp/bin/twemoji/1fa91.png
new file mode 100644
index 0000000000000..2ffe0ada06bc0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa91.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa92.png b/Shared/CIPPSharp/bin/twemoji/1fa92.png
new file mode 100644
index 0000000000000..02ec9122050ab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa92.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa93.png b/Shared/CIPPSharp/bin/twemoji/1fa93.png
new file mode 100644
index 0000000000000..eb96121dd6cda
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa93.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa94.png b/Shared/CIPPSharp/bin/twemoji/1fa94.png
new file mode 100644
index 0000000000000..161befbaf5fa1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa94.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa95.png b/Shared/CIPPSharp/bin/twemoji/1fa95.png
new file mode 100644
index 0000000000000..f5eb90921e4ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa95.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa96.png b/Shared/CIPPSharp/bin/twemoji/1fa96.png
new file mode 100644
index 0000000000000..47d54a833e4a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa96.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa97.png b/Shared/CIPPSharp/bin/twemoji/1fa97.png
new file mode 100644
index 0000000000000..d198407df7e28
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa97.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa98.png b/Shared/CIPPSharp/bin/twemoji/1fa98.png
new file mode 100644
index 0000000000000..9e25d364188ce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa98.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa99.png b/Shared/CIPPSharp/bin/twemoji/1fa99.png
new file mode 100644
index 0000000000000..8df742e5d733e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa99.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa9a.png b/Shared/CIPPSharp/bin/twemoji/1fa9a.png
new file mode 100644
index 0000000000000..6c2b2e9e17d2b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa9a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa9b.png b/Shared/CIPPSharp/bin/twemoji/1fa9b.png
new file mode 100644
index 0000000000000..215ebb527345b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa9b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa9c.png b/Shared/CIPPSharp/bin/twemoji/1fa9c.png
new file mode 100644
index 0000000000000..7486beece7ee5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa9c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa9d.png b/Shared/CIPPSharp/bin/twemoji/1fa9d.png
new file mode 100644
index 0000000000000..67499210a6389
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa9d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa9e.png b/Shared/CIPPSharp/bin/twemoji/1fa9e.png
new file mode 100644
index 0000000000000..843365b96f9a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa9e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fa9f.png b/Shared/CIPPSharp/bin/twemoji/1fa9f.png
new file mode 100644
index 0000000000000..41627f39dd085
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fa9f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa0.png b/Shared/CIPPSharp/bin/twemoji/1faa0.png
new file mode 100644
index 0000000000000..51a1058063bc7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa1.png b/Shared/CIPPSharp/bin/twemoji/1faa1.png
new file mode 100644
index 0000000000000..92f82ce01d7a6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa2.png b/Shared/CIPPSharp/bin/twemoji/1faa2.png
new file mode 100644
index 0000000000000..beaedaf0cbfbc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa3.png b/Shared/CIPPSharp/bin/twemoji/1faa3.png
new file mode 100644
index 0000000000000..01c6a2476b4c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa4.png b/Shared/CIPPSharp/bin/twemoji/1faa4.png
new file mode 100644
index 0000000000000..8571b0f319582
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa5.png b/Shared/CIPPSharp/bin/twemoji/1faa5.png
new file mode 100644
index 0000000000000..bed7fa028d2ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa6.png b/Shared/CIPPSharp/bin/twemoji/1faa6.png
new file mode 100644
index 0000000000000..30e67e7cbf954
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa7.png b/Shared/CIPPSharp/bin/twemoji/1faa7.png
new file mode 100644
index 0000000000000..2421eb6e5223b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa8.png b/Shared/CIPPSharp/bin/twemoji/1faa8.png
new file mode 100644
index 0000000000000..2f56725b81866
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faa9.png b/Shared/CIPPSharp/bin/twemoji/1faa9.png
new file mode 100644
index 0000000000000..371dd3f59af78
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faa9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faaa.png b/Shared/CIPPSharp/bin/twemoji/1faaa.png
new file mode 100644
index 0000000000000..28914d597dcc7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faaa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faab.png b/Shared/CIPPSharp/bin/twemoji/1faab.png
new file mode 100644
index 0000000000000..56248eae44ab5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faac.png b/Shared/CIPPSharp/bin/twemoji/1faac.png
new file mode 100644
index 0000000000000..95b5e05072c64
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faac.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faad.png b/Shared/CIPPSharp/bin/twemoji/1faad.png
new file mode 100644
index 0000000000000..c9973e08470da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faad.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faae.png b/Shared/CIPPSharp/bin/twemoji/1faae.png
new file mode 100644
index 0000000000000..0469ee9d75068
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faae.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faaf.png b/Shared/CIPPSharp/bin/twemoji/1faaf.png
new file mode 100644
index 0000000000000..050384ee17b9a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faaf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab0.png b/Shared/CIPPSharp/bin/twemoji/1fab0.png
new file mode 100644
index 0000000000000..5183b5bb989c3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab1.png b/Shared/CIPPSharp/bin/twemoji/1fab1.png
new file mode 100644
index 0000000000000..5ae8568f0b267
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab2.png b/Shared/CIPPSharp/bin/twemoji/1fab2.png
new file mode 100644
index 0000000000000..fcc1e46f7509b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab3.png b/Shared/CIPPSharp/bin/twemoji/1fab3.png
new file mode 100644
index 0000000000000..a237252382589
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab4.png b/Shared/CIPPSharp/bin/twemoji/1fab4.png
new file mode 100644
index 0000000000000..10c0fa57a506d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab5.png b/Shared/CIPPSharp/bin/twemoji/1fab5.png
new file mode 100644
index 0000000000000..5d25b7a23013d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab6.png b/Shared/CIPPSharp/bin/twemoji/1fab6.png
new file mode 100644
index 0000000000000..5ff7191cdbf69
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab7.png b/Shared/CIPPSharp/bin/twemoji/1fab7.png
new file mode 100644
index 0000000000000..1cbdb98467748
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab8.png b/Shared/CIPPSharp/bin/twemoji/1fab8.png
new file mode 100644
index 0000000000000..f312f47d566fa
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fab9.png b/Shared/CIPPSharp/bin/twemoji/1fab9.png
new file mode 100644
index 0000000000000..505c9f891eff3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fab9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faba.png b/Shared/CIPPSharp/bin/twemoji/1faba.png
new file mode 100644
index 0000000000000..d2a849425208f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faba.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fabb.png b/Shared/CIPPSharp/bin/twemoji/1fabb.png
new file mode 100644
index 0000000000000..d6da522ceb748
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fabb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fabc.png b/Shared/CIPPSharp/bin/twemoji/1fabc.png
new file mode 100644
index 0000000000000..4ffad41c6d1b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fabc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fabd.png b/Shared/CIPPSharp/bin/twemoji/1fabd.png
new file mode 100644
index 0000000000000..2d9efc8bf0934
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fabd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fabe.png b/Shared/CIPPSharp/bin/twemoji/1fabe.png
new file mode 100644
index 0000000000000..49a4c5abde342
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fabe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fabf.png b/Shared/CIPPSharp/bin/twemoji/1fabf.png
new file mode 100644
index 0000000000000..93688c24f27d5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fabf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac0.png b/Shared/CIPPSharp/bin/twemoji/1fac0.png
new file mode 100644
index 0000000000000..6d712a0652b47
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac1.png b/Shared/CIPPSharp/bin/twemoji/1fac1.png
new file mode 100644
index 0000000000000..3259df2647ef6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac2.png b/Shared/CIPPSharp/bin/twemoji/1fac2.png
new file mode 100644
index 0000000000000..8cc1c058588f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fb.png
new file mode 100644
index 0000000000000..2040952ba4a64
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fc.png
new file mode 100644
index 0000000000000..1a4a8f2c874b6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fd.png
new file mode 100644
index 0000000000000..fa2e94b5511bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fe.png
new file mode 100644
index 0000000000000..6decc3e1aa08b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac3-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3ff.png
new file mode 100644
index 0000000000000..960abc8c8ff75
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac3-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac3.png b/Shared/CIPPSharp/bin/twemoji/1fac3.png
new file mode 100644
index 0000000000000..a1bb8560d81d8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fb.png
new file mode 100644
index 0000000000000..76cfb2e71db5f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fc.png
new file mode 100644
index 0000000000000..36d5f5401efc9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fd.png
new file mode 100644
index 0000000000000..4c7ba5a161671
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fe.png
new file mode 100644
index 0000000000000..26963851ad06c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac4-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3ff.png
new file mode 100644
index 0000000000000..d3118efb96c40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac4-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac4.png b/Shared/CIPPSharp/bin/twemoji/1fac4.png
new file mode 100644
index 0000000000000..2bc18378681fe
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fb.png
new file mode 100644
index 0000000000000..f9d535683d1dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fc.png
new file mode 100644
index 0000000000000..13e32b14b9beb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fd.png
new file mode 100644
index 0000000000000..09c284ceee0bd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fe.png
new file mode 100644
index 0000000000000..eb639141b174a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac5-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3ff.png
new file mode 100644
index 0000000000000..c3607584ab3df
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac5-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac5.png b/Shared/CIPPSharp/bin/twemoji/1fac5.png
new file mode 100644
index 0000000000000..22e3e9d501d7b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac6.png b/Shared/CIPPSharp/bin/twemoji/1fac6.png
new file mode 100644
index 0000000000000..8f045e03c0fc4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fac8.png b/Shared/CIPPSharp/bin/twemoji/1fac8.png
new file mode 100644
index 0000000000000..f5aad025dce77
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fac8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1facd.png b/Shared/CIPPSharp/bin/twemoji/1facd.png
new file mode 100644
index 0000000000000..aced863706ad0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1facd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1face.png b/Shared/CIPPSharp/bin/twemoji/1face.png
new file mode 100644
index 0000000000000..2fa60c3cfc6be
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1face.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1facf.png b/Shared/CIPPSharp/bin/twemoji/1facf.png
new file mode 100644
index 0000000000000..d9eec52bac332
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1facf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad0.png b/Shared/CIPPSharp/bin/twemoji/1fad0.png
new file mode 100644
index 0000000000000..3dbe93433ca95
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad1.png b/Shared/CIPPSharp/bin/twemoji/1fad1.png
new file mode 100644
index 0000000000000..b4ef7e32a8c47
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad2.png b/Shared/CIPPSharp/bin/twemoji/1fad2.png
new file mode 100644
index 0000000000000..3e660e6d0c285
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad3.png b/Shared/CIPPSharp/bin/twemoji/1fad3.png
new file mode 100644
index 0000000000000..30b2977b6816e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad4.png b/Shared/CIPPSharp/bin/twemoji/1fad4.png
new file mode 100644
index 0000000000000..7dba90554eb6c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad5.png b/Shared/CIPPSharp/bin/twemoji/1fad5.png
new file mode 100644
index 0000000000000..8b1f5073370f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad6.png b/Shared/CIPPSharp/bin/twemoji/1fad6.png
new file mode 100644
index 0000000000000..37b47ed427ada
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad7.png b/Shared/CIPPSharp/bin/twemoji/1fad7.png
new file mode 100644
index 0000000000000..6f7e690458fd5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad8.png b/Shared/CIPPSharp/bin/twemoji/1fad8.png
new file mode 100644
index 0000000000000..ae12344e84395
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fad9.png b/Shared/CIPPSharp/bin/twemoji/1fad9.png
new file mode 100644
index 0000000000000..6988172c39aea
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fad9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fada.png b/Shared/CIPPSharp/bin/twemoji/1fada.png
new file mode 100644
index 0000000000000..5cd8622186af0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fada.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fadb.png b/Shared/CIPPSharp/bin/twemoji/1fadb.png
new file mode 100644
index 0000000000000..3e56b7a9ff441
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fadb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fadc.png b/Shared/CIPPSharp/bin/twemoji/1fadc.png
new file mode 100644
index 0000000000000..73956914439d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fadc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fadf.png b/Shared/CIPPSharp/bin/twemoji/1fadf.png
new file mode 100644
index 0000000000000..89cf85425a275
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fadf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae0.png b/Shared/CIPPSharp/bin/twemoji/1fae0.png
new file mode 100644
index 0000000000000..b22f9f4ce1490
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae1.png b/Shared/CIPPSharp/bin/twemoji/1fae1.png
new file mode 100644
index 0000000000000..16d636271d028
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae2.png b/Shared/CIPPSharp/bin/twemoji/1fae2.png
new file mode 100644
index 0000000000000..9153a41d89415
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae3.png b/Shared/CIPPSharp/bin/twemoji/1fae3.png
new file mode 100644
index 0000000000000..b4572380a8c7b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae4.png b/Shared/CIPPSharp/bin/twemoji/1fae4.png
new file mode 100644
index 0000000000000..44c34dc71d4dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae5.png b/Shared/CIPPSharp/bin/twemoji/1fae5.png
new file mode 100644
index 0000000000000..e0444c480ec93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae6.png b/Shared/CIPPSharp/bin/twemoji/1fae6.png
new file mode 100644
index 0000000000000..755c94e5ae3c3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae7.png b/Shared/CIPPSharp/bin/twemoji/1fae7.png
new file mode 100644
index 0000000000000..8b402bdba3b25
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae8.png b/Shared/CIPPSharp/bin/twemoji/1fae8.png
new file mode 100644
index 0000000000000..2720a2dfcd646
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1fae9.png b/Shared/CIPPSharp/bin/twemoji/1fae9.png
new file mode 100644
index 0000000000000..f9c18a6a15608
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1fae9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faea.png b/Shared/CIPPSharp/bin/twemoji/1faea.png
new file mode 100644
index 0000000000000..06a237f5e4bca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faef.png b/Shared/CIPPSharp/bin/twemoji/1faef.png
new file mode 100644
index 0000000000000..f03999f6b51c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fb.png
new file mode 100644
index 0000000000000..64fe03d81534f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fc.png
new file mode 100644
index 0000000000000..4c5610564e73b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fd.png
new file mode 100644
index 0000000000000..fa2b902e5795c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fe.png
new file mode 100644
index 0000000000000..6a2c153ec3286
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf0-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3ff.png
new file mode 100644
index 0000000000000..8e73cdf494b81
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf0-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf0.png b/Shared/CIPPSharp/bin/twemoji/1faf0.png
new file mode 100644
index 0000000000000..1a4ebedf2e764
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fc.png
new file mode 100644
index 0000000000000..2c911d7d70f8f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fd.png
new file mode 100644
index 0000000000000..5f81f9d886cc0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fe.png
new file mode 100644
index 0000000000000..b1f794731c350
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3ff.png
new file mode 100644
index 0000000000000..270800ee51314
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb-200d-1faf2-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb.png
new file mode 100644
index 0000000000000..350fd42a0bdbc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fb.png
new file mode 100644
index 0000000000000..3d7487d6194f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fd.png
new file mode 100644
index 0000000000000..681473f688c0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fe.png
new file mode 100644
index 0000000000000..267dfa1f34172
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3ff.png
new file mode 100644
index 0000000000000..09312a04ad5c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc-200d-1faf2-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc.png
new file mode 100644
index 0000000000000..7a8459690c75d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fb.png
new file mode 100644
index 0000000000000..8fff1125da4cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fc.png
new file mode 100644
index 0000000000000..b71098b814070
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fe.png
new file mode 100644
index 0000000000000..7e76b6a8496d4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3ff.png
new file mode 100644
index 0000000000000..df2600e84acf9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd-200d-1faf2-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd.png
new file mode 100644
index 0000000000000..62cdaa15fc020
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fb.png
new file mode 100644
index 0000000000000..7f8c42c1b95da
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fc.png
new file mode 100644
index 0000000000000..2982f4e0afd3e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fd.png
new file mode 100644
index 0000000000000..cea2e531f3b23
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3ff.png
new file mode 100644
index 0000000000000..353d0adcc4264
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe-200d-1faf2-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe.png
new file mode 100644
index 0000000000000..754a1fdc042ee
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fb.png
new file mode 100644
index 0000000000000..7fda714716721
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fc.png
new file mode 100644
index 0000000000000..3f09537065c21
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fd.png
new file mode 100644
index 0000000000000..2759c418101ce
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fe.png
new file mode 100644
index 0000000000000..c17022a84b98d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff-200d-1faf2-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff.png
new file mode 100644
index 0000000000000..22527d97e7d1b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf1.png b/Shared/CIPPSharp/bin/twemoji/1faf1.png
new file mode 100644
index 0000000000000..c03e0401cc11b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fb.png
new file mode 100644
index 0000000000000..2d75e3048fb13
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fc.png
new file mode 100644
index 0000000000000..cf9fb69a5e512
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fd.png
new file mode 100644
index 0000000000000..38b0cdc55dede
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fe.png
new file mode 100644
index 0000000000000..d10f7a0396902
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf2-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3ff.png
new file mode 100644
index 0000000000000..68b394f37266e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf2-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf2.png b/Shared/CIPPSharp/bin/twemoji/1faf2.png
new file mode 100644
index 0000000000000..499742365969f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fb.png
new file mode 100644
index 0000000000000..d8168dce4dc6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fc.png
new file mode 100644
index 0000000000000..5a841e5023eb8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fd.png
new file mode 100644
index 0000000000000..c439588ed0a9e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fe.png
new file mode 100644
index 0000000000000..3b63da73ca9f1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf3-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3ff.png
new file mode 100644
index 0000000000000..a8ea30ce80d51
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf3-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf3.png b/Shared/CIPPSharp/bin/twemoji/1faf3.png
new file mode 100644
index 0000000000000..1e057115a4af8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fb.png
new file mode 100644
index 0000000000000..0695579d7b9b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fc.png
new file mode 100644
index 0000000000000..4251f775a3ee9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fd.png
new file mode 100644
index 0000000000000..49208c249fca9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fe.png
new file mode 100644
index 0000000000000..ae14345638223
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf4-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3ff.png
new file mode 100644
index 0000000000000..fcc64e7f98f74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf4-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf4.png b/Shared/CIPPSharp/bin/twemoji/1faf4.png
new file mode 100644
index 0000000000000..d9fdff839f35c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fb.png
new file mode 100644
index 0000000000000..e6ae0b9df1e26
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fc.png
new file mode 100644
index 0000000000000..9dfd77c87905e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fd.png
new file mode 100644
index 0000000000000..222201c99da74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fe.png
new file mode 100644
index 0000000000000..5bba90bb65ca4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf5-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3ff.png
new file mode 100644
index 0000000000000..3d922501fa6f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf5-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf5.png b/Shared/CIPPSharp/bin/twemoji/1faf5.png
new file mode 100644
index 0000000000000..9e3a1b383886a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fb.png
new file mode 100644
index 0000000000000..55bfa0f369c1c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fc.png
new file mode 100644
index 0000000000000..d79a55f31a93a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fd.png
new file mode 100644
index 0000000000000..b0eb0d00b1183
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fe.png
new file mode 100644
index 0000000000000..e6f52ba0a08b1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf6-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3ff.png
new file mode 100644
index 0000000000000..f85b0ca83f2dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf6-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf6.png b/Shared/CIPPSharp/bin/twemoji/1faf6.png
new file mode 100644
index 0000000000000..23cf0502f23c7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fb.png
new file mode 100644
index 0000000000000..9e4f338583fe6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fc.png
new file mode 100644
index 0000000000000..acba6237efcdc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fd.png
new file mode 100644
index 0000000000000..50700f0aeb64f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fe.png
new file mode 100644
index 0000000000000..a4a8d1a1688ca
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf7-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3ff.png
new file mode 100644
index 0000000000000..0a57d9c5bbcda
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf7-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf7.png b/Shared/CIPPSharp/bin/twemoji/1faf7.png
new file mode 100644
index 0000000000000..edc4feb4021d0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fb.png
new file mode 100644
index 0000000000000..3f6cf4af3d2a5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fc.png
new file mode 100644
index 0000000000000..1148af5ba0104
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fd.png
new file mode 100644
index 0000000000000..07f293a53b405
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fe.png
new file mode 100644
index 0000000000000..3aed95634752e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf8-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3ff.png
new file mode 100644
index 0000000000000..d4589f053f32f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf8-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/1faf8.png b/Shared/CIPPSharp/bin/twemoji/1faf8.png
new file mode 100644
index 0000000000000..dbdceaba81597
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/1faf8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/203c.png b/Shared/CIPPSharp/bin/twemoji/203c.png
new file mode 100644
index 0000000000000..2334a7f5c100d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/203c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2049.png b/Shared/CIPPSharp/bin/twemoji/2049.png
new file mode 100644
index 0000000000000..c5304bf1417b1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2049.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2122.png b/Shared/CIPPSharp/bin/twemoji/2122.png
new file mode 100644
index 0000000000000..b9ffb56e3fb1d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2122.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2139.png b/Shared/CIPPSharp/bin/twemoji/2139.png
new file mode 100644
index 0000000000000..829f0bf085159
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2139.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2194.png b/Shared/CIPPSharp/bin/twemoji/2194.png
new file mode 100644
index 0000000000000..d0cb730c83454
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2194.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2195.png b/Shared/CIPPSharp/bin/twemoji/2195.png
new file mode 100644
index 0000000000000..cbbe269e4e1ae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2195.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2196.png b/Shared/CIPPSharp/bin/twemoji/2196.png
new file mode 100644
index 0000000000000..c3f9bdfce5933
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2196.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2197.png b/Shared/CIPPSharp/bin/twemoji/2197.png
new file mode 100644
index 0000000000000..08eb63ceed5fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2197.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2198.png b/Shared/CIPPSharp/bin/twemoji/2198.png
new file mode 100644
index 0000000000000..5135705c6fdb4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2198.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2199.png b/Shared/CIPPSharp/bin/twemoji/2199.png
new file mode 100644
index 0000000000000..41b24fe673a79
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2199.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/21a9.png b/Shared/CIPPSharp/bin/twemoji/21a9.png
new file mode 100644
index 0000000000000..1df93e69069e3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/21a9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/21aa.png b/Shared/CIPPSharp/bin/twemoji/21aa.png
new file mode 100644
index 0000000000000..7a0b709d25600
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/21aa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23-20e3.png b/Shared/CIPPSharp/bin/twemoji/23-20e3.png
new file mode 100644
index 0000000000000..f9129612eaac6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/231a.png b/Shared/CIPPSharp/bin/twemoji/231a.png
new file mode 100644
index 0000000000000..0f0ec3c9e360c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/231a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/231b.png b/Shared/CIPPSharp/bin/twemoji/231b.png
new file mode 100644
index 0000000000000..8e9196f3cd307
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/231b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2328.png b/Shared/CIPPSharp/bin/twemoji/2328.png
new file mode 100644
index 0000000000000..22a0a7dbcefef
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2328.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23cf.png b/Shared/CIPPSharp/bin/twemoji/23cf.png
new file mode 100644
index 0000000000000..940831bdc193c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23cf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23e9.png b/Shared/CIPPSharp/bin/twemoji/23e9.png
new file mode 100644
index 0000000000000..a4277ef3f094d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23ea.png b/Shared/CIPPSharp/bin/twemoji/23ea.png
new file mode 100644
index 0000000000000..9018ecf7eb117
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23eb.png b/Shared/CIPPSharp/bin/twemoji/23eb.png
new file mode 100644
index 0000000000000..3311acf024c65
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23eb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23ec.png b/Shared/CIPPSharp/bin/twemoji/23ec.png
new file mode 100644
index 0000000000000..2e53b4fffa332
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23ec.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23ed.png b/Shared/CIPPSharp/bin/twemoji/23ed.png
new file mode 100644
index 0000000000000..a69200295cfab
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23ed.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23ee.png b/Shared/CIPPSharp/bin/twemoji/23ee.png
new file mode 100644
index 0000000000000..56116b43d0e54
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23ee.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23ef.png b/Shared/CIPPSharp/bin/twemoji/23ef.png
new file mode 100644
index 0000000000000..4de7931beef55
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23ef.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23f0.png b/Shared/CIPPSharp/bin/twemoji/23f0.png
new file mode 100644
index 0000000000000..1e16c4f64f3dc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23f1.png b/Shared/CIPPSharp/bin/twemoji/23f1.png
new file mode 100644
index 0000000000000..34d7f141a0d69
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23f2.png b/Shared/CIPPSharp/bin/twemoji/23f2.png
new file mode 100644
index 0000000000000..e8b7dc4741775
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23f3.png b/Shared/CIPPSharp/bin/twemoji/23f3.png
new file mode 100644
index 0000000000000..b86946b324c0c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23f8.png b/Shared/CIPPSharp/bin/twemoji/23f8.png
new file mode 100644
index 0000000000000..f2843e3af5688
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23f9.png b/Shared/CIPPSharp/bin/twemoji/23f9.png
new file mode 100644
index 0000000000000..009bce06d650c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/23fa.png b/Shared/CIPPSharp/bin/twemoji/23fa.png
new file mode 100644
index 0000000000000..8f14600a2409f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/23fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/24c2.png b/Shared/CIPPSharp/bin/twemoji/24c2.png
new file mode 100644
index 0000000000000..64e209fd09991
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/24c2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25aa.png b/Shared/CIPPSharp/bin/twemoji/25aa.png
new file mode 100644
index 0000000000000..ab6088aac9557
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25aa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25ab.png b/Shared/CIPPSharp/bin/twemoji/25ab.png
new file mode 100644
index 0000000000000..250060020df35
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25ab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25b6.png b/Shared/CIPPSharp/bin/twemoji/25b6.png
new file mode 100644
index 0000000000000..b0bf29e5b4c23
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25b6.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25c0.png b/Shared/CIPPSharp/bin/twemoji/25c0.png
new file mode 100644
index 0000000000000..2721eabe55c40
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25c0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25fb.png b/Shared/CIPPSharp/bin/twemoji/25fb.png
new file mode 100644
index 0000000000000..8696fed41dcfc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25fc.png b/Shared/CIPPSharp/bin/twemoji/25fc.png
new file mode 100644
index 0000000000000..417cf851099c0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25fd.png b/Shared/CIPPSharp/bin/twemoji/25fd.png
new file mode 100644
index 0000000000000..a7de8524b808b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/25fe.png b/Shared/CIPPSharp/bin/twemoji/25fe.png
new file mode 100644
index 0000000000000..bcfd21205d3cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/25fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2600.png b/Shared/CIPPSharp/bin/twemoji/2600.png
new file mode 100644
index 0000000000000..718b31db31a4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2600.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2601.png b/Shared/CIPPSharp/bin/twemoji/2601.png
new file mode 100644
index 0000000000000..6b1fead8acc97
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2601.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2602.png b/Shared/CIPPSharp/bin/twemoji/2602.png
new file mode 100644
index 0000000000000..ce9bb58d1ef5f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2602.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2603.png b/Shared/CIPPSharp/bin/twemoji/2603.png
new file mode 100644
index 0000000000000..dfff95c7f28b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2603.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2604.png b/Shared/CIPPSharp/bin/twemoji/2604.png
new file mode 100644
index 0000000000000..3b6021bcda914
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2604.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/260e.png b/Shared/CIPPSharp/bin/twemoji/260e.png
new file mode 100644
index 0000000000000..e3319af0376a7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/260e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2611.png b/Shared/CIPPSharp/bin/twemoji/2611.png
new file mode 100644
index 0000000000000..4b530a8faa2d1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2611.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2614.png b/Shared/CIPPSharp/bin/twemoji/2614.png
new file mode 100644
index 0000000000000..b8a96f9c33250
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2614.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2615.png b/Shared/CIPPSharp/bin/twemoji/2615.png
new file mode 100644
index 0000000000000..5ce8931e1dec0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2615.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2618.png b/Shared/CIPPSharp/bin/twemoji/2618.png
new file mode 100644
index 0000000000000..f987099ff7a5c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2618.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/261d-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/261d-1f3fb.png
new file mode 100644
index 0000000000000..18a978063969a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/261d-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/261d-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/261d-1f3fc.png
new file mode 100644
index 0000000000000..13dc0973c254f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/261d-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/261d-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/261d-1f3fd.png
new file mode 100644
index 0000000000000..a042487226756
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/261d-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/261d-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/261d-1f3fe.png
new file mode 100644
index 0000000000000..4365323610c96
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/261d-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/261d-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/261d-1f3ff.png
new file mode 100644
index 0000000000000..2e943bcb4661b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/261d-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/261d.png b/Shared/CIPPSharp/bin/twemoji/261d.png
new file mode 100644
index 0000000000000..23d764187132a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/261d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2620.png b/Shared/CIPPSharp/bin/twemoji/2620.png
new file mode 100644
index 0000000000000..ba32dd234db34
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2620.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2622.png b/Shared/CIPPSharp/bin/twemoji/2622.png
new file mode 100644
index 0000000000000..6b167878b16b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2622.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2623.png b/Shared/CIPPSharp/bin/twemoji/2623.png
new file mode 100644
index 0000000000000..5d8d42b02ba74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2623.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2626.png b/Shared/CIPPSharp/bin/twemoji/2626.png
new file mode 100644
index 0000000000000..b9f0e3a8665b3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2626.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/262a.png b/Shared/CIPPSharp/bin/twemoji/262a.png
new file mode 100644
index 0000000000000..c7538a524baa4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/262a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/262e.png b/Shared/CIPPSharp/bin/twemoji/262e.png
new file mode 100644
index 0000000000000..8a8be5e46376d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/262e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/262f.png b/Shared/CIPPSharp/bin/twemoji/262f.png
new file mode 100644
index 0000000000000..82faf77a03908
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/262f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2638.png b/Shared/CIPPSharp/bin/twemoji/2638.png
new file mode 100644
index 0000000000000..e3a3e9210a2a4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2638.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2639.png b/Shared/CIPPSharp/bin/twemoji/2639.png
new file mode 100644
index 0000000000000..9d9698f6b7212
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2639.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/263a.png b/Shared/CIPPSharp/bin/twemoji/263a.png
new file mode 100644
index 0000000000000..29c80a226fcae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/263a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2640.png b/Shared/CIPPSharp/bin/twemoji/2640.png
new file mode 100644
index 0000000000000..f9b176035826e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2640.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2642.png b/Shared/CIPPSharp/bin/twemoji/2642.png
new file mode 100644
index 0000000000000..2591c832acfac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2642.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2648.png b/Shared/CIPPSharp/bin/twemoji/2648.png
new file mode 100644
index 0000000000000..0798e87b7e73e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2648.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2649.png b/Shared/CIPPSharp/bin/twemoji/2649.png
new file mode 100644
index 0000000000000..5ca7494601ab2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2649.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/264a.png b/Shared/CIPPSharp/bin/twemoji/264a.png
new file mode 100644
index 0000000000000..7bdc7b100289c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/264a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/264b.png b/Shared/CIPPSharp/bin/twemoji/264b.png
new file mode 100644
index 0000000000000..9d14919ebfe84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/264b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/264c.png b/Shared/CIPPSharp/bin/twemoji/264c.png
new file mode 100644
index 0000000000000..a1009e9a0de21
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/264c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/264d.png b/Shared/CIPPSharp/bin/twemoji/264d.png
new file mode 100644
index 0000000000000..8bf788774b46e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/264d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/264e.png b/Shared/CIPPSharp/bin/twemoji/264e.png
new file mode 100644
index 0000000000000..f06a78cf2ea4d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/264e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/264f.png b/Shared/CIPPSharp/bin/twemoji/264f.png
new file mode 100644
index 0000000000000..2ca7e0b9c26f4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/264f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2650.png b/Shared/CIPPSharp/bin/twemoji/2650.png
new file mode 100644
index 0000000000000..57919345ec45a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2650.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2651.png b/Shared/CIPPSharp/bin/twemoji/2651.png
new file mode 100644
index 0000000000000..b89c8d21960a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2651.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2652.png b/Shared/CIPPSharp/bin/twemoji/2652.png
new file mode 100644
index 0000000000000..de34060dd313b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2652.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2653.png b/Shared/CIPPSharp/bin/twemoji/2653.png
new file mode 100644
index 0000000000000..84d436f39a40d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2653.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/265f.png b/Shared/CIPPSharp/bin/twemoji/265f.png
new file mode 100644
index 0000000000000..18f933cb0cc84
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/265f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2660.png b/Shared/CIPPSharp/bin/twemoji/2660.png
new file mode 100644
index 0000000000000..c9138c3963d8b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2660.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2663.png b/Shared/CIPPSharp/bin/twemoji/2663.png
new file mode 100644
index 0000000000000..20af6f8d3676c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2663.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2665.png b/Shared/CIPPSharp/bin/twemoji/2665.png
new file mode 100644
index 0000000000000..f80860bb3ae39
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2665.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2666.png b/Shared/CIPPSharp/bin/twemoji/2666.png
new file mode 100644
index 0000000000000..574fadf609aec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2666.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2668.png b/Shared/CIPPSharp/bin/twemoji/2668.png
new file mode 100644
index 0000000000000..6ca91542f13fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2668.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/267b.png b/Shared/CIPPSharp/bin/twemoji/267b.png
new file mode 100644
index 0000000000000..97c09767f317e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/267b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/267e.png b/Shared/CIPPSharp/bin/twemoji/267e.png
new file mode 100644
index 0000000000000..778e87b2e491c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/267e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/267f.png b/Shared/CIPPSharp/bin/twemoji/267f.png
new file mode 100644
index 0000000000000..5d796cee1b4bb
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/267f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2692.png b/Shared/CIPPSharp/bin/twemoji/2692.png
new file mode 100644
index 0000000000000..055a8e7aa0e9b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2692.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2693.png b/Shared/CIPPSharp/bin/twemoji/2693.png
new file mode 100644
index 0000000000000..277f85ec4d41a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2693.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2694.png b/Shared/CIPPSharp/bin/twemoji/2694.png
new file mode 100644
index 0000000000000..61bf8b1bf0a3b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2694.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2695.png b/Shared/CIPPSharp/bin/twemoji/2695.png
new file mode 100644
index 0000000000000..d542f01bd6715
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2695.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2696.png b/Shared/CIPPSharp/bin/twemoji/2696.png
new file mode 100644
index 0000000000000..cf179675d9aa5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2696.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2697.png b/Shared/CIPPSharp/bin/twemoji/2697.png
new file mode 100644
index 0000000000000..c4b62271c779c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2697.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2699.png b/Shared/CIPPSharp/bin/twemoji/2699.png
new file mode 100644
index 0000000000000..b78e56447a548
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2699.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/269b.png b/Shared/CIPPSharp/bin/twemoji/269b.png
new file mode 100644
index 0000000000000..7daedd8e404e7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/269b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/269c.png b/Shared/CIPPSharp/bin/twemoji/269c.png
new file mode 100644
index 0000000000000..7ad56ad454383
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/269c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26a0.png b/Shared/CIPPSharp/bin/twemoji/26a0.png
new file mode 100644
index 0000000000000..a154653002f0f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26a0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26a1.png b/Shared/CIPPSharp/bin/twemoji/26a1.png
new file mode 100644
index 0000000000000..797d3ca938168
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26a1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26a7.png b/Shared/CIPPSharp/bin/twemoji/26a7.png
new file mode 100644
index 0000000000000..fc84e19d14c1f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26a7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26aa.png b/Shared/CIPPSharp/bin/twemoji/26aa.png
new file mode 100644
index 0000000000000..1d5ec9319fd74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26aa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26ab.png b/Shared/CIPPSharp/bin/twemoji/26ab.png
new file mode 100644
index 0000000000000..038f93edd6971
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26ab.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26b0.png b/Shared/CIPPSharp/bin/twemoji/26b0.png
new file mode 100644
index 0000000000000..184c59f60d6b9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26b1.png b/Shared/CIPPSharp/bin/twemoji/26b1.png
new file mode 100644
index 0000000000000..9c45483469ea0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26b1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26bd.png b/Shared/CIPPSharp/bin/twemoji/26bd.png
new file mode 100644
index 0000000000000..5e11489594248
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26bd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26be.png b/Shared/CIPPSharp/bin/twemoji/26be.png
new file mode 100644
index 0000000000000..b69c9c765bea5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26be.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26c4.png b/Shared/CIPPSharp/bin/twemoji/26c4.png
new file mode 100644
index 0000000000000..70518ad8edfb8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26c4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26c5.png b/Shared/CIPPSharp/bin/twemoji/26c5.png
new file mode 100644
index 0000000000000..13ff46049f3a0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26c5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26c8.png b/Shared/CIPPSharp/bin/twemoji/26c8.png
new file mode 100644
index 0000000000000..699b775ce617f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26c8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26ce.png b/Shared/CIPPSharp/bin/twemoji/26ce.png
new file mode 100644
index 0000000000000..24fbd8a748b8e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26ce.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26cf.png b/Shared/CIPPSharp/bin/twemoji/26cf.png
new file mode 100644
index 0000000000000..d482a9062294f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26cf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26d1.png b/Shared/CIPPSharp/bin/twemoji/26d1.png
new file mode 100644
index 0000000000000..d99f6046f5658
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26d1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26d3-fe0f-200d-1f4a5.png b/Shared/CIPPSharp/bin/twemoji/26d3-fe0f-200d-1f4a5.png
new file mode 100644
index 0000000000000..c92a434e393f2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26d3-fe0f-200d-1f4a5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26d3.png b/Shared/CIPPSharp/bin/twemoji/26d3.png
new file mode 100644
index 0000000000000..1fa9dfd00696d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26d3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26d4.png b/Shared/CIPPSharp/bin/twemoji/26d4.png
new file mode 100644
index 0000000000000..d4410559bed6c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26d4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26e9.png b/Shared/CIPPSharp/bin/twemoji/26e9.png
new file mode 100644
index 0000000000000..0fb5d1286d0f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26e9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26ea.png b/Shared/CIPPSharp/bin/twemoji/26ea.png
new file mode 100644
index 0000000000000..3d84412bb96ed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26ea.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f0.png b/Shared/CIPPSharp/bin/twemoji/26f0.png
new file mode 100644
index 0000000000000..26f6e5cfa16dd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f1.png b/Shared/CIPPSharp/bin/twemoji/26f1.png
new file mode 100644
index 0000000000000..120de456f78b7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f2.png b/Shared/CIPPSharp/bin/twemoji/26f2.png
new file mode 100644
index 0000000000000..545c3eb85e79a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f2.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f3.png b/Shared/CIPPSharp/bin/twemoji/26f3.png
new file mode 100644
index 0000000000000..4dbfac67812fc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f4.png b/Shared/CIPPSharp/bin/twemoji/26f4.png
new file mode 100644
index 0000000000000..ce8759630bfc5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f4.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f5.png b/Shared/CIPPSharp/bin/twemoji/26f5.png
new file mode 100644
index 0000000000000..ed45fad83880c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f5.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f7-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fb.png
new file mode 100644
index 0000000000000..9cd4e00aed538
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f7-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fc.png
new file mode 100644
index 0000000000000..1ed165b678a47
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f7-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fd.png
new file mode 100644
index 0000000000000..427b3d027ee51
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f7-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fe.png
new file mode 100644
index 0000000000000..5970ef6ecbf0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f7-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f7-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/26f7-1f3ff.png
new file mode 100644
index 0000000000000..390c4fb504669
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f7-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f7.png b/Shared/CIPPSharp/bin/twemoji/26f7.png
new file mode 100644
index 0000000000000..7de15aa6c7232
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f7.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f8.png b/Shared/CIPPSharp/bin/twemoji/26f8.png
new file mode 100644
index 0000000000000..aedf5af158765
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f8.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..83750a1515b6d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..4d4d656f533cc
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb.png
new file mode 100644
index 0000000000000..082b064721bed
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..807a7fbcf4a08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..a2427ae231c93
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc.png
new file mode 100644
index 0000000000000..b8f1405132b08
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..7cbed5efaf251
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..10facd5e677cd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd.png
new file mode 100644
index 0000000000000..b2b315a6838c9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..851ee25df414e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..fb6f377a8fbe5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe.png
new file mode 100644
index 0000000000000..b5a25be18c9c8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..e3d4cec6908f6
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..830fa1a72e31d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff.png
new file mode 100644
index 0000000000000..74e0500e7f932
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-fe0f-200d-2640-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-fe0f-200d-2640-fe0f.png
new file mode 100644
index 0000000000000..42df033036988
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-fe0f-200d-2640-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9-fe0f-200d-2642-fe0f.png b/Shared/CIPPSharp/bin/twemoji/26f9-fe0f-200d-2642-fe0f.png
new file mode 100644
index 0000000000000..122f3307259a2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9-fe0f-200d-2642-fe0f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26f9.png b/Shared/CIPPSharp/bin/twemoji/26f9.png
new file mode 100644
index 0000000000000..b7f7856204069
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26f9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26fa.png b/Shared/CIPPSharp/bin/twemoji/26fa.png
new file mode 100644
index 0000000000000..d8a0dbd39e672
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26fa.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/26fd.png b/Shared/CIPPSharp/bin/twemoji/26fd.png
new file mode 100644
index 0000000000000..8307de2e55573
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/26fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2702.png b/Shared/CIPPSharp/bin/twemoji/2702.png
new file mode 100644
index 0000000000000..ba94dc641870d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2702.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2705.png b/Shared/CIPPSharp/bin/twemoji/2705.png
new file mode 100644
index 0000000000000..0683c7ecf12ac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2705.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2708.png b/Shared/CIPPSharp/bin/twemoji/2708.png
new file mode 100644
index 0000000000000..6bffcd5a9652c
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2708.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2709.png b/Shared/CIPPSharp/bin/twemoji/2709.png
new file mode 100644
index 0000000000000..90023eb6858c5
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2709.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270a-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/270a-1f3fb.png
new file mode 100644
index 0000000000000..0b7aeb80428f8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270a-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270a-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/270a-1f3fc.png
new file mode 100644
index 0000000000000..14b14468f2179
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270a-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270a-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/270a-1f3fd.png
new file mode 100644
index 0000000000000..73ff6c977f550
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270a-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270a-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/270a-1f3fe.png
new file mode 100644
index 0000000000000..f2ae4eb0df321
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270a-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270a-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/270a-1f3ff.png
new file mode 100644
index 0000000000000..39e3a237da39f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270a-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270a.png b/Shared/CIPPSharp/bin/twemoji/270a.png
new file mode 100644
index 0000000000000..0e2291c261d82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270a.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270b-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/270b-1f3fb.png
new file mode 100644
index 0000000000000..b8a37846189bf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270b-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270b-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/270b-1f3fc.png
new file mode 100644
index 0000000000000..45c1a47426d82
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270b-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270b-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/270b-1f3fd.png
new file mode 100644
index 0000000000000..d1a826860bc7e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270b-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270b-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/270b-1f3fe.png
new file mode 100644
index 0000000000000..0a593055eea6f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270b-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270b-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/270b-1f3ff.png
new file mode 100644
index 0000000000000..d556c2a316623
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270b-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270b.png b/Shared/CIPPSharp/bin/twemoji/270b.png
new file mode 100644
index 0000000000000..ce49d6aef1d0a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270c-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/270c-1f3fb.png
new file mode 100644
index 0000000000000..3a69852347324
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270c-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270c-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/270c-1f3fc.png
new file mode 100644
index 0000000000000..488baf8bf67b8
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270c-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270c-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/270c-1f3fd.png
new file mode 100644
index 0000000000000..10a5746601679
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270c-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270c-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/270c-1f3fe.png
new file mode 100644
index 0000000000000..bf52c750e4451
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270c-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270c-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/270c-1f3ff.png
new file mode 100644
index 0000000000000..61f75f2d75739
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270c-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270c.png b/Shared/CIPPSharp/bin/twemoji/270c.png
new file mode 100644
index 0000000000000..5734f34918c65
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270d-1f3fb.png b/Shared/CIPPSharp/bin/twemoji/270d-1f3fb.png
new file mode 100644
index 0000000000000..a2f9d932ebd7b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270d-1f3fb.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270d-1f3fc.png b/Shared/CIPPSharp/bin/twemoji/270d-1f3fc.png
new file mode 100644
index 0000000000000..f9f6739061b3a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270d-1f3fc.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270d-1f3fd.png b/Shared/CIPPSharp/bin/twemoji/270d-1f3fd.png
new file mode 100644
index 0000000000000..0943238115d9f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270d-1f3fd.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270d-1f3fe.png b/Shared/CIPPSharp/bin/twemoji/270d-1f3fe.png
new file mode 100644
index 0000000000000..8252421f519fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270d-1f3fe.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270d-1f3ff.png b/Shared/CIPPSharp/bin/twemoji/270d-1f3ff.png
new file mode 100644
index 0000000000000..4214c3a152d74
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270d-1f3ff.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270d.png b/Shared/CIPPSharp/bin/twemoji/270d.png
new file mode 100644
index 0000000000000..86f753c3d2b73
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/270f.png b/Shared/CIPPSharp/bin/twemoji/270f.png
new file mode 100644
index 0000000000000..ae8bdbc285865
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/270f.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2712.png b/Shared/CIPPSharp/bin/twemoji/2712.png
new file mode 100644
index 0000000000000..e5d30fd605773
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2712.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2714.png b/Shared/CIPPSharp/bin/twemoji/2714.png
new file mode 100644
index 0000000000000..b63dce1d12ebd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2714.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2716.png b/Shared/CIPPSharp/bin/twemoji/2716.png
new file mode 100644
index 0000000000000..32c55aa9a2ae1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2716.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/271d.png b/Shared/CIPPSharp/bin/twemoji/271d.png
new file mode 100644
index 0000000000000..0755be4508145
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/271d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2721.png b/Shared/CIPPSharp/bin/twemoji/2721.png
new file mode 100644
index 0000000000000..149560071a542
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2721.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2728.png b/Shared/CIPPSharp/bin/twemoji/2728.png
new file mode 100644
index 0000000000000..ebd2c77b1de10
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2728.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2733.png b/Shared/CIPPSharp/bin/twemoji/2733.png
new file mode 100644
index 0000000000000..1f393dae535a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2733.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2734.png b/Shared/CIPPSharp/bin/twemoji/2734.png
new file mode 100644
index 0000000000000..83d31fafd2dc1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2734.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2744.png b/Shared/CIPPSharp/bin/twemoji/2744.png
new file mode 100644
index 0000000000000..ee53c868739f0
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2744.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2747.png b/Shared/CIPPSharp/bin/twemoji/2747.png
new file mode 100644
index 0000000000000..8a9731b97d234
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2747.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/274c.png b/Shared/CIPPSharp/bin/twemoji/274c.png
new file mode 100644
index 0000000000000..8347c7bad5ba3
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/274c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/274e.png b/Shared/CIPPSharp/bin/twemoji/274e.png
new file mode 100644
index 0000000000000..a96a67c92d2f9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/274e.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2753.png b/Shared/CIPPSharp/bin/twemoji/2753.png
new file mode 100644
index 0000000000000..1f337b221441e
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2753.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2754.png b/Shared/CIPPSharp/bin/twemoji/2754.png
new file mode 100644
index 0000000000000..a28b30475abae
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2754.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2755.png b/Shared/CIPPSharp/bin/twemoji/2755.png
new file mode 100644
index 0000000000000..0b173031e2d10
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2755.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2757.png b/Shared/CIPPSharp/bin/twemoji/2757.png
new file mode 100644
index 0000000000000..9c48a72739125
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2757.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2763.png b/Shared/CIPPSharp/bin/twemoji/2763.png
new file mode 100644
index 0000000000000..1e421bc9db219
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2763.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2764-fe0f-200d-1f525.png b/Shared/CIPPSharp/bin/twemoji/2764-fe0f-200d-1f525.png
new file mode 100644
index 0000000000000..36be1b8077545
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2764-fe0f-200d-1f525.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2764-fe0f-200d-1fa79.png b/Shared/CIPPSharp/bin/twemoji/2764-fe0f-200d-1fa79.png
new file mode 100644
index 0000000000000..b834e62ccb972
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2764-fe0f-200d-1fa79.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2764.png b/Shared/CIPPSharp/bin/twemoji/2764.png
new file mode 100644
index 0000000000000..a7511e97ae30a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2764.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2795.png b/Shared/CIPPSharp/bin/twemoji/2795.png
new file mode 100644
index 0000000000000..21d5a886d293b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2795.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2796.png b/Shared/CIPPSharp/bin/twemoji/2796.png
new file mode 100644
index 0000000000000..7779c9d3f0e2d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2796.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2797.png b/Shared/CIPPSharp/bin/twemoji/2797.png
new file mode 100644
index 0000000000000..1d2425eaff0a1
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2797.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/27a1.png b/Shared/CIPPSharp/bin/twemoji/27a1.png
new file mode 100644
index 0000000000000..1cf8b3d683d6d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/27a1.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/27b0.png b/Shared/CIPPSharp/bin/twemoji/27b0.png
new file mode 100644
index 0000000000000..71def8e1bdcdf
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/27b0.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/27bf.png b/Shared/CIPPSharp/bin/twemoji/27bf.png
new file mode 100644
index 0000000000000..e01c0c2dd6aba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/27bf.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2934.png b/Shared/CIPPSharp/bin/twemoji/2934.png
new file mode 100644
index 0000000000000..bafb601bb6e7d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2934.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2935.png b/Shared/CIPPSharp/bin/twemoji/2935.png
new file mode 100644
index 0000000000000..83466a0243f2b
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2935.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2a-20e3.png b/Shared/CIPPSharp/bin/twemoji/2a-20e3.png
new file mode 100644
index 0000000000000..8944081e47d61
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2a-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2b05.png b/Shared/CIPPSharp/bin/twemoji/2b05.png
new file mode 100644
index 0000000000000..03c7d3af48681
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2b05.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2b06.png b/Shared/CIPPSharp/bin/twemoji/2b06.png
new file mode 100644
index 0000000000000..4f2a41102139f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2b06.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2b07.png b/Shared/CIPPSharp/bin/twemoji/2b07.png
new file mode 100644
index 0000000000000..cbb200dadc88f
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2b07.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2b1b.png b/Shared/CIPPSharp/bin/twemoji/2b1b.png
new file mode 100644
index 0000000000000..1ea0e3ec7ef86
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2b1b.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2b1c.png b/Shared/CIPPSharp/bin/twemoji/2b1c.png
new file mode 100644
index 0000000000000..5f76e52ee332d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2b1c.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2b50.png b/Shared/CIPPSharp/bin/twemoji/2b50.png
new file mode 100644
index 0000000000000..0590867e07d28
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2b50.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/2b55.png b/Shared/CIPPSharp/bin/twemoji/2b55.png
new file mode 100644
index 0000000000000..8106cde2605e4
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/2b55.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/30-20e3.png b/Shared/CIPPSharp/bin/twemoji/30-20e3.png
new file mode 100644
index 0000000000000..f0d5615acfeec
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/30-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/3030.png b/Shared/CIPPSharp/bin/twemoji/3030.png
new file mode 100644
index 0000000000000..8e74f9b895c03
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/3030.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/303d.png b/Shared/CIPPSharp/bin/twemoji/303d.png
new file mode 100644
index 0000000000000..1a47aff64f4d9
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/303d.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/31-20e3.png b/Shared/CIPPSharp/bin/twemoji/31-20e3.png
new file mode 100644
index 0000000000000..3836e2c3e4476
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/31-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/32-20e3.png b/Shared/CIPPSharp/bin/twemoji/32-20e3.png
new file mode 100644
index 0000000000000..dbb85d1f9962a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/32-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/3297.png b/Shared/CIPPSharp/bin/twemoji/3297.png
new file mode 100644
index 0000000000000..ac83914e0a16d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/3297.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/3299.png b/Shared/CIPPSharp/bin/twemoji/3299.png
new file mode 100644
index 0000000000000..c9e9e27f0a21d
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/3299.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/33-20e3.png b/Shared/CIPPSharp/bin/twemoji/33-20e3.png
new file mode 100644
index 0000000000000..4b77c2d792aac
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/33-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/34-20e3.png b/Shared/CIPPSharp/bin/twemoji/34-20e3.png
new file mode 100644
index 0000000000000..ddbb5559ca41a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/34-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/35-20e3.png b/Shared/CIPPSharp/bin/twemoji/35-20e3.png
new file mode 100644
index 0000000000000..6bf88f6a59cc7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/35-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/36-20e3.png b/Shared/CIPPSharp/bin/twemoji/36-20e3.png
new file mode 100644
index 0000000000000..cf16307eb46e2
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/36-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/37-20e3.png b/Shared/CIPPSharp/bin/twemoji/37-20e3.png
new file mode 100644
index 0000000000000..308e89ca0a9fd
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/37-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/38-20e3.png b/Shared/CIPPSharp/bin/twemoji/38-20e3.png
new file mode 100644
index 0000000000000..34f098df014ba
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/38-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/39-20e3.png b/Shared/CIPPSharp/bin/twemoji/39-20e3.png
new file mode 100644
index 0000000000000..df6e1161d66db
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/39-20e3.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/ATTRIBUTION.txt b/Shared/CIPPSharp/bin/twemoji/ATTRIBUTION.txt
new file mode 100644
index 0000000000000..a3584ef88aa24
--- /dev/null
+++ b/Shared/CIPPSharp/bin/twemoji/ATTRIBUTION.txt
@@ -0,0 +1,409 @@
+Twemoji colour emoji graphics
+=============================
+
+The PNG files in this directory are Twemoji (https://github.com/jdecked/twemoji),
+the maintained community fork of Twitter's open-source emoji set. The CIPP
+server-side PDF renderer places them as inline colour images so reports show
+colour emoji (the standard PDF fonts and font embedding are monochrome-only).
+
+Graphics licence: CC-BY 4.0.
+Attribution: "Twemoji" by Twitter, Inc. and other contributors, licensed under
+CC-BY 4.0 (https://creativecommons.org/licenses/by/4.0/).
+
+Only the 72x72 PNG assets are bundled; the Twemoji JavaScript (MIT) is not used.
+The full CC-BY 4.0 licence text follows.
+
+
+Attribution 4.0 International
+
+=======================================================================
+
+Creative Commons Corporation ("Creative Commons") is not a law firm and
+does not provide legal services or legal advice. Distribution of
+Creative Commons public licenses does not create a lawyer-client or
+other relationship. Creative Commons makes its licenses and related
+information available on an "as-is" basis. Creative Commons gives no
+warranties regarding its licenses, any material licensed under their
+terms and conditions, or any related information. Creative Commons
+disclaims all liability for damages resulting from their use to the
+fullest extent possible.
+
+Using Creative Commons Public Licenses
+
+Creative Commons public licenses provide a standard set of terms and
+conditions that creators and other rights holders may use to share
+original works of authorship and other material subject to copyright
+and certain other rights specified in the public license below. The
+following considerations are for informational purposes only, are not
+exhaustive, and do not form part of our licenses.
+
+     Considerations for licensors: Our public licenses are
+     intended for use by those authorized to give the public
+     permission to use material in ways otherwise restricted by
+     copyright and certain other rights. Our licenses are
+     irrevocable. Licensors should read and understand the terms
+     and conditions of the license they choose before applying it.
+     Licensors should also secure all rights necessary before
+     applying our licenses so that the public can reuse the
+     material as expected. Licensors should clearly mark any
+     material not subject to the license. This includes other CC-
+     licensed material, or material used under an exception or
+     limitation to copyright. More considerations for licensors:
+	wiki.creativecommons.org/Considerations_for_licensors
+
+     Considerations for the public: By using one of our public
+     licenses, a licensor grants the public permission to use the
+     licensed material under specified terms and conditions. If
+     the licensor's permission is not necessary for any reason--for
+     example, because of any applicable exception or limitation to
+     copyright--then that use is not regulated by the license. Our
+     licenses grant only permissions under copyright and certain
+     other rights that a licensor has authority to grant. Use of
+     the licensed material may still be restricted for other
+     reasons, including because others have copyright or other
+     rights in the material. A licensor may make special requests,
+     such as asking that all changes be marked or described.
+     Although not required by our licenses, you are encouraged to
+     respect those requests where reasonable. More_considerations
+     for the public: 
+	wiki.creativecommons.org/Considerations_for_licensees
+
+=======================================================================
+
+Creative Commons Attribution 4.0 International Public License
+
+By exercising the Licensed Rights (defined below), You accept and agree
+to be bound by the terms and conditions of this Creative Commons
+Attribution 4.0 International Public License ("Public License"). To the
+extent this Public License may be interpreted as a contract, You are
+granted the Licensed Rights in consideration of Your acceptance of
+these terms and conditions, and the Licensor grants You such rights in
+consideration of benefits the Licensor receives from making the
+Licensed Material available under these terms and conditions.
+
+
+Section 1 -- Definitions.
+
+  a. Adapted Material means material subject to Copyright and Similar
+     Rights that is derived from or based upon the Licensed Material
+     and in which the Licensed Material is translated, altered,
+     arranged, transformed, or otherwise modified in a manner requiring
+     permission under the Copyright and Similar Rights held by the
+     Licensor. For purposes of this Public License, where the Licensed
+     Material is a musical work, performance, or sound recording,
+     Adapted Material is always produced where the Licensed Material is
+     synched in timed relation with a moving image.
+
+  b. Adapter's License means the license You apply to Your Copyright
+     and Similar Rights in Your contributions to Adapted Material in
+     accordance with the terms and conditions of this Public License.
+
+  c. Copyright and Similar Rights means copyright and/or similar rights
+     closely related to copyright including, without limitation,
+     performance, broadcast, sound recording, and Sui Generis Database
+     Rights, without regard to how the rights are labeled or
+     categorized. For purposes of this Public License, the rights
+     specified in Section 2(b)(1)-(2) are not Copyright and Similar
+     Rights.
+
+  d. Effective Technological Measures means those measures that, in the
+     absence of proper authority, may not be circumvented under laws
+     fulfilling obligations under Article 11 of the WIPO Copyright
+     Treaty adopted on December 20, 1996, and/or similar international
+     agreements.
+
+  e. Exceptions and Limitations means fair use, fair dealing, and/or
+     any other exception or limitation to Copyright and Similar Rights
+     that applies to Your use of the Licensed Material.
+
+  f. Licensed Material means the artistic or literary work, database,
+     or other material to which the Licensor applied this Public
+     License.
+
+  g. Licensed Rights means the rights granted to You subject to the
+     terms and conditions of this Public License, which are limited to
+     all Copyright and Similar Rights that apply to Your use of the
+     Licensed Material and that the Licensor has authority to license.
+
+  h. Licensor means the individual(s) or entity(ies) granting rights
+     under this Public License.
+
+  i. Share means to provide material to the public by any means or
+     process that requires permission under the Licensed Rights, such
+     as reproduction, public display, public performance, distribution,
+     dissemination, communication, or importation, and to make material
+     available to the public including in ways that members of the
+     public may access the material from a place and at a time
+     individually chosen by them.
+
+  j. Sui Generis Database Rights means rights other than copyright
+     resulting from Directive 96/9/EC of the European Parliament and of
+     the Council of 11 March 1996 on the legal protection of databases,
+     as amended and/or succeeded, as well as other essentially
+     equivalent rights anywhere in the world.
+
+  k. You means the individual or entity exercising the Licensed Rights
+     under this Public License. Your has a corresponding meaning.
+
+
+Section 2 -- Scope.
+
+  a. License grant.
+
+       1. Subject to the terms and conditions of this Public License,
+          the Licensor hereby grants You a worldwide, royalty-free,
+          non-sublicensable, non-exclusive, irrevocable license to
+          exercise the Licensed Rights in the Licensed Material to:
+
+            a. reproduce and Share the Licensed Material, in whole or
+               in part; and
+
+            b. produce, reproduce, and Share Adapted Material.
+
+       2. Exceptions and Limitations. For the avoidance of doubt, where
+          Exceptions and Limitations apply to Your use, this Public
+          License does not apply, and You do not need to comply with
+          its terms and conditions.
+
+       3. Term. The term of this Public License is specified in Section
+          6(a).
+
+       4. Media and formats; technical modifications allowed. The
+          Licensor authorizes You to exercise the Licensed Rights in
+          all media and formats whether now known or hereafter created,
+          and to make technical modifications necessary to do so. The
+          Licensor waives and/or agrees not to assert any right or
+          authority to forbid You from making technical modifications
+          necessary to exercise the Licensed Rights, including
+          technical modifications necessary to circumvent Effective
+          Technological Measures. For purposes of this Public License,
+          simply making modifications authorized by this Section 2(a)
+          (4) never produces Adapted Material.
+
+       5. Downstream recipients.
+
+            a. Offer from the Licensor -- Licensed Material. Every
+               recipient of the Licensed Material automatically
+               receives an offer from the Licensor to exercise the
+               Licensed Rights under the terms and conditions of this
+               Public License.
+
+            b. No downstream restrictions. You may not offer or impose
+               any additional or different terms or conditions on, or
+               apply any Effective Technological Measures to, the
+               Licensed Material if doing so restricts exercise of the
+               Licensed Rights by any recipient of the Licensed
+               Material.
+
+       6. No endorsement. Nothing in this Public License constitutes or
+          may be construed as permission to assert or imply that You
+          are, or that Your use of the Licensed Material is, connected
+          with, or sponsored, endorsed, or granted official status by,
+          the Licensor or others designated to receive attribution as
+          provided in Section 3(a)(1)(A)(i).
+
+  b. Other rights.
+
+       1. Moral rights, such as the right of integrity, are not
+          licensed under this Public License, nor are publicity,
+          privacy, and/or other similar personality rights; however, to
+          the extent possible, the Licensor waives and/or agrees not to
+          assert any such rights held by the Licensor to the limited
+          extent necessary to allow You to exercise the Licensed
+          Rights, but not otherwise.
+
+       2. Patent and trademark rights are not licensed under this
+          Public License.
+
+       3. To the extent possible, the Licensor waives any right to
+          collect royalties from You for the exercise of the Licensed
+          Rights, whether directly or through a collecting society
+          under any voluntary or waivable statutory or compulsory
+          licensing scheme. In all other cases the Licensor expressly
+          reserves any right to collect such royalties.
+
+
+Section 3 -- License Conditions.
+
+Your exercise of the Licensed Rights is expressly made subject to the
+following conditions.
+
+  a. Attribution.
+
+       1. If You Share the Licensed Material (including in modified
+          form), You must:
+
+            a. retain the following if it is supplied by the Licensor
+               with the Licensed Material:
+
+                 i. identification of the creator(s) of the Licensed
+                    Material and any others designated to receive
+                    attribution, in any reasonable manner requested by
+                    the Licensor (including by pseudonym if
+                    designated);
+
+                ii. a copyright notice;
+
+               iii. a notice that refers to this Public License;
+
+                iv. a notice that refers to the disclaimer of
+                    warranties;
+
+                 v. a URI or hyperlink to the Licensed Material to the
+                    extent reasonably practicable;
+
+            b. indicate if You modified the Licensed Material and
+               retain an indication of any previous modifications; and
+
+            c. indicate the Licensed Material is licensed under this
+               Public License, and include the text of, or the URI or
+               hyperlink to, this Public License.
+
+       2. You may satisfy the conditions in Section 3(a)(1) in any
+          reasonable manner based on the medium, means, and context in
+          which You Share the Licensed Material. For example, it may be
+          reasonable to satisfy the conditions by providing a URI or
+          hyperlink to a resource that includes the required
+          information.
+
+       3. If requested by the Licensor, You must remove any of the
+          information required by Section 3(a)(1)(A) to the extent
+          reasonably practicable.
+
+       4. If You Share Adapted Material You produce, the Adapter's
+          License You apply must not prevent recipients of the Adapted
+          Material from complying with this Public License.
+
+
+Section 4 -- Sui Generis Database Rights.
+
+Where the Licensed Rights include Sui Generis Database Rights that
+apply to Your use of the Licensed Material:
+
+  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
+     to extract, reuse, reproduce, and Share all or a substantial
+     portion of the contents of the database;
+
+  b. if You include all or a substantial portion of the database
+     contents in a database in which You have Sui Generis Database
+     Rights, then the database in which You have Sui Generis Database
+     Rights (but not its individual contents) is Adapted Material; and
+
+  c. You must comply with the conditions in Section 3(a) if You Share
+     all or a substantial portion of the contents of the database.
+
+For the avoidance of doubt, this Section 4 supplements and does not
+replace Your obligations under this Public License where the Licensed
+Rights include other Copyright and Similar Rights.
+
+
+Section 5 -- Disclaimer of Warranties and Limitation of Liability.
+
+  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
+     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
+     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
+     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
+     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
+     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
+     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
+     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
+     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
+
+  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
+     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
+     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
+     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
+     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
+     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
+     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
+     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
+     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
+
+  c. The disclaimer of warranties and limitation of liability provided
+     above shall be interpreted in a manner that, to the extent
+     possible, most closely approximates an absolute disclaimer and
+     waiver of all liability.
+
+
+Section 6 -- Term and Termination.
+
+  a. This Public License applies for the term of the Copyright and
+     Similar Rights licensed here. However, if You fail to comply with
+     this Public License, then Your rights under this Public License
+     terminate automatically.
+
+  b. Where Your right to use the Licensed Material has terminated under
+     Section 6(a), it reinstates:
+
+       1. automatically as of the date the violation is cured, provided
+          it is cured within 30 days of Your discovery of the
+          violation; or
+
+       2. upon express reinstatement by the Licensor.
+
+     For the avoidance of doubt, this Section 6(b) does not affect any
+     right the Licensor may have to seek remedies for Your violations
+     of this Public License.
+
+  c. For the avoidance of doubt, the Licensor may also offer the
+     Licensed Material under separate terms or conditions or stop
+     distributing the Licensed Material at any time; however, doing so
+     will not terminate this Public License.
+
+  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
+     License.
+
+
+Section 7 -- Other Terms and Conditions.
+
+  a. The Licensor shall not be bound by any additional or different
+     terms or conditions communicated by You unless expressly agreed.
+
+  b. Any arrangements, understandings, or agreements regarding the
+     Licensed Material not stated herein are separate from and
+     independent of the terms and conditions of this Public License.
+
+
+Section 8 -- Interpretation.
+
+  a. For the avoidance of doubt, this Public License does not, and
+     shall not be interpreted to, reduce, limit, restrict, or impose
+     conditions on any use of the Licensed Material that could lawfully
+     be made without permission under this Public License.
+
+  b. To the extent possible, if any provision of this Public License is
+     deemed unenforceable, it shall be automatically reformed to the
+     minimum extent necessary to make it enforceable. If the provision
+     cannot be reformed, it shall be severed from this Public License
+     without affecting the enforceability of the remaining terms and
+     conditions.
+
+  c. No term or condition of this Public License will be waived and no
+     failure to comply consented to unless expressly agreed to by the
+     Licensor.
+
+  d. Nothing in this Public License constitutes or may be interpreted
+     as a limitation upon, or waiver of, any privileges and immunities
+     that apply to the Licensor or You, including from the legal
+     processes of any jurisdiction or authority.
+
+
+=======================================================================
+
+Creative Commons is not a party to its public licenses.
+Notwithstanding, Creative Commons may elect to apply one of its public
+licenses to material it publishes and in those instances will be
+considered the "Licensor." Except for the limited purpose of indicating
+that material is shared under a Creative Commons public license or as
+otherwise permitted by the Creative Commons policies published at
+creativecommons.org/policies, Creative Commons does not authorize the
+use of the trademark "Creative Commons" or any other trademark or logo
+of Creative Commons without its prior written consent including,
+without limitation, in connection with any unauthorized modifications
+to any of its public licenses or any other arrangements,
+understandings, or agreements concerning use of licensed material. For
+the avoidance of doubt, this paragraph does not form part of the public
+licenses.
+
+Creative Commons may be contacted at creativecommons.org.
diff --git a/Shared/CIPPSharp/bin/twemoji/a9.png b/Shared/CIPPSharp/bin/twemoji/a9.png
new file mode 100644
index 0000000000000..db8ce8aed8796
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/a9.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/ae.png b/Shared/CIPPSharp/bin/twemoji/ae.png
new file mode 100644
index 0000000000000..76dec323b05f7
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/ae.png differ
diff --git a/Shared/CIPPSharp/bin/twemoji/e50a.png b/Shared/CIPPSharp/bin/twemoji/e50a.png
new file mode 100644
index 0000000000000..898209d50560a
Binary files /dev/null and b/Shared/CIPPSharp/bin/twemoji/e50a.png differ
diff --git a/Shared/CIPPSharp/lib/OfficeIMO.Core.dll b/Shared/CIPPSharp/lib/OfficeIMO.Core.dll
new file mode 100644
index 0000000000000..d5f32f8e633f4
Binary files /dev/null and b/Shared/CIPPSharp/lib/OfficeIMO.Core.dll differ
diff --git a/Shared/CIPPSharp/lib/OfficeIMO.Pdf.dll b/Shared/CIPPSharp/lib/OfficeIMO.Pdf.dll
new file mode 100644
index 0000000000000..744c438e0b72a
Binary files /dev/null and b/Shared/CIPPSharp/lib/OfficeIMO.Pdf.dll differ
diff --git a/Tests/ActivityTriggers/Push-BECRun.Tests.ps1 b/Tests/ActivityTriggers/Push-BECRun.Tests.ps1
new file mode 100644
index 0000000000000..9fc4a152382fe
--- /dev/null
+++ b/Tests/ActivityTriggers/Push-BECRun.Tests.ps1
@@ -0,0 +1,393 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    # The shipped heuristics and malicious-app catalog are read through $env:CIPPRootPath.
+    $env:CIPPRootPath = $RepoRoot
+
+    # Platform helpers the run calls; each is a stub so Mock has something to replace.
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor, $Select, $useSystemMailbox, $NoAuthCheck, [switch]$Compliance, $ApiVersion, [switch]$AsApp) }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination, $scope, $ComplexFilter, $NoAuthCheck, [switch]$verbose) }
+    function New-GraphBulkRequest { param($Requests, $tenantid, $asapp, $NoAuthCheck, $scope, $NoPaginateIds, $Version, $Headers) }
+    function Get-CIPPTenantCapabilities { param($TenantFilter, $APIName, $Headers) }
+    function Get-CIPPGeoIPLocationBatch { param([string[]]$IPs) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    function Get-NormalizedError { param($message) $message }
+    function Set-CippBecCaseContext { param($CaseId) }
+    function Set-CIPPBecReport { param($TenantFilter, $CaseId, $Properties, $Results, [switch]$Replace) }
+    # Live progress (the async-deployment rows the page polls)
+    function Get-CIPPAsyncDeployment { param($JobId) }
+    function New-CIPPAsyncDeployment { param($JobId, $Names, $StepTitles, $Source, $TenantFilter) $JobId }
+    function Set-CIPPAsyncDeploymentStatus { param($JobId, $Name, $Status, $Logs) }
+    function Set-CIPPAsyncDeploymentStep { param($JobId, $Name, $StepIndex, $StepStatus, $Message) }
+    function Search-CIPPBecAuditLog { param($TenantFilter, $StartDate, $EndDate, $Operations, $UserIds, $RecordType, $ObjectIds, $Anchor, $PageSize, $MaxPages) }
+    function Get-CIPPBecMessageTrace { param($TenantFilter, $SenderAddress, $RecipientAddress, $StartDate, $EndDate, $Anchor, $PageSize, $MaxPages) }
+    # Full-scope collectors
+    function Get-CIPPBecMailboxInventory { param($TenantFilter, $UserPrincipalName, $Heuristics, $AcceptedDomains) }
+    function Get-CIPPBecUserGrants { param($TenantFilter, $UserId, $Heuristics, $RogueAppFeed) }
+    function Get-CIPPBecTransportRules { param($TenantFilter, $StartDate, $EndDate, $Heuristics, $Anchor) }
+    function Get-CIPPBecReceivedMailFindings { param($TenantFilter, $UserPrincipalName, $StartDate, $EndDate, $Heuristics, $AcceptedDomains, $Anchor, [switch]$IncludeDefender) }
+    function Get-CIPPBecDirectoryAudits { param($TenantFilter, $UserId, $StartDate, $Heuristics, $Cap) }
+    function Get-CIPPBecRegisteredDevices { param($TenantFilter, $UserId, $StartDate) }
+    function Get-CIPPBecNonInteractiveSignIns { param($TenantFilter, $UserId, $UsageLocation, $StartDate) }
+    function Get-CIPPBecMailActivity { param($TenantFilter, $UserPrincipalName, $StartDate, $EndDate, $Heuristics, $Anchor) }
+    function Get-CIPPBecRiskState { param($TenantFilter, $UserId, $StartDate, $Cap) }
+    function Get-CIPPBecRogueAppFeed { }
+    function Get-CIPPPartnerUserLookup { @{} }
+    # The IP analysis has its own suite; here it only has to be wired in and its verdicts stamped.
+    function Get-CIPPBecAttackerActivity { param($TenantFilter, $UserPrincipalName, $StartDate, $EndDate, $Heuristics, $Verdicts, $SignIns, $NonInteractiveSignIns, $MailRecords, $SharingChanges, $KnownSubjects, $Anchor) }
+    function Get-CIPPBecDelegatedAccess { param($TenantFilter, $UserPrincipalName, $UserDisplayName, $PermissionChanges, $MailActivity, $AttackerMail) }
+    function Get-CIPPBecBlastRadius { param($TenantFilter, $UserId, $UserPrincipalName, $Verdicts, $Peers, $StartDate, $EndDate, $Heuristics, $Anchor) }
+    function Invoke-CIPPBecIPAnalysis { param($TenantFilter, $UserId, $UserPrincipalName, $Results, $Heuristics, $WindowStart, $UsageLocation, $Anchor, $Baseline, $KnownPeers, $Overrides, $ExtraPeers, $TechnicianIPs, [switch]$SampleColleagues) }
+
+    # Real pieces under test alongside the run
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/AuditLogs/Resolve-CIPPAuditActor.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCaseId.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecScore.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecRunSteps.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecErrorInfo.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Set-CIPPBecIPVerdictStamp.ps1')
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Push-BECRun.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function Empty { New-CIPPBecCollectorResult -Data @() }
+    $script:Item = @{ TenantFilter = 'contoso.com'; UserID = 'user-guid'; userName = 'victim@contoso.com'; CaseId = 'BEC-20260820120000-test01' }
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Push-BECRun' {
+    BeforeEach {
+        $script:Saved = $null
+        # the last write wins: the run writes Running first, then Completed or Error
+        Mock Set-CIPPBecReport { $script:Saved = @{ TenantFilter = $TenantFilter; CaseId = $CaseId; Properties = $Properties; Results = $Results } }
+        $script:StepCalls = [System.Collections.Generic.List[object]]::new()
+        Mock Set-CIPPAsyncDeploymentStep { $script:StepCalls.Add(@{ JobId = $JobId; Name = $Name; Index = $StepIndex; Status = $StepStatus; Message = $Message }) }
+        $script:StatusCalls = [System.Collections.Generic.List[object]]::new()
+        Mock Set-CIPPAsyncDeploymentStatus { $script:StatusCalls.Add(@{ JobId = $JobId; Name = $Name; Status = $Status; Logs = $Logs }) }
+        Mock Get-CIPPAsyncDeployment { @() }
+        Mock New-CIPPAsyncDeployment { $JobId }
+        Mock Write-LogMessage { }
+        Mock Set-CippBecCaseContext { }
+        Mock Get-CIPPGeoIPLocationBatch { @{ '203.0.113.10' = [pscustomobject]@{ CountryOrRegion = 'NG'; City = 'Lagos' } } }
+        Mock New-ExoRequest {
+            switch ($cmdlet) {
+                'Get-AdminAuditLogConfig' { [pscustomobject]@{ UnifiedAuditLogIngestionEnabled = $true } }
+                'Get-InboxRule' { [pscustomobject]@{ Name = 'Hide invoices'; Identity = 'r1'; Enabled = $true; MoveToFolder = 'RSS Feeds'; MarkAsRead = $true; Description = 'x' }, [pscustomobject]@{ Name = 'Junk E-Mail Rule'; Identity = 'junk' } }
+                'Get-MailboxJunkEmailConfiguration' { [pscustomobject]@{ TrustedSendersAndDomains = @('partner@example.org'); BlockedSendersAndDomains = @() } }
+                'Get-AcceptedDomain' { [pscustomobject]@{ DomainName = 'contoso.com' }, [pscustomobject]@{ DomainName = 'contoso.onmicrosoft.com' } }
+                default { @() }
+            }
+        }
+        Mock Search-CIPPBecAuditLog {
+            if ($Operations -contains 'New-InboxRule') {
+                [pscustomobject]@{ Complete = $true; Cap = $null; Pages = 1; Records = @([pscustomobject]@{ Identity = 'a1'; Operation = 'New-InboxRule'; AuditData = [pscustomobject]@{ Operation = 'New-InboxRule'; UserId = 'victim@contoso.com'; CreationTime = '2026-08-19T01:00:00Z'; ClientIP = '203.0.113.10:51234'; ObjectId = 'victim@contoso.com\Hide invoices'; Parameters = @([pscustomobject]@{ Name = 'Name'; Value = 'Hide invoices' }, [pscustomobject]@{ Name = 'MoveToFolder'; Value = 'RSS Feeds' }) } }) }
+            } elseif ($Operations -contains 'Add-MailboxPermission') {
+                # one grant on the investigated mailbox (the delegation join below picks it up), page cap hit
+                [pscustomobject]@{ Complete = $false; Cap = '10 pages of 5000 records'; Pages = 10; Records = @([pscustomobject]@{ Identity = 'p1'; Operation = 'Add-MailboxPermission'; AuditData = [pscustomobject]@{ Operation = 'Add-MailboxPermission'; UserKey = 'admin@contoso.com'; CreationTime = '2026-08-19T05:00:00Z'; ClientIP = '203.0.113.10'; ObjectId = 'contoso.onmicrosoft.com/Users/Victim'; Parameters = @([pscustomobject]@{ Name = 'Identity'; Value = 'victim@contoso.com' }, [pscustomobject]@{ Name = 'User'; Value = 'helper@contoso.com' }, [pscustomobject]@{ Name = 'AccessRights'; Value = 'FullAccess' }) } }) }
+            } else {
+                [pscustomobject]@{ Complete = $true; Cap = $null; Pages = 1; Records = @() }
+            }
+        }
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Complete = $true; Cap = $null; Pages = 1; Rows = @([pscustomobject]@{ MessageTraceId = 't1'; Status = 'Delivered'; Subject = 'Hi'; RecipientAddress = 'a@example.org'; Received = '2026-08-19T02:00:00Z'; FromIP = '203.0.113.10' }) } }
+        # Eligible tenant: Entra ID P2, Defender for Office 365 Plan 2 and Intune present, so the
+        # licence preflight lets Identity Protection, Defender and the device query run.
+        Mock Get-CIPPTenantCapabilities { [pscustomobject]@{ AAD_PREMIUM_P2 = $true; THREAT_INTELLIGENCE = $true; INTUNE_A = $true } }
+        Mock New-GraphGetRequest {
+            if ($uri -like '*signIns*') {
+                [pscustomobject]@{ id = 's1'; createdDateTime = '2026-08-19T03:00:00Z'; resourceDisplayName = 'Office 365 Exchange Online'; clientAppUsed = 'Browser'; conditionalAccessStatus = 'success'; status = [pscustomobject]@{ errorCode = 0 }; ipAddress = '203.0.113.10'; location = [pscustomobject]@{ countryOrRegion = 'NG'; city = 'Lagos' } }
+            } else { @() }
+        }
+        Mock New-GraphBulkRequest {
+            foreach ($Request in $Requests) {
+                switch -Wildcard ($Request.id) {
+                    'Users' { [pscustomobject]@{ id = 'Users'; status = 200; body = [pscustomobject]@{ value = @([pscustomobject]@{ id = 'user-guid'; displayName = 'Victim'; userPrincipalName = 'victim@contoso.com'; createdDateTime = '2025-01-01T00:00:00Z'; lastPasswordChangeDateTime = '2025-01-01T00:00:00Z' }, [pscustomobject]@{ id = '1b4e28ba-2fa1-11d2-883f-0016d3cca427'; displayName = 'Assistant'; userPrincipalName = 'assistant@contoso.com'; createdDateTime = '2025-01-01T00:00:00Z'; lastPasswordChangeDateTime = '2025-01-01T00:00:00Z' }) } } }
+                    # createdDateTime is relative to now: the score's RecentMfaMethods signal only counts a method registered inside the (live-anchored) analysis window, so a fixed date would age out and silently drop 2 points from the expected score.
+                    'MFADevices' { [pscustomobject]@{ id = 'MFADevices'; status = 200; body = [pscustomobject]@{ value = @([pscustomobject]@{ '@odata.type' = '#microsoft.graph.microsoftAuthenticatorAuthenticationMethod'; id = 'm1'; displayName = 'Pixel'; createdDateTime = (Get-Date).ToUniversalTime().AddDays(-1).ToString('yyyy-MM-ddTHH:mm:ssZ') }) } } }
+                    'NewSPs' { [pscustomobject]@{ id = 'NewSPs'; status = 200; body = [pscustomobject]@{ value = @() } } }
+                    'IntuneDevices' { [pscustomobject]@{ id = 'IntuneDevices'; status = 403; body = [pscustomobject]@{ error = [pscustomobject]@{ message = 'No Intune licence' } } } }
+                    'SuspectUser' { [pscustomobject]@{ id = 'SuspectUser'; status = 200; body = [pscustomobject]@{ id = 'user-guid'; displayName = 'Victim'; userPrincipalName = 'victim@contoso.com'; usageLocation = 'NL'; country = 'Netherlands' } } }
+                    'MaliciousSPs*' { [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ value = @() } } }
+                }
+            }
+        }
+        Mock Get-CIPPBecMailboxInventory { [pscustomobject]@{ MailboxState = (New-CIPPBecCollectorResult -Data ([pscustomobject]@{ HasForwarding = $true; ForwardingSmtpAddress = 'smtp:x@example.org' }) -Count 1); Delegations = (New-CIPPBecCollectorResult -Data @([pscustomobject]@{ PermissionType = 'FullAccess'; Trustee = 'outsider@example.org'; Flagged = $true }, [pscustomobject]@{ PermissionType = 'FullAccess'; Trustee = 'Helper@contoso.com'; Flagged = $false }, [pscustomobject]@{ PermissionType = 'SendOnBehalf'; Trustee = '1b4e28ba-2fa1-11d2-883f-0016d3cca427'; Flagged = $false })); AddIns = (Empty) } }
+        Mock Get-CIPPBecUserGrants { New-CIPPBecCollectorResult -Data @([pscustomobject]@{ Id = 'g1'; Risk = 'CatalogMatch'; Flagged = $true }) }
+        Mock Get-CIPPBecTransportRules { [pscustomobject]@{ Changes = (New-CIPPBecCollectorResult -Data @([pscustomobject]@{ Operation = 'New-TransportRule'; RuleName = 'Exfil'; ClientIP = '203.0.113.10'; Flagged = $true })); Flagged = (Empty) } }
+        Mock Get-CIPPBecReceivedMailFindings { [pscustomobject]@{ Findings = (Empty); Defender = (New-CIPPBecCollectorResult -Data @() -Error 'Invalid subscription') } }
+        Mock Get-CIPPBecDirectoryAudits { Empty }
+        Mock Get-CIPPBecRegisteredDevices { Empty }
+        Mock Get-CIPPBecNonInteractiveSignIns { Empty }
+        Mock Invoke-CIPPBecIPAnalysis {
+            $script:IPAnalysisInput = $Results
+            $script:IPAnalysisTechnicians = $TechnicianIPs
+            [pscustomobject]@{
+                Baseline    = New-CIPPBecCollectorResult -Data ([pscustomobject]@{ Successful = 12 }) -Count 12
+                Guidance    = New-CIPPBecCollectorResult -Data @()
+                PeersResult = New-CIPPBecCollectorResult -Data @()
+                Peers       = @{}
+                Geo         = @{}
+                Verdicts    = @([pscustomobject]@{ IP = '203.0.113.10'; Verdict = 'LikelyAttacker'; SuccessfulSignIns = 1; Activities = 2 })
+                Events      = @()
+            }
+        }
+        Mock Get-CIPPBecAttackerActivity {
+            $script:AttackerInput = @{ Verdicts = $Verdicts; MailRecords = $MailRecords; KnownSubjects = $KnownSubjects }
+            $Mail = New-CIPPBecCollectorResult -Data @([pscustomobject]@{ Operation = 'MailItemsAccessed'; Subject = 'Wire details'; IPVerdict = 'LikelyAttacker'; MailboxOwner = 'victim@contoso.com' })
+            $Mail | Add-Member -NotePropertyName Summary -NotePropertyValue ([pscustomobject]@{ MessagesOpened = 1 }) -Force
+            $Forms = New-CIPPBecCollectorResult -Data @()
+            $Forms | Add-Member -NotePropertyName Summary -NotePropertyValue ([pscustomobject]@{ FlaggedActions = 0; Forms = @() }) -Force
+            [pscustomobject]@{ Mail = $Mail; Files = (Empty); LinkUsage = (Empty); Forms = $Forms; Subjects = $null }
+        }
+        Mock Get-CIPPBecDelegatedAccess { New-CIPPBecCollectorResult -Data @([pscustomobject]@{ Mailbox = 'ceo@contoso.com'; Flagged = $false }) }
+        Mock Get-CIPPBecBlastRadius { $script:BlastPeers = $Peers; New-CIPPBecCollectorResult -Data @([pscustomobject]@{ UserPrincipalName = 'cfo@contoso.com'; Reached = $false }) }
+        Mock Get-CIPPBecMailActivity { $R = Empty; $R | Add-Member -NotePropertyName Summary -NotePropertyValue ([pscustomobject]@{ HardDeleteExceeded = $false }) -Force; $R }
+        Mock Get-CIPPBecRiskState { New-CIPPBecCollectorResult -Data ([pscustomobject]@{ Listed = $false; Detections = @() }) -Count 0 }
+        Mock Get-CIPPBecRogueAppFeed { [pscustomobject]@{ Apps = @{}; HuntressAvailable = $false } }
+        Mock Get-CIPPPartnerUserLookup { @{ '0123abcd-4567-4890-8abc-def012345678' = @{ userPrincipalName = 'tech@msp.example' } } }
+    }
+
+    It 'runs every collector (a legacy Scope on the queue item is ignored), flattens their data and scores the signals' {
+        Push-BECRun -Item ($script:Item + @{ Scope = 'Quick'; RequestedFromIP = '192.0.2.77'; RequestedBy = 'tech@msp.com' })
+        foreach ($Collector in 'Get-CIPPBecMailboxInventory', 'Get-CIPPBecUserGrants', 'Get-CIPPBecTransportRules', 'Get-CIPPBecReceivedMailFindings', 'Get-CIPPBecDirectoryAudits', 'Get-CIPPBecRegisteredDevices', 'Get-CIPPBecNonInteractiveSignIns', 'Get-CIPPBecMailActivity', 'Get-CIPPBecRiskState') {
+            Should -Invoke $Collector -Times 1 -Because "$Collector runs on Full scope"
+        }
+        Should -Invoke Get-CIPPBecMailboxInventory -Times 1 -ParameterFilter { $AcceptedDomains -contains 'contoso.com' -and $UserPrincipalName -eq 'victim@contoso.com' }
+        Should -Invoke Get-CIPPBecReceivedMailFindings -Times 1 -ParameterFilter { $IncludeDefender.IsPresent }
+        Should -Invoke Get-CIPPBecNonInteractiveSignIns -Times 1 -ParameterFilter { $UsageLocation -eq 'NL' }
+        $R = $script:Saved.Results
+        $R.MailboxState.HasForwarding | Should -BeTrue
+        $R.Delegations.Count | Should -Be 3
+        $Helper = $R.Delegations | Where-Object { $_.Trustee -eq 'Helper@contoso.com' }
+        $Helper.GrantedInWindow | Should -BeTrue -Because 'the Add-MailboxPermission for this mailbox is in the window'
+        $Helper.Flagged | Should -BeTrue -Because 'a grant made in the window is flagged even for an internal trustee'
+        ($R.Delegations | Where-Object { $_.Trustee -eq 'outsider@example.org' }).GrantedInWindow | Should -BeFalse
+        $Assistant = $R.Delegations | Where-Object { $_.PermissionType -eq 'SendOnBehalf' }
+        $Assistant.Trustee | Should -Be 'assistant@contoso.com' -Because 'directory ids resolve to the UPN'
+        $Assistant.TrusteeId | Should -Be '1b4e28ba-2fa1-11d2-883f-0016d3cca427'
+        $R.Delegations[0].Flagged | Should -BeTrue -Because 'flagged delegations sort first'
+        $R.UserGrants[0].Risk | Should -Be 'CatalogMatch'
+        $R.TransportRuleChanges[0].Country | Should -Be 'NG' -Because 'full-scope client IPs go through the same geo lookup'
+        $R.TransportRuleChanges[0].ForeignLocation | Should -BeTrue
+        $R.InboxRuleChanges[0].ClientIP | Should -Be '203.0.113.10' -Because 'the client port is dropped so one host correlates as one'
+        $R.InboxRuleChanges[0].Country | Should -Be 'NG'
+        $R.InboxRuleChanges[0].AuditData.Operation | Should -Be 'New-InboxRule' -Because 'the raw audit record rides along for the More Info panel'
+        $R.InboxRuleChanges[0].ActorKind | Should -Be 'User' -Because 'the mailbox owner made the rule'
+        $R.LocationAnalysis.ForeignTransportRuleChangeCount | Should -Be 1
+        $R.Completeness.DefenderDetections.Complete | Should -BeFalse
+        $R.Completeness.DefenderDetections.Error | Should -Be 'Invalid subscription'
+        $R.Completeness.Delegations.Complete | Should -BeTrue
+        $R.Completeness.RiskState.Complete | Should -BeTrue
+        # the IP analysis gets the rows it judges, and its verdicts land on the case and on the rows
+        $script:IPAnalysisInput.InboxRuleChanges[0].ClientIP | Should -Be '203.0.113.10'
+        $script:IPAnalysisInput.SuspectUserSignIns[0].IPAddress | Should -Be '203.0.113.10'
+        $R.IPVerdicts[0].Verdict | Should -Be 'LikelyAttacker'
+        $R.IPBaseline.Successful | Should -Be 12
+        $script:IPAnalysisTechnicians[0].IP | Should -Be '192.0.2.77' -Because 'the technician who started the run gets a trusted start'
+        $R.IPTechnicians[0].By | Should -Be 'tech@msp.com'
+        $R.InboxRuleChanges[0].IPVerdict | Should -Be 'LikelyAttacker'
+        $R.SuspectUserSignIns[0].IPVerdict | Should -Be 'LikelyAttacker'
+        $R.Completeness.SignInBaseline.Complete | Should -BeTrue
+        $R.Completeness.IPVerdicts.Count | Should -Be 1
+        # the attacker-activity pass gets the verdicts, the raw mailbox records and the known subjects
+        $script:AttackerInput.Verdicts[0].IP | Should -Be '203.0.113.10'
+        $script:AttackerInput.KnownSubjects.Count | Should -BeGreaterOrEqual 0
+        $R.AttackerMailActivity[0].Subject | Should -Be 'Wire details'
+        $R.AttackerMailSummary.MessagesOpened | Should -Be 1
+        $R.DelegatedAccess[0].Mailbox | Should -Be 'ceo@contoso.com'
+        $R.UserPrincipalName | Should -Be 'victim@contoso.com'
+        $R.Completeness.AttackerMailActivity.Complete | Should -BeTrue
+        $R.Completeness.DelegatedAccess.Complete | Should -BeTrue
+        $R.BlastRadius[0].UserPrincipalName | Should -Be 'cfo@contoso.com'
+        $R.Completeness.BlastRadius.Complete | Should -BeTrue
+        $script:BlastPeers | Should -BeOfType [hashtable] -Because "the analysis' tenant-wide sign-in lookup is reused"
+        # Quick score 21 + flagged delegation 2 + catalog grant 5 + risky transport change 4 + attacker IP 4 + attacker mail 3
+        $R.Score.Value | Should -Be 39
+    }
+
+    It 'resolves a missing UPN from the object id, writes it back, and runs the investigation' {
+        # A run queued with only the object id (an API/MCP caller, or a page race) must not run the
+        # mailbox collectors with an empty UPN; the run resolves it from the id first.
+        Mock New-GraphGetRequest { [pscustomobject]@{ userPrincipalName = 'victim@contoso.com'; displayName = 'Victim' } } -ParameterFilter { $uri -like '*/users/user-guid*' }
+        Push-BECRun -Item @{ TenantFilter = 'contoso.com'; UserID = 'user-guid'; userName = ''; CaseId = 'BEC-20260820120000-test02' }
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like '*/users/user-guid*' }
+        Should -Invoke Set-CIPPBecReport -Times 1 -ParameterFilter { $Properties.UserPrincipalName -eq 'victim@contoso.com' }
+        Should -Invoke Get-CIPPBecMailboxInventory -Times 1 -ParameterFilter { $UserPrincipalName -eq 'victim@contoso.com' }
+        $script:Saved.Properties.Status | Should -Be 'Completed'
+    }
+
+    It 'fails a blank-UPN run cleanly when the object id cannot be resolved, without running the collectors' {
+        # the default New-GraphGetRequest mock returns nothing for an unknown users/{id} lookup
+        Push-BECRun -Item @{ TenantFilter = 'contoso.com'; UserID = 'ghost-guid'; userName = ''; CaseId = 'BEC-20260820120000-test03' }
+        $script:Saved.Properties.Status | Should -Be 'Error'
+        $script:Saved.Properties.ErrorMessage | Should -Match 'user principal name'
+        Should -Invoke Get-CIPPBecMailboxInventory -Times 0
+        Should -Invoke Search-CIPPBecAuditLog -Times 0
+    }
+
+    It 'degrades a collector that throws to an error marker without failing the run' {
+        Mock Get-CIPPBecUserGrants { throw 'Graph exploded' }
+        Push-BECRun -Item ($script:Item + @{ Scope = 'Full' })
+        $R = $script:Saved.Results
+        $script:Saved.Properties.Status | Should -Be 'Completed'
+        $R.Completeness.UserGrants.Complete | Should -BeFalse
+        $R.Completeness.UserGrants.Error | Should -Match 'Graph exploded'
+        $R.UserGrants.Count | Should -Be 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $message -like '*collector UserGrants failed*' }
+    }
+
+    It 'marks the audit-dependent checks incomplete when the unified audit log is disabled' {
+        Mock New-ExoRequest {
+            switch ($cmdlet) {
+                'Get-AdminAuditLogConfig' { [pscustomobject]@{ UnifiedAuditLogIngestionEnabled = $false } }
+                'Get-InboxRule' { @() }
+                'Get-MailboxJunkEmailConfiguration' { [pscustomobject]@{ TrustedSendersAndDomains = @(); BlockedSendersAndDomains = @() } }
+                default { @() }
+            }
+        }
+        Push-BECRun -Item $script:Item
+        $R = $script:Saved.Results
+        $R.ExtractResult | Should -Match 'disabled'
+        $R.Completeness.AuditLog.Complete | Should -BeFalse
+        $R.Completeness.AuditLog.Error | Should -Match 'disabled'
+        $R.InboxRuleChanges.Count | Should -Be 0
+        Should -Invoke Search-CIPPBecAuditLog -Times 0
+    }
+
+    It 'records a failed run instead of leaving it waiting' {
+        Mock New-GraphBulkRequest { throw 'bulk blew up' }
+        Push-BECRun -Item $script:Item
+        $script:Saved.Properties.Status | Should -Be 'Error'
+        $script:Saved.Properties.ErrorMessage | Should -Match 'bulk blew up'
+        $script:Saved.Results | Should -BeNullOrEmpty
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { [string]::IsNullOrEmpty($CaseId) }
+    }
+
+    Context 'live progress (the async-deployment job the page polls)' {
+        It 'creates the job when the queue did not, marks the run Running, walks each of the fourteen phases running then done, and ends succeeded' {
+            Push-BECRun -Item $script:Item
+            Should -Invoke New-CIPPAsyncDeployment -Times 1 -ParameterFilter { $JobId -eq 'BEC-20260820120000-test01' -and $Names -contains 'victim@contoso.com' -and @($StepTitles).Count -eq 14 -and $Source -eq 'BEC' }
+            Should -Invoke Set-CIPPBecReport -Times 1 -ParameterFilter { $Properties.Status -eq 'Running' -and $Properties.StartedAt }
+            @($script:StatusCalls.Status) | Should -Be @('running', 'succeeded')
+            $script:StatusCalls[-1].Logs | Should -Match 'threat level High'
+            @(($script:StepCalls | Where-Object { $_.Status -eq 'running' }).Index) | Should -Be @(0..13) -Because 'the phases run in order'
+            @(($script:StepCalls | Where-Object { $_.Status -eq 'succeeded' }).Index) | Should -Be @(0..13)
+            ($script:StepCalls | Where-Object { $_.Status -eq 'succeeded' })[-1].Message | Should -Match '^Threat level High'
+            @($script:StepCalls | Where-Object { $_.Status -eq 'failed' }).Count | Should -Be 0
+            $script:StepCalls | ForEach-Object { $_.JobId | Should -Be 'BEC-20260820120000-test01'; $_.Name | Should -Be 'victim@contoso.com' }
+        }
+
+        It 'marks the phase that was running as failed, and the job failed, when the run throws' {
+            Mock New-GraphBulkRequest { throw 'bulk blew up' }
+            Push-BECRun -Item $script:Item
+            @($script:StatusCalls.Status) | Should -Be @('running', 'failed')
+            $Failed = @($script:StepCalls | Where-Object { $_.Status -eq 'failed' })
+            $Failed.Count | Should -Be 1
+            $Failed[0].Index | Should -Be 4 -Because 'the bulk Graph read belongs to the tenant phase'
+            $Failed[0].Message | Should -Match 'bulk blew up'
+        }
+
+        It 'recreates the job at start so a Craft retry shows a clean progression instead of the dead attempt''s steps' {
+            Mock Get-CIPPAsyncDeployment { @([pscustomobject]@{ Name = 'victim@contoso.com'; Status = 'running'; Steps = @([pscustomobject]@{ Title = 'x'; Status = 'succeeded'; Message = 'Done' }); Logs = '' }) }
+            Push-BECRun -Item $script:Item
+            Should -Invoke New-CIPPAsyncDeployment -Times 1 -ParameterFilter { $JobId -eq 'BEC-20260820120000-test01' -and @($StepTitles).Count -eq 14 }
+            @($script:StatusCalls.Status) | Should -Be @('running', 'succeeded')
+        }
+    }
+
+    It 'mints a case id when the queue item carries none' {
+        Push-BECRun -Item @{ TenantFilter = 'contoso.com'; UserID = 'user-guid'; userName = 'victim@contoso.com' }
+        $script:Saved.CaseId | Should -Match '^BEC-\d{14}-[0-9a-f]{6}$'
+    }
+
+    It 'stamps partner (GDAP) and CIPP actors on audited rows so the case can list them separately' {
+        Mock Search-CIPPBecAuditLog {
+            if ($Operations -contains 'New-InboxRule') {
+                [pscustomobject]@{ Complete = $true; Cap = $null; Pages = 1; Records = @([pscustomobject]@{ Identity = 'a2'; Operation = 'New-InboxRule'; AuditData = [pscustomobject]@{ Operation = 'New-InboxRule'; UserId = 'user_0123abcd456748908abcdef012345678@contoso.onmicrosoft.com'; CreationTime = '2026-08-19T02:00:00Z'; ClientIP = '198.51.100.7'; ObjectId = 'victim@contoso.com\Partner rule'; Parameters = @([pscustomobject]@{ Name = 'Name'; Value = 'Partner rule' }) } }) }
+            } else { [pscustomobject]@{ Complete = $true; Cap = $null; Pages = 1; Records = @() } }
+        }
+        Mock Get-CIPPBecDirectoryAudits { New-CIPPBecCollectorResult -Data @([pscustomobject]@{ Id = 'd1'; ActivityDateTime = '2026-08-19T03:00:00Z'; Activity = 'Reset user password'; InitiatedBy = 'CIPP-SAM'; InitiatedByType = 'Application'; InitiatedById = '11111111-2222-4333-8444-555555555555'; Flagged = $true }) }
+        $PriorAppId = $env:ApplicationID
+        $env:ApplicationID = '11111111-2222-4333-8444-555555555555'
+        try {
+            Push-BECRun -Item $script:Item
+        } finally {
+            $env:ApplicationID = $PriorAppId
+        }
+        $R = $script:Saved.Results
+        $R.InboxRuleChanges[0].ActorKind | Should -Be 'Partner'
+        $R.InboxRuleChanges[0].ActorResolved | Should -Be 'tech@msp.example'
+        $R.DirectoryAudits[0].ActorKind | Should -Be 'CIPP'
+        $R.DirectoryAudits[0].ActorResolved | Should -Be 'CIPP (service principal)'
+    }
+
+    It 'does nothing without a tenant or user' {
+        Push-BECRun -Item @{ TenantFilter = 'contoso.com' }
+        Should -Invoke Set-CIPPBecReport -Times 0
+    }
+
+    It 'preflight skips Identity Protection when the tenant has no Entra ID P2 - without calling it' {
+        Mock Get-CIPPTenantCapabilities { [pscustomobject]@{ AAD_PREMIUM = $true; INTUNE_A = $true } }
+        Push-BECRun -Item ($script:Item + @{ Scope = 'Full' })
+        Should -Invoke Get-CIPPBecRiskState -Times 0 -Because 'the licence preflight skips it instead of running it to fail'
+        $R = $script:Saved.Results
+        $R.Completeness.RiskState.Skipped | Should -BeTrue
+        $R.Completeness.RiskState.Requirement | Should -Match 'Entra ID P2'
+        $script:Saved.Properties.Status | Should -Be 'Completed'
+    }
+
+    It 'preflight skips the Intune device check when the tenant has no Intune plan - without querying it' {
+        Mock Get-CIPPTenantCapabilities { [pscustomobject]@{ AAD_PREMIUM_P2 = $true } }
+        Push-BECRun -Item $script:Item
+        Should -Invoke New-GraphBulkRequest -Times 0 -ParameterFilter { @($Requests | Where-Object { $_.id -eq 'IntuneDevices' }).Count -gt 0 } -Because 'the licence preflight drops the request instead of sending it to fail'
+        $R = $script:Saved.Results
+        $R.Completeness.IntuneDevices.Skipped | Should -BeTrue
+        $R.Completeness.IntuneDevices.Requirement | Should -Match 'Intune licence'
+        $R.Completeness.IntuneDevices.Error | Should -BeNullOrEmpty
+        $R.IntuneDevices | Should -BeNullOrEmpty
+        $script:Saved.Properties.Status | Should -Be 'Completed'
+    }
+
+    It 'runs every gated check when the plan read itself fails - never skips on a failed preflight' {
+        Mock Get-CIPPTenantCapabilities { throw 'CacheCapabilities unavailable' }
+        Push-BECRun -Item $script:Item
+        Should -Invoke Get-CIPPBecRiskState -Times 1
+        Should -Invoke New-GraphBulkRequest -Times 1 -ParameterFilter { @($Requests | Where-Object { $_.id -eq 'IntuneDevices' }).Count -gt 0 }
+        $script:Saved.Results.Completeness.RiskState.Skipped | Should -BeFalse
+        $script:Saved.Properties.Status | Should -Be 'Completed'
+    }
+
+    It 'classifies a user without a mailbox as skipped mailbox checks, not failed ones' {
+        Mock Get-CIPPBecMailboxInventory { $E = New-CIPPBecCollectorResult -Data @() -Error 'Get-Mailbox: Ex41BAF5|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|The specified mailbox doesn''t exist.'; [pscustomobject]@{ MailboxState = $E; Delegations = $E; AddIns = $E } }
+        Push-BECRun -Item $script:Item
+        $R = $script:Saved.Results
+        $R.Completeness.MailboxState.Skipped | Should -BeTrue
+        $R.Completeness.Delegations.Skipped | Should -BeTrue
+        $R.Completeness.MailboxState.Requirement | Should -Match 'no Exchange Online mailbox'
+        $script:Saved.Properties.Status | Should -Be 'Completed'
+    }
+
+    It 'flags an inbox rule that forwards externally, deletes, and scopes to no conditions' {
+        Mock New-ExoRequest {
+            switch ($cmdlet) {
+                'Get-AdminAuditLogConfig' { [pscustomobject]@{ UnifiedAuditLogIngestionEnabled = $true } }
+                'Get-InboxRule' { [pscustomobject]@{ Name = 'auto'; Identity = 'r9'; Enabled = $true; ForwardTo = @('attacker@evil.example'); DeleteMessage = $true } }
+                'Get-MailboxJunkEmailConfiguration' { [pscustomobject]@{ TrustedSendersAndDomains = @(); BlockedSendersAndDomains = @() } }
+                'Get-AcceptedDomain' { [pscustomobject]@{ DomainName = 'contoso.com' } }
+                default { @() }
+            }
+        }
+        Push-BECRun -Item ($script:Item + @{ Scope = 'Full' })
+        $Rule = @($script:Saved.Results.NewRules)[0]
+        $Rule.Suspicious | Should -BeTrue
+        $Rule.Risk | Should -Be 'High'
+        $Rule.RiskReasons | Should -Contain 'Forwards or redirects mail to an external address'
+        $Rule.RiskReasons | Should -Contain 'Deletes messages'
+        $Rule.RiskReasons | Should -Contain 'Acts on all incoming mail'
+    }
+}
diff --git a/Tests/Alerts/Get-CIPPAlertExpiringLicenses.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertExpiringLicenses.Tests.ps1
new file mode 100644
index 0000000000000..50e45bc422768
--- /dev/null
+++ b/Tests/Alerts/Get-CIPPAlertExpiringLicenses.Tests.ps1
@@ -0,0 +1,67 @@
+# Pester tests for Get-CIPPAlertExpiringLicenses.
+# Each emitted row must carry the Graph subscription id as `Id` so Get-AlertContentHash keys the
+# snooze fingerprint on it rather than falling back to `Message`, which embeds DaysUntilRenew and
+# therefore changes on every scheduled run (a snooze could never match the next run).
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $AlertPath = Join-Path $RepoRoot 'Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1'
+    $HashPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Get-AlertContentHash.ps1'
+
+    function Get-CIPPLicenseOverview { param($TenantFilter, [switch]$AlertMode) }
+    function Write-AlertTrace { param($cmdletName, $tenantFilter, $data) }
+
+    . $AlertPath
+    . $HashPath
+}
+
+Describe 'Get-CIPPAlertExpiringLicenses' {
+    BeforeEach {
+        $script:CapturedAlertData = $null
+        Mock Write-AlertTrace {
+            param($cmdletName, $tenantFilter, $data)
+            $script:CapturedAlertData = @($data)
+        }
+    }
+
+    Context 'snooze identity' {
+        It 'emits the subscription id as Id on every row' {
+            Mock Get-CIPPLicenseOverview {
+                [pscustomobject]@{
+                    License = 'Microsoft 365 Business Premium'; skuId = 'cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46'
+                    CountUsed = 10; CountAvailable = 2; Tenant = 'contoso.onmicrosoft.com'
+                    TermInfo = @(
+                        [pscustomobject]@{ Status = 'Enabled'; Term = 'Yearly'; TotalLicenses = 12; DaysUntilRenew = 24; NextLifecycle = '2026-10-05T00:00:00Z'; SubscriptionId = '11111111-aaaa-4aaa-8aaa-111111111111' },
+                        [pscustomobject]@{ Status = 'Enabled'; Term = 'Monthly'; TotalLicenses = 5; DaysUntilRenew = 44; NextLifecycle = '2026-11-01T00:00:00Z'; SubscriptionId = '33333333-cccc-4ccc-8ccc-333333333333' }
+                    )
+                }
+            }
+
+            Get-CIPPAlertExpiringLicenses -InputValue @{ ExpiringLicensesDays = 60; ExpiringLicensesUnassignedOnly = $true } -TenantFilter 'contoso.onmicrosoft.com'
+
+            $script:CapturedAlertData.Count | Should -Be 2
+            $script:CapturedAlertData.Id | Should -Be @('11111111-aaaa-4aaa-8aaa-111111111111', '33333333-cccc-4ccc-8ccc-333333333333')
+        }
+
+        It 'produces the same content hash on consecutive runs even though DaysUntilRenew changes' {
+            $script:Days = 24
+            Mock Get-CIPPLicenseOverview {
+                [pscustomobject]@{
+                    License = 'Microsoft 365 Business Premium'; skuId = 'cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46'
+                    CountUsed = 10; CountAvailable = 2; Tenant = 'contoso.onmicrosoft.com'
+                    TermInfo = @([pscustomobject]@{ Status = 'Enabled'; Term = 'Yearly'; TotalLicenses = 12; DaysUntilRenew = $script:Days; NextLifecycle = '2026-10-05T00:00:00Z'; SubscriptionId = '11111111-aaaa-4aaa-8aaa-111111111111' })
+                }
+            }
+
+            Get-CIPPAlertExpiringLicenses -InputValue @{ ExpiringLicensesDays = 60; ExpiringLicensesUnassignedOnly = $true } -TenantFilter 'contoso.onmicrosoft.com'
+            $FirstHash = (Get-AlertContentHash -AlertItem $script:CapturedAlertData[0]).ContentHash
+
+            $script:Days = 17   # one week later
+            Get-CIPPAlertExpiringLicenses -InputValue @{ ExpiringLicensesDays = 60; ExpiringLicensesUnassignedOnly = $true } -TenantFilter 'contoso.onmicrosoft.com'
+            $SecondHash = (Get-AlertContentHash -AlertItem $script:CapturedAlertData[0]).ContentHash
+
+            $script:CapturedAlertData[0].Message | Should -Match 'expiring in 17 days'
+            $SecondHash | Should -Be $FirstHash
+        }
+    }
+}
diff --git a/Tests/Alerts/Get-CIPPAlertHuntressRogueApps.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertHuntressRogueApps.Tests.ps1
index fc9a6a1c20ee1..7f1e58416a7aa 100644
--- a/Tests/Alerts/Get-CIPPAlertHuntressRogueApps.Tests.ps1
+++ b/Tests/Alerts/Get-CIPPAlertHuntressRogueApps.Tests.ps1
@@ -1,5 +1,6 @@
 # Pester tests for Get-CIPPAlertHuntressRogueApps
-# Covers the feed guard and describing matches from either rogue app list.
+# Covers the feed guard (no lifecycle call when the feed is unavailable), the single empty call
+# when nothing matches, and describing matches from either rogue app list.
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -68,6 +69,17 @@ Describe 'Get-CIPPAlertHuntressRogueApps' {
         }
     }
 
+    Context 'no match' {
+        It 'reconciles once with empty data when no rogue app is present' {
+            Mock -CommandName New-GraphBulkRequest -MockWith { script:New-Principals -AppIds @() }
+
+            Get-CIPPAlertHuntressRogueApps -TenantFilter 'contoso.onmicrosoft.com'
+
+            Should -Invoke -CommandName Write-AlertTrace -Times 1 -Exactly
+            @($script:Alerted) | Should -BeNullOrEmpty
+        }
+    }
+
     Context 'describing a match' {
         It 'fills in an app that is only on the CIPP list' {
             Mock -CommandName New-GraphBulkRequest -MockWith { script:New-Principals -AppIds @($script:CippOnly.appId) }
diff --git a/Tests/Alerts/Get-CIPPAlertMFAAlertUsers.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertMFAAlertUsers.Tests.ps1
new file mode 100644
index 0000000000000..5386a4090393b
--- /dev/null
+++ b/Tests/Alerts/Get-CIPPAlertMFAAlertUsers.Tests.ps1
@@ -0,0 +1,80 @@
+# Pester tests for MFA users alert new-account grace period.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $AlertPath = Join-Path $RepoRoot 'Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertMFAAlertUsers.ps1'
+
+    function Get-CIPPMFAStateReport { param($TenantFilter) }
+    function New-CIPPDbRequest { param($TenantFilter, $Type, $Fields) }
+    function New-GraphGETRequest { param($uri, $tenantid, $AsApp) }
+    function Write-AlertTrace { param($cmdletName, $tenantFilter, $data) }
+    function Write-LogMessage { param($message, $API, $tenant, $sev) }
+
+    . $AlertPath
+}
+
+Describe 'Get-CIPPAlertMFAAlertUsers grace period' {
+    BeforeEach {
+        $script:CapturedData = $null
+        $script:GraphCalled = $false
+
+        Mock -CommandName Write-AlertTrace -MockWith {
+            param($cmdletName, $tenantFilter, $data)
+            $script:CapturedData = @($data)
+        }
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CIPPMFAStateReport -MockWith {
+            @(
+                [pscustomobject]@{ UPN = 'new@contoso.com'; DisplayName = 'New'; IsAdmin = $false; MFARegistration = $false; UserType = 'Member' }
+                [pscustomobject]@{ UPN = 'old@contoso.com'; DisplayName = 'Old'; IsAdmin = $false; MFARegistration = $false; UserType = 'Member' }
+                [pscustomobject]@{ UPN = 'missing@contoso.com'; DisplayName = 'Missing'; IsAdmin = $false; MFARegistration = $false; UserType = 'Member' }
+            )
+        }
+    }
+
+    It 'excludes only known-young accounts from cache; keeps missing and old' {
+        Mock -CommandName New-CIPPDbRequest -MockWith {
+            @(
+                [pscustomobject]@{ userPrincipalName = 'new@contoso.com'; createdDateTime = (Get-Date).ToUniversalTime().AddDays(-2) }
+                [pscustomobject]@{ userPrincipalName = 'old@contoso.com'; createdDateTime = (Get-Date).ToUniversalTime().AddDays(-30) }
+            )
+        }
+        Mock -CommandName New-GraphGETRequest -MockWith { throw 'Graph must not be called when cache has data' }
+
+        Get-CIPPAlertMFAAlertUsers -TenantFilter 'contoso.onmicrosoft.com' -InputValue 7
+
+        $Upns = @($script:CapturedData | ForEach-Object { $_.UserPrincipalName })
+        $Upns | Should -Contain 'old@contoso.com'
+        $Upns | Should -Contain 'missing@contoso.com'
+        $Upns | Should -Not -Contain 'new@contoso.com'
+    }
+
+    It 'falls back to live Graph when cache is empty and applies the same rule' {
+        Mock -CommandName New-CIPPDbRequest -MockWith { @() }
+        Mock -CommandName New-GraphGETRequest -MockWith {
+            $script:GraphCalled = $true
+            @(
+                [pscustomobject]@{ userPrincipalName = 'new@contoso.com'; createdDateTime = (Get-Date).ToUniversalTime().AddDays(-1) }
+                [pscustomobject]@{ userPrincipalName = 'old@contoso.com'; createdDateTime = (Get-Date).ToUniversalTime().AddDays(-40) }
+            )
+        }
+
+        Get-CIPPAlertMFAAlertUsers -TenantFilter 'contoso.onmicrosoft.com' -InputValue 7
+
+        $script:GraphCalled | Should -BeTrue
+        $Upns = @($script:CapturedData | ForEach-Object { $_.UserPrincipalName })
+        $Upns | Should -Contain 'old@contoso.com'
+        $Upns | Should -Contain 'missing@contoso.com'
+        $Upns | Should -Not -Contain 'new@contoso.com'
+    }
+
+    It 'does not apply grace filtering when days is 0' {
+        Mock -CommandName New-CIPPDbRequest -MockWith { throw 'DB must not be queried when grace is disabled' }
+        Mock -CommandName New-GraphGETRequest -MockWith { throw 'Graph must not be queried when grace is disabled' }
+
+        Get-CIPPAlertMFAAlertUsers -TenantFilter 'contoso.onmicrosoft.com' -InputValue 0
+
+        $Upns = @($script:CapturedData | ForEach-Object { $_.UserPrincipalName })
+        $Upns.Count | Should -Be 3
+    }
+}
diff --git a/Tests/Alerts/Get-CIPPAlertMXRecordChanged.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertMXRecordChanged.Tests.ps1
index 62d1cbb0a302f..18ac1e489a5a1 100644
--- a/Tests/Alerts/Get-CIPPAlertMXRecordChanged.Tests.ps1
+++ b/Tests/Alerts/Get-CIPPAlertMXRecordChanged.Tests.ps1
@@ -1,6 +1,8 @@
 # Pester tests for Get-CIPPAlertMXRecordChanged.
 # A domain without a CacheMxRecords row is being observed for the first time; its current
-# records establish the baseline and must not be reported as a change.
+# records establish the baseline and must not be reported as a change. The check still
+# completed, so Write-AlertTrace is called once with empty data (that is what resolves
+# previously open items).
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -43,7 +45,8 @@ Describe 'Get-CIPPAlertMXRecordChanged' {
     It 'stores current MX records as the baseline without alerting when no prior domain row exists' {
         Get-CIPPAlertMXRecordChanged -TenantFilter 'tenant.onmicrosoft.com'
 
-        Should -Invoke Write-AlertTrace -Times 0 -Exactly
+        Should -Invoke Write-AlertTrace -Times 1 -Exactly
+        $script:CapturedAlertData | Should -BeNullOrEmpty
         Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter {
             $Entity.PartitionKey -eq 'tenant.onmicrosoft.com' -and
             $Entity.RowKey -eq 'contoso.com' -and
diff --git a/Tests/Alerts/Get-CIPPAlertQuarantineReleaseRequests.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertQuarantineReleaseRequests.Tests.ps1
index a04bfe4cb50dc..c2e735804c448 100644
--- a/Tests/Alerts/Get-CIPPAlertQuarantineReleaseRequests.Tests.ps1
+++ b/Tests/Alerts/Get-CIPPAlertQuarantineReleaseRequests.Tests.ps1
@@ -5,6 +5,10 @@
 # the received-date window used to be only 6 hours, which silently hid every release request raised
 # against a message that had been sitting in quarantine longer than that - even though the same
 # request is plainly visible on the Quarantine page (which applies no received-date filter).
+#
+# Write-AlertTrace is a lifecycle reconciler: a run that checked and found nothing must still call it
+# once with empty data (that is what resolves earlier requests), while a run that could not check
+# (no licence, EXO error) must not call it at all.
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -62,14 +66,14 @@ Describe 'Get-CIPPAlertQuarantineReleaseRequests' {
         }
     }
 
-    It 'queries a one-day window, not a few hours' {
+    It 'queries the full 30-day quarantine window for requested releases' {
         Get-CIPPAlertQuarantineReleaseRequests -TenantFilter $script:Tenant
 
         $script:CapturedParams | Should -Not -BeNullOrEmpty
         $script:CapturedParams.ReleaseStatus | Should -Be 'Requested'
         $Span = ((Get-Date) - $script:CapturedParams.StartReceivedDate).TotalDays
-        $Span | Should -BeGreaterThan 0.9   # ~1 day
-        $Span | Should -BeLessThan 1.1       # regression guard: the old window was 0.25 days (6 hours)
+        $Span | Should -BeGreaterThan 29.9   # regression guard: 6 hours, then 1 day, both missed requests raised later
+        $Span | Should -BeLessThan 30.1      # EXO rejects a StartReceivedDate beyond 30 days
         $script:CapturedParams.EndReceivedDate | Should -BeGreaterThan $script:CapturedParams.StartReceivedDate
     }
 
@@ -86,12 +90,13 @@ Describe 'Get-CIPPAlertQuarantineReleaseRequests' {
         $script:CapturedData[0].QuarantineViewUrl | Should -Match 'https://cipp.contoso.com/email/administration/quarantine'
     }
 
-    It 'does not emit when there are no pending release requests' {
+    It 'reports an empty run when there are no pending release requests' {
         Mock -CommandName New-ExoRequest -MockWith { param($tenantid, $cmdlet, $cmdParams) $script:CapturedParams = $cmdParams; @() }
 
         Get-CIPPAlertQuarantineReleaseRequests -TenantFilter $script:Tenant
 
-        Should -Invoke Write-AlertTrace -Times 0
+        Should -Invoke Write-AlertTrace -Times 1 -Exactly
+        $script:CapturedTenant | Should -Be $script:Tenant
         $script:CapturedData | Should -BeNullOrEmpty
     }
 
diff --git a/Tests/Alerts/Get-CIPPAlertQuotaUsed.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertQuotaUsed.Tests.ps1
index a441377cea48e..2cd31c0e9dccf 100644
--- a/Tests/Alerts/Get-CIPPAlertQuotaUsed.Tests.ps1
+++ b/Tests/Alerts/Get-CIPPAlertQuotaUsed.Tests.ps1
@@ -2,7 +2,8 @@
 # The mailbox usage report's storageUsedInBytes already equals the live Get-MailboxStatistics
 # TotalItemSize (it excludes the Recoverable Items dumpster and the archive), so the alert trusts the
 # report figure directly. It must still skip rows the report has flagged deleted, and honour the
-# threshold, exclusion and mailbox-type filters.
+# threshold, exclusion and mailbox-type filters. When nothing qualifies it still calls Write-AlertTrace
+# exactly once with empty data, which is what resolves previously open items.
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -36,7 +37,7 @@ Describe 'Get-CIPPAlertQuotaUsed' {
         Mock Write-LogMessage {}
         Mock Write-AlertTrace {
             param($cmdletName, $tenantFilter, $data)
-            $script:CapturedAlertData = @($data)
+            $script:CapturedAlertData = @($data | Where-Object { $null -ne $_ })
         }
     }
 
@@ -53,12 +54,13 @@ Describe 'Get-CIPPAlertQuotaUsed' {
         $Row.ProhibitSendReceiveQuotaInBytes | Should -Be 107374182400
     }
 
-    It 'does not alert when the mailbox is under the threshold' {
+    It 'reports an empty run when the mailbox is under the threshold' {
         $script:ReportRows[0].storageUsedInBytes = 53687091200 # 50%
 
         Get-CIPPAlertQuotaUsed -InputValue @{ QuotaUsedQuota = 90 } -TenantFilter 'contoso.onmicrosoft.com'
 
-        Should -Invoke Write-AlertTrace -Times 0 -Exactly
+        Should -Invoke Write-AlertTrace -Times 1 -Exactly
+        $script:CapturedAlertData.Count | Should -Be 0
     }
 
     It 'skips mailboxes the report has marked as deleted' {
@@ -66,12 +68,22 @@ Describe 'Get-CIPPAlertQuotaUsed' {
 
         Get-CIPPAlertQuotaUsed -InputValue @{ QuotaUsedQuota = 90 } -TenantFilter 'contoso.onmicrosoft.com'
 
-        Should -Invoke Write-AlertTrace -Times 0 -Exactly
+        Should -Invoke Write-AlertTrace -Times 1 -Exactly
+        $script:CapturedAlertData.Count | Should -Be 0
     }
 
     It 'only alerts on the selected mailbox types' {
         Get-CIPPAlertQuotaUsed -InputValue @{ QuotaUsedQuota = 90; QuotaUsedMailboxTypes = @{ value = @('Shared') } } -TenantFilter 'contoso.onmicrosoft.com'
 
+        Should -Invoke Write-AlertTrace -Times 1 -Exactly
+        $script:CapturedAlertData.Count | Should -Be 0
+    }
+
+    It 'does not call the reconciler when the usage report cannot be read' {
+        Mock New-GraphGetRequest { throw 'Graph unavailable' }
+
+        Get-CIPPAlertQuotaUsed -InputValue @{ QuotaUsedQuota = 90 } -TenantFilter 'contoso.onmicrosoft.com'
+
         Should -Invoke Write-AlertTrace -Times 0 -Exactly
     }
 }
diff --git a/Tests/Alerts/Get-CIPPAlertVulnerabilities.Tests.ps1 b/Tests/Alerts/Get-CIPPAlertVulnerabilities.Tests.ps1
new file mode 100644
index 0000000000000..6833acb716066
--- /dev/null
+++ b/Tests/Alerts/Get-CIPPAlertVulnerabilities.Tests.ps1
@@ -0,0 +1,58 @@
+# Pester tests for Get-CIPPAlertVulnerabilities.
+# The alert folds the streamed TVM export (Get-DefenderTvmRaw -Stream) into one bucket per CVE instead
+# of grouping every device x CVE record. Each bucket must report the earliest-seen record's details,
+# the full record count and the unique device names, and CVE-less inventory rows must be ignored.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $AlertPath = Join-Path $RepoRoot 'Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertVulnerabilities.ps1'
+
+    function Get-DefenderTvmRaw { param($TenantId, [switch]$Stream) }
+    function Write-AlertTrace { param($cmdletName, $tenantFilter, $data) }
+    function Write-LogMessage { param($message, $API, $tenant, $sev) }
+
+    . $AlertPath
+
+    function New-TvmRecord ($CveId, $DeviceName, $FirstSeen, $Cvss = 8.0) {
+        [pscustomobject]@{
+            cveId = $CveId; deviceName = $DeviceName; firstSeenTimestamp = [datetime]$FirstSeen
+            lastSeenTimestamp = [datetime]'2026-09-01'; cvssScore = $Cvss; softwareName = "app-$FirstSeen"
+            vulnerabilitySeverityLevel = 'High'; exploitabilityLevel = 'ExploitIsPublic'
+        }
+    }
+}
+
+Describe 'Get-CIPPAlertVulnerabilities' {
+    BeforeEach {
+        $script:Captured = $null
+        Mock Write-AlertTrace { param($cmdletName, $tenantFilter, $data) $script:Captured = @($data) }
+        Mock Write-LogMessage {}
+        Mock Get-DefenderTvmRaw {
+            New-TvmRecord 'CVE-B' 'PC1' '2026-03-01'
+            New-TvmRecord 'CVE-A' 'PC1' '2026-05-01'
+            New-TvmRecord 'CVE-A' 'PC2' '2026-02-01'
+            New-TvmRecord 'CVE-A' 'PC1' '2026-04-01'
+            New-TvmRecord $null 'PC3' '2026-01-01'
+        }
+    }
+
+    It 'streams the TVM export' {
+        Get-CIPPAlertVulnerabilities -InputValue @{ VulnerabilityAgeHours = 0 } -TenantFilter 'contoso.com'
+        Should -Invoke Get-DefenderTvmRaw -Times 1 -Exactly -ParameterFilter { $Stream.IsPresent }
+    }
+
+    It 'emits one row per CVE with the earliest record, record count and unique devices' {
+        Get-CIPPAlertVulnerabilities -InputValue @{ VulnerabilityAgeHours = 0 } -TenantFilter 'contoso.com'
+        $script:Captured.CVE | Should -Be @('CVE-A', 'CVE-B')
+        $A = $script:Captured[0]
+        $A.AffectedDeviceCount | Should -Be 3
+        $A.AffectedDevices | Should -Be 'PC1, PC2'
+        $A.SoftwareName | Should -Be 'app-2026-02-01'
+    }
+
+    It 'applies the CVSS threshold to the earliest record' {
+        Mock Get-DefenderTvmRaw { New-TvmRecord 'CVE-A' 'PC1' '2026-02-01' 5.0; New-TvmRecord 'CVE-A' 'PC2' '2026-03-01' 9.5 }
+        Get-CIPPAlertVulnerabilities -InputValue @{ CVSSSeverity = @{ value = 'high' } } -TenantFilter 'contoso.com'
+        $script:Captured | Should -BeNullOrEmpty
+    }
+}
diff --git a/Tests/Alerts/Send-CIPPAlert.Attachments.Tests.ps1 b/Tests/Alerts/Send-CIPPAlert.Attachments.Tests.ps1
new file mode 100644
index 0000000000000..8cebbe5e0f0f1
--- /dev/null
+++ b/Tests/Alerts/Send-CIPPAlert.Attachments.Tests.ps1
@@ -0,0 +1,57 @@
+# Pester tests for email attachments in Send-CIPPAlert.
+# Graph sendMail rejects a request body over 4MB, so a scheduled report with a large PDF or raw data
+# file failed to send at all. Attachments that don't fit are now omitted and the mail still goes out.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/Send-CIPPAlert.ps1'
+
+    function Get-CIPPTable { param([string]$TableName) }
+    function Get-CIPPAzDataTableEntity { param($TableName, $Filter, $Property, $First) }
+    function Get-CIPPTextReplacement { param($TenantFilter, $Text, $Tenant, [switch]$EscapeForJson) }
+    function New-GraphPostRequest { param($uri, $tenantid, $NoAuthCheck, $type, $body) }
+    function Write-LogMessage { param($API, $tenant, $message, $sev, $LogData, $headers) }
+    function Get-CippException { param($Exception) }
+
+    . $FunctionPath
+
+    function Get-TestAttachment([string]$Name, [int]$Base64Length) {
+        @{ Name = $Name; ContentType = 'application/octet-stream'; ContentBytes = 'A' * $Base64Length }
+    }
+
+    function Send-TestMail($Attachments) {
+        $null = Send-CIPPAlert -Type 'email' -Title 'Report' -HTMLContent '<p>body</p>' -TenantFilter 'contoso.onmicrosoft.com' -Attachments $Attachments
+        ($script:SentBody | ConvertFrom-Json).message
+    }
+}
+
+Describe 'Send-CIPPAlert - email attachment size' {
+    BeforeEach {
+        $script:SentBody = $null
+        Mock -CommandName Get-CIPPTable -MockWith { @{} }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @{ email = 'alerts@contoso.com' } }
+        Mock -CommandName Get-CIPPTextReplacement -MockWith { param($TenantFilter, $Text) $Text }
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName New-GraphPostRequest -MockWith { param($uri, $tenantid, $NoAuthCheck, $type, $body) $script:SentBody = $body }
+    }
+
+    It 'attaches everything when it fits' {
+        $Message = Send-TestMail @((Get-TestAttachment 'report.pdf' 1000), (Get-TestAttachment 'data.csv' 1000))
+
+        @($Message.attachments.name) | Should -Be @('report.pdf', 'data.csv')
+    }
+
+    It 'omits an attachment that would push the request over 4MB and keeps the rest' {
+        $Message = Send-TestMail @((Get-TestAttachment 'report.pdf' 3MB), (Get-TestAttachment 'data.csv' 1MB), (Get-TestAttachment 'small.csv' 1000))
+
+        @($Message.attachments.name) | Should -Be @('report.pdf', 'small.csv')
+        [System.Text.Encoding]::UTF8.GetByteCount($script:SentBody) | Should -BeLessThan 4MB
+    }
+
+    It 'still sends the mail without attachments when none fit' {
+        $Message = Send-TestMail @((Get-TestAttachment 'report.pdf' 5MB))
+
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly
+        $Message.PSObject.Properties.Name | Should -Not -Contain 'attachments'
+    }
+}
diff --git a/Tests/Api/SignInPermissionScope.Tests.ps1 b/Tests/Api/SignInPermissionScope.Tests.ps1
new file mode 100644
index 0000000000000..3296183769b03
--- /dev/null
+++ b/Tests/Api/SignInPermissionScope.Tests.ps1
@@ -0,0 +1,59 @@
+# CIPP.Core.Read is what every role needs in order to sign in, so an endpoint that declares it is
+# reachable by every role that can log in at all. The Logbook and the Tools pages were moved onto
+# their own permission objects so a least-privilege role can leave them out (issue #652). These
+# tests keep them there.
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:EntrypointRoot = Join-Path $BackendRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions'
+    $RolePattern = [regex]::new('(?is)\.ROLE\s+([A-Za-z0-9.]+)')
+
+    function Get-EntrypointRole {
+        param([string]$Name)
+        $File = Get-ChildItem -Path $script:EntrypointRoot -Filter "Invoke-$Name.ps1" -Recurse -File | Select-Object -First 1
+        if (-not $File) { throw "Invoke-$Name.ps1 not found under $script:EntrypointRoot" }
+        $Match = $RolePattern.Match([System.IO.File]::ReadAllText($File.FullName))
+        if (-not $Match.Success) { throw "Invoke-$Name.ps1 declares no .ROLE" }
+        return $Match.Groups[1].Value
+    }
+}
+
+Describe 'Sign-in permission scope' {
+    It 'keeps <Endpoint> on <Role>' -ForEach @(
+        @{ Endpoint = 'ListLogs'; Role = 'CIPP.Logs.Read' }
+        @{ Endpoint = 'ListIPWhitelist'; Role = 'CIPP.IPDatabase.Read' }
+        @{ Endpoint = 'ListKnownIPDb'; Role = 'CIPP.IPDatabase.Read' }
+        @{ Endpoint = 'ListBreachesAccount'; Role = 'CIPP.BreachLookup.Read' }
+        @{ Endpoint = 'ListBreachesTenant'; Role = 'CIPP.BreachLookup.Read' }
+        @{ Endpoint = 'ExecBreachSearch'; Role = 'CIPP.BreachLookup.Read' }
+        @{ Endpoint = 'ListCommunityRepos'; Role = 'CIPP.TemplateLibrary.Read' }
+        @{ Endpoint = 'ListCommunityRepoTemplates'; Role = 'CIPP.TemplateLibrary.Read' }
+        @{ Endpoint = 'ExecCommunityRepo'; Role = 'CIPP.TemplateLibrary.ReadWrite' }
+        @{ Endpoint = 'ListGeneratedReports'; Role = 'CIPP.ReportBuilder.Read' }
+        @{ Endpoint = 'ListReportBuilderTemplates'; Role = 'CIPP.ReportBuilder.Read' }
+        @{ Endpoint = 'ExecGenerateReportBuilderReport'; Role = 'CIPP.ReportBuilder.ReadWrite' }
+        @{ Endpoint = 'ExecReportBuilderTemplate'; Role = 'CIPP.ReportBuilder.ReadWrite' }
+        @{ Endpoint = 'ExecGetReportBuilderPdf'; Role = 'CIPP.ReportBuilder.Read' }
+        @{ Endpoint = 'ExecPreviewReportBuilderPdf'; Role = 'CIPP.ReportBuilder.ReadWrite' }
+    ) {
+        Get-EntrypointRole -Name $Endpoint | Should -Be $Role
+    }
+
+    It 'declares no Tools endpoint on the sign-in permission' {
+        $ToolsRoot = Join-Path $script:EntrypointRoot 'Tools'
+        $OnCore = @(
+            foreach ($File in Get-ChildItem -Path $ToolsRoot -Filter 'Invoke-*.ps1' -Recurse -File) {
+                $Match = $RolePattern.Match([System.IO.File]::ReadAllText($File.FullName))
+                if ($Match.Success -and $Match.Groups[1].Value -like 'CIPP.Core.*') { $File.Name }
+            }
+        )
+        # ListGitHubReleaseNotes feeds the release notes dialog every signed-in user sees, and
+        # ListBrandingPresets styles every PDF export, so both stay on the sign-in permission.
+        $SharedByEveryPage = @('Invoke-ListGitHubReleaseNotes.ps1', 'Invoke-ListBrandingPresets.ps1')
+        $OnCore | Where-Object { $_ -notin $SharedByEveryPage } | Should -BeNullOrEmpty
+    }
+
+    It 'still lets every role sign in through CIPP.Core.Read' {
+        Get-EntrypointRole -Name 'ListTenants' | Should -Be 'CIPP.Core.Read'
+        Get-EntrypointRole -Name 'GetVersion' | Should -Be 'CIPP.Core.Read'
+    }
+}
diff --git a/Tests/Baselines/BaselineExecutors.Tests.ps1 b/Tests/Baselines/BaselineExecutors.Tests.ps1
index 40f3b7ac7d6b1..f0088aacb2c4c 100644
--- a/Tests/Baselines/BaselineExecutors.Tests.ps1
+++ b/Tests/Baselines/BaselineExecutors.Tests.ps1
@@ -107,6 +107,80 @@ Describe 'Invoke-CIPPBaselineExoRequest' {
             $cmdParams['Identity'] -eq 'Default' -and $cmdParams['NotifyOutboundSpam'] -eq $true
         }
     }
+
+    It 'skips a step whose only param is an empty GenericHashTable edit' {
+        # An empty %allowListAdd% variable renders Add as null/empty - Exchange rejects
+        # that with "MultiValuedProperty collections cannot contain null values".
+        $Spec = @{ cmdlets = @(@{
+                    cmdlet = 'Set-ExternalInOutlook'
+                    params = @{ AllowList = @{ '@odata.type' = '#Exchange.GenericHashTable'; Add = $null } }
+                }) } | ConvertTo-Spec
+        Invoke-CIPPBaselineExoRequest -Remediate $Spec -TenantFilter $script:Tenant -Current $null
+        Should -Invoke New-ExoRequest -Times 0 -Exactly
+    }
+
+    It 'drops only the empty edit from a mixed step, keeping the other params' {
+        $Spec = @{ cmdlets = @(@{
+                    cmdlet = 'Set-ExternalInOutlook'
+                    params = @{
+                        Enabled   = $true
+                        AllowList = @{ '@odata.type' = '#Exchange.GenericHashTable'; Add = @(); Remove = $null }
+                    }
+                }) } | ConvertTo-Spec
+        Invoke-CIPPBaselineExoRequest -Remediate $Spec -TenantFilter $script:Tenant -Current $null
+        Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+            $cmdParams.ContainsKey('Enabled') -and -not $cmdParams.ContainsKey('AllowList')
+        }
+    }
+
+    It 'strips null/empty entries out of a non-empty Add array before sending' {
+        $Spec = @{ cmdlets = @(@{
+                    cmdlet = 'Set-ExternalInOutlook'
+                    params = @{ AllowList = @{ '@odata.type' = '#Exchange.GenericHashTable'; Add = @('contoso.com', $null, '') } }
+                }) } | ConvertTo-Spec
+        Invoke-CIPPBaselineExoRequest -Remediate $Spec -TenantFilter $script:Tenant -Current $null
+        Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+            (@($cmdParams['AllowList'].Add) -join ',') -eq 'contoso.com'
+        }
+    }
+
+    It 'sends a non-empty GenericHashTable edit unchanged' {
+        $Spec = @{ cmdlets = @(@{
+                    cmdlet = 'Set-ExternalInOutlook'
+                    params = @{ AllowList = @{ '@odata.type' = '#Exchange.GenericHashTable'; Add = @('contoso.com') } }
+                }) } | ConvertTo-Spec
+        Invoke-CIPPBaselineExoRequest -Remediate $Spec -TenantFilter $script:Tenant -Current $null
+        Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+            $cmdParams.ContainsKey('AllowList') -and @($cmdParams['AllowList'].Add) -contains 'contoso.com'
+        }
+    }
+
+    It 'keeps a legitimate falsy entry (0) in a non-empty Add array' {
+        # Where-Object { $_ } would also drop 0/$false - only null and blank strings are empty.
+        $Spec = @{ cmdlets = @(@{
+                    cmdlet = 'Set-ExternalInOutlook'
+                    params = @{ AllowList = @{ '@odata.type' = '#Exchange.GenericHashTable'; Add = @(0, $null, '') } }
+                }) } | ConvertTo-Spec
+        Invoke-CIPPBaselineExoRequest -Remediate $Spec -TenantFilter $script:Tenant -Current $null
+        Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+            @($cmdParams['AllowList'].Add).Count -eq 1 -and @($cmdParams['AllowList'].Add)[0] -eq 0
+        }
+    }
+
+    It 'passes null, numeric and other non-object params through unchanged' {
+        # A null/scalar param indexed the same way as a GenericHashTable edit threw
+        # "Cannot index into a null array." and failed the whole remediation.
+        $Spec = @{ cmdlets = @(@{
+                    cmdlet = 'Set-Thing'
+                    params = @{ Identity = 'x'; Nullable = $null; Count = 0 }
+                }) } | ConvertTo-Spec
+        Invoke-CIPPBaselineExoRequest -Remediate $Spec -TenantFilter $script:Tenant -Current $null
+        Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+            $cmdParams.ContainsKey('Identity') -and $cmdParams['Identity'] -eq 'x' -and
+            $cmdParams.ContainsKey('Nullable') -and $null -eq $cmdParams['Nullable'] -and
+            $cmdParams.ContainsKey('Count') -and $cmdParams['Count'] -eq 0
+        }
+    }
 }
 
 Describe 'Invoke-CIPPBaselineDeviceRegistrationPolicy' {
diff --git a/Tests/Baselines/BaselineIntuneDeployers.Tests.ps1 b/Tests/Baselines/BaselineIntuneDeployers.Tests.ps1
index 490a7a8b54290..24a33da40f96e 100644
--- a/Tests/Baselines/BaselineIntuneDeployers.Tests.ps1
+++ b/Tests/Baselines/BaselineIntuneDeployers.Tests.ps1
@@ -28,11 +28,16 @@ BeforeAll {
     function Add-CIPPApplicationPermission { param($RequiredResourceAccess, $ApplicationId, $TemplateId, $TenantFilter) }
     function Get-CippTable { param($tablename) @{} }
     function Get-CIPPAzDataTableEntity { param($Filter) }
+    function Add-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
+    function Remove-AzDataTableEntity { param($Entity, [switch]$Force) }
     function Get-CIPPTextReplacement { param($TenantFilter, $Text) $Text }
     function Get-NormalizedError { param($Message) "$Message" }
 
     . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneCompareExclusions.ps1')
     . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1')
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Get-CIPPEnrollmentTimeDeviceMembershipTarget.ps1')
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Set-CIPPEnrollmentTimeDeviceMembershipTarget.ps1')
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Remove-CIPPEnrollmentTimeDeviceMembershipMarker.ps1')
     . (Join-Path $Baselines 'Get-CIPPBaselineCacheRows.ps1')
     . (Join-Path $Baselines 'Test-CIPPBaselineCacheCollected.ps1')
     foreach ($Name in @('DefenderAVPolicy', 'DefenderASRPolicy', 'DefenderEDRPolicy', 'DefenderExclusionPolicy',
@@ -287,7 +292,7 @@ Describe 'Get-CIPPBaselineDevicePrepProfileState' {
                 (New-ChoiceSetting 'enrollment_autopilot_dpp_deploymentmode' 'enrollment_autopilot_dpp_deploymentmode_0')
                 (New-ChoiceSetting 'enrollment_autopilot_dpp_deploymenttype' 'enrollment_autopilot_dpp_deploymenttype_0')
                 (New-ChoiceSetting 'enrollment_autopilot_dpp_jointype' 'enrollment_autopilot_dpp_jointype_0')
-                (New-ChoiceSetting 'enrollment_autopilot_dpp_accountype' 'enrollment_autopilot_dpp_accountype_0')
+                (New-ChoiceSetting 'enrollment_autopilot_dpp_accountype' 'enrollment_autopilot_dpp_accountype_1')
                 (New-ChoiceSetting 'enrollment_autopilot_dpp_allowskip' 'enrollment_autopilot_dpp_allowskip_0')
                 (New-ChoiceSetting 'enrollment_autopilot_dpp_allowdiagnostics' 'enrollment_autopilot_dpp_allowdiagnostics_0')
                 @{ settingInstance = @{ settingDefinitionId = 'enrollment_autopilot_dpp_timeout'; simpleSettingValue = @{ value = 60 } } }
@@ -326,6 +331,138 @@ Describe 'Get-CIPPBaselineDevicePrepProfileState' {
         (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -BeGreaterThan 0
     }
 
+    It 'reads deviceGroupId from the membership target, not from the settings string' {
+        # The devicesecuritygroupids string the portal displays is not what Intune enrols
+        # devices into - the cache carries only the string, so this has to be a live read.
+        Mock New-CIPPDbRequest { @($script:DppPolicy | ConvertTo-Cached) }
+        Mock Compare-CIPPIntuneAssignments { [PSCustomObject]@{ Unknown = $true } }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock Get-CIPPAzDataTableEntity { }
+        Mock New-GraphPostRequest { [PSCustomObject]@{ enrollmentTimeDeviceMembershipTargets = @([PSCustomObject]@{ targetType = 'staticSecurityGroup'; targetId = 'device-group-1' }) } }
+        # The cache string is deliberately EMPTY here: the live action must win over it.
+        $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ProfileName = 'CIPP Device Prep'; CustomErrorMessage = 'msg'; DeviceGroupName = 'DPP Devices'; AssignTo = 'none' } }
+        $Prepared = Get-CIPPBaselineDevicePrepProfileState -Item $Item -TenantFilter $script:Tenant
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like "*configurationPolicies('dpp-1')/retrieveEnrollmentTimeDeviceMembershipTarget" }
+        $Prepared.Current.deviceGroupId | Should -Be 'device-group-1'
+        $Prepared.Expected.deviceGroupId | Should -Be 'device-group-1'
+        # Repairable in place: applying the group must never send the profile down recreate.
+        $Prepared.Current.settingsCorrect | Should -BeTrue
+    }
+
+    It 'the MARKER answers only when the action does not route' {
+        Mock New-CIPPDbRequest { @($script:DppPolicy | ConvertTo-Cached) }
+        Mock Compare-CIPPIntuneAssignments { [PSCustomObject]@{ Unknown = $true } }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ PartitionKey = $script:Tenant; RowKey = 'dpp-1'; GroupId = 'device-group-1' } }
+        Mock New-GraphPostRequest { throw 'No OData route exists' }
+        $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ProfileName = 'CIPP Device Prep'; CustomErrorMessage = 'msg'; DeviceGroupName = 'DPP Devices'; AssignTo = 'none' } }
+        $Prepared = Get-CIPPBaselineDevicePrepProfileState -Item $Item -TenantFilter $script:Tenant
+        # The action is attempted first and fails; the marker is what answers.
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*retrieveEnrollmentTimeDeviceMembershipTarget' }
+        $Prepared.Current.deviceGroupId | Should -Be 'device-group-1'
+        (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -Be 0
+    }
+
+    It 'a MISSING membership target grades as a deviation while the settings stay correct' {
+        Mock New-CIPPDbRequest { @($script:DppPolicy | ConvertTo-Cached) }
+        Mock Compare-CIPPIntuneAssignments { [PSCustomObject]@{ Unknown = $true } }
+        Mock Get-CIPPAzDataTableEntity { }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock New-GraphPostRequest { [PSCustomObject]@{ enrollmentTimeDeviceMembershipTargets = @() } }
+        $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ProfileName = 'CIPP Device Prep'; CustomErrorMessage = 'msg'; DeviceGroupName = 'DPP Devices'; AssignTo = 'none' } }
+        $Prepared = Get-CIPPBaselineDevicePrepProfileState -Item $Item -TenantFilter $script:Tenant
+        $Prepared.Current.deviceGroupId | Should -Be ''
+        (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -BeGreaterThan 0
+        $Prepared.Current.settingsCorrect | Should -BeTrue
+    }
+
+    It 'the settings string alone never vouches for the profile - no marker grades as deviated' {
+        # Every create writes the string whether or not the group was ever applied, so a
+        # half-deployed profile would otherwise grade as healthy forever.
+        $PolicyCopy = $script:DppPolicy.Clone()
+        $PolicyCopy.settings = @($script:DppPolicy.settings | Where-Object { $_.settingInstance.settingDefinitionId -ne 'enrollment_autopilot_dpp_devicesecuritygroupids' }) +
+        @(@{ settingInstance = @{ settingDefinitionId = 'enrollment_autopilot_dpp_devicesecuritygroupids'; simpleSettingValue = @{ value = 'device-group-1' } } })
+        $script:StringOnlyPolicy = $PolicyCopy
+        Mock New-CIPPDbRequest { @($script:StringOnlyPolicy | ConvertTo-Cached) }
+        Mock Compare-CIPPIntuneAssignments { [PSCustomObject]@{ Unknown = $true } }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock Get-CIPPAzDataTableEntity { }
+        Mock New-GraphPostRequest { throw 'No OData route exists' }
+        $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ProfileName = 'CIPP Device Prep'; CustomErrorMessage = 'msg'; DeviceGroupName = 'DPP Devices'; AssignTo = 'none' } }
+        $Prepared = Get-CIPPBaselineDevicePrepProfileState -Item $Item -TenantFilter $script:Tenant
+        $Prepared.Current.deviceGroupId | Should -Be ''
+        (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -BeGreaterThan 0
+        $Prepared.Current.settingsCorrect | Should -BeTrue
+    }
+
+    It 'an EXPECTED group that does not exist leaves the dimension out - nothing here can create it' {
+        Mock New-CIPPDbRequest { @($script:DppPolicy | ConvertTo-Cached) }
+        Mock Compare-CIPPIntuneAssignments { [PSCustomObject]@{ Unknown = $true } }
+        Mock New-GraphGetRequest { @() }
+        Mock Get-CIPPAzDataTableEntity { }
+        Mock New-GraphPostRequest { throw 'should not be called' }
+        $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ProfileName = 'CIPP Device Prep'; CustomErrorMessage = 'msg'; DeviceGroupName = 'DPP Devices'; AssignTo = 'none' } }
+        $Prepared = Get-CIPPBaselineDevicePrepProfileState -Item $Item -TenantFilter $script:Tenant
+        $Prepared.Expected.PSObject.Properties.Name | Should -Not -Contain 'deviceGroupId'
+        $Prepared.Current.PSObject.Properties.Name | Should -Not -Contain 'deviceGroupId'
+        (Get-Verdict -Expected $Prepared.Expected -Current $Prepared.Current).Count | Should -Be 0
+    }
+
+    It 'repairs ONLY what drifted: a wrong group does not re-post a correct assignment' {
+        Mock Get-CIPPIntuneAssignmentTarget { [PSCustomObject]@{ Targets = @(@{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = 'g2' }); Unsupported = $null } }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock New-GraphPostRequest { [PSCustomObject]@{ validationSucceeded = $true } }
+        Mock Add-CIPPAzDataTableEntity { }
+        $Remediate = [PSCustomObject]@{ profileName = 'CIPP Device Prep'; assignTo = 'AllDevicesAndUsers'; deviceGroupName = 'DPP Devices' }
+        $Current = [PSCustomObject]@{ policyId = 'dpp-1'; settingsCorrect = $true; isAssigned = $true; deviceGroupId = '' }
+        Invoke-CIPPBaselineDevicePrepProfile -Remediate $Remediate -TenantFilter $script:Tenant -Current $Current
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*setEnrollmentTimeDeviceMembershipTarget' }
+    }
+
+    It 'repairs ONLY what drifted: a wrong assignment does not re-apply a correct group' {
+        Mock Get-CIPPIntuneAssignmentTarget { [PSCustomObject]@{ Targets = @(@{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = 'g2' }); Unsupported = $null } }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock New-GraphPostRequest { [PSCustomObject]@{ validationSucceeded = $true } }
+        Mock Add-CIPPAzDataTableEntity { }
+        $Remediate = [PSCustomObject]@{ profileName = 'CIPP Device Prep'; assignTo = 'AllDevicesAndUsers'; deviceGroupName = 'DPP Devices' }
+        $Current = [PSCustomObject]@{ policyId = 'dpp-1'; settingsCorrect = $true; isAssigned = $false; deviceGroupId = 'device-group-1' }
+        Invoke-CIPPBaselineDevicePrepProfile -Remediate $Remediate -TenantFilter $script:Tenant -Current $Current
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like "*configurationPolicies('dpp-1')/assign" }
+    }
+
+    It 'the repair-in-place branch APPLIES the device group, which /assign never does' {
+        Mock Get-CIPPIntuneAssignmentTarget { [PSCustomObject]@{ Targets = @(); Unsupported = $null } }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock New-GraphPostRequest { [PSCustomObject]@{ validationSucceeded = $true } }
+        Mock Add-CIPPAzDataTableEntity { }
+        $Remediate = [PSCustomObject]@{ profileName = 'CIPP Device Prep'; assignTo = 'none'; deviceGroupName = 'DPP Devices' }
+        Invoke-CIPPBaselineDevicePrepProfile -Remediate $Remediate -TenantFilter $script:Tenant -Current ([PSCustomObject]@{ policyId = 'dpp-1'; settingsCorrect = $true })
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter {
+            $uri -like "*configurationPolicies('dpp-1')/setEnrollmentTimeDeviceMembershipTarget" -and
+            ($body | ConvertFrom-Json).enrollmentTimeDeviceMembershipTargets[0].targetId -eq 'device-group-1'
+        }
+    }
+
+    It 'the recreate branch applies the device group to the NEW policy and re-markers it' {
+        Mock Get-CIPPIntuneAssignmentTarget { [PSCustomObject]@{ Targets = @(); Unsupported = $null } }
+        Mock New-GraphGetRequest { @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DPP Devices' }) }
+        Mock New-GraphPostRequest { [PSCustomObject]@{ id = 'dpp-new'; validationSucceeded = $true } }
+        Mock Add-CIPPAzDataTableEntity { }
+        Mock Remove-AzDataTableEntity { }
+        $Remediate = [PSCustomObject]@{ profileName = 'CIPP Device Prep'; assignTo = 'none'; deviceGroupName = 'DPP Devices'; timeout = 90 }
+        Invoke-CIPPBaselineDevicePrepProfile -Remediate $Remediate -TenantFilter $script:Tenant -Current ([PSCustomObject]@{ policyId = 'dpp-1'; settingsCorrect = $false })
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter {
+            $uri -like "*configurationPolicies('dpp-new')/setEnrollmentTimeDeviceMembershipTarget" -and
+            ($body | ConvertFrom-Json).enrollmentTimeDeviceMembershipTargets[0].targetId -eq 'device-group-1'
+        }
+        # The old id is gone, so its marker must not outlive it.
+        Should -Invoke Remove-AzDataTableEntity -Times 1 -Exactly -ParameterFilter { $Entity.RowKey -eq 'dpp-1' }
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $Entity.RowKey -eq 'dpp-new' -and $Entity.GroupId -eq 'device-group-1' }
+    }
+
     It 'repairs a wrong assignment IN PLACE - no delete, no recreate' {
         Mock Get-CIPPIntuneAssignmentTarget { [PSCustomObject]@{ Targets = @(@{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = 'g2' }); Unsupported = $null } }
         Mock New-GraphPostRequest { }
diff --git a/Tests/Baselines/BaselineMigrationValueMaps.Tests.ps1 b/Tests/Baselines/BaselineMigrationValueMaps.Tests.ps1
new file mode 100644
index 0000000000000..05788090a73b8
--- /dev/null
+++ b/Tests/Baselines/BaselineMigrationValueMaps.Tests.ps1
@@ -0,0 +1,67 @@
+# The V2 -> baseline migration copies a setting across verbatim when it cannot map the value,
+# and the generic path only snaps a value onto a V3 option when it already equals one. A V2
+# value in a different vocabulary (a switch where V3 wants 'Enabled', an enum name where V3
+# wants the SPO numeric) therefore lands untranslated, and the standard reports drift on every
+# run against a tenant that is actually compliant. These tests run the real migration over the
+# real definitions and pin the translated variables for the standards that need a value map.
+
+BeforeAll {
+    $script:RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $DefinitionRoot = Join-Path $script:RepoRoot 'Config/BaselineStandards'
+
+    function Get-CIPPBaselineDefinition { param($Name) }
+    function Get-CippTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Filter) }
+    function ConvertTo-CIPPODataFilterValue { param($Value) }
+    function New-CIPPBaseline { param($Baseline, $User, $Source, $SHA) }
+    function Write-LogMessage { param($API, $message, $Sev) }
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineMigration.ps1')
+
+    $script:Definitions = Get-ChildItem -Path $DefinitionRoot -Recurse -Filter '*.json' | ForEach-Object { Get-Content $_.FullName -Raw | ConvertFrom-Json }
+
+    # Migrates one V2 template holding the given standards and returns the saved stage configs.
+    function Invoke-Migration {
+        param([hashtable]$Standards)
+        $script:Saved = $null
+        $Json = @{ templateName = 'Test'; tenantFilter = @(@{ label = 'Contoso'; value = 'contoso.com' }); standards = $Standards } | ConvertTo-Json -Depth 20
+        Mock Get-CIPPAzDataTableEntity { @([PSCustomObject]@{ RowKey = 'v2-guid'; GUID = 'v2-guid'; JSON = $Json }) } -ParameterFilter { $Filter -like "*StandardsTemplateV2*" }
+        Mock Get-CIPPAzDataTableEntity { $null } -ParameterFilter { $Filter -like "*rollout*" }
+        Mock New-CIPPBaseline { $script:Saved = $Baseline; [PSCustomObject]@{ GUID = 'b-guid'; DeltaCount = 0 } }
+        $Report = Invoke-CIPPBaselineMigration
+        [PSCustomObject]@{ Report = $Report.templates[0]; Configs = @($script:Saved.stages[0].standards) }
+    }
+}
+
+Describe 'Invoke-CIPPBaselineMigration value maps' {
+    BeforeEach {
+        Mock Get-CIPPBaselineDefinition { $script:Definitions }
+        Mock Get-CippTable { @{} }
+        Mock ConvertTo-CIPPODataFilterValue { $Value }
+        Mock Write-LogMessage {}
+    }
+
+    Context 'TeamsChatProtection' {
+        It 'translates the V2 switches to the Enabled/Disabled strings the Teams cmdlet takes' {
+            $Result = Invoke-Migration @{ TeamsChatProtection = @{ action = @('warn'); standards = @{ TeamsChatProtection = @{ FileTypeCheck = $true; UrlReputationCheck = $false } } } }
+            $Config = $Result.Configs | Where-Object standard -EQ 'TeamsChatProtection'
+            $Config.variables.FileTypeCheck | Should -BeExactly 'Enabled'
+            $Config.variables.UrlReputationCheck | Should -BeExactly 'Disabled'
+        }
+    }
+
+    Context 'DefaultSharingLink' {
+        It 'translates the V2 enum names to the SPO numerics the definition compares against' {
+            $Internal = Invoke-Migration @{ DefaultSharingLink = @{ action = @('warn'); standards = @{ DefaultSharingLink = @{ SharingLinkType = @{ label = 'Internal - Only people in your organization'; value = 'Internal' } } } } }
+            $Direct = Invoke-Migration @{ DefaultSharingLink = @{ action = @('warn'); standards = @{ DefaultSharingLink = @{ SharingLinkType = 'Direct' } } } }
+            ($Internal.Configs | Where-Object standard -EQ 'DefaultSharingLink').variables.sharingLinkType | Should -Be 2
+            ($Direct.Configs | Where-Object standard -EQ 'DefaultSharingLink').variables.sharingLinkType | Should -Be 1
+        }
+
+        It 'lands on the definition option value so the editor shows the selection' {
+            $Result = Invoke-Migration @{ DefaultSharingLink = @{ action = @('warn'); standards = @{ DefaultSharingLink = @{ SharingLinkType = 'Internal' } } } }
+            $Value = ($Result.Configs | Where-Object standard -EQ 'DefaultSharingLink').variables.sharingLinkType
+            $Options = ($script:Definitions | Where-Object name -EQ 'DefaultSharingLink').variables.sharingLinkType.options.value
+            $Options | Should -Contain $Value
+        }
+    }
+}
diff --git a/Tests/Baselines/BaselineOneOffStandards.Tests.ps1 b/Tests/Baselines/BaselineOneOffStandards.Tests.ps1
index ef0b39145ca94..ec18ab3c23ab4 100644
--- a/Tests/Baselines/BaselineOneOffStandards.Tests.ps1
+++ b/Tests/Baselines/BaselineOneOffStandards.Tests.ps1
@@ -158,7 +158,14 @@ Describe 'Get-CIPPBaselineEnableAppConsentRequestsState' {
         Mock New-CIPPDbRequest { @(@{ isEnabled = $true; reviewers = @(@{ query = '/v1.0/users/someone@contoso.com' }) } | ConvertTo-Cached) }
         $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{ ReviewerRoles = [PSCustomObject]@{ label = 'GA'; value = '62e90394-69f5-4237-9190-012177145e10' } } }
         $Prepared = Get-CIPPBaselineEnableAppConsentRequestsState -Item $Item -TenantFilter $script:Tenant
-        $Prepared.Current.missingReviewerRoles | Should -Contain '62e90394-69f5-4237-9190-012177145e10'
+        $Prepared.Current.missingReviewerRoles | Should -Contain 'GA'
+    }
+
+    It 'names the default Global Administrator role when no role is configured and it is missing' {
+        Mock New-CIPPDbRequest { @(@{ isEnabled = $true; reviewers = @(@{ query = '/v1.0/users/someone@contoso.com' }) } | ConvertTo-Cached) }
+        $Item = [PSCustomObject]@{ Variables = [PSCustomObject]@{} }
+        $Prepared = Get-CIPPBaselineEnableAppConsentRequestsState -Item $Item -TenantFilter $script:Tenant
+        $Prepared.Current.missingReviewerRoles | Should -Be @('Global Administrator')
     }
 
     It 'merges configured roles into the reviewer list without dropping hand-added ones' {
diff --git a/Tests/Baselines/BaselineOneOffVerify.Tests.ps1 b/Tests/Baselines/BaselineOneOffVerify.Tests.ps1
index 1d3f9f95fbde8..a8eb18c5ce00d 100644
--- a/Tests/Baselines/BaselineOneOffVerify.Tests.ps1
+++ b/Tests/Baselines/BaselineOneOffVerify.Tests.ps1
@@ -12,8 +12,9 @@ BeforeAll {
     function Update-CippQueueEntry { param($RowKey, $Status, $Name) }
     function Get-CIPPBaselineDefinition { param($Name) }
     function Get-CippTable { param($tablename) @{} }
-    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) "$Value" }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) "$Value" -replace "'", "''" }
     function Get-CIPPAzDataTableEntity { param($Filter) }
+    function Add-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
     function Remove-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
     function Add-CIPPBaselineHistoryEvent { param($TenantFilter, $Standard, $Mode, $TriggeredBy, $Outcome, $Detail, $RunId, $Remediated) }
     function Set-CIPPBaselineResult { param($Result, $Prior, $RunId) }
@@ -348,6 +349,8 @@ Describe 'Push-CIPPBaselineStandard oneoff verification' {
         Mock Set-CIPPDBCacheTestCache { }
         Mock Start-Sleep { }
         Mock Write-LogMessage { }
+        Mock Get-CIPPAzDataTableEntity { [PSCustomObject]@{ PartitionKey = $script:Tenant; RowKey = 'TestStd'; PendingVerification = $true } }
+        Mock Add-CIPPAzDataTableEntity { }
         $script:PushItem = @{
             RunId = 'run-1'; Mode = 'oneoff'; TriggeredBy = 'operator@contoso.com'
             Item  = @{ TenantFilter = $script:Tenant; Standard = 'TestStd'; BaseName = 'TestStd' }
@@ -366,6 +369,29 @@ Describe 'Push-CIPPBaselineStandard oneoff verification' {
         Should -Invoke Write-LogMessage -Times 0 -Exactly -ParameterFilter { $Sev -eq 'Warning' }
     }
 
+    It 'a clean verdict clears PendingVerification on the stored row' {
+        Mock Invoke-CIPPBaselineStandard {
+            if ($GradeOnly) { $script:GradeCalls++; return [PSCustomObject]@{ Compliant = $true } }
+            [PSCustomObject]@{ Remediated = $true; CacheType = @('TestCache') }
+        }
+        Push-CIPPBaselineStandard -Item $script:PushItem
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $Entity.PendingVerification -eq $false }
+    }
+
+    It 'escapes an apostrophe in the Standard name before it reaches the table filter' {
+        # Instance keys are derived from template names and can carry an apostrophe -
+        # unescaped, it breaks out of the OData string literal.
+        Mock Invoke-CIPPBaselineStandard {
+            if ($GradeOnly) { $script:GradeCalls++; return [PSCustomObject]@{ Compliant = $true } }
+            [PSCustomObject]@{ Remediated = $true; CacheType = @('TestCache') }
+        }
+        $script:PushItem.Item.Standard = "IntuneTemplate#Bob's Policy"
+        Push-CIPPBaselineStandard -Item $script:PushItem
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter {
+            $Filter -eq "PartitionKey eq '$($script:Tenant)' and RowKey eq 'IntuneTemplate~Bob''s Policy'"
+        }
+    }
+
     It 'stale then fresh: waits for propagation, collects a SECOND time, ends quiet' {
         # The whole point of the fix - the first refresh captured pre-write state, the
         # retry after the backoff captures the real one.
@@ -380,6 +406,15 @@ Describe 'Push-CIPPBaselineStandard oneoff verification' {
         Should -Invoke Write-LogMessage -Times 0 -Exactly -ParameterFilter { $Sev -eq 'Warning' }
     }
 
+    It 'a verdict that only turns clean AFTER the retries also clears PendingVerification' {
+        Mock Invoke-CIPPBaselineStandard {
+            if ($GradeOnly) { $script:GradeCalls++; return [PSCustomObject]@{ Compliant = ($script:GradeCalls -ge 2) } }
+            [PSCustomObject]@{ Remediated = $true; CacheType = @('TestCache') }
+        }
+        Push-CIPPBaselineStandard -Item $script:PushItem
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $Entity.PendingVerification -eq $false }
+    }
+
     It 'still stale after BOTH retries: warns and STOPS - two growing backoffs, never a loop' {
         Mock Invoke-CIPPBaselineStandard {
             if ($GradeOnly) { $script:GradeCalls++; return [PSCustomObject]@{ Compliant = $false } }
@@ -392,6 +427,15 @@ Describe 'Push-CIPPBaselineStandard oneoff verification' {
         Should -Invoke Write-LogMessage -Times 1 -Exactly -ParameterFilter { $Sev -eq 'Warning' -and $message -like '*still grades*' }
     }
 
+    It 'still non-compliant after both retries does NOT write the row' {
+        Mock Invoke-CIPPBaselineStandard {
+            if ($GradeOnly) { $script:GradeCalls++; return [PSCustomObject]@{ Compliant = $false } }
+            [PSCustomObject]@{ Remediated = $true; CacheType = @('TestCache') }
+        }
+        Push-CIPPBaselineStandard -Item $script:PushItem
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly
+    }
+
     It 'scheduled runs are untouched: impact records out, no inline refresh, no verification' {
         Mock Invoke-CIPPBaselineStandard {
             if ($GradeOnly) { $script:GradeCalls++; return [PSCustomObject]@{ Compliant = $true } }
@@ -403,6 +447,7 @@ Describe 'Push-CIPPBaselineStandard oneoff verification' {
         $Records[0].CacheType | Should -Be 'TestCache'
         Should -Invoke Set-CIPPDBCacheTestCache -Times 0 -Exactly
         $script:GradeCalls | Should -Be 0
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly
     }
 }
 
diff --git a/Tests/Baselines/BaselineSPAnonymousLinkExpiration.Tests.ps1 b/Tests/Baselines/BaselineSPAnonymousLinkExpiration.Tests.ps1
new file mode 100644
index 0000000000000..66aadda845c45
--- /dev/null
+++ b/Tests/Baselines/BaselineSPAnonymousLinkExpiration.Tests.ps1
@@ -0,0 +1,187 @@
+# SPAnonymousLinkExpiration is a single-file (declarative) definition: no prepare hook, no
+# named executor. What can go wrong is therefore in the definition itself and in how the
+# engine renders it - a misspelled SPOTenant property grades against nothing, a blank
+# optional picker leaves its raw token in the write, a number saved as "30" never equals
+# a cached 30. These tests run the REAL definition through the REAL engine against a
+# mocked SPOTenant cache row and pin the grading verdicts and the write shape handed to
+# the SPOTenant executor.
+
+BeforeAll {
+    $script:RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    function Write-LogMessage { param($API, $tenant, $message, $Sev, $LogData) }
+    function Set-CippBaselineRunContext { param($RunId) }
+    function Update-CippQueueEntry { param($RowKey, $Status, $Name) }
+    function Get-CippTable { param($tablename) @{} }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) "$Value" }
+    function Get-CIPPAzDataTableEntity { param($Filter) }
+    function Remove-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
+    function Add-CIPPBaselineHistoryEvent { param($TenantFilter, $Standard, $Mode, $TriggeredBy, $Outcome, $Detail, $RunId, $Remediated) }
+    function Set-CIPPBaselineResult { param($Result, $Prior, $RunId) }
+    function Send-CIPPBaselineAlert { param($Result) }
+    function New-CIPPDbRequest { param($TenantFilter, $Type, $Fields) }
+    function Get-CIPPTextReplacement { param($TenantFilter, $Text, [switch]$EscapeForJson) $Text }
+    function Get-CIPPTenantCapabilities { param($TenantFilter) }
+    function Get-CIPPBaselineDefinition { param($Name) }
+    function Wait-CIPPBaselineCacheReady { param($TenantFilter, $Definition, $RunId) $false }
+    # The engine resolves both by naming convention with Get-Command; stubs keep the
+    # resolution honest without touching SharePoint.
+    function Set-CIPPDBCacheSPOTenant { param($TenantFilter) }
+    function Invoke-CIPPBaselineSPOTenant { param($Remediate, $TenantFilter, $Current) }
+    function Get-CIPPSPOTenant { param($TenantFilter) }
+    function Set-CIPPSPOTenant { [CmdletBinding()] param([Parameter(ValueFromPipeline = $true)]$InputObject, $Properties, $MethodName, $MethodParameters, [switch]$UseCertificate) process { } }
+
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneCompareExclusions.ps1')
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Compare-CIPPIntuneObject.ps1')
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineStandard.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:DefinitionPath = Join-Path $script:RepoRoot 'Config/BaselineStandards/SharePoint Standards/SPAnonymousLinkExpiration.json'
+    $script:Definition = Get-Content $script:DefinitionPath -Raw | ConvertFrom-Json
+
+    # The frontend posts number inputs as strings and picker selections as {label, value}
+    # wrappers - the fixtures mirror what a saved baseline really holds.
+    function New-EngineItem {
+        param($Variables)
+        @{
+            TenantFilter = $script:Tenant; Standard = 'SPAnonymousLinkExpiration'; BaseName = 'SPAnonymousLinkExpiration'
+            Variables = $Variables; Tiers = @(); AlertEnabled = $false; RemediateEnabled = $true
+        }
+    }
+    $script:ViewOnly = [PSCustomObject]@{ label = 'View only'; value = 1 }
+    # Get-CIPPSPOTenant output round-trips through the CIPPDb as JSON, so cached numbers are Int64.
+    function New-CachedTenant {
+        param([int]$ExpireDays, [int]$FileLink = 2, [int]$FolderLink = 2)
+        [PSCustomObject]@{
+            SharingCapability                 = 2
+            RequireAnonymousLinksExpireInDays = $ExpireDays
+            FileAnonymousLinkType             = $FileLink
+            FolderAnonymousLinkType           = $FolderLink
+            DefaultSharingLinkType            = 1
+        } | ConvertTo-Json -Depth 5 | ConvertFrom-Json
+    }
+}
+
+Describe 'SPAnonymousLinkExpiration definition' {
+    BeforeEach {
+        Mock Get-CIPPBaselineDefinition { $script:Definition }
+        Mock Get-CIPPAzDataTableEntity { @() }
+        Mock Set-CIPPBaselineResult { }
+        Mock Add-CIPPBaselineHistoryEvent { }
+        Mock Send-CIPPBaselineAlert { }
+        Mock Write-LogMessage { }
+        Mock Invoke-CIPPBaselineSPOTenant { }
+        # compare/run modes pass the licence gate; oneoff skips it. Flat list = any-of.
+        Mock Get-CIPPTenantCapabilities { [PSCustomObject]@{ SHAREPOINTSTANDARD = $true } }
+    }
+
+    Context 'grading' {
+        It 'is compliant when the tenant expiry matches and the picked permission holds on files AND folders' {
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays 30 -FileLink 1 -FolderLink 1 }
+            $Result = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30'; linkPermission = $script:ViewOnly })) -Mode 'compare'
+            $Result.Compliant | Should -BeTrue
+            # The number variable is saved as the STRING "30"; the engine must coerce it on the
+            # declared type or the compare is a permanent string-vs-number drift.
+            $Result.ExpectedValue.RequireAnonymousLinksExpireInDays | Should -BeExactly 30
+            $Result.ExpectedValue.RequireAnonymousLinksExpireInDays | Should -Not -BeOfType [string]
+        }
+
+        It 'grades the SharePoint default (-1 = no expiration required) as drift on the expiry property' {
+            # Observed live: a tenant with no expiration policy caches RequireAnonymousLinksExpireInDays as -1,
+            # not the 0 the Set-SPOTenant docs describe for removing the requirement.
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays -1 -FileLink 1 -FolderLink 1 }
+            $Result = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30'; linkPermission = $script:ViewOnly })) -Mode 'compare'
+            $Result.Compliant | Should -BeFalse
+            @($Result.Diff).Property | Should -Contain 'RequireAnonymousLinksExpireInDays'
+        }
+
+        It 'grades a longer-than-baseline expiry as drift - the standard pins the value, not a ceiling' {
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays 90 -FileLink 1 -FolderLink 1 }
+            (Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30'; linkPermission = $script:ViewOnly })) -Mode 'compare').Compliant | Should -BeFalse
+        }
+
+        It 'grades a folder permission looser than the pick as drift even when files comply' {
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays 30 -FileLink 1 -FolderLink 2 }
+            $Result = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30'; linkPermission = $script:ViewOnly })) -Mode 'compare'
+            $Result.Compliant | Should -BeFalse
+            @($Result.Diff).Property | Should -Contain 'FolderAnonymousLinkType'
+            @($Result.Diff).Property | Should -Not -Contain 'FileAnonymousLinkType'
+        }
+
+        It 'with the permission left blank, grades expiry ONLY and expresses no opinion on link permissions' {
+            # Anyone links at Edit on both surfaces must not drift a baseline that never asked.
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays 30 -FileLink 2 -FolderLink 2 }
+            $Result = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30' })) -Mode 'compare'
+            $Result.Compliant | Should -BeTrue
+            $Result.ExpectedValue.PSObject.Properties.Name | Should -Not -Contain 'FileAnonymousLinkType'
+            $Result.ExpectedValue.PSObject.Properties.Name | Should -Not -Contain 'FolderAnonymousLinkType'
+        }
+
+        It 'applies the declared 30-day default when the days variable was never filled in' {
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays 30 }
+            $Result = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{})) -Mode 'compare'
+            $Result.ExpectedValue.RequireAnonymousLinksExpireInDays | Should -BeExactly 30
+            $Result.Compliant | Should -BeTrue
+        }
+
+        It 'reports No Data rather than drift when the SPOTenant cache is empty' {
+            Mock New-CIPPDbRequest { @() }
+            $Result = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30' })) -Mode 'compare'
+            $Result.Compliant | Should -BeFalse
+            $Result.Outcome | Should -Not -Be 'Drift'
+        }
+    }
+
+    Context 'remediation' {
+        It 'hands the SPOTenant executor all three properties, numerically typed, when a permission is picked' {
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays -1 }
+            $Result = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30'; linkPermission = $script:ViewOnly })) -Mode 'oneoff'
+            $Result.Remediated | Should -BeTrue
+            Should -Invoke Invoke-CIPPBaselineSPOTenant -Times 1 -Exactly -ParameterFilter {
+                $TenantFilter -eq $script:Tenant -and
+                $Remediate.properties.RequireAnonymousLinksExpireInDays -eq 30 -and
+                $Remediate.properties.RequireAnonymousLinksExpireInDays -isnot [string] -and
+                $Remediate.properties.FileAnonymousLinkType -eq 1 -and
+                $Remediate.properties.FolderAnonymousLinkType -eq 1 -and
+                -not $Remediate.PSObject.Properties['methods']
+            }
+        }
+
+        It 'prunes BOTH permission properties from the write when the picker is blank - no raw token reaches SharePoint' {
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays -1 }
+            $null = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '45' })) -Mode 'oneoff'
+            Should -Invoke Invoke-CIPPBaselineSPOTenant -Times 1 -Exactly -ParameterFilter {
+                $Remediate.properties.RequireAnonymousLinksExpireInDays -eq 45 -and
+                -not $Remediate.properties.PSObject.Properties['FileAnonymousLinkType'] -and
+                -not $Remediate.properties.PSObject.Properties['FolderAnonymousLinkType'] -and
+                (ConvertTo-Json -Compress -InputObject $Remediate) -notmatch '%'
+            }
+        }
+
+        It 'does not write when the tenant already complies' {
+            Mock New-CIPPDbRequest { New-CachedTenant -ExpireDays 30 -FileLink 1 -FolderLink 1 }
+            $null = Invoke-CIPPBaselineStandard -Item (New-EngineItem ([PSCustomObject]@{ days = '30'; linkPermission = $script:ViewOnly })) -Mode 'run'
+            Should -Invoke Invoke-CIPPBaselineSPOTenant -Times 0 -Exactly
+        }
+    }
+}
+
+Describe 'SPOTenant executor wire shape' {
+    BeforeAll {
+        . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Invoke-CIPPBaselineSPOTenant.ps1')
+    }
+
+    It 'sends the rendered properties to Set-CIPPSPOTenant as Int32 - the CSOM whitelist drops Int64 silently' {
+        Mock Get-CIPPSPOTenant { [PSCustomObject]@{ _ObjectIdentity_ = 'id'; TenantFilter = $script:Tenant } }
+        Mock Set-CIPPSPOTenant { }
+        # Exactly what the engine renders: JSON round-trip makes every number Int64.
+        $Spec = '{"executor":"SPOTenant","properties":{"RequireAnonymousLinksExpireInDays":30,"FileAnonymousLinkType":1,"FolderAnonymousLinkType":1}}' | ConvertFrom-Json
+        Invoke-CIPPBaselineSPOTenant -Remediate $Spec -TenantFilter $script:Tenant -Current $null
+        Should -Invoke Set-CIPPSPOTenant -Times 1 -Exactly -ParameterFilter {
+            $Properties.Count -eq 3 -and
+            $Properties['RequireAnonymousLinksExpireInDays'] -is [int] -and $Properties['RequireAnonymousLinksExpireInDays'] -eq 30 -and
+            $Properties['FileAnonymousLinkType'] -is [int] -and $Properties['FileAnonymousLinkType'] -eq 1 -and
+            $Properties['FolderAnonymousLinkType'] -is [int] -and $Properties['FolderAnonymousLinkType'] -eq 1
+        }
+    }
+}
diff --git a/Tests/Baselines/BaselineUsageLocation.Tests.ps1 b/Tests/Baselines/BaselineUsageLocation.Tests.ps1
new file mode 100644
index 0000000000000..ff5124549257b
--- /dev/null
+++ b/Tests/Baselines/BaselineUsageLocation.Tests.ps1
@@ -0,0 +1,133 @@
+# UsageLocation is a per-user sweep: the prepare hook decides WHICH member accounts are
+# wrong and GraphBulkSweep applies the same PATCH to each. Everything that can go wrong
+# lives in that decision - a guest swept into a licence country, an exclusion group that
+# silently resolved to nothing, a hand-set location overwritten despite 'only when blank'.
+# These tests pin the offender set the hook produces from a mocked Users cache and a
+# mocked transitive-membership lookup.
+
+BeforeAll {
+    $script:RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    function New-CIPPDbRequest { param($TenantFilter, $Type, $Fields) }
+    function Get-CIPPBaselineCacheRows { param($TenantFilter, $Type, $CollectorType, $CollectorArgs) }
+    function New-GraphBulkRequest { param($tenantid, $Requests, $asapp, $Version, $scope) }
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Get-CIPPBaselineUsageLocationState.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:Users = @(
+        [PSCustomObject]@{ id = 'u1'; userPrincipalName = 'alice@contoso.com'; userType = 'Member'; usageLocation = 'US' }
+        [PSCustomObject]@{ id = 'u2'; userPrincipalName = 'bob@contoso.com'; userType = 'Member'; usageLocation = $null }
+        [PSCustomObject]@{ id = 'u3'; userPrincipalName = 'carol@contoso.com'; userType = 'Member'; usageLocation = 'NL' }
+        [PSCustomObject]@{ id = 'u4'; userPrincipalName = 'dave@contoso.com'; userType = 'Member'; usageLocation = 'us' }
+        [PSCustomObject]@{ id = 'g1'; userPrincipalName = 'guest_outlook.com#EXT#@contoso.onmicrosoft.com'; userType = 'Guest'; usageLocation = $null }
+    )
+    $script:Groups = @(
+        [PSCustomObject]@{ id = 'grp-overseas'; displayName = 'Overseas Staff' }
+        [PSCustomObject]@{ id = 'grp-licensed'; displayName = 'Licensed Users' }
+    )
+    function Invoke-Hook {
+        param($Variables)
+        Get-CIPPBaselineUsageLocationState -Item ([PSCustomObject]@{ Variables = $Variables }) -TenantFilter $script:Tenant
+    }
+}
+
+Describe 'Get-CIPPBaselineUsageLocationState' {
+    BeforeEach {
+        Mock New-CIPPDbRequest { $script:Users }
+        Mock Get-CIPPBaselineCacheRows { $script:Groups }
+        Mock New-GraphBulkRequest { @() }
+    }
+
+    Context 'offender set' {
+        It 'flags every member whose location differs or is blank, and never a guest' {
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US' })
+            @($Prepared.Current.offenders) | Should -Be @('bob@contoso.com', 'carol@contoso.com')
+            @($Prepared.Current.targets | ForEach-Object { $_.id }) | Should -Be @('u2', 'u3')
+            Should -Invoke New-GraphBulkRequest -Times 0
+        }
+
+        It 'compares the country code case-insensitively so a lowercase cached value is not permanent drift' {
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'us' })
+            @($Prepared.Current.offenders) | Should -Not -Contain 'dave@contoso.com'
+            @($Prepared.Current.offenders) | Should -Not -Contain 'alice@contoso.com'
+        }
+
+        It 'accepts the {label, value} wrapper a one-off hands over unflattened' {
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = [PSCustomObject]@{ label = 'United States'; value = 'US' } })
+            @($Prepared.Current.offenders) | Should -Be @('bob@contoso.com', 'carol@contoso.com')
+        }
+
+        It 'with onlyWhenBlank, leaves a hand-set location alone and only fills the empty ones' {
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; onlyWhenBlank = $true })
+            @($Prepared.Current.offenders) | Should -Be @('bob@contoso.com')
+        }
+
+        It 'is compliant (empty offender set) when every member already matches' {
+            Mock New-CIPPDbRequest { @($script:Users | Where-Object { $_.id -in @('u1', 'u4', 'g1') }) }
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US' })
+            @($Prepared.Current.offenders).Count | Should -Be 0
+            @($Prepared.Current.targets).Count | Should -Be 0
+        }
+    }
+
+    Context 'group scoping' {
+        It 'drops transitive members of an exclude group from the sweep' {
+            Mock New-GraphBulkRequest { @([PSCustomObject]@{ id = 'exclude-grp-overseas'; status = 200; body = [PSCustomObject]@{ value = @([PSCustomObject]@{ id = 'u3' }) } }) }
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; excludeGroups = @('Overseas Staff') })
+            @($Prepared.Current.offenders) | Should -Be @('bob@contoso.com')
+            Should -Invoke New-GraphBulkRequest -Times 1 -Exactly -ParameterFilter {
+                $Version -eq 'v1.0' -and @($Requests).Count -eq 1 -and $Requests[0].url -like 'groups/grp-overseas/transitiveMembers/microsoft.graph.user*'
+            }
+        }
+
+        It 'restricts the sweep to transitive members of an include group' {
+            Mock New-GraphBulkRequest { @([PSCustomObject]@{ id = 'include-grp-licensed'; status = 200; body = [PSCustomObject]@{ value = @([PSCustomObject]@{ id = 'u2' }, [PSCustomObject]@{ id = 'u1' }) } }) }
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; includeGroups = @('Licensed Users') })
+            @($Prepared.Current.offenders) | Should -Be @('bob@contoso.com')
+        }
+
+        It 'applies exclude on top of include when both are configured' {
+            Mock New-GraphBulkRequest { @(
+                    [PSCustomObject]@{ id = 'include-grp-licensed'; status = 200; body = [PSCustomObject]@{ value = @([PSCustomObject]@{ id = 'u2' }, [PSCustomObject]@{ id = 'u3' }) } }
+                    [PSCustomObject]@{ id = 'exclude-grp-overseas'; status = 200; body = [PSCustomObject]@{ value = @([PSCustomObject]@{ id = 'u3' }) } }
+                ) }
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; includeGroups = @('Licensed Users'); excludeGroups = @('Overseas Staff') })
+            @($Prepared.Current.offenders) | Should -Be @('bob@contoso.com')
+        }
+
+        It 'accepts picker wrappers for the group names, matched case-insensitively' {
+            Mock New-GraphBulkRequest { @([PSCustomObject]@{ id = 'exclude-grp-overseas'; status = 200; body = [PSCustomObject]@{ value = @([PSCustomObject]@{ id = 'u3' }) } }) }
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; excludeGroups = @([PSCustomObject]@{ label = 'overseas staff'; value = 'overseas staff' }) })
+            @($Prepared.Current.offenders) | Should -Be @('bob@contoso.com')
+        }
+
+        It 'reports No Data rather than sweeping when a configured group does not exist in the tenant' {
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; excludeGroups = @('Does Not Exist') })
+            $Prepared.Current | Should -BeNullOrEmpty
+            Should -Invoke New-GraphBulkRequest -Times 0
+        }
+
+        It 'reports No Data when the membership lookup throws' {
+            Mock New-GraphBulkRequest { throw 'Graph is down' }
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; excludeGroups = @('Overseas Staff') })
+            $Prepared.Current | Should -BeNullOrEmpty
+        }
+
+        It 'reports No Data when one membership request in the batch fails' {
+            Mock New-GraphBulkRequest { @([PSCustomObject]@{ id = 'exclude-grp-overseas'; status = 403; body = [PSCustomObject]@{ error = [PSCustomObject]@{ message = 'Forbidden' } } }) }
+            $Prepared = Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US'; excludeGroups = @('Overseas Staff') })
+            $Prepared.Current | Should -BeNullOrEmpty
+        }
+    }
+
+    Context 'no data' {
+        It 'reports No Data when the Users cache is empty' {
+            Mock New-CIPPDbRequest { @() }
+            (Invoke-Hook ([PSCustomObject]@{ usageLocation = 'US' })).Current | Should -BeNullOrEmpty
+        }
+
+        It 'reports No Data when the configured value is not a two-letter country code' {
+            (Invoke-Hook ([PSCustomObject]@{ usageLocation = 'United States' })).Current | Should -BeNullOrEmpty
+        }
+    }
+}
diff --git a/Tests/Baselines/Get-CIPPBaseline.SourceSync.Tests.ps1 b/Tests/Baselines/Get-CIPPBaseline.SourceSync.Tests.ps1
new file mode 100644
index 0000000000000..e28ee4ee611f4
--- /dev/null
+++ b/Tests/Baselines/Get-CIPPBaseline.SourceSync.Tests.ps1
@@ -0,0 +1,176 @@
+# The baseline list page needs the same Imported/UpdateAvailable signal listStandardTemplates
+# already shows for standards templates: source (repo FullName) and isSynced (has a SHA).
+
+BeforeAll {
+    $script:RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    function Get-CippTable { param($tablename) @{ Context = "stub-$tablename" } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) "$Value" }
+    function Get-Tenants { @() }
+    function Get-TenantGroups { @() }
+    function Write-LogMessage { param($API, $message, $Sev) }
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/GitHub/Test-CIPPRepoSource.ps1')
+    function Get-CIPPTemplateSourceUrl { param($Source, $SourcePath, $Repos) if ($Source) { "https://github.com/$Source" } }
+
+    . (Join-Path $script:RepoRoot 'Modules/CIPPCore/Public/Baselines/Get-CIPPBaseline.ps1')
+}
+
+Describe 'Get-CIPPBaseline source/isSynced projection' {
+    BeforeEach {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Filter -like "*PartitionKey eq 'rollout'*") {
+                @(
+                    [pscustomobject]@{
+                        RowKey       = 'baseline-1'
+                        templateName = 'Imported Baseline'
+                        Stages       = '[]'
+                        Source       = 'Org/repo'
+                        SHA          = 'abc123'
+                    }
+                )
+            } else {
+                @()
+            }
+        }
+    }
+
+    It 'exposes source and isSynced true when the rollout row carries repo provenance' {
+        $Result = Get-CIPPBaseline -ID 'baseline-1'
+        $Result.source | Should -Be 'Org/repo'
+        $Result.isSynced | Should -BeTrue
+        $Result.sourceUrl | Should -Be 'https://github.com/Org/repo'
+    }
+
+    It 'exposes isSynced false when the rollout row has no SHA' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Filter -like "*PartitionKey eq 'rollout'*") {
+                @([pscustomobject]@{ RowKey = 'baseline-2'; templateName = 'Local Baseline'; Stages = '[]' })
+            } else {
+                @()
+            }
+        }
+        $Result = Get-CIPPBaseline -ID 'baseline-2'
+        $Result.isSynced | Should -BeFalse
+        $Result.source | Should -BeNullOrEmpty
+    }
+
+    It 'exposes hasLocalChanges true when the rollout row is synced and flagged' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Filter -like "*PartitionKey eq 'rollout'*") {
+                @([pscustomobject]@{ RowKey = 'baseline-3'; templateName = 'Edited Baseline'; Stages = '[]'; Source = 'Org/repo'; SHA = 'abc123'; LocalChanges = $true })
+            } else {
+                @()
+            }
+        }
+        $Result = Get-CIPPBaseline -ID 'baseline-3'
+        $Result.hasLocalChanges | Should -BeTrue
+    }
+
+    It 'exposes hasLocalChanges false when the rollout row is synced and unflagged' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Filter -like "*PartitionKey eq 'rollout'*") {
+                @([pscustomobject]@{ RowKey = 'baseline-4'; templateName = 'Pushed Baseline'; Stages = '[]'; Source = 'Org/repo'; SHA = 'abc123'; LocalChanges = $false })
+            } else {
+                @()
+            }
+        }
+        $Result = Get-CIPPBaseline -ID 'baseline-4'
+        $Result.hasLocalChanges | Should -BeFalse
+    }
+
+    It 'exposes hasLocalChanges $null when the rollout row has no Source' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Filter -like "*PartitionKey eq 'rollout'*") {
+                @([pscustomobject]@{ RowKey = 'baseline-5'; templateName = 'Local Baseline'; Stages = '[]' })
+            } else {
+                @()
+            }
+        }
+        $Result = Get-CIPPBaseline -ID 'baseline-5'
+        $Result.hasLocalChanges | Should -BeNullOrEmpty
+    }
+
+    It 'does not read the baseline migration marker as a repo sync' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Filter -like "*PartitionKey eq 'rollout'*") {
+                @([pscustomobject]@{ RowKey = 'baseline-5'; templateName = 'Migrated Baseline'; Stages = '[]'; Source = 'StandardsTemplateV2:9c4c44c0-7e0d-4e5d-a018-dd64619c49bc'; SHA = 'abc123' })
+            } else {
+                @()
+            }
+        }
+        $Result = Get-CIPPBaseline -ID 'baseline-5'
+        $Result.source | Should -BeNullOrEmpty
+        $Result.isSynced | Should -BeFalse
+        $Result.sourceUrl | Should -BeNullOrEmpty
+        $Result.hasLocalChanges | Should -BeNullOrEmpty
+    }
+}
+
+Describe 'Get-CIPPBaseline excluded tenant group expansion' {
+    BeforeEach {
+        Mock -CommandName Get-TenantGroups -MockWith {
+            @(
+                [pscustomobject]@{
+                    Id      = 'group-guid-1'
+                    Name    = 'Group A'
+                    Members = @(
+                        [pscustomobject]@{ defaultDomainName = 'tenant1.onmicrosoft.com' }
+                        [pscustomobject]@{ defaultDomainName = 'tenant4.onmicrosoft.com' }
+                    )
+                }
+            )
+        }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Filter -like "*PartitionKey eq 'rollout'*") {
+                @(
+                    [pscustomobject]@{
+                        RowKey          = 'baseline-6'
+                        templateName    = 'Group Exclusion Baseline'
+                        Stages          = '[{"name":"Stage 1","logic":"and","conditions":[]}]'
+                        excludedTenants = '["group-guid-1","tenant5.onmicrosoft.com"]'
+                        excludedTo      = '[{"label":"Group A (group-guid-1)","value":"group-guid-1","type":"Group"},{"label":"tenant5.onmicrosoft.com","value":"tenant5.onmicrosoft.com","type":"Tenant"}]'
+                    }
+                )
+            } elseif ($Filter -like "*standardItem*") {
+                @(
+                    [pscustomobject]@{ scope = 'group'; scopeId = 'group-guid-1'; scopeName = 'Group A'; stage = 1; standardName = 'Standard1#1'; expectedValue = '{}'; remediateEnabled = $true }
+                    [pscustomobject]@{ scope = 'tenant'; scopeId = 'tenant5.onmicrosoft.com'; scopeName = 'tenant5.onmicrosoft.com'; stage = 1; standardName = 'Standard1#1'; expectedValue = '{}'; remediateEnabled = $true }
+                    [pscustomobject]@{ scope = 'tenant'; scopeId = 'tenant6.onmicrosoft.com'; scopeName = 'tenant6.onmicrosoft.com'; stage = 1; standardName = 'Standard1#1'; expectedValue = '{}'; remediateEnabled = $true }
+                )
+            } else {
+                @()
+            }
+        }
+    }
+
+    It 'expands an excluded group Id to its member domains and keeps plain domains' {
+        $Result = Get-CIPPBaseline -ID 'baseline-6'
+        $Result.excludedTenants | Should -Contain 'tenant1.onmicrosoft.com'
+        $Result.excludedTenants | Should -Contain 'tenant4.onmicrosoft.com'
+        $Result.excludedTenants | Should -Contain 'tenant5.onmicrosoft.com'
+        $Result.excludedTenants | Should -Not -Contain 'group-guid-1'
+    }
+
+    It 'keeps the raw group entry in exclusions for display instead of its members' {
+        $Result = Get-CIPPBaseline -ID 'baseline-6'
+        $GroupExclusion = $Result.exclusions | Where-Object { $_.type -eq 'Group' }
+        $GroupExclusion.value | Should -Be 'group-guid-1'
+        ($Result.exclusions | Where-Object { $_.value -eq 'tenant1.onmicrosoft.com' }) | Should -BeNullOrEmpty
+    }
+
+    It 'excludes tenants assigned via group membership from tenant states' {
+        $Result = Get-CIPPBaseline -ID 'baseline-6'
+        $Result.tenantStates.tenantFilter | Should -Not -Contain 'tenant1.onmicrosoft.com'
+        $Result.tenantStates.tenantFilter | Should -Not -Contain 'tenant4.onmicrosoft.com'
+        $Result.tenantStates.tenantFilter | Should -Not -Contain 'tenant5.onmicrosoft.com'
+        $Result.tenantStates.tenantFilter | Should -Contain 'tenant6.onmicrosoft.com'
+    }
+}
diff --git a/Tests/Baselines/New-CIPPBaseline.LocalChanges.Tests.ps1 b/Tests/Baselines/New-CIPPBaseline.LocalChanges.Tests.ps1
new file mode 100644
index 0000000000000..842d6bb40c345
--- /dev/null
+++ b/Tests/Baselines/New-CIPPBaseline.LocalChanges.Tests.ps1
@@ -0,0 +1,65 @@
+# -LocalChanges marks a synced baseline as having edits not yet pushed to its repo. Explicit
+# true/false wins; when the caller does not pass it, the existing rollout row's value carries
+# across untouched, same as Source/SHA/SourcePath, so an editor re-save cannot silently clear it.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/Baselines/New-CIPPBaseline.ps1'
+
+    function Get-CippTable { param($tablename) @{ Context = "stub-$tablename" } }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) "$Value" }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity) }
+    function Remove-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Get-TenantGroups { @() }
+
+    . $FunctionPath
+
+    function Get-Payload {
+        [pscustomobject]@{
+            GUID            = 'baseline-1'
+            templateName    = 'My Baseline'
+            assignedTenants = @('AllTenants')
+            stages          = @([pscustomobject]@{ name = 'Stage 1'; standards = @() })
+        }
+    }
+}
+
+Describe 'New-CIPPBaseline LocalChanges' {
+    BeforeEach {
+        $script:RolloutWritten = $null
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @() }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Entity)
+            if ($Entity.PartitionKey -eq 'rollout') { $script:RolloutWritten = $Entity }
+        }
+    }
+
+    It 'writes LocalChanges=$true when explicitly passed' {
+        $null = New-CIPPBaseline -Baseline (Get-Payload) -User 'tester' -LocalChanges:$true
+        $script:RolloutWritten.LocalChanges | Should -Be $true
+    }
+
+    It 'writes LocalChanges=$false when explicitly passed' {
+        $null = New-CIPPBaseline -Baseline (Get-Payload) -User 'tester' -LocalChanges:$false
+        $script:RolloutWritten.LocalChanges | Should -Be $false
+    }
+
+    It 'carries the existing rollout LocalChanges value across when not passed' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($Context, $Filter)
+            if ($Context -eq 'stub-BaselineRollouts') {
+                @([pscustomobject]@{ RowKey = 'baseline-1'; Source = 'Org/repo'; SHA = 'abc123'; LocalChanges = $true })
+            } else {
+                @()
+            }
+        }
+        $null = New-CIPPBaseline -Baseline (Get-Payload) -User 'tester'
+        $script:RolloutWritten.LocalChanges | Should -Be $true
+    }
+
+    It 'writes no LocalChanges column for a brand-new baseline with no existing row and no flag passed' {
+        $null = New-CIPPBaseline -Baseline (Get-Payload) -User 'tester'
+        $script:RolloutWritten.ContainsKey('LocalChanges') | Should -BeFalse
+    }
+}
diff --git a/Tests/Build/CIPPSharp-PdfDependencies.Tests.ps1 b/Tests/Build/CIPPSharp-PdfDependencies.Tests.ps1
new file mode 100644
index 0000000000000..b3fb61e6ed9db
--- /dev/null
+++ b/Tests/Build/CIPPSharp-PdfDependencies.Tests.ps1
@@ -0,0 +1,43 @@
+# Guards the bundling of the server-side PDF renderer: the OfficeIMO DLLs must ship next to
+# CIPPSharp.dll (loaded via RequiredAssemblies; .NET resolves them by same-directory probing, there
+# is no deps.json), and the CIPPSharp assembly must expose the ReportPdf entry point.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:Bin = Join-Path $RepoRoot 'Shared/CIPPSharp/bin'
+}
+
+Describe 'CIPPSharp PDF dependencies' {
+    It 'ships CIPPSharp.dll' {
+        Test-Path (Join-Path $script:Bin 'CIPPSharp.dll') | Should -BeTrue
+    }
+    It 'ships OfficeIMO.Pdf.dll beside CIPPSharp.dll' {
+        Test-Path (Join-Path $script:Bin 'OfficeIMO.Pdf.dll') | Should -BeTrue
+    }
+    It 'ships OfficeIMO.Core.dll beside CIPPSharp.dll' {
+        Test-Path (Join-Path $script:Bin 'OfficeIMO.Core.dll') | Should -BeTrue
+    }
+    It 'does not ship the System.Management.Automation facade' {
+        Test-Path (Join-Path $script:Bin 'System.Management.Automation.dll') | Should -BeFalse
+    }
+    It 'ships the emoji fallback font beside CIPPSharp.dll' {
+        # The monochrome symbol/emoji fallback the renderer loads at runtime (ReportPdf.EmojiFontBytes);
+        # without it emoji degrade to ASCII tokens rather than glyphs.
+        Test-Path (Join-Path $script:Bin 'emoji-fallback.ttf') | Should -BeTrue
+    }
+    It 'ships the Twemoji colour emoji image set' {
+        # The colour emoji PNGs the renderer places inline (TwemojiAssets); a large individual-file set so a
+        # render only reads the handful it embeds. A few thousand files, keyed by lowercase hex code point.
+        $twemoji = Join-Path $script:Bin 'twemoji'
+        Test-Path $twemoji | Should -BeTrue
+        (Get-ChildItem -Path $twemoji -Filter '*.png' -File).Count | Should -BeGreaterThan 1000
+        Test-Path (Join-Path $twemoji '26a0.png') | Should -BeTrue   # warning
+        Test-Path (Join-Path $twemoji '2705.png') | Should -BeTrue   # green check
+    }
+    It 'exposes the ReportPdf renderer type' {
+        [void][System.Reflection.Assembly]::LoadFrom((Join-Path $script:Bin 'OfficeIMO.Core.dll'))
+        [void][System.Reflection.Assembly]::LoadFrom((Join-Path $script:Bin 'OfficeIMO.Pdf.dll'))
+        [void][System.Reflection.Assembly]::LoadFrom((Join-Path $script:Bin 'CIPPSharp.dll'))
+        ([type]'CIPP.Reporting.ReportPdf') | Should -Not -BeNullOrEmpty
+    }
+}
diff --git a/Tests/DBCache/Add-CIPPDbItem.Shape.Tests.ps1 b/Tests/DBCache/Add-CIPPDbItem.Shape.Tests.ps1
new file mode 100644
index 0000000000000..19facf3039b33
--- /dev/null
+++ b/Tests/DBCache/Add-CIPPDbItem.Shape.Tests.ps1
@@ -0,0 +1,59 @@
+# Pester tests for the collection shape the cache writer records on the '<Type>-Count' row: the
+# fields its rows carry, one nested level deep, with their types - what the report builder's data
+# picker offers.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Add-CIPPDbItem.ps1' | Select-Object -First 1 -ExpandProperty FullName)
+
+    $script:Written = @{}
+    $script:Existing = $null
+    function Get-CippTable { param($tablename) @{ Context = $tablename } }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) foreach ($e in @($Entity)) { $script:Written[$e.RowKey] = $e } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property) $script:Existing }
+    function Remove-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Write-LogMessage { param([Parameter(ValueFromRemainingArguments = $true)]$Rest) }
+    function Get-Tenants { param($TenantFilter, [switch]$IncludeErrors) @() }
+
+    function Get-Shape { (ConvertFrom-Json -InputObject $script:Written['Devices-Count'].Shape).fields | ForEach-Object { "$($_.name):$($_.type)" } }
+}
+
+Describe 'Add-CIPPDbItem shape' {
+    BeforeEach { $script:Written = @{}; $script:Existing = $null }
+
+    It 'records each field with its type, one nested level deep, on the count row' {
+        @(
+            [PSCustomObject]@{ id = 'a'; deviceName = 'PC1'; isCompliant = $true; storage = 512; enrolledAt = '2026-09-01T10:00:00Z'; hardware = [PSCustomObject]@{ model = 'X1'; ram = 16 }; apps = @([PSCustomObject]@{ name = 'Edge' }) }
+            [PSCustomObject]@{ id = 'b'; deviceName = 'PC2'; isCompliant = $false; storage = $null; lastSeen = $null }
+        ) | Add-CIPPDbItem -TenantFilter 'contoso.onmicrosoft.com' -Type 'Devices' -AddCount
+
+        $Shape = @(Get-Shape)
+        $Shape | Should -Contain 'deviceName:string'
+        $Shape | Should -Contain 'isCompliant:boolean'
+        $Shape | Should -Contain 'storage:number'
+        $Shape | Should -Contain 'enrolledAt:date'
+        $Shape | Should -Contain 'hardware:object'
+        $Shape | Should -Contain 'hardware.model:string'
+        $Shape | Should -Contain 'apps:array'
+        $Shape | Should -Contain 'apps.name:string'
+        $Shape | Should -Contain 'lastSeen:null'
+        $script:Written['Devices-Count'].DataCount | Should -Be 2
+    }
+
+    It 'keeps the recorded shape when a count-only call follows the rows' {
+        $script:Existing = @{ DataCount = 7; Shape = '{"fields":[{"name":"deviceName","type":"string"}]}' }
+        Add-CIPPDbItem -TenantFilter 'contoso.onmicrosoft.com' -Type 'Devices' -InputObject 7 -Count
+
+        @(Get-Shape) | Should -Be @('deviceName:string')
+    }
+
+    It 'merges into the recorded shape when appending' {
+        $script:Existing = @{ DataCount = 1; Shape = '{"fields":[{"name":"deviceName","type":"string"}]}' }
+        @([PSCustomObject]@{ id = 'c'; osVersion = '10.0' }) | Add-CIPPDbItem -TenantFilter 'contoso.onmicrosoft.com' -Type 'Devices' -AddCount -Append
+
+        $Shape = @(Get-Shape)
+        $Shape | Should -Contain 'deviceName:string'
+        $Shape | Should -Contain 'osVersion:string'
+        $script:Written['Devices-Count'].DataCount | Should -Be 2
+    }
+}
diff --git a/Tests/DBCache/Get-CIPPIntuneReportExportRows.Tests.ps1 b/Tests/DBCache/Get-CIPPIntuneReportExportRows.Tests.ps1
new file mode 100644
index 0000000000000..62d8c5784f5bd
--- /dev/null
+++ b/Tests/DBCache/Get-CIPPIntuneReportExportRows.Tests.ps1
@@ -0,0 +1,78 @@
+# Pester tests for Get-CIPPIntuneReportExportRows.
+# The helper streams an Intune report export straight off its download URL: zip -> JSON entry ->
+# one row of the "values" array at a time. A local HttpListener serves real export-shaped zips so
+# the download, unzip and parse path all run.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneReportExportRows.ps1')
+    Add-Type -AssemblyName System.IO.Compression
+
+    function New-ExportZip ([string]$EntryName, [string]$Content) {
+        $Buffer = [System.IO.MemoryStream]::new()
+        $Zip = [System.IO.Compression.ZipArchive]::new($Buffer, [System.IO.Compression.ZipArchiveMode]::Create, $true)
+        $Writer = [System.IO.StreamWriter]::new($Zip.CreateEntry($EntryName).Open(), [System.Text.UTF8Encoding]::new($true))
+        $Writer.Write($Content)
+        $Writer.Dispose(); $Zip.Dispose()
+        , $Buffer.ToArray()
+    }
+
+    # Serves each registered path's bytes; runs on its own runspace so the helper can call it.
+    $script:Port = Get-Random -Minimum 20000 -Maximum 40000
+    $script:Files = [hashtable]::Synchronized(@{})
+    $script:Listener = [System.Net.HttpListener]::new()
+    $script:Listener.Prefixes.Add("http://localhost:$script:Port/")
+    $script:Listener.Start()
+    $script:Server = [powershell]::Create().AddScript({
+            param($Listener, $Files)
+            while ($Listener.IsListening) {
+                try { $Context = $Listener.GetContext() } catch { break }
+                $Bytes = $Files[$Context.Request.Url.AbsolutePath]
+                if ($Bytes) { $Context.Response.OutputStream.Write($Bytes, 0, $Bytes.Length) } else { $Context.Response.StatusCode = 404 }
+                $Context.Response.Close()
+            }
+        }).AddArgument($script:Listener).AddArgument($script:Files)
+    $null = $script:Server.BeginInvoke()
+
+    # Intune's own layout: one row per line inside "values", with a BOM.
+    $script:Files['/export.zip'] = New-ExportZip 'AppInvRawData_1.json' (@(
+            '{'
+            '"columns": ["ApplicationKey","ApplicationName","InstalledDeviceCount"],'
+            '"values": ['
+            '{"ApplicationKey":"k1","ApplicationName":"App \"One\"","InstalledDeviceCount":3},'
+            '{"ApplicationKey":"k2","ApplicationName":"App Two","InstalledDeviceCount":0}'
+            ']'
+            '}'
+        ) -join "`r`n")
+    $script:Files['/empty.zip'] = New-ExportZip 'AppInvRawData_2.json' "{`"columns`": [`"A`"],`r`n`"values`": [`r`n]`r`n}"
+    $script:Files['/nojson.zip'] = New-ExportZip 'AppInvRawData_3.csv' '"A"'
+}
+
+AfterAll {
+    $script:Listener.Stop()
+    $script:Server.Dispose()
+}
+
+Describe 'Get-CIPPIntuneReportExportRows' {
+    It 'emits each row of the values array in order, typed as JSON types' {
+        $Rows = @(Get-CIPPIntuneReportExportRows -Url "http://localhost:$script:Port/export.zip")
+        $Rows.Count | Should -Be 2
+        $Rows[0].ApplicationKey | Should -Be 'k1'
+        $Rows[0].ApplicationName | Should -Be 'App "One"'
+        $Rows[0].InstalledDeviceCount | Should -Be 3
+        $Rows[0].InstalledDeviceCount | Should -BeOfType [long]
+        $Rows[1].ApplicationKey | Should -Be 'k2'
+    }
+
+    It 'emits nothing for an export with no rows' {
+        @(Get-CIPPIntuneReportExportRows -Url "http://localhost:$script:Port/empty.zip").Count | Should -Be 0
+    }
+
+    It 'throws when the archive has no JSON entry' {
+        { Get-CIPPIntuneReportExportRows -Url "http://localhost:$script:Port/nojson.zip" } | Should -Throw '*No JSON entry*'
+    }
+
+    It 'throws when the download fails' {
+        { Get-CIPPIntuneReportExportRows -Url "http://localhost:$script:Port/missing.zip" } | Should -Throw
+    }
+}
diff --git a/Tests/DBCache/Set-CIPPDBCacheIntuneReportExports.Tests.ps1 b/Tests/DBCache/Set-CIPPDBCacheIntuneReportExports.Tests.ps1
new file mode 100644
index 0000000000000..e496eef7bc82b
--- /dev/null
+++ b/Tests/DBCache/Set-CIPPDBCacheIntuneReportExports.Tests.ps1
@@ -0,0 +1,108 @@
+# Pester tests for the Intune report-export cache collectors (DetectedApps, IntuneAppInstallStatus).
+# Both read a completed export job's rows through Get-CIPPIntuneReportExportRows. DetectedApps folds
+# the device x app rows into one row per app, sharing one device object per distinct device tuple;
+# the stored JSON must match a fresh object per row. IntuneAppInstallStatus maps each rollup row.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDetectedApps.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppInstallStatus.ps1')
+
+    function Get-CIPPTable { param($tablename) @{ TableName = $tablename } }
+    function Get-CIPPAzDataTableEntity { param($TableName, $Filter) }
+    function Remove-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) }
+    function New-CIPPIntuneReportExportJob { param($TenantFilter, $ReportName) }
+    function New-GraphGetRequest { param($uri, $tenantid) }
+    function Get-CIPPIntuneReportExportRows { param($Url) }
+    function Get-CippException { param($Exception) @{ NormalizedError = "$Exception" } }
+    function Write-LogMessage { param($API, $tenant, $message, $sev, $LogData) }
+    # Static stub rather than a Mock: it must bind pipeline input the way the real one does.
+    function Add-CIPPDbItem {
+        [CmdletBinding()]
+        param($TenantFilter, $Type, [Parameter(ValueFromPipeline)]$InputObject, $Data, [switch]$AddCount)
+        process { foreach ($Item in @($InputObject) + @($Data)) { if ($null -ne $Item) { $script:Written.Add([pscustomobject]@{ Type = $Type; Item = $Item }) } } }
+    }
+
+    function New-AppRow ($Key, $Device, $User = 'u1') {
+        $Row = [System.Collections.Generic.Dictionary[string, object]]::new()
+        $Row['ApplicationKey'] = $Key; $Row['ApplicationName'] = "Name $Key"; $Row['ApplicationPublisher'] = 'Contoso'
+        $Row['ApplicationVersion'] = '1.0'; $Row['DeviceId'] = "id-$Device"; $Row['DeviceName'] = $Device
+        $Row['OSDescription'] = 'Windows'; $Row['OSVersion'] = '10.0'; $Row['Platform'] = 'Windows'
+        $Row['UserId'] = $User; $Row['UserName'] = "User $User"; $Row['EmailAddress'] = "$User@contoso.com"
+        $Row
+    }
+}
+
+Describe 'Intune report-export collectors' {
+    BeforeEach {
+        $script:Written = [System.Collections.Generic.List[object]]::new()
+        Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'x'; JobId = 'job-1' } }
+        Mock New-GraphGetRequest { [pscustomobject]@{ status = 'completed'; url = 'https://blob/export.zip' } }
+        Mock Remove-CIPPAzDataTableEntity {}
+        Mock Write-LogMessage {}
+    }
+
+    Context 'Set-CIPPDBCacheDetectedApps' {
+        BeforeEach {
+            Mock Get-CIPPIntuneReportExportRows {
+                New-AppRow 'app-a' 'PC1'
+                New-AppRow 'app-b' 'PC1'
+                New-AppRow 'app-a' 'PC2'
+                New-AppRow 'app-a' 'PC1' 'u2'   # same device, different user: a distinct tuple
+                New-AppRow $null 'PC3'          # no application key: skipped
+            }
+        }
+
+        It 'reads the completed job url through the streaming helper' {
+            Set-CIPPDBCacheDetectedApps -TenantFilter 'contoso.com'
+            Should -Invoke Get-CIPPIntuneReportExportRows -Times 1 -Exactly -ParameterFilter { $Url -eq 'https://blob/export.zip' }
+        }
+
+        It 'writes one row per app with every device row, in the stored shape' {
+            Set-CIPPDBCacheDetectedApps -TenantFilter 'contoso.com'
+            $Apps = @($script:Written | Where-Object Type -EQ 'DetectedApps' | ForEach-Object Item | Sort-Object id)
+            $Apps.id | Should -Be @('app-a', 'app-b')
+            $Apps[0].deviceCount | Should -Be 3
+            $Apps[0].managedDevices.deviceName | Should -Be @('PC1', 'PC2', 'PC1')
+            $Apps[0].managedDevices[2].userId | Should -Be 'u2'
+            ($Apps[1] | ConvertTo-Json -Depth 100 -Compress) | Should -Be '{"id":"app-b","displayName":"Name app-b","version":"1.0","publisher":"Contoso","platform":"Windows","deviceCount":1,"managedDevices":[{"id":"id-PC1","deviceName":"PC1","osVersion":"10.0","platform":"Windows","userId":"u1","userPrincipalName":"User u1","emailAddress":"u1@contoso.com"}]}'
+        }
+
+        It 'shares one device object per distinct device tuple across apps' {
+            Set-CIPPDBCacheDetectedApps -TenantFilter 'contoso.com'
+            $Apps = @($script:Written | ForEach-Object Item | Sort-Object id)
+            [object]::ReferenceEquals($Apps[0].managedDevices[0], $Apps[1].managedDevices[0]) | Should -BeTrue
+            [object]::ReferenceEquals($Apps[0].managedDevices[0], $Apps[0].managedDevices[2]) | Should -BeFalse
+        }
+
+        It 'consumes the job row after caching' {
+            Set-CIPPDBCacheDetectedApps -TenantFilter 'contoso.com'
+            Should -Invoke Remove-CIPPAzDataTableEntity -Times 1 -Exactly
+        }
+    }
+
+    Context 'Set-CIPPDBCacheIntuneAppInstallStatus' {
+        BeforeEach {
+            Mock Get-CIPPIntuneReportExportRows {
+                $Row = [System.Collections.Generic.Dictionary[string, object]]::new()
+                $Row['ApplicationId'] = 'app-1'; $Row['DisplayName'] = 'App 1'; $Row['Publisher'] = 'Contoso'
+                $Row['Platform'] = 'Windows'; $Row['AppVersion'] = '2.0'; $Row['InstalledDeviceCount'] = [long]5
+                $Row['FailedDeviceCount'] = [long]2; $Row['FailedUserCount'] = [long]1; $Row['PendingInstallDeviceCount'] = [long]0
+                $Row['NotInstalledDeviceCount'] = [long]3; $Row['FailedDevicePercentage'] = 20.5
+                $Row
+                $Skip = [System.Collections.Generic.Dictionary[string, object]]::new(); $Skip['DisplayName'] = 'no id'; $Skip
+            }
+        }
+
+        It 'maps each rollup row with an application id' {
+            Set-CIPPDBCacheIntuneAppInstallStatus -TenantFilter 'contoso.com'
+            $Rows = @($script:Written | Where-Object Type -EQ 'IntuneAppInstallStatusAggregate' | ForEach-Object Item)
+            $Rows.Count | Should -Be 1
+            $Rows[0].id | Should -Be 'app-1'
+            $Rows[0].platform | Should -Be 'Windows'
+            $Rows[0].failedDeviceCount | Should -Be 2
+            $Rows[0].failedDeviceCount | Should -BeOfType [int]
+            $Rows[0].failedDevicePercentage | Should -Be 20.5
+        }
+    }
+}
diff --git a/Tests/Endpoint/Invoke-AddAPDevice.Tests.ps1 b/Tests/Endpoint/Invoke-AddAPDevice.Tests.ps1
new file mode 100644
index 0000000000000..e37a60612d044
--- /dev/null
+++ b/Tests/Endpoint/Invoke-AddAPDevice.Tests.ps1
@@ -0,0 +1,124 @@
+# Pester tests for Invoke-AddAPDevice.
+#
+# Pins the Partner Center batch contract: an existing batch is appended to using Partner
+# Center's own id spelling (escaped in the URL) with the same device shape the create path
+# sends, an unknown name creates a batch, a slow import is a warning rather than a failure,
+# and per-device upload errors surface as error rows.
+
+BeforeAll {
+    # Resolve by name under Modules/ so the test survives the function moving between modules.
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-AddAPDevice.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-AddAPDevice.ps1 under Modules/' }
+
+    # Azure Functions binding types do not exist outside the Functions host - fake them.
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ('HttpStatusCode' -as [type])) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    # Stub every CIPP helper the function calls so Pester's Mock has a command to replace.
+    # Declare the splatted keys so they bind as real parameters for ParameterFilter.
+    function Get-Tenants { param($TenantFilter) }
+    function New-GraphGetRequest { param($uri, $scope) }
+    function New-GraphPOSTRequest { param($uri, $body, $scope, $returnHeaders) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+    function Get-CippException { param($Exception) }
+
+    . $FunctionPath
+
+    function New-APRequest {
+        param($GroupName, $Devices)
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'AddAPDevice' }
+            Headers = @{ Authorization = 'token' }
+            Body    = [pscustomobject]@{
+                TenantFilter  = @{ value = 'contoso.onmicrosoft.com' }
+                Groupname     = $GroupName
+                autopilotData = $Devices
+            }
+        }
+    }
+}
+
+Describe 'Invoke-AddAPDevice' {
+    BeforeEach {
+        $script:FinishedStatus = [pscustomobject]@{
+            status        = 'finished'
+            devicesStatus = @([pscustomobject]@{ serialNumber = 'SN-1'; status = 'finished' })
+        }
+        Mock -CommandName Start-Sleep -MockWith { }
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CippException -MockWith { [pscustomobject]@{ NormalizedError = "$Exception" } }
+        Mock -CommandName Get-Tenants -MockWith { [pscustomobject]@{ customerId = 'customer-guid' } }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/DeviceBatches' } -MockWith {
+            [pscustomobject]@{ items = @([pscustomobject]@{ id = 'Sales Laptops' }) }
+        }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/batchJobStatus/*' } -MockWith { $script:FinishedStatus }
+        Mock -CommandName New-GraphPOSTRequest -MockWith { @{ Location = 'customers/customer-guid/batchJobStatus/job-1' } }
+
+        $script:Devices = @(
+            [pscustomobject]@{ SerialNumber = 'SN-1'; oemManufacturerName = ''; modelName = ''; productKey = ''; hardwareHash = 'HASH1'; groupTag = '' }
+        )
+    }
+
+    It 'appends to an existing batch using Partner Center spelling, escaped, with the shared device shape' {
+        $response = Invoke-AddAPDevice -Request (New-APRequest -GroupName 'sales laptops' -Devices $script:Devices) -TriggerMetadata $null
+
+        $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter {
+            $uri -like '*/deviceBatches/Sales%20Laptops/devices' -and
+            $body -like '[[]*' -and
+            $body -notmatch 'batchId' -and
+            $body -notmatch '""' -and
+            $body -match 'HASH1'
+        }
+        @($response.Body.Results)[0].state | Should -Be 'success'
+    }
+
+    It 'creates a new batch when the name is unknown' {
+        $response = Invoke-AddAPDevice -Request (New-APRequest -GroupName 'Fresh Batch' -Devices $script:Devices) -TriggerMetadata $null
+
+        $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter {
+            $uri -like '*/customers/customer-guid/DeviceBatches' -and
+            ($body | ConvertFrom-Json).batchId -eq 'Fresh Batch' -and
+            @(($body | ConvertFrom-Json).devices).Count -eq 1
+        }
+    }
+
+    It 'reports a still-running import as a warning instead of a failure' {
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/batchJobStatus/*' } -MockWith {
+            [pscustomobject]@{ status = 'processing' }
+        }
+
+        $response = Invoke-AddAPDevice -Request (New-APRequest -GroupName 'sales laptops' -Devices $script:Devices) -TriggerMetadata $null
+
+        $response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $results = @($response.Body.Results)
+        $results.Count | Should -Be 1
+        $results[0].state | Should -Be 'warning'
+        $results[0].resultText | Should -Match 'Sales Laptops'
+        Should -Invoke New-GraphGetRequest -Times 15 -Exactly -ParameterFilter { $uri -like '*/batchJobStatus/*' }
+    }
+
+    It 'surfaces per-device upload errors with the Partner Center description' {
+        $script:FinishedStatus = [pscustomobject]@{
+            status        = 'finished_with_errors'
+            devicesStatus = @([pscustomobject]@{ serialNumber = 'SN-1'; status = 'finished_with_errors'; errorCode = '806'; errorDescription = 'ZtdDeviceAlreadyAssigned' })
+        }
+
+        $response = Invoke-AddAPDevice -Request (New-APRequest -GroupName 'Fresh Batch' -Devices $script:Devices) -TriggerMetadata $null
+
+        $result = @($response.Body.Results)[0]
+        $result.state | Should -Be 'error'
+        $result.resultText | Should -Match 'ZtdDeviceAlreadyAssigned'
+        $result.copyField | Should -Be 'SN-1'
+    }
+}
diff --git a/Tests/Endpoint/Invoke-AddUserDefaults.Tests.ps1 b/Tests/Endpoint/Invoke-AddUserDefaults.Tests.ps1
new file mode 100644
index 0000000000000..85cf6c34e87e8
--- /dev/null
+++ b/Tests/Endpoint/Invoke-AddUserDefaults.Tests.ps1
@@ -0,0 +1,73 @@
+# Pester tests for Invoke-AddUserDefaults.
+#
+# The endpoint behind Add/Edit Template on the User Templates page. It copies the posted form into a
+# hand-written template object and stores that as JSON, so any field missing from that object is
+# silently dropped: the save still returns OK, the template just comes back without it. That is how
+# the custom user attributes (officeLocation, employeeId, ...) went missing (CyberDrain/CIPP#671).
+
+BeforeAll {
+    # Resolve by name under Modules/ so the test survives the function moving between modules.
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-AddUserDefaults.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-AddUserDefaults.ps1 under Modules/' }
+
+    # Azure Functions binding types do not exist outside the Functions host - fake them.
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+    $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ('HttpStatusCode' -as [type])) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    # Stub every CIPP helper the function calls so Pester's Mock has a command to replace.
+    # Get-CippTable returns a splattable hashtable, so the entity stub needs the matching parameters.
+    function Add-CIPPAzDataTableEntity { param($Context, $TableName, $Force, $Entity) }
+    function Get-CippException { param($Exception) }
+    function Get-CippTable { param($tablename) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+
+    . $FunctionPath
+
+    function New-TemplateRequest {
+        param([hashtable]$Body = @{})
+        $RequestBody = [pscustomobject]@{
+            tenantFilter = 'contoso.com'
+            templateName = 'Sales'
+        }
+        foreach ($Key in $Body.Keys) {
+            $RequestBody | Add-Member -NotePropertyName $Key -NotePropertyValue $Body[$Key] -Force
+        }
+        [pscustomobject]@{
+            Body    = $RequestBody
+            Headers = @{}
+            Params  = @{ CIPPEndpoint = 'AddUserDefaults' }
+        }
+    }
+}
+
+Describe 'Invoke-AddUserDefaults' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CippTable -MockWith { @{ Context = 'ctx'; TableName = 'templates' } }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+    }
+
+    It 'stores the custom user attributes on the template' {
+        $Request = New-TemplateRequest -Body @{
+            defaultAttributes = [pscustomobject]@{
+                officeLocation = [pscustomobject]@{ Value = 'Copenhagen' }
+            }
+        }
+
+        $Response = Invoke-AddUserDefaults -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter {
+            $Entity.PartitionKey -eq 'UserDefaultTemplate' -and
+            ($Entity.JSON | ConvertFrom-Json).defaultAttributes.officeLocation.Value -eq 'Copenhagen'
+        }
+    }
+}
diff --git a/Tests/Endpoint/Invoke-EditTenant.Tests.ps1 b/Tests/Endpoint/Invoke-EditTenant.Tests.ps1
index 3655260a282b3..3c2c733fc76d3 100644
--- a/Tests/Endpoint/Invoke-EditTenant.Tests.ps1
+++ b/Tests/Endpoint/Invoke-EditTenant.Tests.ps1
@@ -89,6 +89,58 @@ Describe 'Invoke-EditTenant tenant groups' {
         }
     }
 
+    It 'clears static memberships for an empty selection while preserving dynamic memberships' {
+        $script:MemberEntities = @(
+            foreach ($GroupId in @($script:StaticGroupId, $script:LegacyGroupId, $script:DynamicGroupId)) {
+                [pscustomobject]@{
+                    PartitionKey = 'Member'
+                    RowKey       = '{0}-{1}' -f $GroupId, $script:CustomerId
+                    GroupId      = $GroupId
+                    customerId   = $script:CustomerId
+                }
+            }
+        )
+        $Request = New-EditRequest -TenantGroups @()
+
+        $Response = Invoke-EditTenant -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        Should -Invoke Remove-CIPPAzDataTableEntity -Times 2 -Exactly
+        foreach ($ExpectedGroupId in @($script:StaticGroupId, $script:LegacyGroupId)) {
+            Should -Invoke Remove-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter {
+                $Entity.GroupId -eq $ExpectedGroupId
+            }
+        }
+        Should -Invoke Remove-CIPPAzDataTableEntity -Times 0 -Exactly -ParameterFilter {
+            $Entity.GroupId -eq $script:DynamicGroupId
+        }
+        Should -Invoke Get-TenantGroups -Times 1 -Exactly -ParameterFilter { $SkipCache }
+    }
+
+    It 'preserves memberships when tenantGroups is <Selection>' -ForEach @(
+        @{ Selection = 'omitted' }
+        @{ Selection = 'null' }
+    ) {
+        $script:MemberEntities = @(
+            [pscustomobject]@{
+                PartitionKey = 'Member'
+                RowKey       = '{0}-{1}' -f $script:StaticGroupId, $script:CustomerId
+                GroupId      = $script:StaticGroupId
+                customerId   = $script:CustomerId
+            }
+        )
+        $Request = New-EditRequest -TenantGroups $null
+        if ($Selection -eq 'omitted') {
+            $Request.Body.PSObject.Properties.Remove('tenantGroups')
+        }
+
+        $Response = Invoke-EditTenant -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        Should -Invoke Remove-CIPPAzDataTableEntity -Times 0 -Exactly
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly
+    }
+
     It 'adds membership for a legacy group that has no GroupType property' {
         $Request = New-EditRequest -TenantGroups @(
             [pscustomobject]@{ groupId = $script:StaticGroupId; groupName = 'Whatever - Do this' }
diff --git a/Tests/Endpoint/Invoke-ExecAddTrustedIP.Tests.ps1 b/Tests/Endpoint/Invoke-ExecAddTrustedIP.Tests.ps1
new file mode 100644
index 0000000000000..1e8d5a0c612e3
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecAddTrustedIP.Tests.ps1
@@ -0,0 +1,49 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Get-CippTable { param($tablename) @{ TableName = $tablename } }
+    function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) }
+    function Get-Tenants { param($TenantFilter) [pscustomobject]@{ defaultDomainName = 'contoso.com' } }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Authentication/ConvertTo-CIPPIPRange.ps1')
+    . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecAddTrustedIP.ps1' | Select-Object -First 1).FullName
+
+    function New-Request {
+        param($TenantFilter = 'contoso.com', $Body)
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecAddTrustedIP' }
+            Headers = $null
+            Query   = [pscustomobject]@{ tenantfilter = $TenantFilter }
+            Body    = [pscustomobject]$Body
+        }
+    }
+}
+
+Describe 'Invoke-ExecAddTrustedIP' {
+    BeforeEach { Mock Add-CIPPAzDataTableEntity { } }
+
+    It 'stores a blocked CIDR range under a key-safe RowKey with the range alongside' {
+        $Response = Invoke-ExecAddTrustedIP -Request (New-Request -TenantFilter 'AllTenants' -Body @{ IP = '203.0.113.0/24'; State = 'Blocked'; Note = 'AiTM kit' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -ParameterFilter {
+            $Entity.PartitionKey -eq 'AllTenants' -and $Entity.RowKey -eq '203.0.113.0_24' -and $Entity.Range -eq '203.0.113.0/24' -and $Entity.state -eq 'Blocked' -and $Entity.Note -eq 'AiTM kit'
+        }
+    }
+
+    It 'accepts several addresses in one call, as an array or a separated string, and dedupes them' {
+        $null = Invoke-ExecAddTrustedIP -Request (New-Request -Body @{ IP = @('198.51.100.7', '198.51.100.8, 198.51.100.7'); State = 'Trusted' }) -TriggerMetadata $null
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 2 -ParameterFilter { $Entity.PartitionKey -eq 'contoso.com' -and $Entity.state -eq 'Trusted' }
+    }
+
+    It 'rejects an invalid address or state without writing anything' {
+        (Invoke-ExecAddTrustedIP -Request (New-Request -Body @{ IP = 'not-an-ip'; State = 'Trusted' }) -TriggerMetadata $null).StatusCode | Should -Be 400
+        (Invoke-ExecAddTrustedIP -Request (New-Request -Body @{ IP = '198.51.100.7'; State = 'Maybe' }) -TriggerMetadata $null).StatusCode | Should -Be 400
+        (Invoke-ExecAddTrustedIP -Request (New-Request -Body @{ IP = ''; State = 'Trusted' }) -TriggerMetadata $null).StatusCode | Should -Be 400
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecApiClient.Tests.ps1 b/Tests/Endpoint/Invoke-ExecApiClient.Tests.ps1
new file mode 100644
index 0000000000000..34fdaf9f20c78
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecApiClient.Tests.ps1
@@ -0,0 +1,88 @@
+# Pester tests for MCP client handling in Invoke-ExecApiClient (AddUpdate).
+#
+# Split-app model: an MCPAllowed API client is an OAuth *client* (the app a connector signs in as),
+# and the dedicated CIPP-MCP app is the shared resource. Several MCPAllowed clients may coexist, each
+# with its own role/IP/redirects/CA, so saving one must NOT clear MCP Access on the others. Enabling
+# MCP on a client configures it via Set-CIPPMCPClientApp.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1'
+    if (-not (Test-Path $FunctionPath)) { throw "Could not locate Invoke-ExecApiClient.ps1 at $FunctionPath" }
+
+    class HttpResponseContext {
+        [object]$StatusCode
+        [object]$Body
+    }
+    $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ('HttpStatusCode' -as [type])) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function Get-CippTable { param($tablename) @{} }
+    function Get-CIPPAzDataTableEntity { param($Filter, $Property) }
+    function Add-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
+    function Test-CippApiClientRoleGrant { param($Request, $Role) @{ Allowed = $true; Message = '' } }
+    function New-CIPPAPIConfig { param($Headers, $ClientId, $AppName, [switch]$ResetSecret) [pscustomobject]@{ ApplicationID = 'new-app'; AppName = 'New Client'; Results = 'ok' } }
+    function Set-CIPPMCPClientApp { param($AppId, $Headers) @{ Success = $true; ClientAppId = $AppId; ResourceAppId = 'resource-app' } }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+
+    . $FunctionPath
+
+    function New-AddUpdateRequest {
+        param([bool]$McpAllowed)
+        [pscustomobject]@{
+            Headers = @{}
+            Query   = [pscustomobject]@{ Action = 'AddUpdate' }
+            Params  = @{ CIPPEndpoint = 'ExecApiClient' }
+            Body    = [pscustomobject]@{
+                Action     = 'AddUpdate'
+                AppName    = 'New Client'
+                Role       = [pscustomobject]@{ value = 'readonly' }
+                Enabled    = $true
+                MCPAllowed = $McpAllowed
+                IpRange    = [pscustomobject]@{ value = @() }
+            }
+        }
+    }
+}
+
+Describe 'Invoke-ExecApiClient - MCP client configuration' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Set-CIPPMCPClientApp -MockWith { @{ Success = $true; ClientAppId = $AppId; ResourceAppId = 'resource-app' } }
+
+        # The new client's RowKey lookup finds nothing (it's new); the unfiltered roster scan returns
+        # an existing client that already holds MCP Access.
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null } -ParameterFilter { $Filter -like 'RowKey eq*' }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{ PartitionKey = 'ApiClients'; RowKey = 'other-mcp'; AppName = 'Other MCP'; Role = 'readonly'; MCPAllowed = $true; Enabled = $true }
+                [pscustomobject]@{ PartitionKey = 'ApiClients'; RowKey = 'plain'; AppName = 'Plain'; Role = 'readonly'; MCPAllowed = $false; Enabled = $true }
+            )
+        } -ParameterFilter { -not $Filter }
+
+        $script:SavedEntities = [System.Collections.Generic.List[object]]::new()
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith {
+            $script:SavedEntities.Add(($Entity | ConvertTo-Json -Depth 6 | ConvertFrom-Json))
+        }
+    }
+
+    It 'allows multiple MCP clients - saving one does not clear MCP Access on others' {
+        $null = Invoke-ExecApiClient -Request (New-AddUpdateRequest -McpAllowed $true)
+
+        ($script:SavedEntities | Where-Object { $_.RowKey -eq 'other-mcp' }) | Should -BeNullOrEmpty
+    }
+
+    It 'configures the saved client as an MCP OAuth client' {
+        $null = Invoke-ExecApiClient -Request (New-AddUpdateRequest -McpAllowed $true)
+
+        Should -Invoke Set-CIPPMCPClientApp -Times 1 -Exactly -ParameterFilter { $AppId -eq 'new-app' }
+    }
+
+    It 'does not configure MCP when the saved client is not MCP-enabled' {
+        $null = Invoke-ExecApiClient -Request (New-AddUpdateRequest -McpAllowed $false)
+
+        Should -Invoke Set-CIPPMCPClientApp -Times 0 -Exactly
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecBECBulkCheck.Tests.ps1 b/Tests/Endpoint/Invoke-ExecBECBulkCheck.Tests.ps1
new file mode 100644
index 0000000000000..2b0a6444bf523
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecBECBulkCheck.Tests.ps1
@@ -0,0 +1,110 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination) }
+    function New-GraphBulkRequest { param($Requests, $tenantid, $asapp) }
+    function New-CippQueueEntry { param($Name, $Link, $Reference, $TotalTasks) }
+    function Set-CIPPBecReport { param($TenantFilter, $CaseId, $Properties, $Results, [switch]$Replace) }
+    function Start-CIPPOrchestrator { param($InputObjectGuid, $InputObject, [switch]$CallerIsQueueTrigger) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    function New-CIPPAsyncDeployment { param($JobId, $Names, $StepTitles, $Source, $TenantFilter) $JobId }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCaseId.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecRunSteps.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecRunRequest.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecBECBulkCheck.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param($Body)
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecBECBulkCheck' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('{"userDetails":"tech@msp.com"}')) }
+            Query   = $null
+            Body    = $Body
+        }
+    }
+    $script:Users = @{
+        'u1' = [pscustomobject]@{ id = 'u1'; userPrincipalName = 'a@contoso.com'; displayName = 'A' }
+        'u2' = [pscustomobject]@{ id = 'u2'; userPrincipalName = 'b@contoso.com'; displayName = 'B' }
+        'u3' = [pscustomobject]@{ id = 'u3'; userPrincipalName = 'c@contoso.com'; displayName = 'C' }
+    }
+}
+
+Describe 'Invoke-ExecBECBulkCheck' {
+    BeforeEach {
+        Mock New-GraphBulkRequest {
+            foreach ($Request in $Requests) {
+                $Ids = [regex]::Matches($Request.url, "'([^']+)'") | ForEach-Object { $_.Groups[1].Value }
+                [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ value = @($Ids | ForEach-Object { $script:Users[$_] } | Where-Object { $_ }) } }
+            }
+        }
+        Mock New-CippQueueEntry { [pscustomobject]@{ RowKey = 'queue-1' } }
+        $script:Rows = [System.Collections.Generic.List[object]]::new()
+        Mock Set-CIPPBecReport { $script:Rows.Add(@{ CaseId = $CaseId; Properties = $Properties; Replace = $Replace.IsPresent }) }
+        $script:Orchestrations = [System.Collections.Generic.List[object]]::new()
+        Mock Start-CIPPOrchestrator { $script:Orchestrations.Add($InputObject) }
+        Mock Write-LogMessage { }
+    }
+
+    It 'queues one run per selected user from the bulk (array) body with the chosen scope' {
+        $Body = @(
+            [pscustomobject]@{ UserIds = 'u1'; tenantFilter = 'contoso.com'; Scope = [pscustomobject]@{ label = 'Full'; value = 'Full' } }
+            [pscustomobject]@{ UserIds = 'u2'; tenantFilter = 'contoso.com'; Scope = [pscustomobject]@{ label = 'Full'; value = 'Full' } }
+        )
+        $Response = Invoke-ExecBECBulkCheck -Request (New-Request $Body) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.QueueId | Should -Be 'queue-1'
+        $Response.Body.Cases.Count | Should -Be 2
+        $Response.Body.Cases[0].CaseId | Should -Match '^BEC-'
+        $script:Rows.Count | Should -Be 2
+        $script:Rows[0].Replace | Should -BeTrue
+        $script:Rows[0].Properties.Status | Should -Be 'Waiting'
+        $script:Rows[0].Properties.QueueId | Should -Be 'queue-1'
+        $script:Rows[0].Properties.RequestedBy | Should -Be 'tech@msp.com'
+        $script:Orchestrations.Count | Should -Be 1
+        $Batch = @($script:Orchestrations[0].Batch)
+        $Batch.Count | Should -Be 2
+        $Batch[0].FunctionName | Should -Be 'BECRun'
+        $Batch[0].QueueId | Should -Be 'queue-1'
+        $Batch[0].userName | Should -Be 'a@contoso.com'
+        $Batch[0].CaseId | Should -Be $script:Rows[0].CaseId
+        Should -Invoke New-CippQueueEntry -Times 1 -ParameterFilter { $TotalTasks -eq 2 }
+    }
+
+    It 'accepts a single object with UserIds[] and always queues the full investigation' {
+        $Response = Invoke-ExecBECBulkCheck -Request (New-Request ([pscustomobject]@{ tenantFilter = 'contoso.com'; UserIds = @('u1', 'u3', 'u1'); Scope = 'Quick' })) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        @($script:Orchestrations[0].Batch).Count | Should -Be 2 -Because 'duplicates are collapsed'
+        $Response.Body.Results | Should -Match 'Queued 2 BEC investigation'
+    }
+
+    It 'reports users it cannot resolve and queues the rest' {
+        $Response = Invoke-ExecBECBulkCheck -Request (New-Request ([pscustomobject]@{ tenantFilter = 'contoso.com'; UserIds = @('u1', 'ghost') })) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        ($Response.Body.Cases | Where-Object { $_.UserId -eq 'ghost' }).Error | Should -Be 'User not found'
+        @($script:Orchestrations[0].Batch).Count | Should -Be 1
+    }
+
+    It 'does not cap the user count - a list over 50 is accepted and every resolvable user is queued' {
+        $Response = Invoke-ExecBECBulkCheck -Request (New-Request ([pscustomobject]@{ tenantFilter = 'contoso.com'; UserIds = @(1..51 | ForEach-Object { "u$_" }) })) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        # only u1/u2/u3 resolve in the mock; the other 48 are reported as not found, none refused
+        @($script:Orchestrations[0].Batch).Count | Should -Be 3
+        @($Response.Body.Cases | Where-Object { $_.Error -eq 'User not found' }).Count | Should -Be 48
+        $Response.Body.Results | Should -Match '48 selected user\(s\) could not be found and were skipped'
+    }
+
+    It 'refuses an empty selection without queueing anything' {
+        $None = Invoke-ExecBECBulkCheck -Request (New-Request ([pscustomobject]@{ tenantFilter = 'contoso.com'; UserIds = @() })) -TriggerMetadata $null
+        $None.StatusCode | Should -Be 500
+        $None.Body.Results | Should -Match 'No users'
+        $script:Orchestrations.Count | Should -Be 0
+        $script:Rows.Count | Should -Be 0
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecBECCheck.Tests.ps1 b/Tests/Endpoint/Invoke-ExecBECCheck.Tests.ps1
new file mode 100644
index 0000000000000..1c92a2da1c7ca
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecBECCheck.Tests.ps1
@@ -0,0 +1,181 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Get-CIPPBecReport { param($TenantFilter, $CaseId, $UserId, [switch]$IncludeResults) }
+    function Set-CIPPBecReport { param($TenantFilter, $CaseId, $Properties, $Results, [switch]$Replace) }
+    function New-CIPPBecCaseId { 'BEC-20260820120000-new001' }
+    function Start-CIPPOrchestrator { param($InputObjectGuid, $InputObject, [switch]$CallerIsQueueTrigger) }
+    function New-CIPPAsyncDeployment { param($JobId, $Names, $StepTitles, $Source, $TenantFilter) $JobId }
+    function Get-CIPPAsyncDeployment { param($JobId) }
+    function Set-CIPPAsyncDeploymentStatus { param($JobId, $Name, $Status, $Logs) }
+    function Set-CIPPAsyncDeploymentStep { param($JobId, $Name, $StepIndex, $StepStatus, $Message) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = $Exception.Exception.Message } }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecRunSteps.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecRunRequest.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecBECCheck.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param([hashtable]$Query = @{}, $Body = $null)
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecBECCheck' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('{"userDetails":"tech@msp.com"}')); 'x-forwarded-for' = '[2001:db8::77]:51000, 10.0.0.1' }
+            Query   = [pscustomobject]$Query
+            Body    = $Body
+        }
+    }
+    $script:Completed = [pscustomobject]@{ CaseId = 'BEC-20260810000000-old001'; RowKey = 'BEC-20260810000000-old001'; Status = 'Completed'; Scope = 'Quick'; ExtractedAt = '2026-08-10T00:10:00Z'; RequestedBy = 'tech@msp.com'; Containment = @(); EvidenceSha256 = $null; EvidenceCreatedAt = $null; Results = [pscustomobject]@{ CaseId = 'BEC-20260810000000-old001'; NewRules = @() } }
+}
+
+Describe 'Invoke-ExecBECCheck' {
+    BeforeEach {
+        Mock Set-CIPPBecReport { }
+        Mock Start-CIPPOrchestrator { }
+        Mock New-CIPPAsyncDeployment { $JobId }
+        Mock Get-CIPPAsyncDeployment { @() }
+        Mock Set-CIPPAsyncDeploymentStatus { }
+        Mock Set-CIPPAsyncDeploymentStep { }
+        Mock Write-LogMessage { }
+    }
+
+    Context 'loading the page (GET without a GUID never starts a run)' {
+        It 'reports that the user has no runs, and queues nothing' {
+            Mock Get-CIPPBecReport { @() }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; userName = 'user@contoso.com' }) -TriggerMetadata $null
+            $Response.StatusCode | Should -Be 200
+            $Response.Body.GUID | Should -BeNullOrEmpty
+            $Response.Body.NoRuns | Should -BeTrue
+            Should -Invoke Start-CIPPOrchestrator -Times 0
+            Should -Invoke Set-CIPPBecReport -Times 0
+        }
+
+        It 'returns the latest existing run without queueing' {
+            Mock Get-CIPPBecReport { @($script:Completed) }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; userName = 'user@contoso.com' }) -TriggerMetadata $null
+            $Response.Body.GUID | Should -Be 'BEC-20260810000000-old001'
+            $Response.Body.Status | Should -Be 'Completed'
+            Should -Invoke Start-CIPPOrchestrator -Times 0
+            Should -Invoke Set-CIPPBecReport -Times 0
+        }
+
+        It 'ignores failed runs when looking for the latest, still without queueing' {
+            Mock Get-CIPPBecReport { @([pscustomobject]@{ CaseId = 'BEC-x'; Status = 'Error' }) }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; userName = 'user@contoso.com' }) -TriggerMetadata $null
+            $Response.Body.NoRuns | Should -BeTrue
+            Should -Invoke Start-CIPPOrchestrator -Times 0
+        }
+
+        It 'fails cleanly without a userid' {
+            Mock Get-CIPPBecReport { @() }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+            $Response.StatusCode | Should -Be 500
+            $Response.Body.Error | Should -Match 'userid'
+        }
+    }
+
+    Context 'starting a run' {
+        It 'POST queues the investigation: history row, progress job keyed on the case id, orchestration, and returns the case id as GUID' {
+            Mock Get-CIPPBecReport { @($script:Completed) }
+            $Response = Invoke-ExecBECCheck -Request (New-Request -Body ([pscustomobject]@{ tenantFilter = 'contoso.com'; userid = 'u1'; userName = 'user@contoso.com' })) -TriggerMetadata $null
+            $Response.StatusCode | Should -Be 200
+            $Response.Body.GUID | Should -Be 'BEC-20260820120000-new001'
+            $Response.Body.Status | Should -Be 'Waiting'
+            Should -Invoke Set-CIPPBecReport -Times 1 -ParameterFilter { $Replace.IsPresent -and $Properties.Status -eq 'Waiting' -and $Properties.UserId -eq 'u1' -and $Properties.RequestedBy -eq 'tech@msp.com' -and $CaseId -eq 'BEC-20260820120000-new001' }
+            Should -Invoke New-CIPPAsyncDeployment -Times 1 -ParameterFilter { $JobId -eq 'BEC-20260820120000-new001' -and $Names -contains 'user@contoso.com' -and @($StepTitles).Count -eq 14 -and $Source -eq 'BEC' }
+            Should -Invoke Start-CIPPOrchestrator -Times 1 -ParameterFilter { $InputObject.OrchestratorName -eq 'BECRunOrchestrator' -and $InputObject.Batch[0].FunctionName -eq 'BECRun' -and $InputObject.Batch[0].CaseId -eq 'BEC-20260820120000-new001' -and $InputObject.Batch[0].UserID -eq 'u1' -and $InputObject.Batch[0].RequestedFromIP -eq '2001:db8::77' }
+            Should -Invoke Set-CIPPBecReport -Times 1 -ParameterFilter { $Properties.RequestedFromIP -eq '2001:db8::77' } -Because "the requester's first x-forwarded-for hop, without port or brackets, is recorded as the technician's address"
+        }
+
+        It 'POST without a userid fails cleanly and queues nothing' {
+            $Response = Invoke-ExecBECCheck -Request (New-Request -Body ([pscustomobject]@{ tenantFilter = 'contoso.com'; userid = '' })) -TriggerMetadata $null
+            $Response.StatusCode | Should -Be 500
+            Should -Invoke Start-CIPPOrchestrator -Times 0
+        }
+    }
+
+    Context 'polling a run' {
+        It 'reports Waiting with the live progress while the run is queued or running' {
+            $Started = (Get-Date).ToUniversalTime().AddMinutes(-2).ToString('o')
+            Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-w'; Status = 'Running'; Scope = 'Full'; RequestedAt = (Get-Date).ToUniversalTime().AddMinutes(-3).ToString('o'); RequestedBy = 'tech@msp.com'; StartedAt = $Started } }
+            Mock Get-CIPPAsyncDeployment { @([pscustomobject]@{ Name = 'user@contoso.com'; Status = 'running'; LastUpdate = [DateTimeOffset]::UtcNow.AddMinutes(-1); Steps = @([pscustomobject]@{ Title = 'Audit log'; Status = 'succeeded'; Message = 'Done' }, [pscustomobject]@{ Title = 'Sign-ins'; Status = 'running'; Message = 'Reading sign-ins' }); Logs = '' }) }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-w' }) -TriggerMetadata $null
+            $Response.Body.Waiting | Should -BeTrue
+            $Response.Body.CaseId | Should -Be 'BEC-w'
+            $Response.Body.Status | Should -Be 'Running'
+            $Response.Body.StartedAt | Should -Be $Started
+            $Response.Body.Progress.Status | Should -Be 'running'
+            @($Response.Body.Progress.Steps).Count | Should -Be 2
+            $Response.Body.Progress.Steps[1].Status | Should -Be 'running'
+            Should -Invoke Get-CIPPBecReport -Times 1 -ParameterFilter { $CaseId -eq 'BEC-w' -and $IncludeResults.IsPresent }
+            Should -Invoke Get-CIPPAsyncDeployment -Times 1 -ParameterFilter { $JobId -eq 'BEC-w' }
+            Should -Invoke Set-CIPPBecReport -Times 0 -Because 'a run that progressed a minute ago is not stale'
+        }
+
+        It 'marks a run with no progress for longer than 20 minutes as failed, on the job rows too, and says why' {
+            Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-stale'; Status = 'Running'; Scope = 'Full'; RequestedAt = (Get-Date).ToUniversalTime().AddMinutes(-50).ToString('o'); StartedAt = (Get-Date).ToUniversalTime().AddMinutes(-45).ToString('o') } }
+            Mock Get-CIPPAsyncDeployment { @([pscustomobject]@{ Name = 'user@contoso.com'; Status = 'running'; LastUpdate = [DateTimeOffset]::UtcNow.AddMinutes(-35); Steps = @([pscustomobject]@{ Title = 'Audit log'; Status = 'succeeded'; Message = 'Done' }, [pscustomobject]@{ Title = 'Sign-ins'; Status = 'running'; Message = 'Reading sign-ins' }); Logs = '' }) }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-stale' }) -TriggerMetadata $null
+            $Response.StatusCode | Should -Be 200
+            $Response.Body.Waiting | Should -BeFalse
+            $Response.Body.Status | Should -Be 'Error'
+            $Response.Body.Error | Should -Match 'No progress for more than 20 minutes'
+            Should -Invoke Set-CIPPBecReport -Times 1 -ParameterFilter { $CaseId -eq 'BEC-stale' -and $Properties.Status -eq 'Error' -and $Properties.ErrorMessage -match 'No progress' }
+            Should -Invoke Set-CIPPAsyncDeploymentStep -Times 1 -ParameterFilter { $JobId -eq 'BEC-stale' -and $StepIndex -eq 1 -and $StepStatus -eq 'failed' }
+            Should -Invoke Set-CIPPAsyncDeploymentStatus -Times 1 -ParameterFilter { $JobId -eq 'BEC-stale' -and $Status -eq 'failed' }
+            Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $message -match 'marked failed' }
+        }
+
+        It 'judges a queued run with no job rows by when it was requested' {
+            Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-q'; Status = 'Waiting'; Scope = 'Full'; RequestedAt = (Get-Date).ToUniversalTime().AddMinutes(-5).ToString('o') } }
+            Mock Get-CIPPAsyncDeployment { @() }
+            (Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-q' }) -TriggerMetadata $null).Body.Waiting | Should -BeTrue
+            Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-q'; Status = 'Waiting'; Scope = 'Full'; RequestedAt = (Get-Date).ToUniversalTime().AddMinutes(-25).ToString('o') } }
+            $Old = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-q' }) -TriggerMetadata $null
+            $Old.Body.Waiting | Should -BeFalse
+            $Old.Body.Error | Should -Match 'abandoned'
+            Should -Invoke Set-CIPPAsyncDeploymentStatus -Times 0 -Because 'there are no job rows to mark'
+        }
+
+        It 'reports Waiting without progress when the job rows are missing' {
+            Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-w'; Status = 'Waiting'; Scope = 'Quick' } }
+            Mock Get-CIPPAsyncDeployment { @() }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-w' }) -TriggerMetadata $null
+            $Response.Body.Waiting | Should -BeTrue
+            $Response.Body.Progress | Should -BeNullOrEmpty
+        }
+
+        It 'returns the results payload with a Run header once completed' {
+            Mock Get-CIPPBecReport { $script:Completed }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-20260810000000-old001' }) -TriggerMetadata $null
+            $Response.Body.CaseId | Should -Be 'BEC-20260810000000-old001'
+            $Response.Body.Run.Status | Should -Be 'Completed'
+            $Response.Body.Run.RequestedBy | Should -Be 'tech@msp.com'
+            $Response.Body.PSObject.Properties.Name | Should -Contain 'NewRules'
+        }
+
+        It 'accepts caseId as the explicit form of GUID' {
+            Mock Get-CIPPBecReport { $script:Completed }
+            $Response = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-20260810000000-old001' }) -TriggerMetadata $null
+            $Response.Body.Run.CaseId | Should -Be 'BEC-20260810000000-old001'
+        }
+
+        It 'surfaces a failed run and an unknown case id as errors, not as Waiting' {
+            Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-e'; Status = 'Error'; ErrorMessage = 'boom'; Scope = 'Quick' } }
+            Mock Get-CIPPAsyncDeployment { @([pscustomobject]@{ Name = 'user@contoso.com'; Status = 'failed'; Steps = @([pscustomobject]@{ Title = 'Audit log'; Status = 'failed'; Message = 'boom' }); Logs = 'boom' }) }
+            $Failed = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-e' }) -TriggerMetadata $null
+            $Failed.Body.Waiting | Should -BeFalse
+            $Failed.Body.Error | Should -Be 'boom'
+            $Failed.Body.Progress.Status | Should -Be 'failed' -Because 'the page shows which phase failed'
+            Mock Get-CIPPBecReport { $null }
+            $Missing = Invoke-ExecBECCheck -Request (New-Request @{ tenantFilter = 'contoso.com'; GUID = 'BEC-missing' }) -TriggerMetadata $null
+            $Missing.Body.Waiting | Should -BeFalse
+            $Missing.Body.Error | Should -Match 'not found'
+        }
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecBECEvidenceExport.Tests.ps1 b/Tests/Endpoint/Invoke-ExecBECEvidenceExport.Tests.ps1
new file mode 100644
index 0000000000000..d1cf021a44532
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecBECEvidenceExport.Tests.ps1
@@ -0,0 +1,84 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function New-CIPPBecEvidencePackage { param($TenantFilter, $CaseId, $Headers, $APIName) }
+    function Set-CippBecCaseContext { param($CaseId) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecBECEvidenceExport.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param([hashtable]$Body)
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecBECEvidenceExport' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = 'x' }
+            Query   = $null
+            Body    = [pscustomobject]$Body
+        }
+    }
+    # 3 KB of deterministic bytes standing in for the ZIP the package builder returns
+    $script:ZipBytes = [byte[]]@(0x50, 0x4B, 0x03, 0x04; 1..3068 | ForEach-Object { $_ % 256 })
+    $script:Package = [pscustomobject]@{ CaseId = 'BEC-1'; Bytes = $script:ZipBytes.Length; FileCount = 5; ZipBytes = $script:ZipBytes }
+}
+
+Describe 'Invoke-ExecBECEvidenceExport' {
+    BeforeEach {
+        Mock New-CIPPBecEvidencePackage { $script:Package }
+        Mock Set-CippBecCaseContext { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'builds the package for the case and hands the ZIP back base64-encoded with its size and file count' {
+        $Response = Invoke-ExecBECEvidenceExport -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-1' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.Results | Should -Be 'Evidence package for case BEC-1 created: 5 files, 3 KB'
+        $Response.Body.Evidence.CaseId | Should -Be 'BEC-1'
+        $Response.Body.Evidence.FileCount | Should -Be 5
+        $Response.Body.Evidence.Bytes | Should -Be 3072
+        [System.Convert]::FromBase64String($Response.Body.Evidence.ZipBase64) | Should -Be $script:ZipBytes
+        Should -Invoke New-CIPPBecEvidencePackage -Times 1 -ParameterFilter { $TenantFilter -eq 'contoso.com' -and $CaseId -eq 'BEC-1' -and $APIName -eq 'ExecBECEvidenceExport' -and $Headers.'x-ms-client-principal' -eq 'x' }
+        Should -Invoke Write-LogMessage -Times 0 -ParameterFilter { $sev -eq 'Error' }
+    }
+
+    It 'stamps the case id on the log context while it runs and clears it afterwards' {
+        $null = Invoke-ExecBECEvidenceExport -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-1' }) -TriggerMetadata $null
+        Should -Invoke Set-CippBecCaseContext -Times 2 -Exactly
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { $CaseId -eq 'BEC-1' }
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { [string]::IsNullOrEmpty($CaseId) }
+    }
+
+    It 'fails cleanly without a caseId: builds nothing, logs the error and never stamps a case id it does not have' {
+        $Response = Invoke-ExecBECEvidenceExport -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be 'Evidence export failed: caseId is required'
+        $Response.Body.ContainsKey('Evidence') | Should -BeFalse
+        Should -Invoke New-CIPPBecEvidencePackage -Times 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $sev -eq 'Error' -and $message -match 'caseId is required' -and $API -eq 'ExecBECEvidenceExport' -and $tenant -eq 'contoso.com' }
+        Should -Invoke Set-CippBecCaseContext -Times 0 -ParameterFilter { -not [string]::IsNullOrEmpty($CaseId) }
+        Should -Invoke Set-CippBecCaseContext -Times 2 -Exactly -Because 'the finally block still clears the context'
+    }
+
+    It 'fails cleanly without a tenantFilter' {
+        $Response = Invoke-ExecBECEvidenceExport -Request (New-Request @{ caseId = 'BEC-1' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be 'Evidence export failed: tenantFilter is required'
+        Should -Invoke New-CIPPBecEvidencePackage -Times 0
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { [string]::IsNullOrEmpty($CaseId) }
+    }
+
+    It 'reports a package build failure as a formatted error, logs it with the exception and clears the context' {
+        Mock New-CIPPBecEvidencePackage { throw 'BEC run BEC-1 is Running; only completed runs can be exported' }
+        $Response = Invoke-ExecBECEvidenceExport -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-1' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be 'Evidence export failed: BEC run BEC-1 is Running; only completed runs can be exported'
+        $Response.Body.ContainsKey('Evidence') | Should -BeFalse
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $sev -eq 'Error' -and $message -eq 'Evidence export for BEC case BEC-1 failed: BEC run BEC-1 is Running; only completed runs can be exported' -and $LogData.NormalizedError -match 'only completed runs' }
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { $CaseId -eq 'BEC-1' }
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { [string]::IsNullOrEmpty($CaseId) }
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecBECRemediate.Tests.ps1 b/Tests/Endpoint/Invoke-ExecBECRemediate.Tests.ps1
new file mode 100644
index 0000000000000..d644f1f7de96e
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecBECRemediate.Tests.ps1
@@ -0,0 +1,108 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Invoke-CIPPBecContainment { param($TenantFilter, $UserId, $UserPrincipalName, $Actions, $Parameters, [switch]$Confirmed, $CaseId, $RunResults, $Headers, $APIName) }
+    function Start-CIPPBecContainmentJob { param($TenantFilter, $UserId, $UserPrincipalName, $Actions, $Parameters, $CaseId, $Headers, $APIName) }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecContainmentActions.ps1')
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecBECRemediate.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param([hashtable]$Body)
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecBECRemediate' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = 'x' }
+            Query   = $null
+            Body    = [pscustomobject]$Body
+        }
+    }
+}
+
+Describe 'Invoke-ExecBECRemediate' {
+    BeforeEach {
+        Mock Invoke-CIPPBecContainment { @([pscustomobject]@{ Action = 'RevokeSessions'; Target = 'victim@contoso.com'; state = 'success'; resultText = 'ok'; copyField = $null }) }
+        Mock Start-CIPPBecContainmentJob { 'job-1' }
+        Mock Write-LogMessage { }
+    }
+
+    It 'runs the default set when no actions are given and the UPN is typed' {
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Confirmation = 'Victim@Contoso.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.Results[0].state | Should -Be 'success'
+        Should -Invoke Invoke-CIPPBecContainment -Times 1 -ParameterFilter { $Confirmed.IsPresent -and @($Actions).Count -eq 0 -and $UserPrincipalName -eq 'victim@contoso.com' }
+    }
+
+    It 'returns 400 and runs nothing when a Critical action is selected without the typed UPN' {
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Actions = @('ResetPassword', 'RevokeSessions'); Confirmation = 'wrong' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 400
+        $Response.Body.Results[0].state | Should -Be 'error'
+        $Response.Body.Results[0].resultText | Should -Match 'Type the user''s UPN'
+        Should -Invoke Invoke-CIPPBecContainment -Times 0
+    }
+
+    It 'lets non-Critical actions run without confirmation' {
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Actions = @('RevokeSessions', 'ClearForwarding') }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        Should -Invoke Invoke-CIPPBecContainment -Times 1 -ParameterFilter { -not $Confirmed.IsPresent -and $Actions -contains 'ClearForwarding' }
+    }
+
+    It 'accepts autocomplete-shaped action objects and hands the case on for target resolution' {
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Actions = @([pscustomobject]@{ value = 'RevokeSessions'; label = 'Revoke sessions' }); CaseId = 'BEC-1'; Parameters = [pscustomobject]@{ Protocols = @('IMAP') } }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.DeploymentId | Should -BeNullOrEmpty -Because 'an inline run has nothing to poll'
+        Should -Invoke Invoke-CIPPBecContainment -Times 1 -ParameterFilter { $Actions -contains 'RevokeSessions' -and $Parameters.Protocols -contains 'IMAP' -and $CaseId -eq 'BEC-1' }
+    }
+
+    It 'hands an Async run to the background job with the validated selection and returns its DeploymentId' {
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Confirmation = 'victim@contoso.com'; CaseId = 'BEC-1'; Async = $true; Parameters = [pscustomobject]@{ Protocols = @('IMAP') } }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.DeploymentId | Should -Be 'job-1'
+        $Response.Body.Results[0].state | Should -Be 'info'
+        Should -Invoke Invoke-CIPPBecContainment -Times 0
+        Should -Invoke Start-CIPPBecContainmentJob -Times 1 -ParameterFilter {
+            $TenantFilter -eq 'contoso.com' -and $UserPrincipalName -eq 'victim@contoso.com' -and $UserId -eq 'u1' -and $CaseId -eq 'BEC-1' -and
+            $Parameters.Protocols -contains 'IMAP' -and (@($Actions) -join ',') -eq 'ResetPassword,DisableAccount,RevokeSessions,RemoveMFA,DisableInboxRules,BlockProtocols'
+        }
+    }
+
+    It 'still refuses an unconfirmed Critical selection before queueing anything' {
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Async = $true }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 400
+        Should -Invoke Start-CIPPBecContainmentJob -Times 0
+    }
+
+    It 'reports a job that could not be queued as an error, without a DeploymentId' {
+        Mock Start-CIPPBecContainmentJob { throw "Error - The command 'Invoke-CIPPBecContainment' is not permitted to run as a scheduled task." }
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Actions = @('RevokeSessions'); Async = $true }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results[0].resultText | Should -Match 'not permitted'
+        $Response.Body.DeploymentId | Should -BeNullOrEmpty
+    }
+
+    It 'rejects unknown actions' {
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Actions = @('Nuke') }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results[0].resultText | Should -Match 'Unknown containment action'
+        Should -Invoke Invoke-CIPPBecContainment -Times 0
+    }
+
+    It 'resolves the UPN from the object id when only userid is supplied' {
+        Mock New-GraphGetRequest { [pscustomobject]@{ userPrincipalName = 'victim@contoso.com' } }
+        $null = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; Actions = @('RevokeSessions') }) -TriggerMetadata $null
+        Should -Invoke Invoke-CIPPBecContainment -Times 1 -ParameterFilter { $UserPrincipalName -eq 'victim@contoso.com' -and $UserId -eq 'u1' }
+    }
+
+    It 'keeps copyField on the response rows so the password can be copied' {
+        Mock Invoke-CIPPBecContainment { @([pscustomobject]@{ Action = 'ResetPassword'; Target = 'victim@contoso.com'; state = 'success'; resultText = 'The new password is x'; copyField = 'x' }) }
+        $Response = Invoke-ExecBECRemediate -Request (New-Request @{ tenantFilter = 'contoso.com'; userid = 'u1'; username = 'victim@contoso.com'; Confirmation = 'victim@contoso.com' }) -TriggerMetadata $null
+        $Response.Body.Results[0].copyField | Should -Be 'x'
+        $Response.Body.Results[0].Action | Should -Be 'ResetPassword'
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecBECRemediationDefaults.Tests.ps1 b/Tests/Endpoint/Invoke-ExecBECRemediationDefaults.Tests.ps1
new file mode 100644
index 0000000000000..72aa63b96a9e3
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecBECRemediationDefaults.Tests.ps1
@@ -0,0 +1,53 @@
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification = 'New-Request only builds an in-memory request object for the tests.')]
+param()
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Get-CIPPTable { param($TableName) @{ TableName = $TableName } }
+    function Get-CIPPAzDataTableEntity { param($TableName, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) }
+    function Write-LogMessage { param($message, $API, $headers, $sev) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecContainmentActions.ps1')
+    . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecBECRemediationDefaults.ps1' | Select-Object -First 1).FullName
+
+    function New-Request {
+        param($Query = @{}, $Body = $null)
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecBECRemediationDefaults' }
+            Headers = $null
+            Query   = [pscustomobject]$Query
+            Body    = $Body
+        }
+    }
+}
+
+Describe 'Invoke-ExecBECRemediationDefaults' {
+    BeforeEach {
+        Mock Add-CIPPAzDataTableEntity { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'lists the catalog with the effective defaults' {
+        $Response = Invoke-ExecBECRemediationDefaults -Request (New-Request -Query @{ List = 'true' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.Results.Count | Should -Be 21
+        @($Response.Body.Results | Where-Object { $_.DefaultSelected }).Id | Should -Contain 'BlockProtocols'
+    }
+
+    It 'saves the selected ids as a JSON array' {
+        $Response = Invoke-ExecBECRemediationDefaults -Request (New-Request -Body ([pscustomobject]@{ DefaultActions = @('RevokeSessions', 'ClearForwarding') })) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -ParameterFilter { $Entity.PartitionKey -eq 'BecRemediation' -and $Entity.RowKey -eq 'Defaults' -and $Entity.DefaultActions -eq '["RevokeSessions","ClearForwarding"]' }
+    }
+
+    It 'rejects an empty selection and unknown ids without saving' {
+        (Invoke-ExecBECRemediationDefaults -Request (New-Request -Body ([pscustomobject]@{ DefaultActions = @() })) -TriggerMetadata $null).StatusCode | Should -Be 400
+        (Invoke-ExecBECRemediationDefaults -Request (New-Request -Body ([pscustomobject]@{ DefaultActions = @('Nope') })) -TriggerMetadata $null).StatusCode | Should -Be 400
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecBECReport.Tests.ps1 b/Tests/Endpoint/Invoke-ExecBECReport.Tests.ps1
new file mode 100644
index 0000000000000..c8a1ca036807d
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecBECReport.Tests.ps1
@@ -0,0 +1,71 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Remove-CIPPBecReport { param($TenantFilter, $CaseId) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecBECReport.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param([hashtable]$Body)
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecBECReport' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = 'x' }
+            Query   = $null
+            Body    = [pscustomobject]$Body
+        }
+    }
+}
+
+Describe 'Invoke-ExecBECReport' {
+    BeforeEach {
+        Mock Remove-CIPPBecReport { 'Deleted BEC run BEC-1 for contoso.com' }
+        Mock Write-LogMessage { }
+    }
+
+    It 'Delete removes the run through Remove-CIPPBecReport, logs it and returns the remover''s message as Results' {
+        $Response = Invoke-ExecBECReport -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-1'; Action = 'Delete' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.Results | Should -Be 'Deleted BEC run BEC-1 for contoso.com'
+        Should -Invoke Remove-CIPPBecReport -Times 1 -ParameterFilter { $TenantFilter -eq 'contoso.com' -and $CaseId -eq 'BEC-1' }
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $sev -eq 'Info' -and $message -eq 'Deleted BEC run BEC-1' -and $tenant -eq 'contoso.com' -and $API -eq 'ExecBECReport' }
+    }
+
+    It 'rejects an unknown action as a formatted error, logs it and deletes nothing' {
+        $Response = Invoke-ExecBECReport -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-1'; Action = 'Archive' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be "Failed: Unknown action 'Archive'"
+        Should -Invoke Remove-CIPPBecReport -Times 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $sev -eq 'Error' -and $message -eq "BEC run action 'Archive' failed for BEC-1: Unknown action 'Archive'" -and $LogData.NormalizedError -eq "Unknown action 'Archive'" }
+        Should -Invoke Write-LogMessage -Times 0 -ParameterFilter { $sev -eq 'Info' }
+    }
+
+    It 'treats a missing action as unknown rather than defaulting to Delete' {
+        $Response = Invoke-ExecBECReport -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-1' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be "Failed: Unknown action ''"
+        Should -Invoke Remove-CIPPBecReport -Times 0
+    }
+
+    It 'fails cleanly without a caseId, before the action is looked at' {
+        $Response = Invoke-ExecBECReport -Request (New-Request @{ tenantFilter = 'contoso.com'; Action = 'Archive' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be 'Failed: caseId is required'
+        Should -Invoke Remove-CIPPBecReport -Times 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $sev -eq 'Error' -and $message -match 'caseId is required' -and $API -eq 'ExecBECReport' }
+    }
+
+    It 'surfaces a delete failure (run not found) as a formatted error with an error log entry and no success entry' {
+        Mock Remove-CIPPBecReport { throw 'BEC run BEC-404 was not found for contoso.com' }
+        $Response = Invoke-ExecBECReport -Request (New-Request @{ tenantFilter = 'contoso.com'; caseId = 'BEC-404'; Action = 'Delete' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be 'Failed: BEC run BEC-404 was not found for contoso.com'
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $sev -eq 'Error' -and $message -eq "BEC run action 'Delete' failed for BEC-404: BEC run BEC-404 was not found for contoso.com" -and $LogData.NormalizedError -match 'not found' }
+        Should -Invoke Write-LogMessage -Times 0 -ParameterFilter { $sev -eq 'Info' }
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecClrOnPremAttributes.Tests.ps1 b/Tests/Endpoint/Invoke-ExecClrOnPremAttributes.Tests.ps1
new file mode 100644
index 0000000000000..f3e8b1785d040
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecClrOnPremAttributes.Tests.ps1
@@ -0,0 +1,80 @@
+# Pester tests for Invoke-ExecClrOnPremAttributes.
+#
+# Thin endpoint over Clear-CIPPOnPremisesAttributes. The part worth pinning is the Attributes parsing:
+# the frontend autoComplete sends {label,value} objects, API scripts send plain strings, and a missing
+# list must reach the helper empty so it clears every documented on-premises attribute.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecClrOnPremAttributes.ps1'
+    if (-not (Test-Path $FunctionPath)) { throw "Could not locate Invoke-ExecClrOnPremAttributes.ps1 at $FunctionPath" }
+
+    class HttpResponseContext {
+        [object]$StatusCode
+        [object]$Body
+    }
+    $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ('HttpStatusCode' -as [type])) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function Clear-CIPPOnPremisesAttributes { param($UserID, $TenantFilter, $Headers, $APIName, $Attributes) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+
+    . $FunctionPath
+
+    function New-ClrRequest {
+        param($Attributes)
+        $Body = [pscustomobject]@{ tenantFilter = 'contoso.com'; ID = 'user-guid' }
+        if ($null -ne $Attributes) { $Body | Add-Member -NotePropertyName Attributes -NotePropertyValue $Attributes }
+        [pscustomobject]@{
+            Body    = $Body
+            Query   = [pscustomobject]@{}
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ExecClrOnPremAttributes' }
+            Headers = @{}
+        }
+    }
+}
+
+Describe 'Invoke-ExecClrOnPremAttributes' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        $script:Captured = $null
+        Mock -CommandName Clear-CIPPOnPremisesAttributes -MockWith { $script:Captured = @($Attributes); 'ok' }
+    }
+
+    It 'unwraps autoComplete objects to attribute names' {
+        $Selected = @(
+            [pscustomobject]@{ label = 'Immutable ID'; value = 'onPremisesImmutableId' },
+            [pscustomobject]@{ label = 'SAM'; value = 'onPremisesSamAccountName' }
+        )
+
+        $Response = Invoke-ExecClrOnPremAttributes -Request (New-ClrRequest -Attributes $Selected) -TriggerMetadata $null
+
+        $script:Captured | Should -Be @('onPremisesImmutableId', 'onPremisesSamAccountName')
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $Response.Body.Results | Should -Be 'ok'
+        Should -Invoke Clear-CIPPOnPremisesAttributes -Times 1 -ParameterFilter { $UserID -eq 'user-guid' -and $TenantFilter -eq 'contoso.com' }
+    }
+
+    It 'accepts plain attribute names' {
+        Invoke-ExecClrOnPremAttributes -Request (New-ClrRequest -Attributes @('onPremisesDomainName')) -TriggerMetadata $null
+
+        $script:Captured | Should -Be @('onPremisesDomainName')
+    }
+
+    It 'passes an empty list through when no attributes are sent' {
+        Invoke-ExecClrOnPremAttributes -Request (New-ClrRequest) -TriggerMetadata $null
+
+        $script:Captured.Count | Should -Be 0
+    }
+
+    It 'returns 500 with the helper error message' {
+        Mock -CommandName Clear-CIPPOnPremisesAttributes -MockWith { throw 'graph said no' }
+
+        $Response = Invoke-ExecClrOnPremAttributes -Request (New-ClrRequest) -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError)
+        $Response.Body.Results | Should -Be 'graph said no'
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecExtensionsConfig.Tests.ps1 b/Tests/Endpoint/Invoke-ExecExtensionsConfig.Tests.ps1
new file mode 100644
index 0000000000000..4a16d21b20410
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecExtensionsConfig.Tests.ps1
@@ -0,0 +1,51 @@
+BeforeAll {
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+    $accelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Get-CIPPTable { param($TableName) @{} }
+    function Add-CIPPAzDataTableEntity { param($Entity, [switch]$Force) $script:SavedConfig = $Entity.config | ConvertFrom-Json }
+    function Add-AzDataTableEntity { param($Entity, [switch]$Force) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev) }
+    function Register-CIPPExtensionScheduledTasks {
+        param([switch]$Reschedule, $NextSync, $Extensions)
+        if ($null -eq $script:SavedConfig) { throw 'Configuration must be saved before scheduling.' }
+        $script:ScheduleCalls += @{ Reschedule = $Reschedule.IsPresent; NextSync = $NextSync; Extensions = $Extensions }
+    }
+    . "$PSScriptRoot/../../Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ExecExtensionsConfig.ps1"
+}
+
+Describe 'Extension configuration save ordering' {
+    BeforeEach {
+        $script:SavedConfig = $null
+        $script:ScheduleCalls = @()
+        $request = @{
+            Params = @{ CIPPEndpoint = 'ExecExtensionsConfig' }
+            Headers = @{ 'x-ms-original-url' = 'http://localhost:4280/api/ExecExtensionsConfig' }
+            Body = [PSCustomObject]@{ Hudu = [PSCustomObject]@{ Enabled = $true; APIKey = 'SentToKeyVault'; IncludeLAPS = $true; NextSync = 1800000000 } }
+        }
+    }
+    It 'persists first-time Hudu settings before rescheduling and registers other extensions' {
+        $response = Invoke-ExecExtensionsConfig -Request $request
+        $response.Body.Results | Should -BeLike 'Successfully saved*'
+        $script:SavedConfig.Hudu.Enabled | Should -BeTrue
+        $script:SavedConfig.Hudu.IncludeLAPS | Should -BeTrue
+        $script:SavedConfig.Hudu.NextSync | Should -Be ''
+        $script:ScheduleCalls.Count | Should -Be 2
+        $script:ScheduleCalls[0].Reschedule | Should -BeTrue
+        $script:ScheduleCalls[0].NextSync | Should -Be 1800000000
+        $script:ScheduleCalls[0].Extensions | Should -Be 'Hudu'
+        $script:ScheduleCalls[1].Reschedule | Should -BeFalse
+    }
+    It 'registers normal schedules after saving when no next-sync time is provided' {
+        $request.Body.Hudu.NextSync = ''
+        $response = Invoke-ExecExtensionsConfig -Request $request
+        $response.Body.Results | Should -BeLike 'Successfully saved*'
+        $script:ScheduleCalls.Count | Should -Be 1
+        $script:ScheduleCalls[0].Reschedule | Should -BeFalse
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecGetReportBuilderPdf.Tests.ps1 b/Tests/Endpoint/Invoke-ExecGetReportBuilderPdf.Tests.ps1
new file mode 100644
index 0000000000000..f170ce76cf518
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecGetReportBuilderPdf.Tests.ps1
@@ -0,0 +1,90 @@
+# Pester tests for Invoke-ExecGetReportBuilderPdf
+#
+# The endpoint is AnyTenant (the request carries only the report id), so it scopes the stored PDF
+# row by its tenant partition itself: unrestricted callers get any report, restricted callers only
+# the reports of tenants they can access, and a 404 otherwise.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecGetReportBuilderPdf.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-ExecGetReportBuilderPdf.ps1 under Modules/' }
+
+    class HttpResponseContext {
+        [object]$StatusCode
+        [object]$Body
+        [object]$ContentType
+        [object]$Headers
+    }
+
+    $Accelerators = [psobject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not $Accelerators::Get.ContainsKey('HttpStatusCode')) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function Get-CippTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Context, $TableName, $Filter, $Property) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) }
+    function Write-LogMessage { param($Headers, $API, $message, $Sev, $tenant, $LogData) }
+    function Test-CIPPAccess { param($Request, [switch]$TenantList, [switch]$GroupList) }
+    function Get-Tenants { param($TenantFilter, [switch]$IncludeErrors) }
+    function Get-CippException { param($Exception) }
+
+    . $FunctionPath
+
+    $script:ReportId = '11111111-2222-3333-4444-555555555555'
+    function New-PdfRequest {
+        [pscustomobject]@{
+            Headers = @{}
+            Query   = [pscustomobject]@{ id = $script:ReportId }
+            Body    = $null
+        }
+    }
+}
+
+Describe 'Invoke-ExecGetReportBuilderPdf' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CippTable -MockWith { @{ TableName = 'ReportBuilderPdfs' } }
+        Mock -CommandName ConvertTo-CIPPODataFilterValue -MockWith { $Value }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{
+                PartitionKey = 'contoso.onmicrosoft.com'
+                RowKey       = $script:ReportId
+                FileName     = 'Report.pdf'
+                Pdf          = [Convert]::ToBase64String([byte[]](37, 80, 68, 70))
+            }
+        }
+        Mock -CommandName Get-Tenants -MockWith {
+            [pscustomobject]@{ customerId = 'contoso-id'; defaultDomainName = 'contoso.onmicrosoft.com' }
+            [pscustomobject]@{ customerId = 'fabrikam-id'; defaultDomainName = 'fabrikam.onmicrosoft.com' }
+        }
+    }
+
+    It 'returns the PDF to an unrestricted caller' {
+        Mock -CommandName Test-CIPPAccess -MockWith { @('AllTenants') }
+        $Response = Invoke-ExecGetReportBuilderPdf -Request (New-PdfRequest) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be ([HttpStatusCode]::OK)
+        $Response.ContentType | Should -Be 'application/pdf'
+        $Response.Body | Should -Be ([byte[]](37, 80, 68, 70))
+    }
+
+    It "returns the PDF to a restricted caller who can access the report's tenant" {
+        Mock -CommandName Test-CIPPAccess -MockWith { @('contoso-id') }
+        $Response = Invoke-ExecGetReportBuilderPdf -Request (New-PdfRequest) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be ([HttpStatusCode]::OK)
+    }
+
+    It "hides the report from a restricted caller who cannot access its tenant" {
+        Mock -CommandName Test-CIPPAccess -MockWith { @('fabrikam-id') }
+        $Response = Invoke-ExecGetReportBuilderPdf -Request (New-PdfRequest) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be ([HttpStatusCode]::NotFound)
+        $Response.Body | Should -Not -BeOfType [byte[]]
+    }
+
+    It 'hides the report from a caller with no tenants at all' {
+        Mock -CommandName Test-CIPPAccess -MockWith { @() }
+        $Response = Invoke-ExecGetReportBuilderPdf -Request (New-PdfRequest) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be ([HttpStatusCode]::NotFound)
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecIRMConfiguration.Tests.ps1 b/Tests/Endpoint/Invoke-ExecIRMConfiguration.Tests.ps1
new file mode 100644
index 0000000000000..7679c28187f90
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecIRMConfiguration.Tests.ps1
@@ -0,0 +1,112 @@
+# Pester tests for Invoke-ExecIRMConfiguration
+#
+# The 'Set' action forwards caller-supplied settings to Set-IRMConfiguration. Two things must hold:
+# only the keys the caller actually sent reach Exchange (an API client posting one switch must not
+# flip the others), and only whitelisted keys/values get through, because the body is caller
+# controlled and lands on a tenant-wide cmdlet.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecIRMConfiguration.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-ExecIRMConfiguration.ps1 under Modules/' }
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    # The function uses the short [HttpStatusCode] (the Functions host supplies `using namespace
+    # System.Net`). Register a type accelerator so it resolves when the function is dot-sourced here.
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function New-ExoRequest { [CmdletBinding()] param($tenantid, $cmdlet, $cmdParams) }
+    function Write-LogMessage { [CmdletBinding()] param($Headers, $API, $tenant, $message, $Sev, $LogData) }
+    function Get-CippException { [CmdletBinding()] param($Exception) }
+
+    . $FunctionPath
+
+    function New-SetRequest {
+        param([hashtable]$Body)
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'ExecIRMConfiguration' }
+            Headers = @{}
+            Query   = @{}
+            Body    = [pscustomobject](@{ tenantFilter = 'contoso.com'; Action = 'Set' } + $Body)
+        }
+    }
+}
+
+Describe 'Invoke-ExecIRMConfiguration' {
+    BeforeEach {
+        Mock -CommandName New-ExoRequest -MockWith { }
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CippException -MockWith { @{ NormalizedError = $Exception.Exception.Message } }
+    }
+
+    Context 'Set' {
+        It 'forwards every supported setting when the tools page posts the full form' {
+            $Response = Invoke-ExecIRMConfiguration -Request (New-SetRequest @{
+                    AzureRMSLicensingEnabled                   = $true
+                    SimplifiedClientAccessEnabled              = $true
+                    EnablePdfEncryption                        = $true
+                    DecryptAttachmentForEncryptOnly            = $false
+                    SimplifiedClientAccessDoNotForwardDisabled = $false
+                    SimplifiedClientAccessEncryptOnlyDisabled  = $false
+                    TransportDecryptionSetting                 = 'Mandatory'
+                })
+
+            $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+            Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+                $cmdlet -eq 'Set-IRMConfiguration' -and $tenantid -eq 'contoso.com' -and
+                $cmdParams.Count -eq 7 -and
+                $cmdParams.EnablePdfEncryption -eq $true -and
+                $cmdParams.DecryptAttachmentForEncryptOnly -eq $false -and
+                $cmdParams.TransportDecryptionSetting -eq 'Mandatory'
+            }
+            $Response.Body.Results | Should -Match 'EnablePdfEncryption = True'
+        }
+
+        It 'only touches the settings the caller sent' {
+            $null = Invoke-ExecIRMConfiguration -Request (New-SetRequest @{ EnablePdfEncryption = 'true' })
+
+            Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+                $cmdParams.Count -eq 1 -and $cmdParams.EnablePdfEncryption -eq $true
+            }
+        }
+
+        It 'drops an unknown transport decryption value instead of forwarding it' {
+            $null = Invoke-ExecIRMConfiguration -Request (New-SetRequest @{
+                    AzureRMSLicensingEnabled   = $true
+                    TransportDecryptionSetting = 'Sometimes'
+                })
+
+            Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+                $cmdParams.Count -eq 1 -and -not $cmdParams.ContainsKey('TransportDecryptionSetting')
+            }
+        }
+
+        It 'fails when no supported setting was provided' {
+            $Response = Invoke-ExecIRMConfiguration -Request (New-SetRequest @{ SearchEnabled = $false })
+
+            $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError)
+            $Response.Body.Results | Should -Match 'No message encryption settings'
+            Should -Invoke New-ExoRequest -Times 0 -Exactly
+        }
+    }
+
+    Context 'Test' {
+        It 'refuses to run without both addresses' {
+            $Request = New-SetRequest @{ Sender = 'a@contoso.com' }
+            $Request.Body.Action = 'Test'
+
+            $Response = Invoke-ExecIRMConfiguration -Request $Request
+
+            $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError)
+            Should -Invoke New-ExoRequest -Times 0 -Exactly
+        }
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecRemoveSnooze.Tests.ps1 b/Tests/Endpoint/Invoke-ExecRemoveSnooze.Tests.ps1
index 4594eb305e1c1..13302ed535857 100644
--- a/Tests/Endpoint/Invoke-ExecRemoveSnooze.Tests.ps1
+++ b/Tests/Endpoint/Invoke-ExecRemoveSnooze.Tests.ps1
@@ -1,8 +1,9 @@
 # Pester tests for Invoke-ExecRemoveSnooze
 #
-# The delete is keyed by raw PartitionKey/RowKey, so for restricted callers the endpoint
-# reads the row first and only deletes when the row's Tenant resolves through the
-# scope-narrowed Get-Tenants. Unrestricted callers keep the direct delete.
+# The delete is keyed by raw PartitionKey/RowKey. The endpoint reads the row first for
+# everyone: restricted callers only delete when the row's Tenant resolves through the
+# scope-narrowed Get-Tenants, and the row's Tenant and ContentHash locate the tracked
+# AlertLifecycle item, which goes back to Open as soon as the snooze is gone.
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -21,14 +22,16 @@ BeforeAll {
     }
 
     function Get-CIPPTable { param($tablename) }
-    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property) }
-    function Remove-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Get-CIPPAzDataTableEntity { param($Context, $TableName, $Filter, $Property) }
+    function Add-CIPPAzDataTableEntity { param($Context, $TableName, $Entity, [switch]$Force) }
+    function Remove-CIPPAzDataTableEntity { param($Context, $TableName, $Entity, [switch]$Force) }
     function ConvertTo-CIPPODataFilterValue { param($Value, $Type) }
     function Write-LogMessage { param($headers, $API, $message, $Sev, $LogData) }
     function Test-CIPPAccess { param($Request, [switch]$TenantList, [switch]$GroupList) }
     function Get-Tenants { param($TenantFilter, [switch]$IncludeErrors) }
     function Get-CippException { param($Exception) }
 
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Get-CIPPAlertLifecycleKey.ps1')
     . $FunctionPath
 
     function New-RemoveRequest {
@@ -44,12 +47,16 @@ BeforeAll {
 
 Describe 'Invoke-ExecRemoveSnooze' {
     BeforeEach {
+        $script:Written = $null
         Mock -CommandName Write-LogMessage -MockWith { }
-        Mock -CommandName Get-CIPPTable -MockWith { @{ TableName = 'AlertSnooze' } }
+        Mock -CommandName Get-CIPPTable -MockWith { @{ TableName = $tablename } }
         Mock -CommandName Remove-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:Written = $Entity }
         Mock -CommandName ConvertTo-CIPPODataFilterValue -MockWith { $Value }
         Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
-            [pscustomobject]@{ PartitionKey = 'Get-CIPPAlertSomething'; RowKey = 'contoso.onmicrosoft.com-hash123'; Tenant = 'contoso.onmicrosoft.com' }
+            if ($TableName -eq 'AlertSnooze') {
+                [pscustomobject]@{ PartitionKey = 'Get-CIPPAlertSomething'; RowKey = 'contoso.onmicrosoft.com-hash123'; Tenant = 'contoso.onmicrosoft.com'; ContentHash = 'hash123' }
+            }
         }
         Mock -CommandName Test-CIPPAccess -MockWith { @('AllTenants') }
         Mock -CommandName Get-Tenants -MockWith {
@@ -57,12 +64,45 @@ Describe 'Invoke-ExecRemoveSnooze' {
         }
     }
 
-    It 'removes directly for an unrestricted caller without reading the row back' {
+    It 'removes for an unrestricted caller without a tenant check' {
         $Response = Invoke-ExecRemoveSnooze -Request (New-RemoveRequest) -TriggerMetadata $null
 
         $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
         Should -Invoke Remove-CIPPAzDataTableEntity -Times 1 -Exactly
-        Should -Invoke Get-CIPPAzDataTableEntity -Times 0 -Exactly
+        Should -Invoke Get-Tenants -Times 0 -Exactly
+    }
+
+    It 'returns the tracked alert item to open once the snooze is gone' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            if ($TableName -eq 'AlertSnooze') {
+                [pscustomobject]@{ PartitionKey = 'Get-CIPPAlertSomething'; RowKey = 'contoso.onmicrosoft.com-hash123'; Tenant = 'contoso.onmicrosoft.com'; ContentHash = 'hash123' }
+            } else {
+                [pscustomobject]@{ PartitionKey = 'contoso.onmicrosoft.com'; RowKey = 'Get-CIPPAlertSomething-hash123'; Status = 'Snoozed'; SnoozedBy = 'ops@contoso.com'; SnoozeUntil = '-1'; SnoozeRowKey = 'contoso.onmicrosoft.com-hash123'; ETag = 'W/"1"' }
+            }
+        }
+
+        $Response = Invoke-ExecRemoveSnooze -Request (New-RemoveRequest) -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $TableName -eq 'AlertLifecycle' -and $Filter -eq "PartitionKey eq 'contoso.onmicrosoft.com' and RowKey eq 'Get-CIPPAlertSomething-hash123'" }
+        $script:Written.Status | Should -Be 'Open'
+        $script:Written.SnoozedBy | Should -Be ''
+        $script:Written.SnoozeRowKey | Should -Be ''
+        $script:Written.Keys | Should -Not -Contain 'ETag'
+    }
+
+    It 'leaves a tracked item alone when it is not snoozed' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            if ($TableName -eq 'AlertSnooze') {
+                [pscustomobject]@{ PartitionKey = 'Get-CIPPAlertSomething'; RowKey = 'contoso.onmicrosoft.com-hash123'; Tenant = 'contoso.onmicrosoft.com'; ContentHash = 'hash123' }
+            } else {
+                [pscustomobject]@{ PartitionKey = 'contoso.onmicrosoft.com'; RowKey = 'Get-CIPPAlertSomething-hash123'; Status = 'Resolved' }
+            }
+        }
+
+        $null = Invoke-ExecRemoveSnooze -Request (New-RemoveRequest) -TriggerMetadata $null
+
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly
     }
 
     It 'removes for a restricted caller when the row belongs to a tenant in scope' {
diff --git a/Tests/Endpoint/Invoke-ExecSetSharePointMember.Tests.ps1 b/Tests/Endpoint/Invoke-ExecSetSharePointMember.Tests.ps1
new file mode 100644
index 0000000000000..026d10086131a
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ExecSetSharePointMember.Tests.ps1
@@ -0,0 +1,179 @@
+# Pester tests for Invoke-ExecSetSharePointMember
+# Covers adding several users at once on each path, partial failures and the single-entry removal picker.
+# The endpoint delegates to Set-CIPPSharePointSiteMember, which is loaded too so both are exercised together.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecSetSharePointMember.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-ExecSetSharePointMember.ps1 under Modules/' }
+    $HelperPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Set-CIPPSharePointSiteMember.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $HelperPath) { throw 'Could not locate Set-CIPPSharePointSiteMember.ps1 under Modules/' }
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+    $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ('HttpStatusCode' -as [type])) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function Add-CIPPGroupMember { param($GroupType, $GroupID, $Member, $TenantFilter, $Headers) }
+    function Get-CippException { param($Exception) }
+    function New-GraphGetRequest { param($uri, $tenantid, $scope, $extraHeaders, [switch]$ComplexFilter, [switch]$UseCertificate, $AsApp) }
+    function New-GraphPostRequest { param($uri, $tenantid, $scope, $type, $body, $contentType, $AddedHeaders, [switch]$UseCertificate, $AsApp) }
+    function Remove-CIPPGroupMember { param($GroupType, $GroupID, $Member, $TenantFilter, $Headers) }
+    function Resolve-CIPPSharePointRestContext { param($TenantFilter, $SiteUrl) }
+    function Write-LogMessage { param($Headers, $API, $tenant, $message, $sev, $LogData) }
+
+    . $FunctionPath
+    . $HelperPath
+
+    function New-TestRequest {
+        param($Body)
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'ExecSetSharePointMember' }
+            Headers = @{ Authorization = 'token' }
+            Body    = ($Body | ConvertTo-Json -Depth 5 | ConvertFrom-Json)
+        }
+    }
+    function New-UserOption {
+        param($Upn, $AddedFields = @{ id = 'id' })
+        @{ label = $Upn; value = $Upn; addedFields = $AddedFields }
+    }
+}
+
+Describe 'Invoke-ExecSetSharePointMember' {
+    BeforeEach {
+        Mock -CommandName Get-CippException -MockWith { [pscustomobject]@{ NormalizedError = $Exception.Exception.Message } }
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Resolve-CIPPSharePointRestContext -MockWith {
+            [pscustomobject]@{ Scope = 'https://contoso.sharepoint.com/.default'; Headers = @{}; BaseUri = "$SiteUrl/_api" }
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith { [pscustomobject]@{ id = "id-of-$(($uri -split '/users/')[1] -replace '\?.*')" } }
+        Mock -CommandName New-GraphPostRequest -MockWith {
+            if ($uri -like '*/ensureuser') {
+                $Logon = ($body | ConvertFrom-Json).logonName
+                return [pscustomobject]@{ Id = 7; LoginName = $Logon }
+            }
+        }
+        Mock -CommandName Add-CIPPGroupMember -MockWith { "Successfully added $($Member -join ', ') to group Site." }
+        Mock -CommandName Remove-CIPPGroupMember -MockWith { "Successfully removed $($Member -join ', ') from group Site." }
+    }
+
+    It 'adds several users to a classic site role group in one call' {
+        $Request = New-TestRequest @{
+            tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Members'; SharePointType = 'Sts'
+            URL = 'https://contoso.sharepoint.com/sites/hr'; GroupID = 'owner@contoso.com'
+            user = @((New-UserOption 'a@contoso.com'), (New-UserOption 'b@contoso.com'))
+        }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        @($Response.Body.Results).Count | Should -Be 2
+        $Response.Body.Results | Should -Contain 'Successfully added a@contoso.com as a member of https://contoso.sharepoint.com/sites/hr.'
+        Should -Invoke New-GraphPostRequest -Times 2 -Exactly -ParameterFilter { $uri -like '*/web/associatedmembergroup/users' }
+        Should -Invoke Resolve-CIPPSharePointRestContext -Times 1 -Exactly
+    }
+
+    It 'keeps going when one user fails and reports each outcome' {
+        Mock -CommandName New-GraphPostRequest -MockWith { throw 'User not found' } -ParameterFilter { $uri -like '*/ensureuser' -and $body -like '*bad@contoso.com*' }
+        $Request = New-TestRequest @{
+            tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Visitors'; SharePointType = 'Sts'
+            URL = 'https://contoso.sharepoint.com/sites/hr'
+            user = @((New-UserOption 'bad@contoso.com'), (New-UserOption 'good@contoso.com'))
+        }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        $Response.Body.Results[0] | Should -BeLike 'Failed to add bad@contoso.com*'
+        $Response.Body.Results[1] | Should -Be 'Successfully added good@contoso.com as a visitor of https://contoso.sharepoint.com/sites/hr.'
+    }
+
+    It 'returns BadRequest when every user fails' {
+        Mock -CommandName New-GraphPostRequest -MockWith { throw 'User not found' } -ParameterFilter { $uri -like '*/ensureuser' }
+        $Request = New-TestRequest @{
+            tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Members'; SharePointType = 'Sts'
+            URL = 'https://contoso.sharepoint.com/sites/hr'
+            user = @((New-UserOption 'x@contoso.com'), (New-UserOption 'y@contoso.com'))
+        }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::BadRequest)
+        $Response.Body.Results | Should -BeLike '*Failed to add x@contoso.com*Failed to add y@contoso.com*'
+    }
+
+    It 'passes all users to Add-CIPPGroupMember for members of a group-connected site' {
+        $Request = New-TestRequest @{
+            tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Members'; SharePointType = 'Group'
+            GroupID = '11111111-2222-3333-4444-555555555555'
+            user = @((New-UserOption 'a@contoso.com'), (New-UserOption 'b@contoso.com'))
+        }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        Should -Invoke Add-CIPPGroupMember -Times 1 -Exactly -ParameterFilter {
+            ($Member -join ',') -eq 'a@contoso.com,b@contoso.com' -and $GroupID -eq '11111111-2222-3333-4444-555555555555'
+        }
+    }
+
+    It 'asks the site for its backing group when no group is supplied' {
+        Mock -CommandName New-GraphGetRequest -MockWith { [pscustomobject]@{ GroupId = '11111111-2222-3333-4444-555555555555' } } -ParameterFilter { $uri -like '*/_api/site?*' }
+        $Request = New-TestRequest @{
+            tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Members'; SharePointType = 'Group'
+            URL = 'https://contoso.sharepoint.com/sites/team'; GroupID = ''
+            user = @((New-UserOption 'a@contoso.com'))
+        }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        Should -Invoke New-GraphGetRequest -Times 1 -Exactly -ParameterFilter { $uri -eq 'https://contoso.sharepoint.com/sites/team/_api/site?$select=GroupId' }
+        Should -Invoke Add-CIPPGroupMember -Times 1 -Exactly -ParameterFilter { $GroupID -eq '11111111-2222-3333-4444-555555555555' }
+    }
+
+    It 'adds each user as an owner of the M365 group on a group-connected site' {
+        $Request = New-TestRequest @{
+            tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Owners'; SharePointType = 'Group'
+            GroupID = '11111111-2222-3333-4444-555555555555'
+            user = @((New-UserOption 'a@contoso.com'), (New-UserOption 'b@contoso.com'))
+        }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        @($Response.Body.Results).Count | Should -Be 2
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*/owners/$ref' -and $body -like '*id-of-a@contoso.com*' }
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*/owners/$ref' -and $body -like '*id-of-b@contoso.com*' }
+    }
+
+    It 'still removes a single directly-added user from the role group picked in the removal dialog' {
+        $Request = New-TestRequest @{
+            tenantFilter = 'contoso.onmicrosoft.com'; Add = $false; SharePointType = 'Group'
+            URL = 'https://contoso.sharepoint.com/sites/team'; GroupID = '11111111-2222-3333-4444-555555555555'
+            user = (New-UserOption 'c@contoso.com' @{ Group = 'Owners'; Type = 'User' })
+        }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        $Response.Body.Results | Should -Be 'Successfully removed c@contoso.com as an owner of https://contoso.sharepoint.com/sites/team.'
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $uri -like '*/web/associatedownergroup/users/removebyid(7)' }
+        Should -Invoke Remove-CIPPGroupMember -Times 0 -Exactly
+    }
+
+    It 'returns BadRequest when no user is selected' {
+        $Request = New-TestRequest @{ tenantFilter = 'contoso.onmicrosoft.com'; Add = $true; Role = 'Members'; SharePointType = 'Sts'; URL = 'https://contoso.sharepoint.com/sites/hr' }
+
+        $Response = Invoke-ExecSetSharePointMember -Request $Request -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::BadRequest)
+        $Response.Body.Results | Should -BeLike '*No user was selected*'
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ExecSnoozeAlert.Tests.ps1 b/Tests/Endpoint/Invoke-ExecSnoozeAlert.Tests.ps1
index 7dd55877194ad..b18dc370944b9 100644
--- a/Tests/Endpoint/Invoke-ExecSnoozeAlert.Tests.ps1
+++ b/Tests/Endpoint/Invoke-ExecSnoozeAlert.Tests.ps1
@@ -3,6 +3,10 @@
 # The endpoint is AnyTenant, so the framework's per-tenant check is skipped and the
 # endpoint gates the caller-supplied TenantFilter itself: restricted callers may only
 # snooze alerts for tenants the scope-narrowed Get-Tenants can resolve.
+#
+# A snooze is either timed (7, 14, 30 or 90 days) or "until resolved"; there is no
+# indefinite snooze. KeepVisible leaves the item on the dashboard. The tracked
+# AlertLifecycle row, when one exists and is not resolved, flips to Snoozed straight away.
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -22,35 +26,50 @@ BeforeAll {
 
     function Get-AlertContentHash { param($AlertItem) }
     function Get-CIPPTable { param($tablename) }
-    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Get-CIPPAzDataTableEntity { param($Context, $TableName, $Filter, $Property) }
+    function Add-CIPPAzDataTableEntity { param($Context, $TableName, $Entity, [switch]$Force) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) }
     function Write-LogMessage { param($headers, $API, $message, $Sev, $tenant, $LogData) }
     function Test-CIPPAccess { param($Request, [switch]$TenantList, [switch]$GroupList) }
     function Get-Tenants { param($TenantFilter, [switch]$IncludeErrors) }
     function Get-CippException { param($Exception) }
 
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Get-CIPPAlertLifecycleKey.ps1')
+
     . $FunctionPath
 
     function New-SnoozeRequest {
-        param($TenantFilter = 'contoso.onmicrosoft.com')
+        param($TenantFilter = 'contoso.onmicrosoft.com', $Duration = 7, $UntilResolved, $KeepVisible, $Reason = 'test')
+        $Body = @{
+            CmdletName   = 'Get-CIPPAlertSomething'
+            TenantFilter = $TenantFilter
+            AlertItem    = @{ Message = 'alert text' }
+            Reason       = $Reason
+        }
+        if ($null -ne $Duration) { $Body.Duration = $Duration }
+        if ($null -ne $UntilResolved) { $Body.UntilResolved = $UntilResolved }
+        if ($null -ne $KeepVisible) { $Body.KeepVisible = $KeepVisible }
         [pscustomobject]@{
             Params  = @{ CIPPEndpoint = 'ExecSnoozeAlert' }
             Headers = @{ }
-            Body    = [pscustomobject]@{
-                CmdletName   = 'Get-CIPPAlertSomething'
-                TenantFilter = $TenantFilter
-                AlertItem    = @{ Message = 'alert text' }
-                Duration     = 7
-                Reason       = 'test'
-            }
+            Body    = [pscustomobject]$Body
         }
     }
+
+    function Get-Written {
+        param($Table)
+        ($script:Written | Where-Object { $_.Table -eq $Table } | Select-Object -Last 1).Entity
+    }
 }
 
 Describe 'Invoke-ExecSnoozeAlert' {
     BeforeEach {
+        $script:Written = [System.Collections.Generic.List[object]]::new()
         Mock -CommandName Write-LogMessage -MockWith { }
-        Mock -CommandName Get-CIPPTable -MockWith { @{ TableName = 'AlertSnooze' } }
-        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName Get-CIPPTable -MockWith { @{ TableName = $tablename } }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName ConvertTo-CIPPODataFilterValue -MockWith { $Value }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:Written.Add(@{ Table = $TableName; Entity = $Entity }) }
         Mock -CommandName Get-AlertContentHash -MockWith {
             @{ ContentHash = 'hash123'; ContentPreview = 'alert text'; RawKey = 'raw' }
         }
@@ -60,11 +79,75 @@ Describe 'Invoke-ExecSnoozeAlert' {
         }
     }
 
-    It 'writes the snooze row for an unrestricted caller' {
-        $Response = Invoke-ExecSnoozeAlert -Request (New-SnoozeRequest) -TriggerMetadata $null
+    It 'writes a timed snooze row for an unrestricted caller' {
+        $Response = Invoke-ExecSnoozeAlert -Request (New-SnoozeRequest -Duration 14) -TriggerMetadata $null
 
         $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
-        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $TableName -eq 'AlertSnooze' }
+        $Snooze = Get-Written -Table 'AlertSnooze'
+        $Snooze.PartitionKey | Should -Be 'Get-CIPPAlertSomething'
+        $Snooze.RowKey | Should -Be 'contoso.onmicrosoft.com-hash123'
+        $Snooze.UntilResolved | Should -Be 'False'
+        $Snooze.KeepVisible | Should -Be 'False'
+        $Now = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
+        ([int64]$Snooze.SnoozeUntil) | Should -BeGreaterThan ($Now + 13 * 86400)
+        ([int64]$Snooze.SnoozeUntil) | Should -BeLessOrEqual ($Now + 14 * 86400)
+    }
+
+    It 'writes an until-resolved snooze that keeps the item visible' {
+        $Response = Invoke-ExecSnoozeAlert -Request (New-SnoozeRequest -Duration $null -UntilResolved $true -KeepVisible $true) -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $Response.Body.UntilResolved | Should -BeTrue
+        $Response.Body.KeepVisible | Should -BeTrue
+        $Snooze = Get-Written -Table 'AlertSnooze'
+        $Snooze.UntilResolved | Should -Be 'True'
+        $Snooze.KeepVisible | Should -Be 'True'
+        $Snooze.SnoozeUntil | Should -Be '0'
+    }
+
+    It 'rejects durations outside 7/14/30/90, including the old forever value' {
+        foreach ($Bad in @(-1, 0, 3, 365)) {
+            $Response = Invoke-ExecSnoozeAlert -Request (New-SnoozeRequest -Duration $Bad) -TriggerMetadata $null
+            $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        }
+        $Response = Invoke-ExecSnoozeAlert -Request (New-SnoozeRequest -Duration $null) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly
+    }
+
+    It 'marks the tracked alert item as snoozed when one exists' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{
+                PartitionKey = 'contoso.onmicrosoft.com'
+                RowKey       = 'Get-CIPPAlertSomething-hash123'
+                Status       = 'Open'
+                ContentHash  = 'hash123'
+                ETag         = 'W/"1"'
+            }
+        }
+
+        $Response = Invoke-ExecSnoozeAlert -Request (New-SnoozeRequest -Duration $null -UntilResolved $true -KeepVisible $true -Reason 'ticket 42') -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $TableName -eq 'AlertLifecycle' -and $Filter -eq "PartitionKey eq 'contoso.onmicrosoft.com' and RowKey eq 'Get-CIPPAlertSomething-hash123'" }
+        $Tracked = Get-Written -Table 'AlertLifecycle'
+        $Tracked.Status | Should -Be 'Snoozed'
+        $Tracked.SnoozeRowKey | Should -Be 'contoso.onmicrosoft.com-hash123'
+        $Tracked.SnoozeReason | Should -Be 'ticket 42'
+        $Tracked.SnoozeVisible | Should -Be 'True'
+        $Tracked.SnoozeUntilResolved | Should -Be 'True'
+        $Tracked.Keys | Should -Not -Contain 'ETag'
+    }
+
+    It 'leaves a resolved tracked item alone' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{ PartitionKey = 'contoso.onmicrosoft.com'; RowKey = 'Get-CIPPAlertSomething-hash123'; Status = 'Resolved' }
+        }
+
+        $null = Invoke-ExecSnoozeAlert -Request (New-SnoozeRequest) -TriggerMetadata $null
+
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0 -Exactly -ParameterFilter { $TableName -eq 'AlertLifecycle' }
     }
 
     It 'refuses a restricted caller naming a tenant outside their scope' {
diff --git a/Tests/Endpoint/Invoke-ListAlertResults.Tests.ps1 b/Tests/Endpoint/Invoke-ListAlertResults.Tests.ps1
new file mode 100644
index 0000000000000..91d4c73a5bc0b
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ListAlertResults.Tests.ps1
@@ -0,0 +1,176 @@
+# Pester tests for Invoke-ListAlertResults
+#
+# The endpoint reads the AlertLifecycle table. Open and Snoozed rows always come back;
+# Resolved rows only with IncludeResolved=true and only when resolved within the last Days
+# days. Every row carries the keys the frontend needs to snooze or unsnooze it plus the
+# snooze details, and rows are narrowed to the caller's tenants.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ListAlertResults.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-ListAlertResults.ps1 under Modules/' }
+
+    class HttpResponseContext {
+        [object]$StatusCode
+        [object]$Body
+    }
+
+    $Accelerators = [psobject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not $Accelerators::Get.ContainsKey('HttpStatusCode')) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function Get-CIPPTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Context, $TableName, $Filter, $Property) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) }
+    function Write-LogMessage { param($headers, $API, $message, $Sev, $tenant, $LogData) }
+    function Get-CippException { param($Exception) }
+    function Select-CippAllowedTenantData {
+        param([Parameter(ValueFromPipeline)]$InputObject, $TenantProperty)
+        process { $InputObject }
+    }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Get-CIPPAlertLifecycleKey.ps1')
+    . $FunctionPath
+
+    function New-ListRequest {
+        param($TenantFilter = 'contoso.onmicrosoft.com', $IncludeResolved, $Days)
+        $Query = @{ tenantFilter = $TenantFilter }
+        if ($null -ne $IncludeResolved) { $Query.IncludeResolved = $IncludeResolved }
+        if ($null -ne $Days) { $Query.Days = $Days }
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'ListAlertResults' }
+            Headers = @{ }
+            Body    = [pscustomobject]@{ }
+            Query   = [pscustomobject]$Query
+        }
+    }
+
+    function New-Row {
+        param($Tenant = 'contoso.onmicrosoft.com', $Hash, $Status = 'Open', $ResolvedAt = '', $LastSeen = '2026-09-22T10:00:00.0000000Z')
+        [pscustomobject]@{
+            PartitionKey        = $Tenant
+            RowKey              = "Get-CIPPAlertSomething-$Hash"
+            CmdletName          = 'Get-CIPPAlertSomething'
+            Tenant              = $Tenant
+            ContentHash         = $Hash
+            ContentPreview      = "item $Hash"
+            AlertItem           = '{"Message":"item"}'
+            AlertComment        = ''
+            Status              = $Status
+            FirstSeen           = '2026-09-20T10:00:00.0000000Z'
+            LastSeen            = $LastSeen
+            LastChecked         = $LastSeen
+            ResolvedAt          = $ResolvedAt
+            ReopenCount         = '2'
+            SnoozeUntil         = ''
+            SnoozedBy           = ''
+            SnoozeRowKey        = ''
+            SnoozeReason        = ''
+            SnoozeVisible       = ''
+            SnoozeUntilResolved = ''
+        }
+    }
+}
+
+Describe 'Invoke-ListAlertResults' {
+    BeforeEach {
+        $script:Rows = @()
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CIPPTable -MockWith { @{ TableName = 'AlertLifecycle' } }
+        Mock -CommandName ConvertTo-CIPPODataFilterValue -MockWith { $Value }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $script:Rows }
+    }
+
+    It 'requires a tenantFilter' {
+        $Response = Invoke-ListAlertResults -Request (New-ListRequest -TenantFilter '') -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+    }
+
+    It 'returns open and snoozed rows but hides resolved ones by default' {
+        $script:Rows = @(
+            (New-Row -Hash 'a' -Status 'Open'),
+            (New-Row -Hash 'c' -Status 'Snoozed'),
+            (New-Row -Hash 'd' -Status 'Resolved' -ResolvedAt ([datetime]::UtcNow.AddHours(-1).ToString('o')))
+        )
+
+        $Response = Invoke-ListAlertResults -Request (New-ListRequest) -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        @($Response.Body).Count | Should -Be 2
+        @($Response.Body).Status | Should -Not -Contain 'Resolved'
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { $Filter -eq "PartitionKey eq 'contoso.onmicrosoft.com'" }
+    }
+
+    It 'includes resolved rows within the window when asked, and sorts them last' {
+        $script:Rows = @(
+            (New-Row -Hash 'old' -Status 'Resolved' -ResolvedAt ([datetime]::UtcNow.AddDays(-10).ToString('o'))),
+            (New-Row -Hash 'fresh' -Status 'Resolved' -ResolvedAt ([datetime]::UtcNow.AddHours(-3).ToString('o'))),
+            (New-Row -Hash 'open' -Status 'Open')
+        )
+
+        $Response = Invoke-ListAlertResults -Request (New-ListRequest -IncludeResolved 'true' -Days 2) -TriggerMetadata $null
+
+        @($Response.Body).Count | Should -Be 2
+        @($Response.Body)[0].ContentHash | Should -Be 'open'
+        @($Response.Body)[1].ContentHash | Should -Be 'fresh'
+    }
+
+    It 'derives the snooze keys and parses the alert item' {
+        $script:Rows = @(New-Row -Hash 'abc/def' -Status 'Open')
+
+        $Response = Invoke-ListAlertResults -Request (New-ListRequest) -TriggerMetadata $null
+
+        $Row = @($Response.Body)[0]
+        $Row.SnoozePartitionKey | Should -Be 'Get-CIPPAlertSomething'
+        $Row.SnoozeRowKey | Should -Be 'contoso.onmicrosoft.com-abc_def'
+        $Row.AlertItem.Message | Should -Be 'item'
+        $Row.ReopenCount | Should -Be 2
+        $Row.RowKey | Should -Be 'Get-CIPPAlertSomething-abc/def'
+        $Row.SnoozeVisible | Should -BeFalse
+        $Row.SnoozeUntilResolved | Should -BeFalse
+    }
+
+    It 'exposes the snooze details of a snoozed row as booleans' {
+        $Row = New-Row -Hash 'abc' -Status 'Snoozed'
+        $Row.SnoozeRowKey = 'stored-key'
+        $Row.SnoozeVisible = 'True'
+        $Row.SnoozeUntilResolved = 'True'
+        $Row.SnoozeReason = 'ticket 42'
+        $script:Rows = @($Row)
+
+        $Response = Invoke-ListAlertResults -Request (New-ListRequest) -TriggerMetadata $null
+
+        $Out = @($Response.Body)[0]
+        $Out.SnoozeRowKey | Should -Be 'stored-key'
+        $Out.SnoozeVisible | Should -BeTrue
+        $Out.SnoozeUntilResolved | Should -BeTrue
+        $Out.SnoozeReason | Should -Be 'ticket 42'
+    }
+
+    It 'reads the whole table for AllTenants and narrows it to allowed tenants' {
+        $script:Rows = @(
+            (New-Row -Tenant 'contoso.onmicrosoft.com' -Hash 'a'),
+            (New-Row -Tenant 'fabrikam.onmicrosoft.com' -Hash 'b')
+        )
+        Mock -CommandName Select-CippAllowedTenantData -MockWith {
+            process { if ($InputObject.Tenant -eq 'contoso.onmicrosoft.com') { $InputObject } }
+        }
+
+        $Response = Invoke-ListAlertResults -Request (New-ListRequest -TenantFilter 'AllTenants') -TriggerMetadata $null
+
+        @($Response.Body).Count | Should -Be 1
+        @($Response.Body)[0].Tenant | Should -Be 'contoso.onmicrosoft.com'
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter { [string]::IsNullOrEmpty($Filter) }
+    }
+
+    It 'clamps Days to the allowed range' {
+        $script:Rows = @(New-Row -Hash 'a' -Status 'Resolved' -ResolvedAt ([datetime]::UtcNow.AddDays(-400).ToString('o')))
+
+        $Response = Invoke-ListAlertResults -Request (New-ListRequest -IncludeResolved 'true' -Days 9999) -TriggerMetadata $null
+
+        @($Response.Body).Count | Should -Be 0
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ListAutopilotconfig.Tests.ps1 b/Tests/Endpoint/Invoke-ListAutopilotconfig.Tests.ps1
new file mode 100644
index 0000000000000..24f9c61bd0fe9
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ListAutopilotconfig.Tests.ps1
@@ -0,0 +1,135 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ListAutopilotconfig.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-ListAutopilotconfig.ps1 under Modules/' }
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+    $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ('HttpStatusCode' -as [type])) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function New-GraphGetRequest { param($uri, $tenantid) }
+    function New-GraphBulkRequest { param($Requests, $tenantid) }
+    function Get-NormalizedError { param($Message) $Message }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/ConvertTo-CIPPIntunePolicyListItem.ps1')
+    . $FunctionPath
+
+    function New-ListAPRequest {
+        param($Type)
+        [pscustomobject]@{
+            Query = [pscustomobject]@{ TenantFilter = 'contoso.onmicrosoft.com'; type = $Type }
+        }
+    }
+
+    function New-APProfile {
+        param($Name, $Targets)
+        [pscustomobject]@{
+            id          = "$Name-id"
+            displayName = $Name
+            assignments = @($Targets | ForEach-Object { [pscustomobject]@{ target = $_ } })
+        }
+    }
+}
+
+Describe 'Invoke-ListAutopilotconfig ApProfile' {
+    BeforeEach {
+        $script:Profiles = @()
+        $script:ProfileStatus = 200
+        Mock New-GraphBulkRequest {
+            @($Requests | ForEach-Object {
+                    $Body = if ($_.id -eq 'Groups') {
+                        [pscustomobject]@{ value = @([pscustomobject]@{ id = 'group-1'; displayName = 'Autopilot Devices' }) }
+                    } elseif ($script:ProfileStatus -eq 200) {
+                        [pscustomobject]@{ value = $script:Profiles }
+                    } else {
+                        [pscustomobject]@{ error = [pscustomobject]@{ message = 'Graph said no' } }
+                    }
+                    [pscustomobject]@{
+                        id     = $_.id
+                        status = if ($_.id -eq 'Groups') { 200 } else { $script:ProfileStatus }
+                        body   = $Body
+                    }
+                })
+        }
+        Mock New-GraphGetRequest { @() }
+    }
+
+    It 'resolves group assignment targets to display names' {
+        $script:Profiles = @(
+            (New-APProfile -Name 'Standard' -Targets @(
+                    [pscustomobject]@{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = 'group-1' }
+                )),
+            (New-APProfile -Name 'Kiosk' -Targets @(
+                    [pscustomobject]@{ '@odata.type' = '#microsoft.graph.allDevicesAssignmentTarget' }
+                ))
+        )
+
+        $Response = Invoke-ListAutopilotconfig -Request (New-ListAPRequest -Type 'ApProfile') -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        $Response.Body | Should -HaveCount 2
+        ($Response.Body | Where-Object displayName -EQ 'Standard').PolicyAssignment | Should -Be 'Autopilot Devices'
+        ($Response.Body | Where-Object displayName -EQ 'Kiosk').PolicyAssignment | Should -Be 'All Devices'
+        $Response.Body.PolicyTypeName | Select-Object -Unique | Should -Be 'Autopilot Profile'
+        Should -Invoke New-GraphBulkRequest -Times 1 -ParameterFilter {
+            $tenantid -eq 'contoso.onmicrosoft.com' -and
+            ($Requests.url -join ' ') -like '*windowsAutopilotDeploymentProfiles?$expand=assignments*' -and
+            ($Requests.url -join ' ') -like '*/groups?*select=id,displayName*'
+        }
+        Should -Not -Invoke New-GraphGetRequest
+    }
+
+    It 'leaves the name blank for a deleted group and keeps the raw assignments' {
+        $script:Profiles = @(
+            (New-APProfile -Name 'Orphaned' -Targets @(
+                    [pscustomobject]@{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = 'gone-group' }
+                ))
+        )
+
+        $Response = Invoke-ListAutopilotconfig -Request (New-ListAPRequest -Type 'ApProfile') -TriggerMetadata $null
+
+        $Response.Body | Should -HaveCount 1
+        $Response.Body[0].PolicyAssignment | Should -BeNullOrEmpty
+        $Response.Body[0].assignments[0].target.groupId | Should -Be 'gone-group'
+    }
+
+    It 'returns an empty body when the tenant has no profiles' {
+        $Response = Invoke-ListAutopilotconfig -Request (New-ListAPRequest -Type 'ApProfile') -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        @($Response.Body) | Should -HaveCount 0
+    }
+
+    It 'surfaces a Graph error on the profile request as Forbidden' {
+        $script:ProfileStatus = 403
+
+        $Response = Invoke-ListAutopilotconfig -Request (New-ListAPRequest -Type 'ApProfile') -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::Forbidden)
+        $Response.Body | Should -Be 'Graph said no'
+    }
+}
+
+Describe 'Invoke-ListAutopilotconfig ESP' {
+    It 'still uses the single Graph GET for enrollment status pages' {
+        Mock New-GraphBulkRequest { throw 'should not batch for ESP' }
+        Mock New-GraphGetRequest {
+            @(
+                [pscustomobject]@{ '@odata.type' = '#microsoft.graph.windows10EnrollmentCompletionPageConfiguration'; displayName = 'ESP' },
+                [pscustomobject]@{ '@odata.type' = '#microsoft.graph.deviceEnrollmentLimitConfiguration'; displayName = 'Limit' }
+            )
+        }
+
+        $Response = Invoke-ListAutopilotconfig -Request (New-ListAPRequest -Type 'ESP') -TriggerMetadata $null
+
+        $Response.StatusCode | Should -Be ([int][System.Net.HttpStatusCode]::OK)
+        $Response.Body.displayName | Should -Be 'ESP'
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like '*deviceEnrollmentConfigurations*' }
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ListBECPhishingSpread.Tests.ps1 b/Tests/Endpoint/Invoke-ListBECPhishingSpread.Tests.ps1
new file mode 100644
index 0000000000000..d16aa60acf22b
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ListBECPhishingSpread.Tests.ps1
@@ -0,0 +1,141 @@
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '', Justification = 'Stubs exist only so Pester can mock them.')]
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification = 'Stubs exist only so Pester can mock them.')]
+param()
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Get-CIPPBecMessageTrace { param($TenantFilter, $SenderAddress, $RecipientAddress, $StartDate, $EndDate, $Anchor, $PageSize, $MaxPages) }
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor, $useSystemMailbox, $NoAuthCheck) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ListBECPhishingSpread.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param([hashtable]$Query = @{})
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ListBECPhishingSpread' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('{"userDetails":"tech@msp.com"}')) }
+            Query   = [pscustomobject]$Query
+            Body    = $null
+        }
+    }
+    function New-TraceRow {
+        param([string]$TraceId, [string]$Recipient, [string]$Received, [string]$Subject, [string]$Status = 'Delivered')
+        [pscustomobject]@{ MessageTraceId = $TraceId; RecipientAddress = $Recipient; SenderAddress = 'ceo@contos0.com'; Subject = $Subject; Status = $Status; Received = $Received; FromIP = '203.0.113.5' }
+    }
+    # One sender, three recipients. alice has four distinct messages (t1 appears twice, once quarantined),
+    # bob is external, carol is on the second accepted domain, and the last row has no recipient at all.
+    $script:Spread = @(
+        (New-TraceRow -TraceId 't1' -Recipient 'Alice@Contoso.com' -Received '2026-08-20T12:00:00Z' -Subject 'Invoice 1')
+        (New-TraceRow -TraceId 't1' -Recipient 'alice@contoso.com' -Received '2026-08-20T12:00:05Z' -Subject 'Invoice 1' -Status 'Quarantined')
+        (New-TraceRow -TraceId 't2' -Recipient 'alice@contoso.com' -Received '2026-08-18T09:00:00Z' -Subject 'Invoice 2')
+        (New-TraceRow -TraceId 't3' -Recipient 'alice@contoso.com' -Received '2026-08-19T10:00:00Z' -Subject 'Invoice 3')
+        (New-TraceRow -TraceId 't4' -Recipient 'alice@contoso.com' -Received '2026-08-19T11:00:00Z' -Subject 'Invoice 4')
+        (New-TraceRow -TraceId 't1' -Recipient 'bob@gmail.com' -Received '2026-08-20T12:00:00Z' -Subject 'Invoice 1')
+        (New-TraceRow -TraceId 't5' -Recipient 'carol@contoso.onmicrosoft.com' -Received '2026-08-20T13:00:00Z' -Subject 'Invoice 5')
+        (New-TraceRow -TraceId 't6' -Recipient '' -Received '2026-08-20T14:00:00Z' -Subject 'No recipient')
+    )
+}
+
+Describe 'Invoke-ListBECPhishingSpread' {
+    BeforeEach {
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = @(); Complete = $true } }
+        Mock New-ExoRequest { @([pscustomobject]@{ DomainName = 'contoso.com' }, [pscustomobject]@{ DomainName = 'Contoso.onmicrosoft.com' }) }
+    }
+
+    It 'requires a sender and traces nothing without one' {
+        $Response = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Match '^Failed to trace the spread from .*sender is required'
+        Should -Invoke Get-CIPPBecMessageTrace -Times 0
+    }
+
+    It 'traces one 7-day window by default and walks 10-day windows, newest first, for longer ranges' {
+        $script:Now = (Get-Date).ToUniversalTime()
+        $Response = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.Sender | Should -Be 'ceo@contos0.com'
+        $Response.Body.Days | Should -Be 7
+        $Response.Body.Complete | Should -BeTrue
+        $Response.Body.TotalMessages | Should -Be 0
+        Should -Invoke Get-CIPPBecMessageTrace -Times 1 -Exactly -ParameterFilter { $TenantFilter -eq 'contoso.com' -and $SenderAddress -eq 'ceo@contos0.com' -and [math]::Round(($EndDate - $StartDate).TotalDays) -eq 7 }
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $tenantid -eq 'contoso.com' -and $cmdlet -eq 'Get-AcceptedDomain' }
+
+        $null = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com'; days = '25' }) -TriggerMetadata $null
+        Should -Invoke Get-CIPPBecMessageTrace -Times 4 -Exactly -Because '25 days is three windows on top of the default run'
+        Should -Invoke Get-CIPPBecMessageTrace -Times 3 -Exactly -ParameterFilter { ($EndDate - $StartDate).TotalDays -le 10 -and $StartDate -le $script:Now.AddDays(-10).AddMinutes(1) -and $StartDate -ge $script:Now.AddDays(-25).AddMinutes(-1) -and $EndDate -le $script:Now.AddMinutes(1) -and $EndDate -gt $StartDate } -Because 'the 25-day run starts its windows at -10, -20 and -25 days; the default run started at -7'
+        Should -Invoke Get-CIPPBecMessageTrace -Times 1 -Exactly -ParameterFilter { [math]::Round(($EndDate - $StartDate).TotalDays) -eq 5 } -Because 'the oldest window is clipped to the range start'
+    }
+
+    It 'clamps the look-back to 1-90 days' {
+        $Long = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com'; days = '500' }) -TriggerMetadata $null
+        $Long.StatusCode | Should -Be 200
+        $Long.Body.Days | Should -Be 90
+        Should -Invoke Get-CIPPBecMessageTrace -Times 9 -Exactly
+        $Short = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com'; days = '0' }) -TriggerMetadata $null
+        $Short.Body.Days | Should -Be 1
+        Should -Invoke Get-CIPPBecMessageTrace -Times 10 -Exactly
+    }
+
+    It 'reports a non-numeric look-back as a formatted error instead of crashing' {
+        $Response = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com'; days = 'soon' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Match '^Failed to trace the spread from ceo@contos0\.com: .+'
+        Should -Invoke Get-CIPPBecMessageTrace -Times 0
+    }
+
+    It 'groups the rows per recipient: internal from the accepted domains, distinct message count, first and last delivery, statuses and up to three subjects' {
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = $script:Spread; Complete = $true } }
+        $Response = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.TotalMessages | Should -Be 6 -Because 'six distinct trace ids were returned'
+        $Response.Body.InternalCount | Should -Be 2
+        $Response.Body.ExternalCount | Should -Be 1
+        @($Response.Body.Recipients).Recipient | Should -Be @('alice@contoso.com', 'carol@contoso.onmicrosoft.com', 'bob@gmail.com') -Because 'internal recipients sort first, then by address; the row without a recipient is dropped and case is folded'
+        $Alice = $Response.Body.Recipients[0]
+        $Alice.Internal | Should -BeTrue
+        $Alice.MessageCount | Should -Be 4 -Because 'the two t1 rows are one message'
+        $Alice.FirstReceived | Should -Be '2026-08-18T09:00:00Z'
+        $Alice.LastReceived | Should -Be '2026-08-20T12:00:05Z'
+        $Alice.Statuses | Should -Be 'Delivered, Quarantined'
+        $Alice.Subjects | Should -Be 'Invoice 1 | Invoice 2 | Invoice 3' -Because 'subjects are capped at three'
+        $Response.Body.Recipients[1].Internal | Should -BeTrue -Because 'accepted domains match case-insensitively'
+        $Response.Body.Recipients[2].Internal | Should -BeFalse
+        $Response.Body.Recipients[2].MessageCount | Should -Be 1
+    }
+
+    It 'narrows the trace to subjects containing the fragment, case-insensitively' {
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = $script:Spread; Complete = $true } }
+        $Response = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com'; subject = 'INVOICE 1' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.TotalMessages | Should -Be 1
+        @($Response.Body.Recipients).Recipient | Should -Be @('alice@contoso.com', 'bob@gmail.com')
+        $Response.Body.Recipients[0].MessageCount | Should -Be 1
+        $Response.Body.Recipients[0].Subjects | Should -Be 'Invoice 1'
+        $Response.Body.InternalCount | Should -Be 1
+        $Response.Body.ExternalCount | Should -Be 1
+    }
+
+    It 'reports Complete=false when any window hit the page cap' {
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = @(); Complete = $false } } -ParameterFilter { $EndDate -lt (Get-Date).ToUniversalTime().AddDays(-5) }
+        $Response = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com'; days = '30' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.Complete | Should -BeFalse -Because 'the newest window was complete but the two older ones were not'
+        Should -Invoke Get-CIPPBecMessageTrace -Times 3 -Exactly
+    }
+
+    It 'marks nobody internal when the accepted domains cannot be read' {
+        Mock New-ExoRequest { throw 'EXO unavailable' }
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = $script:Spread; Complete = $true } }
+        $Response = Invoke-ListBECPhishingSpread -Request (New-Request @{ tenantFilter = 'contoso.com'; sender = 'ceo@contos0.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200 -Because 'the accepted-domain lookup is best effort'
+        $Response.Body.InternalCount | Should -Be 0
+        $Response.Body.ExternalCount | Should -Be 3
+        @($Response.Body.Recipients).Recipient | Should -Be @('alice@contoso.com', 'bob@gmail.com', 'carol@contoso.onmicrosoft.com')
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ListBECRemediationActions.Tests.ps1 b/Tests/Endpoint/Invoke-ListBECRemediationActions.Tests.ps1
new file mode 100644
index 0000000000000..df4042ef862e6
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ListBECRemediationActions.Tests.ps1
@@ -0,0 +1,81 @@
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification = 'New-Request only builds an in-memory request object for the tests.')]
+param()
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Get-CIPPTable { param($TableName) @{ TableName = $TableName } }
+    function Get-CIPPAzDataTableEntity { param($TableName, $Filter) }
+    # The real catalog: the endpoint is a projection of it, so the test pins what the frontend sees.
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecContainmentActions.ps1')
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ListBECRemediationActions.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param([hashtable]$Query = @{})
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ListBECRemediationActions' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes('{"userDetails":"tech@msp.com"}')) }
+            Query   = [pscustomobject]$Query
+            Body    = $null
+        }
+    }
+}
+
+Describe 'Invoke-ListBECRemediationActions' {
+    It 'returns the catalog as a bare array of 21 actions, without needing a tenant' {
+        $Response = Invoke-ListBECRemediationActions -Request (New-Request) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.GetType().IsArray | Should -BeTrue -Because 'list endpoints return rows, not a Results wrapper'
+        $Response.Body.Count | Should -Be 21
+        $Response.Body[0].Id | Should -Be 'ResetPassword'
+        $Response.Body[-1].Id | Should -Be 'RemoveSharingLinks'
+    }
+
+    It 'projects exactly the fields the frontend renders, each with a label and description' {
+        $Response = Invoke-ListBECRemediationActions -Request (New-Request) -TriggerMetadata $null
+        $Expected = @('Id', 'Label', 'Description', 'Impact', 'Reversible', 'DefaultSelected', 'Order', 'TargetSource', 'ParameterName')
+        foreach ($Row in $Response.Body) { @($Row.PSObject.Properties.Name) | Should -Be $Expected }
+        @($Response.Body | Where-Object { -not $_.Label -or -not $_.Description }).Count | Should -Be 0
+        ($Response.Body | Where-Object { $_.Id -eq 'RemoveMFA' }).ParameterName | Should -Be 'MfaMethodIds'
+        ($Response.Body | Where-Object { $_.Id -eq 'RemoveMFA' }).TargetSource | Should -Be 'MFADevices'
+    }
+
+    It 'flags the destructive actions as Critical and keeps every impact within the four levels' {
+        $Body = (Invoke-ListBECRemediationActions -Request (New-Request) -TriggerMetadata $null).Body
+        @($Body | Where-Object { $_.Impact -eq 'Critical' }).Id | Should -Be @('ResetPassword', 'DisableAccount', 'RemoveOAuthGrants', 'DisableServicePrincipals', 'RemoveDelegations', 'DisableTransportRules', 'RemoveRegisteredDevices')
+        @($Body | Where-Object { $_.Impact -notin @('Low', 'Medium', 'High', 'Critical') }).Count | Should -Be 0
+        ($Body | Where-Object { $_.Id -eq 'ResetPassword' }).Reversible | Should -BeFalse
+        ($Body | Where-Object { $_.Id -eq 'DisableAccount' }).Reversible | Should -BeTrue
+    }
+
+    It 'pre-selects the built-in default set and numbers the actions in dispatcher order' {
+        $Body = (Invoke-ListBECRemediationActions -Request (New-Request) -TriggerMetadata $null).Body
+        @($Body | Where-Object { $_.DefaultSelected }).Id | Should -Be @('ResetPassword', 'DisableAccount', 'RevokeSessions', 'RemoveMFA', 'DisableInboxRules', 'BlockProtocols')
+        @($Body.Id | Select-Object -Unique).Count | Should -Be 21
+        @($Body.Order) | Should -Be @(1..21)
+    }
+
+    It 'replaces the built-in defaults with the instance-wide defaults saved in settings' {
+        Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ DefaultActions = '["RevokeSessions","ClearForwarding"]' } } -ParameterFilter { $Filter -match 'BecRemediation' }
+        $Body = (Invoke-ListBECRemediationActions -Request (New-Request) -TriggerMetadata $null).Body
+        @($Body | Where-Object { $_.DefaultSelected }).Id | Should -Be @('RevokeSessions', 'ClearForwarding')
+    }
+
+    It 'keeps the built-in defaults when the settings read fails' {
+        Mock Get-CIPPTable { throw 'storage down' }
+        $Body = (Invoke-ListBECRemediationActions -Request (New-Request) -TriggerMetadata $null).Body
+        @($Body | Where-Object { $_.DefaultSelected }).Count | Should -Be 6
+    }
+
+    It 'reports a catalog failure as a 500 with a Results message' {
+        Mock Get-CIPPBecContainmentActions { throw 'catalog broken' }
+        $Response = Invoke-ListBECRemediationActions -Request (New-Request) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be 'Failed to list containment actions: catalog broken'
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ListBECReports.Tests.ps1 b/Tests/Endpoint/Invoke-ListBECReports.Tests.ps1
new file mode 100644
index 0000000000000..fc83fb1020a5a
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ListBECReports.Tests.ps1
@@ -0,0 +1,89 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function Get-CIPPBecReport { param($TenantFilter, $CaseId, $UserId, [switch]$IncludeResults) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ListBECReports.ps1' | Select-Object -First 1
+    . $FunctionPath.FullName
+
+    function New-Request {
+        param([hashtable]$Query = @{})
+        [pscustomobject]@{
+            Params  = [pscustomobject]@{ CIPPEndpoint = 'ListBECReports' }
+            Headers = [pscustomobject]@{ 'x-ms-client-principal' = 'x' }
+            Query   = [pscustomobject]$Query
+            Body    = $null
+        }
+    }
+    # Rows as Get-CIPPBecReport hands them over: the table columns plus the CaseId/Tenant aliases, Containment
+    # already parsed. A run that was never contained has no Containment column at all - New-CIPPBecRunRequest
+    # does not write one and Invoke-CIPPBecContainment only writes it once there is an entry.
+    $script:Contained = [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-20260820120000-aaa001'; CaseId = 'BEC-20260820120000-aaa001'; Tenant = 'contoso.com'; UserId = 'u1'; UserPrincipalName = 'victim@contoso.com'; DisplayName = 'Victim'; Status = 'Completed'; Level = 'High'; Score = 82; IncompleteCount = 0; ExtractedAt = '2026-08-20T12:20:00Z'; RequestedAt = '2026-08-20T12:00:00Z'; RequestedBy = 'tech@msp.com'; ErrorMessage = $null; EvidenceSha256 = 'abc'; LastContainmentAt = '2026-08-20T13:00:00Z'; Containment = @([pscustomobject]@{ At = '2026-08-20T12:30:00Z'; By = 'tech@msp.com'; Actions = @('RevokeSessions') }, [pscustomobject]@{ At = '2026-08-20T13:00:00Z'; By = 'tech@msp.com'; Actions = @('ResetPassword') }) }
+    $script:Fresh = [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-20260821090000-bbb002'; CaseId = 'BEC-20260821090000-bbb002'; Tenant = 'contoso.com'; UserId = 'u2'; UserPrincipalName = 'other@contoso.com'; Status = 'Waiting'; RequestedAt = '2026-08-21T09:00:00Z'; RequestedBy = 'tech@msp.com' }
+}
+
+Describe 'Invoke-ListBECReports' {
+    BeforeEach {
+        Mock Get-CIPPBecReport { @($script:Contained, $script:Fresh) }
+    }
+
+    It 'returns the runs as a plain array projected to the list columns, never the table keys or evidence internals' {
+        $Response = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        ($Response.Body -is [array]) | Should -BeTrue
+        $Response.Body.Count | Should -Be 2
+        $Response.Body[0].PSObject.Properties.Name | Should -Be @('CaseId', 'Tenant', 'UserId', 'UserPrincipalName', 'DisplayName', 'Status', 'Level', 'Score', 'IncompleteCount', 'ExtractedAt', 'RequestedAt', 'RequestedBy', 'ErrorMessage', 'ContainmentRuns')
+        $Response.Body[0].CaseId | Should -Be 'BEC-20260820120000-aaa001'
+        $Response.Body[0].Tenant | Should -Be 'contoso.com'
+        $Response.Body[0].Score | Should -Be 82
+        $Response.Body[0].RequestedBy | Should -Be 'tech@msp.com'
+        $Response.Body[1].Status | Should -Be 'Waiting'
+        $Response.Body[1].Level | Should -BeNullOrEmpty
+    }
+
+    It 'counts the containment runs of a run that was contained twice' {
+        $Response = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        $Response.Body[0].ContainmentRuns | Should -Be 2
+    }
+
+    It 'counts no containment runs for a run that was never contained' {
+        $Response = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        $Response.Body[1].ContainmentRuns | Should -Be 0 -Because 'a fresh run row has no Containment column and must not read as already contained'
+    }
+
+    It 'narrows to one user when userId is given, and only then' {
+        $null = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com'; userId = 'u1' }) -TriggerMetadata $null
+        Should -Invoke Get-CIPPBecReport -Times 1 -ParameterFilter { $TenantFilter -eq 'contoso.com' -and $UserId -eq 'u1' -and [string]::IsNullOrEmpty($CaseId) -and -not $IncludeResults.IsPresent }
+        $null = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        Should -Invoke Get-CIPPBecReport -Times 1 -ParameterFilter { $TenantFilter -eq 'contoso.com' -and [string]::IsNullOrEmpty($UserId) }
+    }
+
+    It 'lists every tenant when tenantFilter is absent' {
+        $null = Invoke-ListBECReports -Request (New-Request) -TriggerMetadata $null
+        Should -Invoke Get-CIPPBecReport -Times 1 -ParameterFilter { $TenantFilter -eq 'AllTenants' -and [string]::IsNullOrEmpty($UserId) }
+    }
+
+    It 'keeps the array shape for zero runs and for a single run' {
+        Mock Get-CIPPBecReport { @() }
+        $Empty = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        $Empty.StatusCode | Should -Be 200
+        ($Empty.Body -is [array]) | Should -BeTrue
+        $Empty.Body.Count | Should -Be 0
+        Mock Get-CIPPBecReport { $script:Contained }
+        $Single = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        ($Single.Body -is [array]) | Should -BeTrue -Because 'the table page only renders Array.isArray data'
+        $Single.Body.Count | Should -Be 1
+        $Single.Body[0].CaseId | Should -Be 'BEC-20260820120000-aaa001'
+    }
+
+    It 'reports a storage failure as a formatted error' {
+        Mock Get-CIPPBecReport { throw 'BecReports table unavailable' }
+        $Response = Invoke-ListBECReports -Request (New-Request @{ tenantFilter = 'contoso.com' }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Be 'Failed to list BEC runs: BecReports table unavailable'
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ListDefenderTVM.Tests.ps1 b/Tests/Endpoint/Invoke-ListDefenderTVM.Tests.ps1
new file mode 100644
index 0000000000000..3e1bd18277a5f
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ListDefenderTVM.Tests.ps1
@@ -0,0 +1,50 @@
+# Pester tests for Invoke-ListDefenderTVM.
+# The endpoint folds the streamed TVM export (Get-DefenderTvmRaw -Stream) into one row per CVE. Each
+# row keeps the lowest non-null value per property (arrays flattened), counts every record and lists
+# every device name as { deviceName } objects - the shape the grouped implementation returned.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListDefenderTVM.ps1')
+
+    function Get-DefenderTvmRaw { param($TenantId, [switch]$Stream) }
+    function Get-NormalizedError { param($Message) $Message }
+    if (-not ('HttpResponseContext' -as [type])) {
+        Add-Type -TypeDefinition 'public class HttpResponseContext { public object StatusCode; public object Body; public string ContentType; public object Headers; }'
+    }
+    if (-not ('HttpStatusCode' -as [type])) {
+        [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+}
+
+Describe 'Invoke-ListDefenderTVM' {
+    BeforeEach {
+        Mock Get-DefenderTvmRaw {
+            [pscustomobject]@{ cveId = 'CVE-B'; deviceName = 'PC1'; cvssScore = 7.1; osPlatform = 'Windows11'; diskPaths = @('D:\b', 'C:\z') }
+            [pscustomobject]@{ cveId = 'CVE-A'; deviceName = 'PC2'; cvssScore = 9.8; osPlatform = $null; diskPaths = $null }
+            [pscustomobject]@{ cveId = 'CVE-A'; deviceName = 'PC1'; cvssScore = 9.1; osPlatform = 'Windows10'; diskPaths = @('E:\a') }
+        }
+        $script:Request = [pscustomobject]@{ Query = [pscustomobject]@{ tenantFilter = 'contoso.com' } }
+    }
+
+    It 'streams the TVM export and returns one row per CVE' {
+        $Rows = @((Invoke-ListDefenderTVM -Request $script:Request).Body)
+        Should -Invoke Get-DefenderTvmRaw -Times 1 -Exactly -ParameterFilter { $Stream.IsPresent }
+        $Rows.cveId | Should -Be @('CVE-A', 'CVE-B')
+    }
+
+    It 'counts records, lists devices and keeps the lowest non-null value per property' {
+        $A = @((Invoke-ListDefenderTVM -Request $script:Request).Body)[0]
+        $A.customerId | Should -Be 'contoso.com'
+        $A.affectedDevicesCount | Should -Be 2
+        $A.affectedDevices.deviceName | Should -Be @('PC2', 'PC1')
+        $A.cvssScore | Should -Be 9.1
+        $A.osPlatform | Should -Be 'Windows10'
+        $A.diskPaths | Should -Be 'E:\a'
+    }
+
+    It 'flattens array values before taking the lowest' {
+        $B = @((Invoke-ListDefenderTVM -Request $script:Request).Body)[1]
+        $B.diskPaths | Should -Be 'C:\z'
+    }
+}
diff --git a/Tests/Endpoint/Invoke-ListIRMConfiguration.Tests.ps1 b/Tests/Endpoint/Invoke-ListIRMConfiguration.Tests.ps1
index 2e1d19120c955..e91b314242298 100644
--- a/Tests/Endpoint/Invoke-ListIRMConfiguration.Tests.ps1
+++ b/Tests/Endpoint/Invoke-ListIRMConfiguration.Tests.ps1
@@ -44,6 +44,10 @@ BeforeAll {
             InternalLicensingEnabled       = $true
             ExternalLicensingEnabled       = $false
             SimplifiedClientAccessEnabled  = $false
+            SimplifiedClientAccessDoNotForwardDisabled = $false
+            SimplifiedClientAccessEncryptOnlyDisabled = $true
+            EnablePdfEncryption            = $true
+            DecryptAttachmentForEncryptOnly = $false
             TransportDecryptionSetting     = 'Optional'
             JournalReportDecryptionEnabled = $true
             LicensingLocation              = $LicensingLocation
@@ -134,6 +138,17 @@ Describe 'Invoke-ListIRMConfiguration' {
             $Response.Body.TransportDecryptionSetting | Should -Be 'Optional'
         }
 
+        It 'passes the optional IRM settings through for the tools page' {
+            Mock -CommandName New-ExoRequest -MockWith { New-IRMConfig -LicensingLocation @() }
+
+            $Response = Invoke-ListIRMConfiguration -Request (New-IRMRequest)
+
+            $Response.Body.EnablePdfEncryption | Should -BeTrue
+            $Response.Body.DecryptAttachmentForEncryptOnly | Should -BeFalse
+            $Response.Body.SimplifiedClientAccessDoNotForwardDisabled | Should -BeFalse
+            $Response.Body.SimplifiedClientAccessEncryptOnlyDisabled | Should -BeTrue
+        }
+
         It 'reports message encryption as disabled when Azure RMS licensing is off' {
             Mock -CommandName New-ExoRequest -MockWith {
                 New-IRMConfig -LicensingLocation @() -AzureRMSLicensingEnabled $false
diff --git a/Tests/Endpoint/Invoke-ListLicenseRecommendations.Tests.ps1 b/Tests/Endpoint/Invoke-ListLicenseRecommendations.Tests.ps1
new file mode 100644
index 0000000000000..ab0fae2f0ee1d
--- /dev/null
+++ b/Tests/Endpoint/Invoke-ListLicenseRecommendations.Tests.ps1
@@ -0,0 +1,79 @@
+# Pester tests for Invoke-ListLicenseRecommendations — parameter parsing, the single-tenant guard,
+# and error handling.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ListLicenseRecommendations.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Invoke-ListLicenseRecommendations.ps1 under Modules/' }
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    function Get-CippException { param($Exception) @{ NormalizedError = $Exception } }
+    function Get-CIPPLicenseRecommendation { param($TenantFilter, $Currency, $InactiveDays, $TenureMonths, $RecommendDowngrades, $RecommendUpgrades, $RecommendTerms, $ProtectSecurityFeatures) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+
+    . $FunctionPath
+
+    function New-RecRequest {
+        param([hashtable]$Query = @{})
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'ListLicenseRecommendations' }
+            Headers = @{ Authorization = 'token' }
+            Query   = [pscustomobject]$Query
+            Body    = [pscustomobject]@{}
+        }
+    }
+}
+
+Describe 'Invoke-ListLicenseRecommendations' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CippException -MockWith { param($Exception) @{ NormalizedError = "$Exception" } }
+        Mock -CommandName Get-CIPPLicenseRecommendation -MockWith {
+            [pscustomobject]@{ Summary = [pscustomobject]@{ Tenant = $TenantFilter; TotalPotentialMonthly = 42 }; Downgrades = @(); Upgrades = @(); Terms = @() }
+        }
+    }
+
+    It 'returns the report with default settings' {
+        $Response = Invoke-ListLicenseRecommendations -Request (New-RecRequest @{ tenantFilter = 'contoso.com' })
+
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.Results.Summary.TotalPotentialMonthly | Should -Be 42
+        Should -Invoke Get-CIPPLicenseRecommendation -Times 1 -Exactly -ParameterFilter {
+            $TenantFilter -eq 'contoso.com' -and $Currency -eq 'USD' -and $InactiveDays -eq 90 -and $TenureMonths -eq 6 -and
+            $RecommendDowngrades -eq $true -and $RecommendUpgrades -eq $true -and $RecommendTerms -eq $true -and $ProtectSecurityFeatures -eq $true
+        }
+    }
+
+    It 'passes switches, thresholds and currency through' {
+        $null = Invoke-ListLicenseRecommendations -Request (New-RecRequest @{
+                tenantFilter = 'contoso.com'; currency = 'EUR'; inactiveDays = '30'; tenureMonths = '9'
+                recommendDowngrades = 'false'; recommendUpgrades = 'true'; recommendTerms = 'false'; protectSecurityFeatures = 'false'
+            })
+
+        Should -Invoke Get-CIPPLicenseRecommendation -Times 1 -Exactly -ParameterFilter {
+            $Currency -eq 'EUR' -and $InactiveDays -eq 30 -and $TenureMonths -eq 9 -and
+            $RecommendDowngrades -eq $false -and $RecommendUpgrades -eq $true -and $RecommendTerms -eq $false -and $ProtectSecurityFeatures -eq $false
+        }
+    }
+
+    It 'rejects AllTenants and a missing tenant' {
+        (Invoke-ListLicenseRecommendations -Request (New-RecRequest @{ tenantFilter = 'AllTenants' })).StatusCode | Should -Be 500
+        (Invoke-ListLicenseRecommendations -Request (New-RecRequest @{})).StatusCode | Should -Be 500
+        Should -Invoke Get-CIPPLicenseRecommendation -Times 0
+    }
+
+    It 'returns 500 with the error text when the report fails' {
+        Mock -CommandName Get-CIPPLicenseRecommendation -MockWith { throw 'boom' }
+
+        $Response = Invoke-ListLicenseRecommendations -Request (New-RecRequest @{ tenantFilter = 'contoso.com' })
+
+        $Response.StatusCode | Should -Be 500
+        $Response.Body.Results | Should -Match 'boom'
+        Should -Invoke Write-LogMessage -Times 1 -Exactly
+    }
+}
diff --git a/Tests/Endpoint/Invoke-PublicMcpRegister.Tests.ps1 b/Tests/Endpoint/Invoke-PublicMcpRegister.Tests.ps1
new file mode 100644
index 0000000000000..a583039f483ac
--- /dev/null
+++ b/Tests/Endpoint/Invoke-PublicMcpRegister.Tests.ps1
@@ -0,0 +1,161 @@
+# Pester tests for MCP resource-client selection in Invoke-PublicMcpRegister.
+#
+# This anonymous RFC 7591 endpoint hands an MCP client (Claude, ChatGPT, ...) the client_id of the
+# instance's MCP resource app registration. Issue #619: failed setups left several API clients with
+# MCPAllowed set, and one whose Entra app registration no longer existed got advertised, so every
+# connect failed at authorize with AADSTS700016. The endpoint now advertises only a holder whose app
+# registration still resolves in Entra, and skips stale ones.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-PublicMcpRegister.ps1'
+    $ErrorHelperPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/MCP/New-CippMcpRegistrationError.ps1'
+    if (-not (Test-Path $FunctionPath)) { throw "Could not locate Invoke-PublicMcpRegister.ps1 at $FunctionPath" }
+
+    class HttpResponseContext {
+        [object]$StatusCode
+        [object]$Headers
+        [object]$Body
+    }
+    $Accelerators = [PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ('HttpStatusCode' -as [type])) {
+        $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+
+    function Get-CippTable { param($tablename) @{} }
+    function Get-CIPPAzDataTableEntity { param($Filter, $Property) }
+    function New-GraphGetRequest { param($uri, $NoAuthCheck, $AsApp, $tenantid, [switch]$ComplexFilter, $Select) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+    function Get-CippMcpKnownClients {
+        [pscustomobject]@{
+            PublicClientRedirectUris = @()
+            ConfidentialRedirectUris = @()
+            PreAuthorizedClientIds   = @()
+        }
+    }
+
+    . $ErrorHelperPath
+    . $FunctionPath
+
+    # Loopback callback passes redirect validation directly, so no redirect-URI Graph call fires and
+    # the tests isolate the app-registration existence check.
+    function New-RegisterRequest {
+        param([string[]]$RedirectUris = @('http://127.0.0.1:52100/callback'))
+        [pscustomobject]@{
+            Method  = 'POST'
+            Headers = @{}
+            Params  = @{ CIPPEndpoint = 'PublicMcpRegister' }
+            Body    = [pscustomobject]@{
+                client_name   = 'Test MCP client'
+                redirect_uris = $RedirectUris
+            }
+        }
+    }
+}
+
+Describe 'Invoke-PublicMcpRegister - advertising a live MCP resource client' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        # Reset the per-runspace existence cache so a verdict from one test can't leak into the next.
+        $script:McpResourceAppExistsCache = $null
+        $script:McpResourceAppRedirectCache = $null
+    }
+
+    It 'returns an error when no client holds MCP Access' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @() }
+        Mock -CommandName New-GraphGetRequest -MockWith { throw 'Graph must not be called when no client holds MCP Access' }
+
+        $Response = Invoke-PublicMcpRegister -Request (New-RegisterRequest)
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        ($Response.Body | ConvertFrom-Json).error_description | Should -BeLike '*No MCP client is configured*'
+        Should -Invoke New-GraphGetRequest -Times 0 -Exactly
+    }
+
+    It 'advertises the holder when its app registration exists' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @([pscustomobject]@{ RowKey = 'live-app'; MCPAllowed = $true; Enabled = $true })
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith { [pscustomobject]@{ appId = 'live-app' } }
+
+        $Response = Invoke-PublicMcpRegister -Request (New-RegisterRequest)
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::Created)
+        ($Response.Body | ConvertFrom-Json).client_id | Should -Be 'live-app'
+    }
+
+    It 'refuses to advertise a stale holder whose app registration is gone' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @([pscustomobject]@{ RowKey = 'stale-app'; MCPAllowed = $true; Enabled = $true })
+        }
+        # No application matches the appId filter -> the app registration no longer exists.
+        Mock -CommandName New-GraphGetRequest -MockWith { @() }
+
+        $Response = Invoke-PublicMcpRegister -Request (New-RegisterRequest)
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        ($Response.Body | ConvertFrom-Json).error_description | Should -BeLike '*no longer has a valid app registration*'
+    }
+
+    It 'skips a stale holder and advertises a live one when both are flagged' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{ RowKey = 'stale-app'; MCPAllowed = $true; Enabled = $true }
+                [pscustomobject]@{ RowKey = 'live-app'; MCPAllowed = $true; Enabled = $true }
+            )
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith { @() } -ParameterFilter { $uri -like "*'stale-app'*" }
+        Mock -CommandName New-GraphGetRequest -MockWith { [pscustomobject]@{ appId = 'live-app' } } -ParameterFilter { $uri -like "*'live-app'*" }
+
+        $Response = Invoke-PublicMcpRegister -Request (New-RegisterRequest)
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::Created)
+        ($Response.Body | ConvertFrom-Json).client_id | Should -Be 'live-app'
+    }
+
+    It 'advertises the holder rather than blocking when the existence check errors' {
+        # A transient Graph outage must not break every connect, so an unverifiable client is served.
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @([pscustomobject]@{ RowKey = 'unverified-app'; MCPAllowed = $true; Enabled = $true })
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith { throw 'Graph is having a moment' }
+
+        $Response = Invoke-PublicMcpRegister -Request (New-RegisterRequest)
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::Created)
+        ($Response.Body | ConvertFrom-Json).client_id | Should -Be 'unverified-app'
+    }
+
+    It 'pins the client app when ?client= scopes the request to a specific MCPAllowed client' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{ RowKey = 'client-a'; MCPAllowed = $true; Enabled = $true }
+                [pscustomobject]@{ RowKey = 'client-b'; MCPAllowed = $true; Enabled = $true }
+            )
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith { [pscustomobject]@{ appId = 'client-b' } }
+
+        $Request = New-RegisterRequest
+        $Request.Params.client = 'client-b'
+        $Request | Add-Member -NotePropertyName Query -NotePropertyValue ([pscustomobject]@{ client = 'client-b' }) -Force
+
+        $Response = Invoke-PublicMcpRegister -Request $Request
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::Created)
+        ($Response.Body | ConvertFrom-Json).client_id | Should -Be 'client-b'
+    }
+
+    It 'errors when ?client= matches no enabled MCP client' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @([pscustomobject]@{ RowKey = 'client-a'; MCPAllowed = $true; Enabled = $true })
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith { [pscustomobject]@{ appId = 'client-a' } }
+
+        $Request = New-RegisterRequest
+        $Request | Add-Member -NotePropertyName Query -NotePropertyValue ([pscustomobject]@{ client = 'does-not-exist' }) -Force
+
+        $Response = Invoke-PublicMcpRegister -Request $Request
+
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+    }
+}
diff --git a/Tests/Extensions/Get-NinjaOneDeviceNonCompliantSettings.Tests.ps1 b/Tests/Extensions/Get-NinjaOneDeviceNonCompliantSettings.Tests.ps1
new file mode 100644
index 0000000000000..afb9f23322003
--- /dev/null
+++ b/Tests/Extensions/Get-NinjaOneDeviceNonCompliantSettings.Tests.ps1
@@ -0,0 +1,96 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    function New-GraphBulkRequest { param($Requests, $tenantid) }
+
+    . (Join-Path $RepoRoot 'Modules/CippExtensions/Public/NinjaOne/Get-NinjaOneDeviceNonCompliantSettings.ps1')
+}
+
+Describe 'Get-NinjaOneDeviceNonCompliantSettings' {
+    It 'returns nothing and skips Graph when no device ids are given' {
+        Mock New-GraphBulkRequest { @() }
+
+        $Result = Get-NinjaOneDeviceNonCompliantSettings -TenantFilter 'contoso.onmicrosoft.com' -ManagedDeviceIds @()
+
+        $Result.Count | Should -Be 0
+        Should -Invoke New-GraphBulkRequest -Times 0 -Exactly
+    }
+
+    It 'lists the failing settings per device, once per setting, with the state appended for errors' {
+        Mock New-GraphBulkRequest -ParameterFilter { $Requests[0].url -like '*deviceCompliancePolicyStates' } {
+            @(
+                [pscustomobject]@{
+                    id     = 'dev-1'
+                    status = 200
+                    body   = [pscustomobject]@{
+                        value = @(
+                            [pscustomobject]@{ id = 'pol-a'; displayName = 'Windows Compliance'; state = 'nonCompliant' },
+                            [pscustomobject]@{ id = 'pol-b'; displayName = 'Default Device Compliance Policy'; state = 'compliant' },
+                            [pscustomobject]@{ id = 'pol-c'; displayName = 'Broken Policy'; state = 'error' }
+                        )
+                    }
+                },
+                [pscustomobject]@{
+                    id     = 'dev-2'
+                    status = 200
+                    body   = [pscustomobject]@{ value = @([pscustomobject]@{ id = 'pol-a'; displayName = 'Windows Compliance'; state = 'compliant' }) }
+                }
+            )
+        }
+        Mock New-GraphBulkRequest -ParameterFilter { $Requests[0].url -like '*settingStates' } {
+            @(
+                [pscustomobject]@{
+                    id     = 'dev-1|pol-a'
+                    status = 200
+                    body   = [pscustomobject]@{
+                        value = @(
+                            [pscustomobject]@{ setting = 'Windows10CompliancePolicy.BitLockerEnabled'; settingName = 'BitLocker'; state = 'nonCompliant'; userPrincipalName = 'a@contoso.com' },
+                            [pscustomobject]@{ setting = 'Windows10CompliancePolicy.BitLockerEnabled'; settingName = 'BitLocker'; state = 'nonCompliant'; userPrincipalName = 'b@contoso.com' },
+                            [pscustomobject]@{ setting = 'Windows10CompliancePolicy.OsMinimumVersion'; settingName = 'Minimum OS version'; state = 'compliant' }
+                        )
+                    }
+                },
+                [pscustomobject]@{
+                    id     = 'dev-1|pol-c'
+                    status = 200
+                    body   = [pscustomobject]@{ value = @([pscustomobject]@{ setting = 'Windows10CompliancePolicy.PasswordRequired'; state = 'error' }) }
+                }
+            )
+        }
+
+        $Result = Get-NinjaOneDeviceNonCompliantSettings -TenantFilter 'contoso.onmicrosoft.com' -ManagedDeviceIds @('dev-1', 'dev-2', 'dev-1')
+
+        @($Result.Keys) | Should -Be @('dev-1')
+        $Result['dev-1'] | Should -Be "Windows Compliance: BitLocker`nBroken Policy: Windows10CompliancePolicy.PasswordRequired (error)"
+        Should -Invoke New-GraphBulkRequest -Times 1 -Exactly -ParameterFilter { $Requests.Count -eq 2 -and $Requests[0].url -like '*deviceCompliancePolicyStates' }
+        Should -Invoke New-GraphBulkRequest -Times 1 -Exactly -ParameterFilter { $Requests.Count -eq 2 -and $Requests[0].url -eq "/deviceManagement/managedDevices('dev-1')/deviceCompliancePolicyStates/pol-a/settingStates" }
+    }
+
+    It 'does not fetch setting states when every policy state is compliant' {
+        Mock New-GraphBulkRequest {
+            @([pscustomobject]@{ id = 'dev-1'; status = 200; body = [pscustomobject]@{ value = @([pscustomobject]@{ id = 'pol-a'; displayName = 'P'; state = 'compliant' }) } })
+        }
+
+        $Result = Get-NinjaOneDeviceNonCompliantSettings -TenantFilter 'contoso.onmicrosoft.com' -ManagedDeviceIds @('dev-1')
+
+        $Result.Count | Should -Be 0
+        Should -Invoke New-GraphBulkRequest -Times 1 -Exactly
+    }
+
+    It 'skips a device whose policy state lookup failed and still reports the others' {
+        Mock New-GraphBulkRequest -ParameterFilter { $Requests[0].url -like '*deviceCompliancePolicyStates' } {
+            @(
+                [pscustomobject]@{ id = 'dev-gone'; status = 404; body = [pscustomobject]@{ error = [pscustomobject]@{ message = 'Not found' } } },
+                [pscustomobject]@{ id = 'dev-1'; status = 200; body = [pscustomobject]@{ value = @([pscustomobject]@{ id = 'pol-a'; displayName = 'P'; state = 'nonCompliant' }) } }
+            )
+        }
+        Mock New-GraphBulkRequest -ParameterFilter { $Requests[0].url -like '*settingStates' } {
+            @([pscustomobject]@{ id = 'dev-1|pol-a'; status = 200; body = [pscustomobject]@{ value = @([pscustomobject]@{ settingName = 'Firewall'; state = 'nonCompliant' }) } })
+        }
+
+        $Result = Get-NinjaOneDeviceNonCompliantSettings -TenantFilter 'contoso.onmicrosoft.com' -ManagedDeviceIds @('dev-gone', 'dev-1') -WarningAction SilentlyContinue
+
+        @($Result.Keys) | Should -Be @('dev-1')
+        $Result['dev-1'] | Should -Be 'P: Firewall'
+    }
+}
diff --git a/Tests/Extensions/Invoke-HuduExtensionSync.Tests.ps1 b/Tests/Extensions/Invoke-HuduExtensionSync.Tests.ps1
new file mode 100644
index 0000000000000..34aeb5974327b
--- /dev/null
+++ b/Tests/Extensions/Invoke-HuduExtensionSync.Tests.ps1
@@ -0,0 +1,344 @@
+BeforeAll {
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Find-HuduDeviceMatch.ps1"
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerKeySlot.ps1"
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerSyncField.ps1"
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1"
+
+    function Connect-HuduAPI { param($Configuration) }
+    function Get-Tenants { param($TenantFilter, [switch]$IncludeErrors) }
+    function Get-AssignedNameMap { }
+    function Get-AssignedMap { }
+    function Get-CIPPTable { param($TableName) }
+    function Get-CIPPAzDataTableEntity { param($Filter) }
+    function Get-CippExtensionReportingData { param($TenantFilter, [switch]$IncludeMailboxes) }
+    function Get-HuduCompanies { param($Id) }
+    function Add-HuduAssetLayoutField { param($AssetLayoutId, $Label, $FieldType, $Position, $ShowInList) }
+    function Get-HuduAssetLayouts { param($Id, $LayoutId) }
+    function Get-HuduAssets { param($CompanyId, $AssetLayoutId) }
+    function Get-HuduRelations { }
+    function Remove-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
+    function Add-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
+    function Get-HuduLinkBlock { param($Title, $URL, $Icon) }
+    function New-GraphGetRequest { param($Uri, $TenantId, [switch]$NoAuthCheck) }
+    function Get-CIPPDbItem { param($TenantFilter, $Type) }
+    function Get-CIPPLapsPassword { param($Device, $TenantFilter) }
+    function Get-CIPPBitLockerKey { param($Device, $TenantFilter) }
+    function Get-HuduFormattedField { param($Title, $Value) }
+    function Get-HuduFormattedBlock { param($Heading, $Body) }
+    function Get-StringHash { param($String) }
+    function Set-HuduAsset { param($AssetId, $Name, $CompanyId, $AssetLayoutId, $Fields, $PrimarySerial) }
+    function New-HuduAsset { param($Name, $CompanyId, $AssetLayoutId, $Fields, $PrimarySerial) }
+    function New-HuduRelation { param($FromableType, $FromableID, $ToableType, $ToableID) }
+    function Set-HuduMagicDash { param($Title, $CompanyName, $Message, $Icon, $Content, $Shade) }
+    function Get-HuduWebsites { param($Name) }
+    function New-HuduWebsite { param($Name, $Notes, $Paused, $CompanyId, $DisableDNS, $DisableSSL, $DisableWhois) }
+    function Write-LogMessage { param($Tenant, $TenantId, $API, $Message, $Level) }
+    function Get-CippException { param($Exception) return [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } }
+    function Get-CippDbRoleMembers { param($TenantFilter, $RoleTemplateId) }
+}
+
+Describe 'Invoke-HuduExtensionSync credential integration' {
+    BeforeEach {
+        $env:CIPPRootPath = (Resolve-Path "$PSScriptRoot/../..").Path
+        $script:CachedHash = $null
+        $script:HuduDevice = [PSCustomObject]@{
+            id              = 101
+            name            = 'DEVICE-01'
+            primary_serial  = 'SERIAL-01'
+            asset_layout_id = 10
+            cards           = @()
+            fields          = @(
+                [PSCustomObject]@{ label = 'Microsoft 365'; slug = 'microsoft_365'; value = 'old' }
+            )
+        }
+        $script:Layout = [PSCustomObject]@{
+            id = 10
+            fields = @(
+                [PSCustomObject]@{ label = 'LAPS Account'; position = 0; field_type = 'Email' }
+                [PSCustomObject]@{ label = 'LAPS Password'; position = 1; field_type = 'Password' }
+                [PSCustomObject]@{ label = 'LAPS Backup Date'; position = 2; field_type = 'Text' }
+                [PSCustomObject]@{ label = 'Microsoft 365'; position = 3; field_type = 'RichText' }
+                [PSCustomObject]@{ label = 'BitLocker OS Drive 1 Key ID'; position = 4; field_type = 'Text' }
+                [PSCustomObject]@{ label = 'BitLocker OS Drive 1 Recovery Key'; position = 5; field_type = 'Password' }
+            )
+        }
+        $Configuration = [PSCustomObject]@{
+            Hudu = [PSCustomObject]@{
+                IncludeLAPS = $true; IncludeBitLocker = $true
+                CreateMissingUsers = $false; CreateMissingDevices = $false
+                ExcludeSerials = 'CUSTOM-PLACEHOLDER'
+                ImportDomains = $false; MonitorDomains = $false; HideEmptyRoles = $false
+                IncludeDefenderLink = $false; IncludeComplianceLink = $false; IncludeParterCenterLink = $false
+            }
+        }
+
+        Mock Connect-HuduAPI { }
+        Mock Get-Tenants {
+            [PSCustomObject]@{ displayName = 'Contoso'; defaultDomainName = 'contoso.onmicrosoft.com'; initialDomainName = 'contoso.onmicrosoft.com'; customerId = 'tenant-1' }
+        }
+        Mock Get-AssignedNameMap { [PSCustomObject]@{} }
+        Mock Get-AssignedMap { [PSCustomObject]@{} }
+        Mock Get-CIPPTable { @{} }
+        Mock Get-CIPPAzDataTableEntity {
+            if ($Filter -like "*PartitionKey eq 'HuduMapping'*") {
+                return @(
+                    [PSCustomObject]@{ PartitionKey = 'HuduMapping'; RowKey = 'tenant-1'; IntegrationId = 20; IntegrationName = 'Contoso' }
+                    [PSCustomObject]@{ PartitionKey = 'HuduMapping'; RowKey = 'Devices'; IntegrationId = 10; IntegrationName = 'Computers' }
+                )
+            }
+            if ($Filter -like "*InstanceProperties*") { return [PSCustomObject]@{ Value = 'cipp.example.test' } }
+            if ($Filter -like "*CacheMetadata*") { return [PSCustomObject]@{ LastRefresh = (Get-Date).ToUniversalTime().ToString('o') } }
+            if ($Filter -like "*PartitionKey eq 'HuduRelation'*") { return @() }
+            if ($Filter -like "*PartitionKey eq 'HuduDevice'*") {
+                if ($script:CachedHash) { return [PSCustomObject]@{ Hash = $script:CachedHash } }
+                return $null
+            }
+        }
+        Mock Get-CippExtensionReportingData {
+            [PSCustomObject]@{
+                Users = @(); AllRoles = @(); Domains = @(); Licenses = @()
+                Devices = @([PSCustomObject]@{
+                    id = 'managed-1'; azureADDeviceId = 'device-1'; deviceName = 'DEVICE-01'; serialNumber = 'SERIAL-01'
+                    operatingSystem = 'Windows'; deviceType = 'windowsRT'; complianceState = 'compliant'
+                    totalStorageSpaceInBytes = 1073741824; freeStorageSpaceInBytes = 536870912
+                    enrolledDateTime = '2026-09-01T00:00:00Z'; lastSyncDateTime = '2026-09-10T00:00:00Z'
+                })
+                DeviceCompliancePolicies = @(); Groups = @(); ConditionalAccess = @()
+                OneDriveUsage = @(); CASMailbox = @(); Mailboxes = @(); MailboxUsage = @(); MailboxPermissions = @()
+            }
+        }
+        Mock Get-HuduCompanies { [PSCustomObject]@{ id = 20; name = 'Contoso'; archived = $false } }
+        Mock Add-HuduAssetLayoutField { }
+        Mock Get-HuduAssetLayouts { $script:Layout }
+        Mock Get-HuduAssets { @($script:HuduDevice) }
+        Mock Find-HuduDeviceMatch {
+            $script:ObservedExcludeSerials = @($ExcludeSerials)
+            return @($script:HuduDevice)
+        }
+        Mock Get-HuduRelations { @() }
+        Mock Get-HuduLinkBlock { [PSCustomObject]@{ html = $Title } }
+        Mock New-GraphGetRequest { [PSCustomObject]@{ id = 'device-1'; deviceName = 'DEVICE-01'; lastBackupDateTime = '2026-09-10T12:00:00Z' } }
+        Mock Get-CIPPDbItem {
+            if ($Type -eq 'BitlockerKeys') {
+                return @(
+                    [PSCustomObject]@{ RowKey = 'BitlockerKeys-Count'; DataCount = 1 }
+                    [PSCustomObject]@{ RowKey = 'key-1'; Data = [PSCustomObject]@{ id = 'key-1'; deviceId = 'device-1'; volumeType = 1 } }
+                )
+            }
+            return @()
+        }
+        Mock Get-CIPPLapsPassword { [PSCustomObject]@{ state = 'success'; accountName = 'Administrator'; copyField = 'laps-secret'; backupDateTime = '2026-09-10T12:00:00Z' } }
+        Mock Get-CIPPBitLockerKey { [PSCustomObject]@{ state = 'success'; keyId = 'key-1'; copyField = 'bitlocker-secret' } }
+        Mock Get-HuduFormattedField { [PSCustomObject]@{ title = $Title; value = $Value } }
+        Mock Get-HuduFormattedBlock { "<$Heading>$Body</$Heading>" }
+        Mock Get-StringHash { 'device-hash' }
+        Mock Add-CIPPAzDataTableEntity {
+            if ($Entity.PartitionKey -eq 'HuduDevice') { $script:CachedHash = $Entity.Hash }
+        }
+        Mock Set-HuduAsset {
+            $Labels = @{
+                laps_account = 'LAPS Account'; laps_password = 'LAPS Password'; laps_backup_date = 'LAPS Backup Date'
+                bitlocker_os_drive_1_key_id = 'BitLocker OS Drive 1 Key ID'
+                bitlocker_os_drive_1_recovery_key = 'BitLocker OS Drive 1 Recovery Key'
+                microsoft_365 = 'Microsoft 365'
+            }
+            foreach ($Key in $Fields.Keys) {
+                $Existing = $script:HuduDevice.fields | Where-Object slug -eq $Key | Select-Object -First 1
+                if ($Existing) { $Existing.value = $Fields[$Key] }
+                else { $script:HuduDevice.fields += [PSCustomObject]@{ label = $Labels[$Key]; slug = $Key; value = $Fields[$Key] } }
+            }
+        }
+        Mock Set-HuduMagicDash { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'updates missing credentials once and performs a no-op asset sync on the second pass' {
+        $First = Invoke-HuduExtensionSync -Configuration $Configuration -TenantFilter 'contoso.onmicrosoft.com'
+        $Second = Invoke-HuduExtensionSync -Configuration $Configuration -TenantFilter 'contoso.onmicrosoft.com'
+
+        $First.Devices | Should -Be 1
+        $Second.Devices | Should -Be 1
+        $script:HuduDevice.fields.Where({ $_.slug -eq 'laps_account' }).value | Should -Be '.\Administrator'
+        $script:HuduDevice.fields.Where({ $_.slug -eq 'laps_password' }).value | Should -Be 'laps-secret'
+        $script:HuduDevice.fields.Where({ $_.slug -eq 'bitlocker_os_drive_1_key_id' }).value | Should -Be 'key-1'
+        $script:HuduDevice.fields.Where({ $_.slug -eq 'bitlocker_os_drive_1_recovery_key' }).value | Should -Be 'bitlocker-secret'
+        Should -Invoke Get-CIPPLapsPassword -Times 1 -Exactly
+        Should -Invoke Get-CIPPBitLockerKey -Times 1 -Exactly
+        Should -Invoke Set-HuduAsset -Times 1 -Exactly
+        Should -Invoke Add-HuduAssetLayoutField -Times 0 -Exactly
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -Exactly -ParameterFilter {
+            $Entity.PartitionKey -eq 'HuduDevice'
+        }
+        Should -Invoke Find-HuduDeviceMatch -Times 2 -Exactly -ParameterFilter {
+            'SystemSerialNumber' -in $ExcludeSerials -and 'CUSTOM-PLACEHOLDER' -in $ExcludeSerials
+        }
+    }
+}
+
+Describe 'Invoke-HuduExtensionSync user license sync' {
+    BeforeEach {
+        $env:CIPPRootPath = (Resolve-Path "$PSScriptRoot/../..").Path
+        $script:ObservedUserFields = $null
+        $script:LicenseCache = @(
+            [PSCustomObject]@{ skuId = 'CBDC14AB-D96C-4C30-B9F4-6ADA7CDC1D46'; skuPartNumber = 'Microsoft 365 Business Premium'; consumedUnits = 1; prepaidUnits = @{ enabled = 5 } }
+            [PSCustomObject]@{ skuId = '4ef96642-f096-40de-a3e9-d83fb2f90211'; skuPartNumber = 'Microsoft Defender for Office 365 (Plan 1)'; consumedUnits = 1; prepaidUnits = @{ enabled = 5 } }
+        )
+        $script:PeopleLayout = [PSCustomObject]@{
+            id     = 30
+            fields = @(
+                [PSCustomObject]@{ label = 'Microsoft 365'; position = 0; field_type = 'RichText' }
+                [PSCustomObject]@{ label = 'Email Address'; position = 1; field_type = 'Text' }
+                [PSCustomObject]@{ label = 'Licenses'; position = 2; field_type = 'Text' }
+            )
+        }
+        $script:HuduPerson = [PSCustomObject]@{
+            id = 201; name = 'Jane Doe'; primary_mail = 'jane@contoso.onmicrosoft.com'; url = 'https://hudu.example.test/a/201'
+            asset_layout_id = 30; cards = @(); fields = @()
+        }
+        $Configuration = [PSCustomObject]@{
+            Hudu = [PSCustomObject]@{
+                IncludeLAPS = $false; IncludeBitLocker = $false
+                CreateMissingUsers = $false; CreateMissingDevices = $false
+                ImportDomains = $false; MonitorDomains = $false; HideEmptyRoles = $false
+                IncludeDefenderLink = $false; IncludeComplianceLink = $false; IncludeParterCenterLink = $false
+            }
+        }
+
+        Mock Connect-HuduAPI { }
+        Mock Get-Tenants {
+            [PSCustomObject]@{ displayName = 'Contoso'; defaultDomainName = 'contoso.onmicrosoft.com'; initialDomainName = 'contoso.onmicrosoft.com'; customerId = 'tenant-1' }
+        }
+        Mock Get-AssignedNameMap { [PSCustomObject]@{} }
+        Mock Get-AssignedMap { [PSCustomObject]@{} }
+        Mock Get-CIPPTable { @{} }
+        Mock Get-CIPPAzDataTableEntity {
+            if ($Filter -like "*PartitionKey eq 'HuduMapping'*") {
+                return @(
+                    [PSCustomObject]@{ PartitionKey = 'HuduMapping'; RowKey = 'tenant-1'; IntegrationId = 20; IntegrationName = 'Contoso' }
+                    [PSCustomObject]@{ PartitionKey = 'HuduMapping'; RowKey = 'Users'; IntegrationId = 30; IntegrationName = 'People' }
+                )
+            }
+            if ($Filter -like "*InstanceProperties*") { return [PSCustomObject]@{ Value = 'cipp.example.test' } }
+            if ($Filter -like "*CacheMetadata*") { return [PSCustomObject]@{ LastRefresh = (Get-Date).ToUniversalTime().ToString('o') } }
+            return $null
+        }
+        Mock Get-CippExtensionReportingData {
+            [PSCustomObject]@{
+                Users    = @([PSCustomObject]@{
+                        id = 'user-1'; displayName = 'Jane Doe'; userPrincipalName = 'jane@contoso.onmicrosoft.com'; accountEnabled = $true
+                        proxyAddresses = @('SMTP:jane@contoso.onmicrosoft.com'); businessPhones = @()
+                        assignedLicenses = @(
+                            [PSCustomObject]@{ skuId = 'cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46' }
+                            [PSCustomObject]@{ skuId = 'f30db892-07e9-47e9-837c-80727f46fd3d' }
+                            [PSCustomObject]@{ skuId = '4ef96642-f096-40de-a3e9-d83fb2f90211' }
+                        )
+                    })
+                AllRoles = @(); Domains = @(); Licenses = $script:LicenseCache; Devices = @()
+                DeviceCompliancePolicies = @(); Groups = @(); ConditionalAccess = @()
+                OneDriveUsage = @(); CASMailbox = @(); Mailboxes = @(); MailboxUsage = @(); MailboxPermissions = @()
+            }
+        }
+        Mock Get-HuduCompanies { [PSCustomObject]@{ id = 20; name = 'Contoso'; archived = $false } }
+        Mock Add-HuduAssetLayoutField { }
+        Mock Get-HuduAssetLayouts { $script:PeopleLayout }
+        Mock Get-HuduAssets { @($script:HuduPerson) }
+        Mock Get-HuduRelations { @() }
+        Mock Get-HuduLinkBlock { [PSCustomObject]@{ html = $Title } }
+        Mock Get-CIPPDbItem { @() }
+        Mock Get-HuduFormattedField { [PSCustomObject]@{ title = $Title; value = $Value } }
+        Mock Get-HuduFormattedBlock { "<$Heading>$Body</$Heading>" }
+        Mock Get-StringHash { 'user-hash' }
+        Mock Get-HuduFormattedField { "<p>$Title`: $Value</p>" }
+        Mock Add-CIPPAzDataTableEntity { }
+        Mock Set-HuduAsset { $script:ObservedUserFields = $Fields }
+        Mock Set-HuduMagicDash { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'writes friendly license names to a dedicated Licenses field and drops excluded SKUs' {
+        $Result = Invoke-HuduExtensionSync -Configuration $Configuration -TenantFilter 'contoso.onmicrosoft.com'
+
+        $Result.Users | Should -Be 1
+        $Result.Errors | Where-Object { $_ -like 'User *' } | Should -BeNullOrEmpty
+        Should -Invoke Add-HuduAssetLayoutField -Times 1 -Exactly -ParameterFilter { $AssetLayoutId -eq 30 -and $Label -eq 'Licenses' -and $FieldType -eq 'Text' }
+        Should -Invoke Set-HuduAsset -Times 1 -Exactly
+        $script:ObservedUserFields.licenses | Should -Be 'Microsoft 365 Business Premium, Microsoft Defender for Office 365 (Plan 1)'
+        $script:ObservedUserFields.email_address | Should -Be 'jane@contoso.onmicrosoft.com'
+        $script:ObservedUserFields.microsoft_365 | Should -Match 'Microsoft 365 Business Premium'
+    }
+
+    It 'falls back to the raw SKU IDs when the license cache is empty' {
+        $script:LicenseCache = @()
+        $null = Invoke-HuduExtensionSync -Configuration $Configuration -TenantFilter 'contoso.onmicrosoft.com'
+
+        $script:ObservedUserFields.licenses | Should -Be '4ef96642-f096-40de-a3e9-d83fb2f90211, cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46, f30db892-07e9-47e9-837c-80727f46fd3d'
+    }
+}
+
+Describe 'Invoke-HuduExtensionSync roles table' {
+    BeforeEach {
+        $env:CIPPRootPath = (Resolve-Path "$PSScriptRoot/../..").Path
+        $script:MagicDash = $null
+        $Configuration = [PSCustomObject]@{
+            Hudu = [PSCustomObject]@{
+                IncludeLAPS = $false; IncludeBitLocker = $false
+                CreateMissingUsers = $false; CreateMissingDevices = $false
+                ImportDomains = $false; MonitorDomains = $false; HideEmptyRoles = $true
+                IncludeDefenderLink = $false; IncludeComplianceLink = $false; IncludeParterCenterLink = $false
+            }
+        }
+
+        Mock Connect-HuduAPI { }
+        Mock Get-Tenants {
+            [PSCustomObject]@{ displayName = 'Contoso'; defaultDomainName = 'contoso.onmicrosoft.com'; initialDomainName = 'contoso.onmicrosoft.com'; customerId = 'tenant-1' }
+        }
+        Mock Get-AssignedNameMap { [PSCustomObject]@{} }
+        Mock Get-AssignedMap { [PSCustomObject]@{} }
+        Mock Get-CIPPTable { @{} }
+        Mock Get-CIPPAzDataTableEntity {
+            if ($Filter -like "*PartitionKey eq 'HuduMapping'*") {
+                return @([PSCustomObject]@{ PartitionKey = 'HuduMapping'; RowKey = 'tenant-1'; IntegrationId = 20; IntegrationName = 'Contoso' })
+            }
+            if ($Filter -like "*InstanceProperties*") { return [PSCustomObject]@{ Value = 'cipp.example.test' } }
+            if ($Filter -like "*CacheMetadata*") { return [PSCustomObject]@{ LastRefresh = (Get-Date).ToUniversalTime().ToString('o') } }
+            return $null
+        }
+        Mock Get-CippExtensionReportingData {
+            [PSCustomObject]@{
+                Users    = @(); Domains = @(); Licenses = @(); Devices = @()
+                AllRoles = @(
+                    [PSCustomObject]@{ id = 'role-instance-1'; roleTemplateId = '62e90394-69f5-4237-9190-012177145e10'; displayName = 'Global Administrator'; description = 'GA'; members = @() }
+                    [PSCustomObject]@{ id = 'role-instance-2'; roleTemplateId = 'empty-template'; displayName = 'Empty Role'; description = 'nobody'; members = @() }
+                )
+                DeviceCompliancePolicies = @(); Groups = @(); ConditionalAccess = @()
+                OneDriveUsage = @(); CASMailbox = @(); Mailboxes = @(); MailboxUsage = @(); MailboxPermissions = @()
+            }
+        }
+        Mock Get-CippDbRoleMembers {
+            if ($RoleTemplateId -ne '62e90394-69f5-4237-9190-012177145e10') { return @() }
+            @(
+                [PSCustomObject]@{ id = 'u-direct'; displayName = 'Direct Admin'; userPrincipalName = 'direct@contoso.onmicrosoft.com'; AssignmentType = 'Direct'; EndDateTime = $null; IsPermanent = $true }
+                [PSCustomObject]@{ id = 'u-eligible'; displayName = 'Eligible Admin'; userPrincipalName = 'eligible@contoso.onmicrosoft.com'; AssignmentType = 'Eligible'; EndDateTime = '2030-01-15T00:00:00Z'; IsPermanent = $false }
+                [PSCustomObject]@{ id = 'u-expired'; displayName = 'Expired Admin'; userPrincipalName = 'expired@contoso.onmicrosoft.com'; AssignmentType = 'Eligible'; EndDateTime = '2020-01-01T00:00:00Z'; IsPermanent = $false }
+            )
+        }
+        Mock Get-HuduCompanies { [PSCustomObject]@{ id = 20; name = 'Contoso'; archived = $false } }
+        Mock Get-HuduRelations { @() }
+        Mock Get-HuduLinkBlock { [PSCustomObject]@{ html = $Title } }
+        Mock Get-CIPPDbItem { @() }
+        Mock Add-CIPPAzDataTableEntity { }
+        Mock Set-HuduMagicDash { $script:MagicDash = $Content }
+        Mock Write-LogMessage { }
+    }
+
+    It 'lists PIM-eligible members in their own column, drops expired eligibilities and empty roles' {
+        $null = Invoke-HuduExtensionSync -Configuration $Configuration -TenantFilter 'contoso.onmicrosoft.com'
+
+        Should -Invoke Get-CippDbRoleMembers -ParameterFilter { $RoleTemplateId -eq '62e90394-69f5-4237-9190-012177145e10' -and $TenantFilter -eq 'contoso.onmicrosoft.com' }
+        $script:MagicDash | Should -Match '<th>EligibleMembers</th>'
+        $script:MagicDash | Should -Match 'Direct Admin'
+        $script:MagicDash | Should -Match 'Eligible Admin \(until 2030-01-15\)'
+        $script:MagicDash | Should -Not -Match 'Expired Admin'
+        $script:MagicDash | Should -Not -Match 'Empty Role'
+    }
+}
diff --git a/Tests/Extensions/New-CippExtAlert.TicketReference.Tests.ps1 b/Tests/Extensions/New-CippExtAlert.TicketReference.Tests.ps1
index 461194db5ef2e..554e039229a83 100644
--- a/Tests/Extensions/New-CippExtAlert.TicketReference.Tests.ps1
+++ b/Tests/Extensions/New-CippExtAlert.TicketReference.Tests.ps1
@@ -191,3 +191,114 @@ Describe 'New-CippExtAlert - HaloPSA ticket reference' {
         }
     }
 }
+
+Describe 'New-CippExtAlert - PSA consolidation key' {
+    BeforeEach {
+        $script:TicketArgs = $null
+        $script:GradientArgs = $null
+
+        Mock -CommandName Get-CIPPTable -MockWith {
+            param([string]$TableName)
+            @{ TableName = $TableName }
+        }
+
+        Mock -CommandName Get-Tenants -MockWith {
+            [pscustomobject]@{
+                customerId = 'customer-guid'
+            }
+        }
+
+        Mock -CommandName Write-LogMessage -MockWith { }
+
+        Mock -CommandName New-HaloPSATicket -MockWith {
+            param(
+                $Title,
+                $Description,
+                $Client,
+                $UserUPN,
+                $AzureOID,
+                $DisplayName,
+                $TicketPriority,
+                $TicketId,
+                $ConsolidationKey
+            )
+
+            $script:TicketArgs = [pscustomobject]@{
+                Title            = $Title
+                Client           = $Client
+                ConsolidationKey = $ConsolidationKey
+            }
+        }
+
+        Mock -CommandName New-GradientAlert -MockWith {
+            param($Title, $Description, $Client)
+
+            $script:GradientArgs = [pscustomobject]@{
+                Title  = $Title
+                Client = $Client
+            }
+        }
+    }
+
+    It 'passes the optional consolidation key to HaloPSA' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($TableName, $Filter)
+
+            if ($Filter -like '*HaloMapping*') {
+                return [pscustomobject]@{
+                    RowKey        = 'customer-guid'
+                    IntegrationId = 19
+                }
+            }
+
+            [pscustomobject]@{
+                config = (@{
+                    HaloPSA = @{
+                        enabled = $true
+                    }
+                } | ConvertTo-Json -Depth 5)
+            }
+        }
+
+        $Alert = [pscustomobject]@{
+            TenantId            = 'contoso.onmicrosoft.com'
+            AlertTitle          = '[CIPP] dynamic title'
+            AlertText           = '<p>body</p>'
+            PSAConsolidationKey = 'contoso.com|Alerts'
+        }
+
+        New-CippExtAlert -Alert $Alert
+
+        $script:TicketArgs.ConsolidationKey |
+            Should -Be 'contoso.com|Alerts'
+    }
+
+    It 'does not change the Gradient call when the consolidation key is present' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($TableName, $Filter)
+
+            [pscustomobject]@{
+                config = (@{
+                    Gradient = @{
+                        enabled = $true
+                    }
+                } | ConvertTo-Json -Depth 5)
+            }
+        }
+
+        $Alert = [pscustomobject]@{
+            TenantId            = 'contoso.onmicrosoft.com'
+            AlertTitle          = '[CIPP] dynamic title'
+            AlertText           = '<p>body</p>'
+            PSAConsolidationKey = 'contoso.com|Alerts'
+        }
+
+        New-CippExtAlert -Alert $Alert
+
+        $script:GradientArgs.Title |
+            Should -Be '[CIPP] dynamic title'
+
+        $script:GradientArgs.Client |
+            Should -Be 'contoso.onmicrosoft.com'
+    }
+}
diff --git a/Tests/Extensions/New-GradientServiceSyncRun.Tests.ps1 b/Tests/Extensions/New-GradientServiceSyncRun.Tests.ps1
new file mode 100644
index 0000000000000..7756a42b9a5c3
--- /dev/null
+++ b/Tests/Extensions/New-GradientServiceSyncRun.Tests.ps1
@@ -0,0 +1,67 @@
+# Pester tests for New-GradientServiceSyncRun.
+#
+# Licence counts are read from the reporting DB (LicenseOverview) instead of a live subscribedSkus
+# call per tenant. The old path ran those calls in a parallel runspace; when they failed it posted a
+# placeholder whose prepaidUnits was a scriptblock, so Gradient received unitCount null and rejected
+# every client ("unitCount must be a number"), and created a "Could not connect to client" service.
+
+BeforeAll {
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Gradient/New-GradientServiceSyncRun.ps1"
+
+    function Get-CIPPTable { param($TableName) }
+    function Get-CIPPAzDataTableEntity { param($Filter) }
+    function Get-Tenants { param($TenantFilter, [switch]$IncludeErrors) }
+    function Get-GradientToken { param($Configuration) }
+    function New-CIPPDbRequest { param($TenantFilter, $Type, $Fields) }
+    function New-GraphGetRequest { param($uri, $tenantid) }
+    function Write-LogMessage { param($API, $message, $Sev, $tenant) }
+
+    $env:CIPPRootPath = (Resolve-Path "$PSScriptRoot/../..").Path
+}
+
+Describe 'New-GradientServiceSyncRun licence sync' {
+    BeforeEach {
+        $script:CountPosts = [System.Collections.Generic.List[object]]::new()
+
+        Mock Get-CIPPTable { @{} }
+        Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ config = '{"Gradient":{}}' } }
+        Mock Get-GradientToken { @{ Authorization = 'x' } }
+        Mock Write-LogMessage { }
+        Mock New-GraphGetRequest { throw 'no live Graph calls expected' }
+        Mock Get-Tenants {
+            @(
+                [pscustomobject]@{ displayName = 'Contoso'; defaultDomainName = 'contoso.onmicrosoft.com' }
+                [pscustomobject]@{ displayName = 'Fabrikam'; defaultDomainName = 'fabrikam.onmicrosoft.com' }
+            )
+        }
+        Mock New-CIPPDbRequest {
+            if ($TenantFilter -eq 'contoso.onmicrosoft.com') {
+                [pscustomobject]@{ skuId = '05e9a617-0261-4cee-bb44-138d3ef5d965'; License = 'Microsoft 365 E3'; TotalLicenses = '25' }
+            }
+        }
+        Mock Invoke-RestMethod {
+            if ($Uri -like '*/organization/accounts') { return @() }
+            if ($Uri -like '*/vendor-api/organization') { return [pscustomobject]@{ Status = 'active' } }
+            if ($Uri -like '*/vendor-api') { return [pscustomobject]@{ data = [pscustomobject]@{ skus = @([pscustomobject]@{ name = 'Microsoft 365 E3'; id = 'svc-1' }) } } }
+            if ($Uri -like '*/count') { $script:CountPosts.Add(($Body | ConvertFrom-Json)); return $null }
+        }
+    }
+
+    It 'posts the cached purchased count as a number, without calling Graph' {
+        New-GradientServiceSyncRun
+
+        $script:CountPosts.Count | Should -Be 1
+        $script:CountPosts[0].accountId | Should -Be 'contoso.onmicrosoft.com'
+        $script:CountPosts[0].unitCount | Should -Be 25
+        $script:CountPosts[0].unitCount | Should -BeOfType [long]
+        Should -Invoke New-GraphGetRequest -Times 0 -Exactly
+        Should -Invoke New-CIPPDbRequest -ParameterFilter { $Type -eq 'LicenseOverview' } -Times 2 -Exactly
+    }
+
+    It 'skips a tenant with no cached licence data and says so' {
+        New-GradientServiceSyncRun
+
+        @($script:CountPosts | Where-Object accountId -EQ 'fabrikam.onmicrosoft.com').Count | Should -Be 0
+        Should -Invoke Write-LogMessage -ParameterFilter { $tenant -eq 'fabrikam.onmicrosoft.com' -and $message -like 'No cached licence data*' } -Times 1 -Exactly
+    }
+}
diff --git a/Tests/Extensions/New-HaloPSATicket.Consolidation.Tests.ps1 b/Tests/Extensions/New-HaloPSATicket.Consolidation.Tests.ps1
new file mode 100644
index 0000000000000..677fd247be2aa
--- /dev/null
+++ b/Tests/Extensions/New-HaloPSATicket.Consolidation.Tests.ps1
@@ -0,0 +1,228 @@
+# Pester tests for HaloPSA ticket consolidation keys.
+# Scheduled CIPP alerts may include dynamic data such as timestamps in their visible title.
+# A stable ConsolidationKey allows those alerts to reuse the same HaloPSA ticket while
+# preserving the original displayed title.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CippExtensions/Public/Halo/New-HaloPSATicket.ps1'
+
+    function Get-CIPPTable { param([string]$TableName) }
+    function Get-CIPPAzDataTableEntity { param($TableName, $Filter, $Property, $First) }
+    function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) }
+    function Get-HaloToken { param($configuration) }
+    function Get-CippUserAgent { 'CIPP/test' }
+    function Get-HaloUser { param($AzureOID, $Email, $ClientId, $Configuration, $Token) }
+    function Get-StringHash { param($String) }
+    function Get-NormalizedError { param($Message) }
+    function Get-CippException { param($Exception) }
+    function Write-LogMessage { param($API, $tenant, $message, $sev, $LogData, $headers) }
+
+    . $FunctionPath
+
+    function New-HaloConfigRow {
+        param(
+            [bool]$ConsolidateTickets = $true,
+            [bool]$LinkTicketsToUsers = $false
+        )
+
+        [pscustomobject]@{
+            config = (@{
+                    HaloPSA = @{
+                        Enabled            = $true
+                        ResourceURL        = 'https://halo.example.com/api'
+                        TicketType         = 21
+                        ConsolidateTickets = $ConsolidateTickets
+                        LinkTicketsToUsers = $LinkTicketsToUsers
+                        Outcome            = @{ label = 'CIPP Update'; value = 155 }
+                    }
+                } | ConvertTo-Json -Depth 5)
+        }
+    }
+}
+
+Describe 'New-HaloPSATicket - consolidation key' {
+    BeforeEach {
+        $script:HashInput = $null
+        $script:TicketLookupFilter = $null
+
+        Mock -CommandName Get-CIPPTable -MockWith {
+            param([string]$TableName)
+            @{ TableName = $TableName }
+        }
+
+        Mock -CommandName Get-HaloToken -MockWith {
+            @{ access_token = 'token' }
+        }
+
+        Mock -CommandName Get-StringHash -MockWith {
+            param($String)
+            $script:HashInput = $String
+            'stablehash'
+        }
+
+        Mock -CommandName Get-HaloUser -MockWith {
+            $null
+        }
+
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName Write-LogMessage -MockWith { }
+
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($TableName, $Filter)
+
+            if ($Filter) {
+                $script:TicketLookupFilter = $Filter
+                return [pscustomobject]@{
+                    TicketID = 999
+                }
+            }
+
+            New-HaloConfigRow
+        }
+
+        Mock -CommandName Invoke-RestMethod -MockWith {
+            param($Uri, $ContentType, $Method, $Body, $Headers, [switch]$SkipHttpErrorCheck)
+
+            if ($Method -eq 'Get') {
+                return @{
+                    id            = 999
+                    hasbeenclosed = $false
+                }
+            }
+
+            if ($Uri -like '*/actions') {
+                return @{
+                    id = 5555
+                }
+            }
+
+            return @{
+                id = 1000
+            }
+        }
+    }
+
+    It 'preserves title-based consolidation when no key is supplied' {
+        $null = New-HaloPSATicket `
+            -title '[CIPP] contoso.com CIPP Alert: Alerts found starting at 09/22/2026 09:45:00' `
+            -description '<p>body</p>' `
+            -client 19
+
+        $script:HashInput |
+            Should -Be '[CIPP] contoso.com CIPP Alert: Alerts found starting at 09/22/2026 09:45:00'
+    }
+
+    It 'uses the stable consolidation key instead of the dynamic title' {
+        $null = New-HaloPSATicket `
+            -title '[CIPP] contoso.com CIPP Alert: Alerts found starting at 09/22/2026 09:45:00' `
+            -description '<p>body</p>' `
+            -client 19 `
+            -ConsolidationKey 'contoso.com|Alerts'
+
+        $script:HashInput | Should -Be 'contoso.com|Alerts'
+    }
+
+    It 'produces the same consolidation input for different timestamped titles' {
+        $null = New-HaloPSATicket `
+            -title '[CIPP] contoso.com CIPP Alert: Alerts found starting at 09/22/2026 09:45:00' `
+            -description '<p>first</p>' `
+            -client 19 `
+            -ConsolidationKey 'contoso.com|Alerts'
+
+        $FirstHashInput = $script:HashInput
+
+        $null = New-HaloPSATicket `
+            -title '[CIPP] contoso.com CIPP Alert: Alerts found starting at 09/22/2026 10:00:00' `
+            -description '<p>second</p>' `
+            -client 19 `
+            -ConsolidationKey 'contoso.com|Alerts'
+
+        $SecondHashInput = $script:HashInput
+
+        $FirstHashInput | Should -Be 'contoso.com|Alerts'
+        $SecondHashInput | Should -Be $FirstHashInput
+    }
+
+    It 'uses the stable hash in the PSATickets row key lookup' {
+        $null = New-HaloPSATicket `
+            -title '[CIPP] dynamic title' `
+            -description '<p>body</p>' `
+            -client 19 `
+            -ConsolidationKey 'contoso.com|Alerts'
+
+        $script:TicketLookupFilter |
+            Should -Be "PartitionKey eq 'HaloPSA' and RowKey eq '19-stablehash'"
+    }
+}
+
+Describe 'New-HaloPSATicket - consolidation key with affected users' {
+    BeforeEach {
+        $script:HashInput = $null
+
+        Mock -CommandName Get-CIPPTable -MockWith {
+            param([string]$TableName)
+            @{ TableName = $TableName }
+        }
+
+        Mock -CommandName Get-HaloToken -MockWith {
+            @{ access_token = 'token' }
+        }
+
+        Mock -CommandName Get-StringHash -MockWith {
+            param($String)
+            $script:HashInput = $String
+            'stablehash'
+        }
+
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName Write-LogMessage -MockWith { }
+
+        Mock -CommandName Get-HaloUser -MockWith {
+            [pscustomobject]@{
+                id      = 123
+                site_id = 7
+            }
+        }
+
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            param($TableName, $Filter)
+
+            if ($Filter) {
+                return [pscustomobject]@{
+                    TicketID = 999
+                }
+            }
+
+            New-HaloConfigRow -LinkTicketsToUsers $true
+        }
+
+        Mock -CommandName Invoke-RestMethod -MockWith {
+            param($Uri, $ContentType, $Method, $Body, $Headers, [switch]$SkipHttpErrorCheck)
+
+            if ($Method -eq 'Get') {
+                return @{
+                    id            = 999
+                    hasbeenclosed = $false
+                }
+            }
+
+            return @{
+                id = 5555
+            }
+        }
+    }
+
+    It 'keeps affected users separated when a stable consolidation key is supplied' {
+        $null = New-HaloPSATicket `
+            -title '[CIPP] dynamic title' `
+            -description '<p>body</p>' `
+            -client 19 `
+            -UserUPN 'user1@contoso.com' `
+            -AzureOID '11111111-1111-1111-1111-111111111111' `
+            -ConsolidationKey 'contoso.com|Alerts'
+
+        $script:HashInput |
+            Should -Be 'contoso.com|Alerts|user1@contoso.com'
+    }
+}
diff --git a/Tests/GitHub/Get-CIPPTemplateContentHash.Tests.ps1 b/Tests/GitHub/Get-CIPPTemplateContentHash.Tests.ps1
new file mode 100644
index 0000000000000..394c6dc95dc21
--- /dev/null
+++ b/Tests/GitHub/Get-CIPPTemplateContentHash.Tests.ps1
@@ -0,0 +1,43 @@
+# hasLocalChanges compares this hash against the stamped ContentHash, so it must be stable
+# across key order and ignore the fields that change on every save without a real edit
+# (tenantFilter, excludedTenants, updatedAt/updatedBy, createdAt).
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1'
+
+    . $FunctionPath
+}
+
+Describe 'Get-CIPPTemplateContentHash' {
+    It 'hashes equal for the same content with different key order' {
+        $A = Get-CIPPTemplateContentHash -JSON '{"a":1,"b":{"y":2,"x":1}}'
+        $B = Get-CIPPTemplateContentHash -JSON '{"b":{"x":1,"y":2},"a":1}'
+        $A | Should -Be $B
+    }
+
+    It 'hashes differ when a value changes' {
+        $A = Get-CIPPTemplateContentHash -JSON '{"a":1}'
+        $B = Get-CIPPTemplateContentHash -JSON '{"a":2}'
+        $A | Should -Not -Be $B
+    }
+
+    It 'ignores tenantFilter, excludedTenants and the timestamp/actor fields' {
+        $A = Get-CIPPTemplateContentHash -JSON '{"templateName":"Foo","tenantFilter":["t1"],"excludedTenants":["t2"],"updatedAt":"2026-01-01","updatedBy":"a@b.com","createdAt":"2025-01-01"}'
+        $B = Get-CIPPTemplateContentHash -JSON '{"templateName":"Foo","tenantFilter":["t9"],"excludedTenants":[],"updatedAt":"2026-09-23","updatedBy":"c@d.com","createdAt":"2020-01-01"}'
+        $A | Should -Be $B
+    }
+
+    It 'returns a lowercase hex SHA256 string' {
+        $Hash = Get-CIPPTemplateContentHash -JSON '{"a":1}'
+        $Hash | Should -Match '^[0-9a-f]{64}$'
+    }
+
+    It 'returns $null for empty input' {
+        Get-CIPPTemplateContentHash -JSON '' | Should -BeNullOrEmpty
+    }
+
+    It 'returns $null for unparsable input' {
+        Get-CIPPTemplateContentHash -JSON 'not { valid json' | Should -BeNullOrEmpty
+    }
+}
diff --git a/Tests/GitHub/Get-CIPPTemplateSourceUrl.Tests.ps1 b/Tests/GitHub/Get-CIPPTemplateSourceUrl.Tests.ps1
new file mode 100644
index 0000000000000..b5c2e16c61344
--- /dev/null
+++ b/Tests/GitHub/Get-CIPPTemplateSourceUrl.Tests.ps1
@@ -0,0 +1,46 @@
+# The frontend cannot guess a synced template's repo path - the scheduled sync matches files by
+# sanitised filename anywhere in the tree, so the path is only known at import/push time and is
+# stored as SourcePath. This builds the GitHub URL from Source/SourcePath plus the repo's branch.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateSourceUrl.ps1'
+
+    function Get-CIPPTable { param($TableName) @{ Context = "stub-$TableName" } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+
+    . $FunctionPath
+}
+
+Describe 'Get-CIPPTemplateSourceUrl' {
+    It 'returns $null when Source is empty' {
+        Get-CIPPTemplateSourceUrl -Source '' -SourcePath 'CATemplate/Foo.json' | Should -BeNullOrEmpty
+    }
+
+    It 'returns the repo root URL when SourcePath is not set' {
+        Get-CIPPTemplateSourceUrl -Source 'Org/repo' -Repos @() | Should -Be 'https://github.com/Org/repo'
+    }
+
+    It 'returns a blob URL on the default branch when no repo row matches' {
+        Get-CIPPTemplateSourceUrl -Source 'Org/repo' -SourcePath 'CATemplate/Foo.json' -Repos @() |
+            Should -Be 'https://github.com/Org/repo/blob/main/CATemplate/Foo.json'
+    }
+
+    It 'uses the repo row UploadBranch over DefaultBranch' {
+        $Repos = @([pscustomobject]@{ FullName = 'Org/repo'; UploadBranch = 'staging'; DefaultBranch = 'main' })
+        Get-CIPPTemplateSourceUrl -Source 'Org/repo' -SourcePath 'CATemplate/Foo.json' -Repos $Repos |
+            Should -Be 'https://github.com/Org/repo/blob/staging/CATemplate/Foo.json'
+    }
+
+    It 'falls back to DefaultBranch when UploadBranch is not set' {
+        $Repos = @([pscustomobject]@{ FullName = 'Org/repo'; DefaultBranch = 'develop' })
+        Get-CIPPTemplateSourceUrl -Source 'Org/repo' -SourcePath 'CATemplate/Foo.json' -Repos $Repos |
+            Should -Be 'https://github.com/Org/repo/blob/develop/CATemplate/Foo.json'
+    }
+
+    It 'does one table read when -Repos is not pre-fetched' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @() }
+        $null = Get-CIPPTemplateSourceUrl -Source 'Org/repo' -SourcePath 'CATemplate/Foo.json'
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1
+    }
+}
diff --git a/Tests/GitHub/Push-CIPPBaselineToRepo.Tests.ps1 b/Tests/GitHub/Push-CIPPBaselineToRepo.Tests.ps1
new file mode 100644
index 0000000000000..291d17d866470
--- /dev/null
+++ b/Tests/GitHub/Push-CIPPBaselineToRepo.Tests.ps1
@@ -0,0 +1,80 @@
+# A pushed baseline stamps every related template row plus the rollout row with the blob
+# SHA and repo FullName returned for that push, so the next sync recognises each as current.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Push-CIPPBaselineToRepo.ps1'
+    $HashFunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1'
+
+    function Get-CIPPTable { param($TableName) @{ Context = "stub-$TableName" } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [string]$OperationType) }
+    function Push-GitHubContent { param($FullName, $Path, $Content, $Message, $Branch) }
+    function Export-CIPPBaselineTemplate { param($GUID) }
+
+    . $HashFunctionPath
+    . $FunctionPath
+}
+
+Describe 'Push-CIPPBaselineToRepo' {
+    BeforeEach {
+        $script:WrittenEntities = [System.Collections.Generic.List[object]]::new()
+        Mock -CommandName Export-CIPPBaselineTemplate -MockWith {
+            @{
+                Baseline  = [pscustomobject]@{ templateName = 'My Baseline' }
+                Templates = @(
+                    [pscustomobject]@{ RowKey = 'tpl-1'; PartitionKey = 'CATemplate'; JSON = '{"displayName":"CA One"}' }
+                    [pscustomobject]@{ RowKey = 'tpl-2'; PartitionKey = 'IntuneTemplate'; JSON = '{"displayName":"Intune One"}' }
+                    [pscustomobject]@{ RowKey = 'tpl-3'; PartitionKey = 'StandardsTemplateV2'; JSON = '{"templateName":"Standards One"}' }
+                )
+            }
+        }
+        Mock -CommandName Push-GitHubContent -MockWith { @{ content = @{ sha = "sha-for-$($Path)" } } }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:WrittenEntities.Add($Entity) }
+    }
+
+    It 'stamps every related template row and the rollout row' {
+        $Result = Push-CIPPBaselineToRepo -GUID 'baseline-1' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+
+        $Result.state | Should -Be 'success'
+        $script:WrittenEntities.Count | Should -Be 4
+
+        $Tpl1 = $script:WrittenEntities | Where-Object { $_.PartitionKey -eq 'CATemplate' }
+        $Tpl1.RowKey | Should -Be 'tpl-1'
+        $Tpl1.Source | Should -Be 'Org/repo'
+        $Tpl1.SHA | Should -Not -BeNullOrEmpty
+        $Tpl1.SourcePath | Should -Be 'CATemplate/CA_One.json'
+        $Tpl1.ContainsKey('ContentHash') | Should -BeFalse
+
+        $Tpl2 = $script:WrittenEntities | Where-Object { $_.PartitionKey -eq 'IntuneTemplate' }
+        $Tpl2.RowKey | Should -Be 'tpl-2'
+        $Tpl2.SourcePath | Should -Be 'IntuneTemplate/Intune_One.json'
+        $Tpl2.ContainsKey('ContentHash') | Should -BeFalse
+
+        $Tpl3 = $script:WrittenEntities | Where-Object { $_.PartitionKey -eq 'StandardsTemplateV2' }
+        $Tpl3.RowKey | Should -Be 'tpl-3'
+        $Tpl3.ContentHash | Should -Not -BeNullOrEmpty
+        $Tpl3.ContentHash | Should -Match '^[0-9a-f]{64}$'
+
+        $Rollout = $script:WrittenEntities | Where-Object { $_.PartitionKey -eq 'rollout' }
+        $Rollout.RowKey | Should -Be 'baseline-1'
+        $Rollout.Source | Should -Be 'Org/repo'
+        $Rollout.SHA | Should -Not -BeNullOrEmpty
+        $Rollout.SourcePath | Should -Be 'BaselineTemplate/My_Baseline.json'
+        $Rollout.LocalChanges | Should -Be $false
+    }
+
+    It 'returns an error result when the baseline does not exist' {
+        Mock -CommandName Export-CIPPBaselineTemplate -MockWith { $null }
+        $Result = Push-CIPPBaselineToRepo -GUID 'missing' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+        $Result.state | Should -Be 'error'
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0
+    }
+
+    It 'returns an error result and stamps nothing when GitHub returns no blob sha' {
+        Mock -CommandName Push-GitHubContent -MockWith { $null }
+        $Result = Push-CIPPBaselineToRepo -GUID 'baseline-1' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+        $Result.state | Should -Be 'error'
+        $script:WrittenEntities.Count | Should -Be 0
+    }
+}
diff --git a/Tests/GitHub/Push-CIPPTemplateToRepo.Tests.ps1 b/Tests/GitHub/Push-CIPPTemplateToRepo.Tests.ps1
new file mode 100644
index 0000000000000..f9598af67a07d
--- /dev/null
+++ b/Tests/GitHub/Push-CIPPTemplateToRepo.Tests.ps1
@@ -0,0 +1,73 @@
+# A pushed template's row must be stamped with the returned blob SHA and the repo FullName
+# via UpsertMerge (not a full rewrite) so the next repo sync recognises this as the current
+# copy instead of re-importing it as new.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Push-CIPPTemplateToRepo.ps1'
+    $HashFunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1'
+
+    function Get-CIPPTable { param($TableName) @{ Context = "stub-$TableName" } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [string]$OperationType) }
+    function Push-GitHubContent { param($FullName, $Path, $Content, $Message, $Branch) }
+
+    . $HashFunctionPath
+    . $FunctionPath
+}
+
+Describe 'Push-CIPPTemplateToRepo' {
+    BeforeEach {
+        $script:Written = $null
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{
+                RowKey       = 'guid-1'
+                PartitionKey = 'StandardsTemplateV2'
+                JSON         = '{"templateName":"My Template","tenantFilter":[{"value":"tenant1"}]}'
+            }
+        }
+        Mock -CommandName Push-GitHubContent -MockWith { @{ content = @{ sha = 'newsha123' } } }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:Written = $Entity } -ParameterFilter { $OperationType -eq 'UpsertMerge' }
+    }
+
+    It 'stamps SHA and Source on the template row via UpsertMerge and returns success' {
+        $Result = Push-CIPPTemplateToRepo -GUID 'guid-1' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -ParameterFilter { $OperationType -eq 'UpsertMerge' }
+        $script:Written.PartitionKey | Should -Be 'StandardsTemplateV2'
+        $script:Written.RowKey | Should -Be 'guid-1'
+        $script:Written.SHA | Should -Be 'newsha123'
+        $script:Written.Source | Should -Be 'Org/repo'
+        $Result.state | Should -Be 'success'
+    }
+
+    It 'stamps SourcePath with the computed repo path' {
+        $null = Push-CIPPTemplateToRepo -GUID 'guid-1' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+        $script:Written.SourcePath | Should -Be 'StandardsTemplateV2/My_Template.json'
+    }
+
+    It 'stamps ContentHash with the hash of the pushed JSON' {
+        $null = Push-CIPPTemplateToRepo -GUID 'guid-1' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+        $script:Written.ContentHash | Should -Not -BeNullOrEmpty
+        $script:Written.ContentHash | Should -Match '^[0-9a-f]{64}$'
+    }
+
+    It 'does not rewrite the JSON column, only stamps SHA and Source' {
+        $null = Push-CIPPTemplateToRepo -GUID 'guid-1' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+        $script:Written.ContainsKey('JSON') | Should -BeFalse
+    }
+
+    It 'returns an error result and does not stamp when the template is not found' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+        $Result = Push-CIPPTemplateToRepo -GUID 'missing' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+        $Result.state | Should -Be 'error'
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0
+    }
+
+    It 'returns an error result and does not stamp when GitHub returns no blob sha' {
+        Mock -CommandName Push-GitHubContent -MockWith { $null }
+        $Result = Push-CIPPTemplateToRepo -GUID 'guid-1' -FullName 'Org/repo' -Message 'push it' -Branch 'main'
+        $Result.state | Should -Be 'error'
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 0
+    }
+}
diff --git a/Tests/GitHub/Test-CIPPRepoSource.Tests.ps1 b/Tests/GitHub/Test-CIPPRepoSource.Tests.ps1
new file mode 100644
index 0000000000000..10152f7eb88b3
--- /dev/null
+++ b/Tests/GitHub/Test-CIPPRepoSource.Tests.ps1
@@ -0,0 +1,25 @@
+# The Source column carries more than repository names: the baseline migration writes a
+# 'StandardsTemplateV2:<guid>' marker and tenant-sourced templates carry a domain. Only
+# owner/repo values may read as a GitHub sync.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Test-CIPPRepoSource.ps1')
+}
+
+Describe 'Test-CIPPRepoSource' {
+    It 'accepts an owner/repo source' {
+        Test-CIPPRepoSource -Source 'CyberDrain/CIPP-Templates' | Should -BeTrue
+        Test-CIPPRepoSource -Source 'j0eyv/Conditional.Access-Baseline_v2' | Should -BeTrue
+    }
+
+    It 'rejects the baseline migration marker' {
+        Test-CIPPRepoSource -Source 'StandardsTemplateV2:9c4c44c0-7e0d-4e5d-a018-dd64619c49bc' | Should -BeFalse
+    }
+
+    It 'rejects tenant domains, empty and null' {
+        Test-CIPPRepoSource -Source 'contoso.onmicrosoft.com' | Should -BeFalse
+        Test-CIPPRepoSource -Source '' | Should -BeFalse
+        Test-CIPPRepoSource -Source $null | Should -BeFalse
+    }
+}
diff --git a/Tests/GraphHelper/Get-CIPPActiveAlertSnoozes.Tests.ps1 b/Tests/GraphHelper/Get-CIPPActiveAlertSnoozes.Tests.ps1
new file mode 100644
index 0000000000000..593c4910b3df4
--- /dev/null
+++ b/Tests/GraphHelper/Get-CIPPActiveAlertSnoozes.Tests.ps1
@@ -0,0 +1,87 @@
+# Pester tests for Get-CIPPActiveAlertSnoozes.
+# Timed snoozes are active until their SnoozeUntil passes; "until resolved" snoozes are always
+# active; rows with no usable expiry (the old -1 "forever" value included) are treated as lapsed
+# and cleaned up rather than muting an alert indefinitely.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    function Get-CIPPTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Context, $TableName, $Filter, $Property) }
+    function Remove-CIPPAzDataTableEntity { param($Context, $TableName, $Entity, [switch]$Force) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Get-CIPPActiveAlertSnoozes.ps1')
+
+    function New-Snooze {
+        param($Hash, $SnoozeUntil, $UntilResolved = 'False')
+        [pscustomobject]@{
+            PartitionKey  = 'Get-CIPPAlertSomething'
+            RowKey        = "contoso.onmicrosoft.com-$Hash"
+            Tenant        = 'contoso.onmicrosoft.com'
+            ContentHash   = $Hash
+            SnoozeUntil   = [string]$SnoozeUntil
+            UntilResolved = $UntilResolved
+        }
+    }
+}
+
+Describe 'Get-CIPPActiveAlertSnoozes' {
+    BeforeEach {
+        $script:Removed = [System.Collections.Generic.List[object]]::new()
+        Mock Get-CIPPTable { @{ TableName = 'AlertSnooze' } }
+        Mock ConvertTo-CIPPODataFilterValue { $Value }
+        Mock Remove-CIPPAzDataTableEntity { $script:Removed.Add($Entity) }
+    }
+
+    It 'keeps timed snoozes that have not expired and until-resolved snoozes' {
+        $Now = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
+        Mock Get-CIPPAzDataTableEntity {
+            @(
+                (New-Snooze -Hash 'future' -SnoozeUntil ($Now + 86400)),
+                (New-Snooze -Hash 'past' -SnoozeUntil ($Now - 3600)),
+                (New-Snooze -Hash 'untilresolved' -SnoozeUntil 0 -UntilResolved 'True')
+            )
+        }
+
+        $Active = Get-CIPPActiveAlertSnoozes -CmdletName 'Get-CIPPAlertSomething' -TenantFilter 'contoso.onmicrosoft.com'
+
+        $Active.Keys | Should -Contain 'future'
+        $Active.Keys | Should -Contain 'untilresolved'
+        $Active.Keys | Should -Not -Contain 'past'
+        $script:Removed.Count | Should -Be 0
+    }
+
+    It 'treats the legacy forever value as lapsed and removes it' {
+        Mock Get-CIPPAzDataTableEntity { @(New-Snooze -Hash 'forever' -SnoozeUntil -1) }
+
+        $Active = Get-CIPPActiveAlertSnoozes -CmdletName 'Get-CIPPAlertSomething' -TenantFilter 'contoso.onmicrosoft.com'
+
+        $Active.Count | Should -Be 0
+        $script:Removed.Count | Should -Be 1
+        $script:Removed[0].RowKey | Should -Be 'contoso.onmicrosoft.com-forever'
+    }
+
+    It 'removes timed snoozes that expired more than 30 days ago' {
+        $Now = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
+        Mock Get-CIPPAzDataTableEntity { @(New-Snooze -Hash 'ancient' -SnoozeUntil ($Now - 40 * 86400)) }
+
+        $Active = Get-CIPPActiveAlertSnoozes -CmdletName 'Get-CIPPAlertSomething' -TenantFilter 'contoso.onmicrosoft.com'
+
+        $Active.Count | Should -Be 0
+        $script:Removed.Count | Should -Be 1
+    }
+
+    It 'ignores rows for other tenants' {
+        $Now = [int64](([datetime]::UtcNow) - (Get-Date '1/1/1970')).TotalSeconds
+        Mock Get-CIPPAzDataTableEntity {
+            $Row = New-Snooze -Hash 'other' -SnoozeUntil ($Now + 86400)
+            $Row.Tenant = 'fabrikam.onmicrosoft.com'
+            @($Row)
+        }
+
+        $Active = Get-CIPPActiveAlertSnoozes -CmdletName 'Get-CIPPAlertSomething' -TenantFilter 'contoso.onmicrosoft.com'
+
+        $Active.Count | Should -Be 0
+    }
+}
diff --git a/Tests/GraphHelper/Get-CippSamPermissions.Grants.Tests.ps1 b/Tests/GraphHelper/Get-CippSamPermissions.Grants.Tests.ps1
new file mode 100644
index 0000000000000..d51002eeebb65
--- /dev/null
+++ b/Tests/GraphHelper/Get-CippSamPermissions.Grants.Tests.ps1
@@ -0,0 +1,159 @@
+# The permission diff must reflect what is actually granted on the CIPP-SAM enterprise
+# application, not what CIPP recorded that it applied. An instance with no admin consent
+# reported "all the required permissions" while every Exchange call returned 401.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Get-CippSamPermissions.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Get-CippSamPermissions.ps1 under Modules/' }
+
+    function Get-CippTable { param($tablename) @{ Context = 'stub' } }
+    function Get-CippAzDataTableEntity { param($Context, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function New-GraphGetRequest { param($Uri, $tenantid, $NoAuthCheck, $AsApp) }
+    function New-GraphBulkRequest { param($tenantid, $Requests, $NoAuthCheck, $asapp) }
+    function Write-LogMessage { param($message, $tenant, $API, $sev, $Headers, $LogData) }
+
+    . $FunctionPath
+
+    $script:GraphAppId = '00000003-0000-0000-c000-000000000000'
+    $script:GraphSpId = 'aaaaaaaa-0000-0000-0000-000000000001'
+    $script:SamAppId = 'bbbbbbbb-0000-0000-0000-000000000002'
+    $script:SamSpId = 'cccccccc-0000-0000-0000-000000000003'
+    $script:ScopeId = '11111111-1111-1111-1111-111111111111'
+    $script:ScopeName = 'Directory.Read.All'
+    $script:RoleId = '22222222-2222-2222-2222-222222222222'
+    $script:RoleName = 'Directory.ReadWrite.All'
+
+    $script:ConfigRoot = Join-Path ([IO.Path]::GetTempPath()) ("samgrants-" + [guid]::NewGuid())
+    $null = New-Item -ItemType Directory -Path (Join-Path $script:ConfigRoot 'Config') -Force
+    @{
+        requiredResourceAccess = @(
+            @{
+                resourceAppId  = $script:GraphAppId
+                resourceAccess = @(
+                    @{ id = $script:ScopeId; type = 'Scope' },
+                    @{ id = $script:RoleId; type = 'Role' }
+                )
+            }
+        )
+    } | ConvertTo-Json -Depth 10 | Set-Content -Path (Join-Path $script:ConfigRoot 'Config/SAMManifest.json')
+    '[]' | Set-Content -Path (Join-Path $script:ConfigRoot 'Config/AdditionalPermissions.json')
+
+    $env:CIPPRootPath = $script:ConfigRoot
+    $env:TenantID = '00000000-0000-0000-0000-000000000001'
+    $env:ApplicationID = $script:SamAppId
+}
+
+AfterAll {
+    Remove-Item -Path $script:ConfigRoot -Recurse -Force -ErrorAction SilentlyContinue
+}
+
+Describe 'Get-CippSamPermissions grant diff' {
+    BeforeEach {
+        $script:CippSamPermissionsCache = $null
+        $script:CippSamPermissionsCacheTime = $null
+        # Grants returned for the CIPP-SAM service principal; each test sets these.
+        $script:AppRoleAssignments = @()
+        $script:OAuthGrants = @()
+        $script:GrantLookupThrows = $false
+
+        Mock -CommandName Get-CippTable -MockWith { @{ Context = 'stub' } }
+        Mock -CommandName Get-CippAzDataTableEntity -MockWith { $null }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName New-GraphBulkRequest -MockWith {
+            @(
+                @{
+                    body = [pscustomobject]@{
+                        appId                     = $script:GraphAppId
+                        displayName               = 'Microsoft Graph'
+                        appRoles                  = @([pscustomobject]@{ id = $script:RoleId; value = $script:RoleName })
+                        publishedPermissionScopes = @([pscustomobject]@{ id = $script:ScopeId; value = $script:ScopeName })
+                    }
+                }
+            )
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            if ($Uri -match 'servicePrincipals\?') {
+                return @(
+                    [pscustomobject]@{ id = $script:GraphSpId; appId = $script:GraphAppId; displayName = 'Microsoft Graph' },
+                    [pscustomobject]@{ id = $script:SamSpId; appId = $script:SamAppId; displayName = 'CIPP-SAM' }
+                )
+            }
+            if ($script:GrantLookupThrows) { throw 'Request failed with status code Forbidden' }
+            if ($Uri -match "servicePrincipals\(appId='") { return [pscustomobject]@{ id = $script:SamSpId } }
+            if ($Uri -match 'appRoleAssignments') { return $script:AppRoleAssignments }
+            if ($Uri -match 'oauth2PermissionGrants') { return $script:OAuthGrants }
+            return @()
+        }
+    }
+
+    It 'reports nothing missing when both permissions are granted on the service principal' {
+        $script:AppRoleAssignments = @([pscustomobject]@{ resourceId = $script:GraphSpId; appRoleId = $script:RoleId })
+        $script:OAuthGrants = @([pscustomobject]@{ resourceId = $script:GraphSpId; scope = $script:ScopeName })
+
+        $Result = Get-CippSamPermissions
+
+        $Result.MissingPermissions.PSObject.Properties.Name | Should -BeNullOrEmpty
+        $Result.GrantCheckFailed | Should -Not -BeTrue
+    }
+
+    It 'reports the delegated permission as missing when consent was never granted' {
+        $script:AppRoleAssignments = @([pscustomobject]@{ resourceId = $script:GraphSpId; appRoleId = $script:RoleId })
+        $script:OAuthGrants = @()
+
+        $Result = Get-CippSamPermissions
+
+        $Missing = $Result.MissingPermissions.($script:GraphAppId)
+        @($Missing.delegatedPermissions.value) | Should -Contain $script:ScopeName
+        @($Missing.applicationPermissions) | Should -BeNullOrEmpty
+    }
+
+    It 'reports the application permission as missing when its app role is not assigned' {
+        $script:AppRoleAssignments = @()
+        $script:OAuthGrants = @([pscustomobject]@{ resourceId = $script:GraphSpId; scope = $script:ScopeName })
+
+        $Result = Get-CippSamPermissions
+
+        $Missing = $Result.MissingPermissions.($script:GraphAppId)
+        @($Missing.applicationPermissions.id) | Should -Contain $script:RoleId
+        @($Missing.delegatedPermissions) | Should -BeNullOrEmpty
+    }
+
+    It 'reports everything missing when the app has no consent at all' {
+        $Result = Get-CippSamPermissions
+
+        $Missing = $Result.MissingPermissions.($script:GraphAppId)
+        @($Missing.delegatedPermissions.value) | Should -Contain $script:ScopeName
+        @($Missing.applicationPermissions.id) | Should -Contain $script:RoleId
+    }
+
+    It 'surfaces a grant lookup failure instead of reporting a clean result' {
+        $script:GrantLookupThrows = $true
+
+        $Result = Get-CippSamPermissions
+
+        $Result.GrantCheckFailed | Should -BeTrue
+        $Result.GrantCheckError | Should -Not -BeNullOrEmpty
+    }
+
+    It 'lists grants that are not in the effective set as extras' {
+        $ExtraScope = 'Mail.Read'
+        $script:AppRoleAssignments = @([pscustomobject]@{ resourceId = $script:GraphSpId; appRoleId = $script:RoleId })
+        $script:OAuthGrants = @([pscustomobject]@{ resourceId = $script:GraphSpId; scope = "$($script:ScopeName) $ExtraScope" })
+
+        $Result = Get-CippSamPermissions
+
+        @($Result.PartnerAppDiff.($script:GraphAppId).extraDelegatedPermissions.value) | Should -Contain $ExtraScope
+    }
+
+    It 'skips the grant lookup entirely when called with -NoDiff' {
+        $script:GrantLookupThrows = $true
+
+        $Result = Get-CippSamPermissions -NoDiff
+
+        $Result.MissingPermissions.PSObject.Properties.Name | Should -BeNullOrEmpty
+        $Result.GrantCheckFailed | Should -Not -BeTrue
+    }
+}
diff --git a/Tests/GraphHelper/Get-Tenants.CleanOld.Tests.ps1 b/Tests/GraphHelper/Get-Tenants.CleanOld.Tests.ps1
new file mode 100644
index 0000000000000..4d1c4e549a6ec
--- /dev/null
+++ b/Tests/GraphHelper/Get-Tenants.CleanOld.Tests.ps1
@@ -0,0 +1,109 @@
+# The CleanOld branch removes tenants that dropped out of GDAP. It used to query GDAP
+# relationships unconditionally and log a Critical error on an empty result, even when there
+# were no GDAP-managed tenants on record to reconcile - always true for a direct-tenant
+# deployment, so it logged a false Critical every run of the nightly cleanup timer.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    function Get-CippTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property) }
+    function Get-AzDataTableEntity { param($Context, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Add-AzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Remove-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function New-GraphGetRequest { param($uri, $tenantid, $NoAuthCheck) }
+    function Write-LogMessage { param($API, $tenant, $message, $Sev, $LogData, $headers, $level) }
+    function Get-CippException { param($Exception) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Get-Tenants.ps1')
+
+    $script:OrigRefreshToken = $env:RefreshToken
+    $script:OrigTenantID = $env:TenantID
+    $env:RefreshToken = 'pester'
+    $env:TenantID = 'ffffffff-ffff-ffff-ffff-ffffffffffff'
+
+    $script:GuidA = '11111111-1111-1111-1111-111111111111'
+}
+
+AfterAll {
+    $env:RefreshToken = $script:OrigRefreshToken
+    $env:TenantID = $script:OrigTenantID
+}
+
+Describe 'Get-Tenants -CleanOld' {
+    BeforeEach {
+        # 'owntenant' and a non-empty cache read keep the unrelated GDAP-refresh and
+        # owntenant-fallback blocks out of the way, so only the CleanOld branch is exercised.
+        $script:GdapManagedTenants = @()
+        $script:GDAPRelationships = @()
+
+        Mock Get-CippTable { @{} }
+        Mock Write-LogMessage {}
+        Mock Get-CippException { @{} }
+        Mock Remove-CIPPAzDataTableEntity {}
+        Mock Get-CIPPAzDataTableEntity {
+            if ([string]::IsNullOrEmpty($Filter)) { return [PSCustomObject]@{ state = 'owntenant' } }             # tenantMode
+            if ($Filter -like '*Excluded eq true*') { return $null }                                              # skip list
+            if ($Filter -like '*delegatedPrivilegeStatus ne*') { return $script:GdapManagedTenants }              # CleanOld's own read
+            return @([PSCustomObject]@{ RowKey = $script:GuidA; customerId = $script:GuidA; displayName = 'Contoso'; defaultDomainName = 'contoso.com' })
+        }
+        Mock New-GraphGetRequest {
+            if ($uri -like '*delegatedAdminRelationships*') { return $script:GDAPRelationships }
+            throw "unexpected Graph call: $uri"
+        }
+    }
+
+    It 'does not query GDAP relationships when no GDAP-managed tenants are on record' {
+        $script:GdapManagedTenants = @()
+
+        Get-Tenants -CleanOld | Out-Null
+
+        Should -Invoke New-GraphGetRequest -Times 0 -Exactly
+        Should -Invoke Write-LogMessage -Times 0 -Exactly
+    }
+
+    It 'removes a GDAP-managed tenant that dropped out of the relationships list' {
+        $GuidB = '22222222-2222-2222-2222-222222222222'
+        $script:GdapManagedTenants = @([PSCustomObject]@{ customerId = $GuidB })
+        $script:GDAPRelationships = @()
+
+        try { Get-Tenants -CleanOld | Out-Null } catch { }
+
+        Should -Invoke New-GraphGetRequest -ParameterFilter { $uri -like '*delegatedAdminRelationships*' } -Times 1 -Exactly
+    }
+
+    It 'still throws and logs Critical when GDAP-managed tenants exist but the relationships call comes back empty' {
+        $GuidB = '22222222-2222-2222-2222-222222222222'
+        $script:GdapManagedTenants = @([PSCustomObject]@{ customerId = $GuidB })
+        $script:GDAPRelationships = @()
+
+        { Get-Tenants -CleanOld } | Should -Throw
+
+        # Once from the try block's own check, once more from the outer catch after the throw.
+        Should -Invoke Write-LogMessage -ParameterFilter { $Sev -eq 'Critical' } -Times 2 -Exactly
+    }
+
+    It 'removes tenants no longer present in an active GDAP relationships list' {
+        $GuidB = '22222222-2222-2222-2222-222222222222'
+        $GuidC = '33333333-3333-3333-3333-333333333333'
+        $script:GdapManagedTenants = @(
+            [PSCustomObject]@{ customerId = $GuidB },
+            [PSCustomObject]@{ customerId = $GuidC }
+        )
+        $script:GDAPRelationships = @(
+            [PSCustomObject]@{
+                displayName        = 'GDAP-Fabrikam'
+                customer           = [PSCustomObject]@{ tenantId = $GuidB; displayName = 'Fabrikam' }
+                autoExtendDuration = 'P180D'
+                endDateTime        = (Get-Date).AddYears(1).ToString('o')
+            }
+        )
+
+        Get-Tenants -CleanOld | Out-Null
+
+        Should -Invoke Remove-CIPPAzDataTableEntity -ParameterFilter { $Entity.customerId -eq $GuidC } -Times 1 -Exactly
+        Should -Invoke Remove-CIPPAzDataTableEntity -ParameterFilter { $Entity.customerId -eq $GuidB } -Times 0 -Exactly
+    }
+}
diff --git a/Tests/GraphHelper/Get-Tenants.RefreshLoop.Tests.ps1 b/Tests/GraphHelper/Get-Tenants.RefreshLoop.Tests.ps1
index 916947d3e2fbe..2a4f05774e2a8 100644
--- a/Tests/GraphHelper/Get-Tenants.RefreshLoop.Tests.ps1
+++ b/Tests/GraphHelper/Get-Tenants.RefreshLoop.Tests.ps1
@@ -43,7 +43,6 @@ BeforeAll {
             initialDomainName        = $Initial
             delegatedPrivilegeStatus = 'granularDelegatedAdminPrivileges'
             Excluded                 = $false
-            GraphErrorCount          = 0
             LastGraphError           = ''
             RequiresRefresh          = $false
             LastRefresh              = $LastRefresh
@@ -106,6 +105,18 @@ Describe 'Get-Tenants refresh loop' {
         }
     }
 
+    Context 'default cache read' {
+        It 'does not hide tenants behind an error-count threshold' {
+            # The count is never reset for direct tenants, so a threshold filter drops them for good.
+            $script:RowsByKey[$script:GuidA] = New-CachedRow -Guid $script:GuidA -DisplayName 'Contoso' -Default 'contoso.com' -Initial 'contoso.onmicrosoft.com' -LastRefresh ([DateTimeOffset]::UtcNow)
+
+            $Result = Get-Tenants
+
+            Should -Invoke Get-CIPPAzDataTableEntity -ParameterFilter { $Filter -like '*GraphErrorCount*' } -Times 0 -Exactly
+            $Result.customerId | Should -Be $script:GuidA
+        }
+    }
+
     Context 'bulk refresh (no TenantFilter)' {
         BeforeEach {
             $script:Relationships = @(New-Relationship -Guid $script:GuidA -DisplayName 'Contoso')
diff --git a/Tests/GraphHelper/New-GraphBulkRequest.Paging.Tests.ps1 b/Tests/GraphHelper/New-GraphBulkRequest.Paging.Tests.ps1
index 293b0d8dbee2a..4b9ebb9cfb161 100644
--- a/Tests/GraphHelper/New-GraphBulkRequest.Paging.Tests.ps1
+++ b/Tests/GraphHelper/New-GraphBulkRequest.Paging.Tests.ps1
@@ -104,12 +104,64 @@ Describe 'New-GraphBulkRequest continuation paging' {
 
     It 'leaves items that never paged untouched' {
         $script:Replies.Enqueue((New-BatchReply @((New-PageItem -Id 'cp' -Values @(@{ id = 'p1' })), (New-PageItem -Id 'other' -Status 429 -Error 'throttled'))))
+        # the throttled first page is sent again twice (see the first-page retry below) and stays throttled
+        foreach ($i in 1..2) { $script:Replies.Enqueue((New-BatchReply (New-PageItem -Id 'other' -Status 429 -Error 'throttled'))) }
 
         $Result = @(New-GraphBulkRequest -Requests ($script:Requests + @(@{ id = 'other'; url = 'x'; method = 'GET' })) -tenantid 'contoso.onmicrosoft.com' -asapp $true)
 
         $Result.Count | Should -Be 2
         ($Result | Where-Object id -eq 'cp').PSObject.Properties['PagingIncomplete'] | Should -BeNullOrEmpty
-        ($Result | Where-Object id -eq 'other').status | Should -Be 429
-        $script:Calls.Count | Should -Be 1
+        ($Result | Where-Object id -eq 'other').status | Should -Be 429 -Because 'a first page that stays throttled after the retries is returned as it came back'
+        $script:Calls.Count | Should -Be 3
+    }
+}
+
+Describe 'New-GraphBulkRequest first-page retry' {
+    BeforeEach {
+        $script:Calls = [System.Collections.Generic.List[string]]::new()
+        $script:Replies = [System.Collections.Generic.Queue[object]]::new()
+        Mock Get-AuthorisedRequest { $true }
+        Mock Get-GraphToken { @{} }
+        Mock Get-CippTable { @{} }
+        Mock Get-CIPPAzDataTableEntity { $null }
+        Mock Update-AzDataTableEntity {}
+        Mock Start-Sleep {}
+        Mock Invoke-CIPPRestMethod {
+            $script:Calls.Add($Body)
+            if ($script:Replies.Count -gt 0) { $script:Replies.Dequeue() } else { New-BatchReply @() }
+        }
+        $script:Requests = @(
+            @{ id = 'Target'; url = 'auditLogs/directoryAudits?$top=999'; method = 'GET' }
+            @{ id = 'Actor'; url = 'auditLogs/directoryAudits?$filter=x'; method = 'GET' }
+        )
+    }
+
+    It 'sends a throttled first page again, alone, after the Retry-After it asked for' {
+        $Throttled = New-PageItem -Id 'Target' -Status 429 -Headers ([pscustomobject]@{ 'Retry-After' = '7' }) -Error 'This request is throttled.'
+        $script:Replies.Enqueue((New-BatchReply @($Throttled, (New-PageItem -Id 'Actor' -Values @(@{ id = 'a1' })))))
+        $script:Replies.Enqueue((New-BatchReply (New-PageItem -Id 'Target' -Values @(@{ id = 't1' }))))
+
+        $Result = @(New-GraphBulkRequest -Requests $script:Requests -tenantid 'contoso.onmicrosoft.com' -asapp $true)
+
+        ($Result | Where-Object id -eq 'Target').status | Should -Be 200
+        @(($Result | Where-Object id -eq 'Target').body.value).id | Should -Be @('t1')
+        @(($Result | Where-Object id -eq 'Actor').body.value).id | Should -Be @('a1')
+        $script:Calls.Count | Should -Be 2
+        $script:Calls[1] | Should -Match 'directoryAudits\?\$top=999'
+        $script:Calls[1] | Should -Not -Match 'filter=x' -Because 'only the throttled item is sent again'
+        Should -Invoke Start-Sleep -Times 1 -Exactly -ParameterFilter { $Seconds -eq 7 }
+    }
+
+    It 'gives up after two retries and returns the throttled page, and never retries a real error' {
+        $Requests = @($script:Requests[0], @{ id = 'Denied'; url = 'x'; method = 'GET' })
+        $script:Replies.Enqueue((New-BatchReply @((New-PageItem -Id 'Target' -Status 429 -Error 'throttled'), (New-PageItem -Id 'Denied' -Status 403 -Error 'Forbidden'))))
+        foreach ($i in 1..2) { $script:Replies.Enqueue((New-BatchReply (New-PageItem -Id 'Target' -Status 429 -Error 'throttled'))) }
+
+        $Result = @(New-GraphBulkRequest -Requests $Requests -tenantid 'contoso.onmicrosoft.com' -asapp $true)
+
+        ($Result | Where-Object id -eq 'Target').status | Should -Be 429
+        ($Result | Where-Object id -eq 'Denied').status | Should -Be 403
+        $script:Calls.Count | Should -Be 3
+        @($script:Calls | Where-Object { $_ -match '"Denied"' }).Count | Should -Be 1 -Because 'a 403 is not transient'
     }
 }
diff --git a/Tests/GraphHelper/Test-CIPPGraphEndpointBlocked.Tests.ps1 b/Tests/GraphHelper/Test-CIPPGraphEndpointBlocked.Tests.ps1
new file mode 100644
index 0000000000000..460df53055278
--- /dev/null
+++ b/Tests/GraphHelper/Test-CIPPGraphEndpointBlocked.Tests.ps1
@@ -0,0 +1,477 @@
+# Test-CIPPGraphEndpointBlocked — customer-content Graph path blocklist for arbitrary Graph proxies.
+using namespace System.Net
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $env:CIPPRootPath = $RepoRoot
+    $script:CippGraphEndpointBlocklist = $null
+
+    if (-not ('HttpResponseContext' -as [type])) {
+        Add-Type -TypeDefinition 'public class HttpResponseContext { public object StatusCode; public object Body; public string ContentType; public object Headers; }'
+    }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Test-CIPPGraphEndpointBlocked.ps1')
+}
+
+Describe 'Test-CIPPGraphEndpointBlocked' {
+    BeforeEach {
+        $script:CippGraphEndpointBlocklist = $null
+    }
+
+    Context 'blocked paths' {
+        It 'blocks OneDrive drive item paths' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users/user@contoso.com/drive/items/ABC' | Should -BeTrue
+        }
+
+        It 'blocks full Graph drive URIs' {
+            Test-CIPPGraphEndpointBlocked -Uri 'https://graph.microsoft.com/v1.0/users/x/drive/root/children' | Should -BeTrue
+        }
+
+        It 'blocks mailbox messages' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users/x/messages' | Should -BeTrue
+        }
+
+        It 'blocks mail MIME $value' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users/x/messages/y/$value' | Should -BeTrue
+        }
+
+        It 'blocks chats' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users/x/chats' | Should -BeTrue
+        }
+
+        It 'blocks calendar events' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users/x/events' | Should -BeTrue
+        }
+
+        It 'blocks group conversations' {
+            Test-CIPPGraphEndpointBlocked -Uri 'groups/x/conversations' | Should -BeTrue
+        }
+
+        It 'blocks /content downloads' {
+            Test-CIPPGraphEndpointBlocked -Uri 'drives/x/items/y/content' | Should -BeTrue
+        }
+
+        It 'blocks OData key syntax on <Uri>' -ForEach @(
+            @{ Uri = "users/x/messages('m1')" }
+            @{ Uri = "users/x/events('e1')" }
+            @{ Uri = "users/x/contacts('c1')" }
+            @{ Uri = "users/x/chats('c1')" }
+            @{ Uri = "drives('b!abc')/root/children" }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'blocks percent-encoded path <Uri>' -ForEach @(
+            @{ Uri = 'users/x/%64rive/items/y' }
+            @{ Uri = 'users/x/drive%2Fitems' }
+            @{ Uri = 'users/x/%256Dessages' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'blocks alternate driveItem route <Uri>' -ForEach @(
+            @{ Uri = 'sites/s/lists/l/items/i/driveItem' }
+            @{ Uri = 'sites/s/lists/l/items/i/driveItem/thumbnails' }
+            @{ Uri = 'shares/u!abc/driveItem' }
+            @{ Uri = 'shares/u!abc/root' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'blocks $expand in the query string of <Uri>' -ForEach @(
+            @{ Uri = 'sites/s/lists/l/items?$expand=driveItem' }
+            @{ Uri = 'sites/s/lists/l/items?$expand=fields,driveItem($select=id)' }
+            @{ Uri = 'users/x/mailFolders/inbox?$expand=messages' }
+            @{ Uri = 'sites/s/lists/l/items?%24expand=driveItem' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'blocks personal contacts <Uri>' -ForEach @(
+            @{ Uri = 'users/x/contacts' }
+            @{ Uri = 'me/contacts' }
+            @{ Uri = 'users/x/contactFolders/f/contacts/c' }
+            @{ Uri = 'users/x?$expand=contacts' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'blocks user-content endpoint <Uri> (<Id>)' -ForEach @(
+            @{ Uri = 'users/x/todo/lists/l/tasks'; Id = 'todo-tasks' }
+            @{ Uri = "users/x/todo/lists('l')/tasks/t/checklistItems"; Id = 'todo-tasks' }
+            @{ Uri = 'users/x/todo/lists?$expand=tasks'; Id = 'todo-tasks' }
+            @{ Uri = 'users/x/planner/tasks'; Id = 'planner-tasks' }
+            @{ Uri = 'planner/tasks/t/details'; Id = 'planner-tasks' }
+            @{ Uri = 'planner/plans/p/buckets/b/tasks'; Id = 'planner-tasks' }
+            @{ Uri = 'planner/plans/p?$expand=tasks'; Id = 'planner-tasks' }
+            @{ Uri = 'sites/s/pages'; Id = 'site-pages' }
+            @{ Uri = 'sites/s/pages/p/microsoft.graph.sitePage?$expand=canvasLayout'; Id = 'site-pages' }
+            @{ Uri = 'sites/s/lists/l/items'; Id = 'list-items' }
+            @{ Uri = "sites/s/lists('l')/items('1')/fields"; Id = 'list-items' }
+            @{ Uri = 'sites/s/lists/l?$expand=items'; Id = 'list-items' }
+            @{ Uri = 'copilot/users/u/interactionHistory/getAllEnterpriseInteractions'; Id = 'copilot-interactions' }
+            @{ Uri = 'users/u/aiInteractionHistory/getAllEnterpriseInteractions'; Id = 'copilot-interactions' }
+            @{ Uri = 'teams/t/channels/getAllMessages'; Id = 'mail-messages' }
+            @{ Uri = 'users/u/chats/getAllRetainedMessages'; Id = 'mail-messages' }
+            @{ Uri = 'teams/t/channels/getAllRetainedMessages'; Id = 'mail-messages' }
+            @{ Uri = 'users/u/mailFolders/inbox/messages/m/attachments'; Id = 'mail-messages' }
+            @{ Uri = 'groups/g/threads/t/posts/p/attachments'; Id = 'mail-attachments' }
+            @{ Uri = "users/u/messages('m')/attachments('a')/content"; Id = 'file-content' }
+            @{ Uri = 'users/u/events/e/attachments/a/content'; Id = 'file-content' }
+            @{ Uri = 'users/u/adhocCalls/c/transcripts/t/metadataContent'; Id = 'adhoc-calls' }
+            @{ Uri = 'users/u/adhocCalls/getAllTranscripts'; Id = 'adhoc-calls' }
+            @{ Uri = 'users/u/adhocCalls/c/recordings'; Id = 'adhoc-calls' }
+            @{ Uri = 'users/u/insights/used'; Id = 'document-insights' }
+            @{ Uri = 'me/insights/trending/i/resource'; Id = 'document-insights' }
+            @{ Uri = 'users/u?$expand=insights'; Id = 'document-insights' }
+            @{ Uri = 'external/connections/contosohr/items/TSP228082938'; Id = 'external-items' }
+            @{ Uri = 'external/connections/c?$expand=items'; Id = 'external-items' }
+            @{ Uri = "external/connections('c')/items('i')"; Id = 'external-items' }
+            @{ Uri = 'solutions/bookingBusinesses/b@contoso.com/customers'; Id = 'bookings-customers' }
+            @{ Uri = "solutions/bookingBusinesses('b')/appointments/a"; Id = 'bookings-customers' }
+            @{ Uri = 'solutions/virtualEvents/webinars/w/registrations'; Id = 'virtual-event-attendees' }
+            @{ Uri = 'solutions/virtualEvents/townhalls/t/sessions/s/attendanceReports'; Id = 'virtual-event-attendees' }
+            @{ Uri = "users/u/calendar/reminderView(startDateTime='2026-01-01',endDateTime='2026-02-01')"; Id = 'calendar-events' }
+            @{ Uri = 'users/u/outlook/taskFolders/f/tasks'; Id = 'todo-tasks' }
+            @{ Uri = 'users/u/planner/myDayTasks'; Id = 'planner-tasks' }
+            @{ Uri = 'users/u/planner/all/delta'; Id = 'planner-tasks' }
+            @{ Uri = 'sites/s/items/i'; Id = 'list-items' }
+            @{ Uri = 'users/u/chats:'; Id = 'chats' }
+            @{ Uri = 'users/u/people'; Id = 'people' }
+            @{ Uri = 'security/cases/ediscoveryCases/c/operations/o'; Id = 'ediscovery' }
+        ) {
+            { Test-CIPPGraphEndpointBlocked -Uri $Uri -Throw } | Should -Throw -ExpectedMessage "*($Id)*"
+        }
+
+        It 'blocks URI normalisation trick <Uri>' -ForEach @(
+            @{ Uri = 'users/x/messages#' }
+            @{ Uri = 'users/x/drive#frag' }
+            @{ Uri = 'https://graph.microsoft.com:443/beta/users/x/chats#' }
+            @{ Uri = 'https://graph.microsoft.com/beta/users/x\drive\items\y' }
+            @{ Uri = 'https://graph.microsoft.com/beta/x/../shares/u!abc/root' }
+            @{ Uri = 'users/x\drive\items\y' }
+            @{ Uri = 'x/../shares/u!abc/root' }
+            @{ Uri = './shares/u!abc/root' }
+            @{ Uri = 'users/x/messages.' }
+            @{ Uri = 'users/x/messages%20' }
+            @{ Uri = 'users/x/drive. /items' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'blocks encoding trick <Uri>' -ForEach @(
+            @{ Uri = 'sites/s/lists/l?$expand=fields, driveItem' }
+            @{ Uri = 'sites/s/lists/l?$expand=fields,+driveItem' }
+            @{ Uri = 'sites/s?$expand=%09driveItem' }
+            @{ Uri = 'sites/s?$expand=driveItem%26x%3D1' }
+            @{ Uri = 'users/x?%20$expand=messages' }
+            @{ Uri = 'users/x??$expand=messages' }
+            @{ Uri = 'users/x?%2524EXPAND=messages' }
+            @{ Uri = 'users/x/%2525252525256Dessages' }
+            @{ Uri = 'users/x/drive%3F' }
+            @{ Uri = 'users/x/drive%23' }
+            @{ Uri = 'users/x/%u006Dessages' }
+            @{ Uri = 'users/x/messages%00' }
+            @{ Uri = 'users/x/mess%E2%80%8Bages' }
+            @{ Uri = "users/x/messages.('m')" }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'only exempts allowed prefixes as whole segments <Uri>' -ForEach @(
+            @{ Uri = 'users/u/mailFolders/xserviceAnnouncement/messages' }
+            @{ Uri = 'users/u/serviceAnnouncement/messages' }
+            @{ Uri = 'blueprint/shares/u!abc/root' }
+            @{ Uri = 'sites/s/xphoto/$value' }
+            @{ Uri = 'sites/s/x/48x48/$value' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeTrue
+        }
+
+        It 'fails closed on input that makes a pattern backtrack' {
+            $Uri = 'sites/' + ('lists(a)/' * 20000) + 'x'
+            { Test-CIPPGraphEndpointBlocked -Uri $Uri -Throw } | Should -Throw -ExpectedMessage '*could not be checked in time*'
+        }
+
+        It 'blocks $expand passed separately via -Expand' {
+            Test-CIPPGraphEndpointBlocked -Uri 'sites/s' -Expand 'lists,driveItem' | Should -BeTrue
+        }
+    }
+
+    Context 'allowed paths' {
+        It 'allows directory users list' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users' | Should -BeFalse
+        }
+
+        It 'allows Message Center messages' {
+            Test-CIPPGraphEndpointBlocked -Uri 'admin/serviceAnnouncement/messages' | Should -BeFalse
+        }
+
+        It 'allows user profile photo $value' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users/x/photo/$value' | Should -BeFalse
+        }
+
+        It 'allows sized profile photo $value' {
+            Test-CIPPGraphEndpointBlocked -Uri 'users/x/photos/48x48/$value' | Should -BeFalse
+        }
+
+        It 'allows contentTypes (not /content)' {
+            Test-CIPPGraphEndpointBlocked -Uri 'sites/x/contentTypes' | Should -BeFalse
+        }
+
+        It 'allows empty Uri' {
+            Test-CIPPGraphEndpointBlocked -Uri '' | Should -BeFalse
+        }
+
+        It 'allows a harmless $expand' {
+            Test-CIPPGraphEndpointBlocked -Uri 'groups?$expand=members($select=id)' -Expand 'owners' | Should -BeFalse
+        }
+
+        It 'allows ordinary queries with spaces and functions <Uri>' -ForEach @(
+            @{ Uri = "users?`$filter=startswith(displayName,'drive')&`$select=id,displayName" }
+            @{ Uri = 'groups?$expand=members($select=id, displayName)' }
+            @{ Uri = 'users/x?$expand=manager($levels=max;$select=id)' }
+            @{ Uri = "deviceManagement/managedDevices?`$filter=operatingSystem eq 'Windows'" }
+            @{ Uri = "reports/getOffice365ActiveUserDetail(period='D7')" }
+            @{ Uri = 'users?$search="displayName:messages"' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeFalse
+        }
+
+        It 'allows admin and device-secret endpoints <Uri>' -ForEach @(
+            @{ Uri = 'admin/people/pronouns' }
+            @{ Uri = 'deviceManagement/autopilotEvents' }
+            @{ Uri = 'deviceManagement/managedDevices/d/detectedApps' }
+            @{ Uri = 'groups/g/transitiveMembers/microsoft.graph.group?$select=id,displayName' }
+            @{ Uri = 'users/u/authentication/methods?$top=99' }
+            @{ Uri = "reports/getMailboxUsageDetail(period='D7')" }
+            @{ Uri = 'directoryRoles/roleTemplateId=62e90394-69f5-4237-9190-012177145e10/members' }
+            @{ Uri = 'organization/o/branding' }
+            @{ Uri = 'informationProtection/bitlocker/recoveryKeys/k?$select=key' }
+            @{ Uri = 'directory/deviceLocalCredentials/d?$select=credentials' }
+            @{ Uri = 'deviceManagement/managedDevices/d/getFileVaultKey' }
+            @{ Uri = "deviceManagement/deviceConfigurations('c')/getOmaSettingPlainTextValue(secretReferenceValueId='s')" }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeFalse
+        }
+
+        It 'allows directory org contacts <Uri>' -ForEach @(
+            @{ Uri = 'contacts' }
+            @{ Uri = '/contacts' }
+            @{ Uri = 'contacts/c1/memberOf' }
+            @{ Uri = "contacts('c1')" }
+            @{ Uri = 'https://graph.microsoft.com/beta/contacts?$select=id,displayName' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeFalse
+        }
+
+        It 'allows metadata-only endpoint <Uri>' -ForEach @(
+            @{ Uri = 'users/x/todo/lists' }
+            @{ Uri = 'groups/g/planner/plans' }
+            @{ Uri = 'planner/plans/p/details' }
+            @{ Uri = 'planner/plans/p/buckets' }
+            @{ Uri = 'sites/s/lists' }
+            @{ Uri = 'sites/s/lists/l/columns' }
+            @{ Uri = 'sites/s/lists?$expand=columns' }
+            @{ Uri = 'admin/serviceAnnouncement?$expand=messages' }
+            @{ Uri = 'deviceManagement/notificationMessageTemplates/t/localizedNotificationMessages' }
+            @{ Uri = 'admin/serviceAnnouncement/messages/m/attachments' }
+            @{ Uri = "admin/serviceAnnouncement/messages('m')/attachments/a/content" }
+            @{ Uri = 'admin/serviceAnnouncement/messages/m?$expand=attachments' }
+            @{ Uri = 'external/connections' }
+            @{ Uri = 'external/connections/c/schema' }
+            @{ Uri = 'solutions/bookingBusinesses' }
+            @{ Uri = 'solutions/bookingBusinesses/b/services' }
+            @{ Uri = 'solutions/virtualEvents/webinars' }
+            @{ Uri = 'solutions/virtualEvents/webinars/w/sessions' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeFalse
+        }
+
+        It 'allows print shares <Uri>' -ForEach @(
+            @{ Uri = 'print/shares' }
+            @{ Uri = 'print/shares/s1/allowedUsers' }
+            @{ Uri = 'https://graph.microsoft.com/beta/print/shares?$top=5' }
+        ) {
+            Test-CIPPGraphEndpointBlocked -Uri $Uri | Should -BeFalse
+        }
+    }
+
+    Context '-Throw' {
+        It 'throws with id and reason for a blocked path' {
+            { Test-CIPPGraphEndpointBlocked -Uri 'users/x/messages' -Throw } |
+                Should -Throw -ExpectedMessage '*mail-messages*'
+        }
+
+        It 'throw message includes the reason text' {
+            { Test-CIPPGraphEndpointBlocked -Uri 'users/x/drive/items/y' -Throw } |
+                Should -Throw -ExpectedMessage '*downloadUrl*'
+        }
+
+        It 'does not throw for an allowed path' {
+            { Test-CIPPGraphEndpointBlocked -Uri 'users' -Throw } | Should -Not -Throw
+        }
+
+        It 'emits nothing for an allowed path so bare guard calls do not leak into caller output' {
+            @(Test-CIPPGraphEndpointBlocked -Uri 'users' -Throw).Count | Should -Be 0
+            @(Test-CIPPGraphEndpointBlocked -Uri '' -Throw).Count | Should -Be 0
+        }
+    }
+}
+
+Describe 'Get-GraphRequestList blocklist gate' {
+    BeforeAll {
+        $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+        $env:CIPPRootPath = $RepoRoot
+        $script:CippGraphEndpointBlocklist = $null
+
+        function New-GraphGetRequest { param([Parameter(ValueFromRemainingArguments)]$Rest) $script:GraphCalled = $true; [pscustomobject]@{ id = '1' } }
+        function Get-StringHash { param($String) 'hash' }
+        function Get-Tenants { param([switch]$IncludeErrors) @() }
+        function Get-CIPPTextReplacement {
+            param($TenantFilter, $Text)
+            if ($Text -isnot [string]) { return $Text }
+            $Text -replace '%d%', 'drive' -replace '%tenantid%', '00000000-0000-0000-0000-000000000001'
+        }
+
+        . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphRequests/Get-GraphRequestList.ps1')
+    }
+
+    BeforeEach {
+        $script:GraphCalled = $false
+    }
+
+    It 'throws with reason for a blocked Endpoint' {
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users/x/drive/items/y' -SkipCache } |
+            Should -Throw -ExpectedMessage '*drive-trees*downloadUrl*'
+        $script:GraphCalled | Should -BeFalse
+    }
+
+    It 'blocks a sensitive $expand parameter' {
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'sites/s' -Parameters @{ '$expand' = 'driveItem' } -SkipCache } |
+            Should -Throw -ExpectedMessage '*drive-item*'
+        $script:GraphCalled | Should -BeFalse
+    }
+
+    It 'blocks a sensitive $expand when UseBatchExpand keeps it out of the query' {
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users' -Parameters @{ '$expand' = 'messages' } -UseBatchExpand -SkipCache } |
+            Should -Throw -ExpectedMessage '*mail-messages*'
+    }
+
+    It 'blocks a forged nextLink' {
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users' -nextLink 'https://graph.microsoft.com/beta/users/x/drive/root/children' -ManualPagination -SkipCache } |
+            Should -Throw -ExpectedMessage '*drive-trees*'
+        $script:GraphCalled | Should -BeFalse
+    }
+
+    It 'blocks a fragment-truncated Endpoint' {
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users/x/messages#' -SkipCache } |
+            Should -Throw -ExpectedMessage '*mail-messages*'
+        $script:GraphCalled | Should -BeFalse
+    }
+
+    It 'blocks a nextLink that relies on backslash or dot-segment normalisation' {
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users' -nextLink 'https://graph.microsoft.com/beta/users/x\drive\items\y' -ManualPagination -SkipCache } |
+            Should -Throw -ExpectedMessage '*drive-trees*'
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users' -nextLink 'https://graph.microsoft.com/beta/x/../shares/u!abc/root' -ManualPagination -SkipCache } |
+            Should -Throw -ExpectedMessage '*shares*'
+        $script:GraphCalled | Should -BeFalse
+    }
+
+    It 'blocks a custom variable that resolves to a blocked path' {
+        { Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users/x/%d%/items/y' -SkipCache } |
+            Should -Throw -ExpectedMessage '*drive-trees*'
+        $script:GraphCalled | Should -BeFalse
+    }
+
+    It 'allows a built-in variable that resolves to an allowed path' {
+        Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'organization/%tenantid%/branding' -SkipCache | Out-Null
+        $script:GraphCalled | Should -BeTrue
+    }
+
+    It 'allows a normal endpoint' {
+        Get-GraphRequestList -TenantFilter 'contoso.onmicrosoft.com' -Endpoint 'users' -Parameters @{ '$select' = 'id' } -SkipCache | Out-Null
+        $script:GraphCalled | Should -BeTrue
+    }
+}
+
+Describe 'Invoke-ListGraphRequest blocklist gate' {
+    BeforeAll {
+        $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+        $env:CIPPRootPath = $RepoRoot
+        $script:CippGraphEndpointBlocklist = $null
+
+        # Azure Functions resolves [HttpStatusCode]; accelerate it for local Pester.
+        $Accelerators = [powershell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+        if (-not $Accelerators::Get.ContainsKey('HttpStatusCode')) {
+            $Accelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+        }
+
+        function Write-LogMessage { param($headers, $API, $message, $Sev) }
+        function New-GraphGetRequest { throw 'New-GraphGetRequest must not be called for blocked endpoints' }
+        function Get-NormalizedError { param($Message) $Message }
+        function Get-Tenants { @() }
+
+        . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphRequests/Get-GraphRequestList.ps1')
+        . (Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphRequest.ps1')
+    }
+
+    It 'returns BadRequest with reason and does not call Graph for a blocked Endpoint' {
+        $Request = [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'ListGraphRequest' }
+            Headers = @{}
+            Query   = @{
+                Endpoint     = 'users/x/drive/items/y'
+                TenantFilter = 'contoso.onmicrosoft.com'
+            }
+        }
+        $Result = Invoke-ListGraphRequest -Request $Request -TriggerMetadata @{ Headers = @{ Referer = 'https://example.com/' } }
+
+        $Result.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        $Result.Body | Should -Match 'drive-trees'
+        $Result.Body | Should -Match 'downloadUrl'
+    }
+
+    It 'blocks a sensitive $expand query parameter on an allowed Endpoint' {
+        $Request = [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'ListGraphRequest' }
+            Headers = @{}
+            Query   = @{
+                Endpoint     = 'sites/s'
+                '$expand'    = 'driveItem'
+                TenantFilter = 'contoso.onmicrosoft.com'
+            }
+        }
+        $Result = Invoke-ListGraphRequest -Request $Request -TriggerMetadata @{ Headers = @{ Referer = 'https://example.com/' } }
+
+        $Result.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        $Result.Body | Should -Match 'drive-item'
+    }
+}
+
+Describe 'Invoke-ListGraphBulkRequest blocklist gate' {
+    BeforeAll {
+        $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+        $env:CIPPRootPath = $RepoRoot
+        $script:CippGraphEndpointBlocklist = $null
+
+        function New-GraphBulkRequest { throw 'New-GraphBulkRequest must not be called for blocked endpoints' }
+
+        . (Join-Path $RepoRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1')
+    }
+
+    It 'returns BadRequest with reason and does not call Graph for a blocked url' {
+        $Request = [pscustomobject]@{
+            Body = @{
+                tenantFilter = 'contoso.onmicrosoft.com'
+                requests     = @(
+                    @{ id = '1'; method = 'GET'; url = 'users/x/messages' }
+                )
+            }
+        }
+        $Result = Invoke-ListGraphBulkRequest -Request $Request -TriggerMetadata @{}
+
+        $Result.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        $Result.Body | Should -Match 'mail-messages'
+    }
+}
diff --git a/Tests/GraphHelper/Write-AlertTrace.Tests.ps1 b/Tests/GraphHelper/Write-AlertTrace.Tests.ps1
new file mode 100644
index 0000000000000..901dc7a0b7680
--- /dev/null
+++ b/Tests/GraphHelper/Write-AlertTrace.Tests.ps1
@@ -0,0 +1,239 @@
+# Pester tests for Write-AlertTrace, the per-item alert lifecycle reconciler.
+#
+# Each alert run hands over everything it found (possibly nothing). Items are hashed and
+# compared with the AlertLifecycle rows for that cmdlet and tenant: unknown items become
+# Open and are returned for notification, known items are refreshed silently, absent
+# items are resolved, resolved items that come back are reopened and returned again, and
+# snoozed items are tracked but never returned. An "until resolved" snooze is deleted when
+# its item resolves; a timed snooze outlives the resolution. -Append never resolves by absence.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $Helper = Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper'
+
+    function Get-CIPPTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Context, $TableName, $Filter, $Property, $First) }
+    function Add-CIPPAzDataTableEntity { param($Context, $TableName, $Entity, [switch]$Force) }
+    function Remove-CIPPAzDataTableEntity { param($Context, $TableName, $Entity, [switch]$Force) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) }
+    function Get-CIPPActiveAlertSnoozes { param($CmdletName, $TenantFilter) }
+
+    . (Join-Path $Helper 'Get-AlertContentHash.ps1')
+    . (Join-Path $Helper 'Get-CIPPAlertLifecycleKey.ps1')
+    . (Join-Path $Helper 'Write-AlertTrace.ps1')
+
+    function New-StoredRow {
+        param($Message, $Status = 'Open', $ReopenCount = '0', $ResolvedAt = '', $LastSeen = '2026-09-20T10:00:00.0000000Z', $SnoozeUntilResolved = '', $SnoozeRowKey = '')
+        $Hash = Get-AlertContentHash -AlertItem @{ Message = $Message }
+        $Keys = Get-CIPPAlertLifecycleKey -CmdletName 'Get-CIPPAlertSomething' -TenantFilter 'contoso.onmicrosoft.com' -ContentHash $Hash.ContentHash
+        [pscustomobject]@{
+            PartitionKey        = $Keys.PartitionKey
+            RowKey              = $Keys.RowKey
+            CmdletName          = 'Get-CIPPAlertSomething'
+            Tenant              = 'contoso.onmicrosoft.com'
+            ContentHash         = $Hash.ContentHash
+            ContentPreview      = $Hash.ContentPreview
+            AlertItem           = (ConvertTo-Json -InputObject @{ Message = $Message } -Compress)
+            AlertComment        = ''
+            Status              = $Status
+            FirstSeen           = '2026-09-18T10:00:00.0000000Z'
+            LastSeen            = $LastSeen
+            LastChecked         = $LastSeen
+            ResolvedAt          = $ResolvedAt
+            ReopenCount         = $ReopenCount
+            SnoozeUntil         = ''
+            SnoozedBy           = ''
+            SnoozeRowKey        = $SnoozeRowKey
+            SnoozeReason        = ''
+            SnoozeVisible       = ''
+            SnoozeUntilResolved = $SnoozeUntilResolved
+            ETag                = 'W/"1"'
+            Timestamp           = [datetimeoffset]::UtcNow
+        }
+    }
+
+    function Get-WrittenRow {
+        param($Message)
+        $Hash = (Get-AlertContentHash -AlertItem @{ Message = $Message }).ContentHash
+        $script:Writes | Where-Object { $_.ContentHash -eq $Hash } | Select-Object -Last 1
+    }
+}
+
+Describe 'Write-AlertTrace' {
+    BeforeEach {
+        $script:Writes = [System.Collections.Generic.List[object]]::new()
+        $script:Removed = [System.Collections.Generic.List[object]]::new()
+        $script:Existing = @()
+        $script:LastRun = @()
+        $script:Snoozes = @{}
+
+        Mock Get-CIPPTable { @{ TableName = $tablename } }
+        Mock ConvertTo-CIPPODataFilterValue { $Value }
+        Mock Get-CIPPActiveAlertSnoozes { $script:Snoozes }
+        Mock Get-CIPPAzDataTableEntity {
+            if ($TableName -eq 'AlertLifecycle') { return $script:Existing }
+            if ($TableName -eq 'AlertLastRun') { return $script:LastRun }
+        }
+        Mock Add-CIPPAzDataTableEntity {
+            foreach ($Row in @($Entity)) { $script:Writes.Add($Row) }
+        }
+        Mock Remove-CIPPAzDataTableEntity { $script:Removed.Add(@{ Table = $TableName; Entity = $Entity }) }
+    }
+
+    It 'stores unknown items as Open and returns them for notification' {
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @(
+            [pscustomobject]@{ Message = 'first' }
+            [pscustomobject]@{ Message = 'second' }
+        )
+
+        @($Result).Count | Should -Be 2
+        @($Result).Message | Should -Be @('first', 'second')
+        $script:Writes.Count | Should -Be 2
+        (Get-WrittenRow -Message 'first').Status | Should -Be 'Open'
+        (Get-WrittenRow -Message 'first').ReopenCount | Should -Be '0'
+        (Get-WrittenRow -Message 'first').FirstSeen | Should -Not -BeNullOrEmpty
+    }
+
+    It 'refreshes known items without returning them' {
+        $script:Existing = @(New-StoredRow -Message 'first')
+
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @([pscustomobject]@{ Message = 'first' })
+
+        $Result | Should -BeNullOrEmpty
+        $Written = Get-WrittenRow -Message 'first'
+        $Written.Status | Should -Be 'Open'
+        $Written.FirstSeen | Should -Be '2026-09-18T10:00:00.0000000Z'
+        $Written.LastSeen | Should -Not -Be '2026-09-20T10:00:00.0000000Z'
+    }
+
+    It 'resolves items missing from the run and returns nothing for an empty run' {
+        $script:Existing = @(
+            (New-StoredRow -Message 'first'),
+            (New-StoredRow -Message 'second')
+        )
+
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data $null
+
+        $Result | Should -BeNullOrEmpty
+        $script:Writes.Count | Should -Be 2
+        (Get-WrittenRow -Message 'first').Status | Should -Be 'Resolved'
+        (Get-WrittenRow -Message 'first').ResolvedAt | Should -Not -BeNullOrEmpty
+        (Get-WrittenRow -Message 'second').Status | Should -Be 'Resolved'
+        # The resolved rows keep every column so the full-row upsert loses nothing.
+        (Get-WrittenRow -Message 'first').AlertItem | Should -Not -BeNullOrEmpty
+        (Get-WrittenRow -Message 'first').Keys | Should -Not -Contain 'ETag'
+    }
+
+    It 'reopens a resolved item, bumps the reopen count and returns it again' {
+        $script:Existing = @(New-StoredRow -Message 'first' -Status 'Resolved' -ReopenCount '1' -ResolvedAt '2026-09-21T10:00:00.0000000Z')
+
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @([pscustomobject]@{ Message = 'first' })
+
+        @($Result).Count | Should -Be 1
+        $Written = Get-WrittenRow -Message 'first'
+        $Written.Status | Should -Be 'Open'
+        $Written.ReopenCount | Should -Be '2'
+        $Written.ResolvedAt | Should -Be ''
+        $Written.FirstSeen | Should -Not -Be '2026-09-18T10:00:00.0000000Z'
+    }
+
+    It 'tracks a snoozed item as Snoozed with its snooze details, without returning it' {
+        $Hash = (Get-AlertContentHash -AlertItem @{ Message = 'first' }).ContentHash
+        $script:Snoozes = @{ $Hash = [pscustomobject]@{ SnoozeUntil = '0'; UntilResolved = 'True'; KeepVisible = 'True'; SnoozeReason = 'ticket 42'; SnoozedBy = 'ops@contoso.com'; RowKey = 'contoso.onmicrosoft.com-hash' } }
+
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @([pscustomobject]@{ Message = 'first' })
+
+        $Result | Should -BeNullOrEmpty
+        $Written = Get-WrittenRow -Message 'first'
+        $Written.Status | Should -Be 'Snoozed'
+        $Written.SnoozedBy | Should -Be 'ops@contoso.com'
+        $Written.SnoozeRowKey | Should -Be 'contoso.onmicrosoft.com-hash'
+        $Written.SnoozeReason | Should -Be 'ticket 42'
+        $Written.SnoozeVisible | Should -Be 'True'
+        $Written.SnoozeUntilResolved | Should -Be 'True'
+    }
+
+    It 'fires again when a snooze has lapsed but the condition persists' {
+        $script:Existing = @(New-StoredRow -Message 'first' -Status 'Snoozed')
+
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @([pscustomobject]@{ Message = 'first' })
+
+        @($Result).Count | Should -Be 1
+        (Get-WrittenRow -Message 'first').Status | Should -Be 'Open'
+    }
+
+    It 'drops an until-resolved snooze when its item resolves, but keeps a timed one' {
+        $script:Existing = @(
+            (New-StoredRow -Message 'untilresolved' -Status 'Snoozed' -SnoozeUntilResolved 'True' -SnoozeRowKey 'contoso.onmicrosoft.com-ur'),
+            (New-StoredRow -Message 'timed' -Status 'Snoozed' -SnoozeUntilResolved 'False' -SnoozeRowKey 'contoso.onmicrosoft.com-timed')
+        )
+
+        $null = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data $null
+
+        (Get-WrittenRow -Message 'untilresolved').Status | Should -Be 'Resolved'
+        (Get-WrittenRow -Message 'untilresolved').SnoozeRowKey | Should -Be ''
+        (Get-WrittenRow -Message 'timed').Status | Should -Be 'Resolved'
+        (Get-WrittenRow -Message 'timed').SnoozeRowKey | Should -Be 'contoso.onmicrosoft.com-timed'
+        $Dropped = @($script:Removed | Where-Object { $_.Table -eq 'AlertSnooze' })
+        $Dropped.Count | Should -Be 1
+        $Dropped[0].Entity.PartitionKey | Should -Be 'Get-CIPPAlertSomething'
+        $Dropped[0].Entity.RowKey | Should -Be 'contoso.onmicrosoft.com-ur'
+    }
+
+    It 'does not resolve by absence in append mode, but does retire stale rows' {
+        $script:Existing = @(
+            (New-StoredRow -Message 'recent' -LastSeen ([datetime]::UtcNow.AddDays(-2).ToString('o'))),
+            (New-StoredRow -Message 'stale' -LastSeen ([datetime]::UtcNow.AddDays(-45).ToString('o')))
+        )
+
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @([pscustomobject]@{ Message = 'event' }) -Append
+
+        @($Result).Count | Should -Be 1
+        Get-WrittenRow -Message 'recent' | Should -BeNullOrEmpty
+        (Get-WrittenRow -Message 'stale').Status | Should -Be 'Resolved'
+    }
+
+    It 'purges resolved rows older than the retention window' {
+        $script:Existing = @(
+            (New-StoredRow -Message 'old' -Status 'Resolved' -ResolvedAt ([datetime]::UtcNow.AddDays(-120).ToString('o'))),
+            (New-StoredRow -Message 'fresh' -Status 'Resolved' -ResolvedAt ([datetime]::UtcNow.AddDays(-5).ToString('o')))
+        )
+
+        $null = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data $null
+
+        $script:Removed.Count | Should -Be 1
+        $script:Removed[0].Entity.RowKey | Should -Be (New-StoredRow -Message 'old').RowKey
+        $script:Writes.Count | Should -Be 0
+    }
+
+    It 'seeds from the last AlertLastRun row so known items are not announced as new' {
+        $script:LastRun = @(
+            [pscustomobject]@{
+                PartitionKey = '20260920'
+                RowKey       = 'contoso.onmicrosoft.com-Get-CIPPAlertSomething'
+                LogData      = (ConvertTo-Json -InputObject @(@{ Message = 'first' }) -Compress)
+                AlertComment = ''
+            }
+        )
+
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @(
+            [pscustomobject]@{ Message = 'first' }
+            [pscustomobject]@{ Message = 'second' }
+        )
+
+        @($Result).Count | Should -Be 1
+        @($Result)[0].Message | Should -Be 'second'
+        (Get-WrittenRow -Message 'first').FirstSeen | Should -BeLike '2026-09-20*'
+        (Get-WrittenRow -Message 'first').Status | Should -Be 'Open'
+    }
+
+    It 'ignores duplicate items within one run' {
+        $Result = Write-AlertTrace -cmdletName 'Get-CIPPAlertSomething' -tenantFilter 'contoso.onmicrosoft.com' -data @(
+            [pscustomobject]@{ Message = 'first' }
+            [pscustomobject]@{ Message = 'first' }
+        )
+
+        @($Result).Count | Should -Be 1
+        $script:Writes.Count | Should -Be 1
+    }
+}
diff --git a/Tests/Private/Add-HuduAssetLayoutField.Tests.ps1 b/Tests/Private/Add-HuduAssetLayoutField.Tests.ps1
new file mode 100644
index 0000000000000..2889f06cab6fa
--- /dev/null
+++ b/Tests/Private/Add-HuduAssetLayoutField.Tests.ps1
@@ -0,0 +1,94 @@
+BeforeAll {
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Extension Functions/Add-HuduAssetLayoutField.ps1"
+    function Get-HuduAssetLayouts { param($LayoutId) $script:Layout }
+    function Set-HuduAssetLayout {
+        param($Id, $Fields)
+        foreach ($field in $Fields) { $field.Remove('required') }
+        $script:SentFields = $Fields
+        $script:Layout.fields = @($Fields | ForEach-Object { [PSCustomObject]$_ })
+    }
+}
+Describe 'Hudu layout field normalization' {
+    It 'copies object and dictionary fields and inserts at the requested position' {
+        $script:Layout = @{ fields = @(
+            [PSCustomObject]@{ id = 1; label = 'Serial'; position = 0; required = $false; field_type = 'Text' }
+            @{ id = 2; label = 'Notes'; position = 1; required = $false; field_type = 'RichText' }
+        ) }
+        Add-HuduAssetLayoutField -AssetLayoutId 10 -Label 'LAPS Password' -FieldType 'Password' -Position 1
+        $script:SentFields.Count | Should -Be 3
+        $script:SentFields[0].id | Should -Be 1
+        $script:SentFields[1].field_type | Should -Be 'Password'
+        $script:SentFields[2].position | Should -Be 2
+        $script:Layout.fields[0].position | Should -Be 0
+        $script:Layout.fields[1].position | Should -Be 1
+    }
+    It 'does not update a layout when field type and position already match' {
+        $script:SentFields = $null
+        $script:Layout = @{ fields = @([PSCustomObject]@{ label = 'LAPS Password'; position = 0; field_type = 'Password'; show_in_list = $false }) }
+        Add-HuduAssetLayoutField -AssetLayoutId 10 -Label 'LAPS Password' -FieldType Password -Position 0
+        $script:SentFields | Should -BeNullOrEmpty
+    }
+
+    It 'preserves identifiers and custom properties when the target field is a dictionary' {
+        $script:Layout = @{ fields = @(
+            @{ id = 10; label = 'LAPS Account'; position = 1; field_type = 'Text'; show_in_list = $true; custom_option = 'preserve-me' }
+            @{ id = 11; label = 'LAPS Password'; position = 0; field_type = 'Password'; show_in_list = $false }
+        ) }
+
+        Add-HuduAssetLayoutField -AssetLayoutId 10 -Label 'LAPS Account' -FieldType 'Email' -Position 0
+
+        $script:SentFields[0].id | Should -Be 10
+        $script:SentFields[0].custom_option | Should -Be 'preserve-me'
+        $script:SentFields[0].field_type | Should -Be 'Email'
+    }
+
+    It 'moves the LAPS account above the password and makes it copyable' {
+        $script:Layout = @{ fields = @(
+            [PSCustomObject]@{ id = 1; label = 'LAPS Password'; position = 0; field_type = 'Password'; show_in_list = $false }
+            [PSCustomObject]@{ id = 2; label = 'LAPS Account'; position = 1; field_type = 'Text'; show_in_list = $false }
+        ) }
+        Add-HuduAssetLayoutField -AssetLayoutId 10 -Label 'LAPS Account' -FieldType Email -Position 0
+        $script:SentFields[0].label | Should -Be 'LAPS Account'
+        $script:SentFields[0].field_type | Should -Be 'Email'
+        $script:SentFields[1].label | Should -Be 'LAPS Password'
+    }
+
+    It 'migrates credential fields, preserves custom layout data, and is idempotent' {
+        $script:Layout = @{ fields = @(
+            [PSCustomObject]@{ id = 1; label = 'LAPS Password'; position = 0; field_type = 'Password'; show_in_list = $false }
+            [PSCustomObject]@{ id = 2; label = 'LAPS Account'; position = 1; field_type = 'Text'; show_in_list = $false }
+            [PSCustomObject]@{ id = 3; label = 'BitLocker Keys'; position = 2; field_type = 'RichText'; show_in_list = $false }
+            [PSCustomObject]@{ id = 4; label = 'Site Notes'; position = 3; field_type = 'Text'; show_in_list = $true; custom_option = 'preserve-me' }
+        ) }
+
+        $DesiredFields = @(
+            @{ Label = 'LAPS Account'; FieldType = 'Email'; Position = 0 }
+            @{ Label = 'LAPS Password'; FieldType = 'Password'; Position = 1 }
+            @{ Label = 'LAPS Backup Date'; FieldType = 'Text'; Position = 2 }
+            @{ Label = 'BitLocker OS Drive 1 Key ID'; FieldType = 'Text'; Position = 5 }
+            @{ Label = 'BitLocker OS Drive 1 Recovery Key'; FieldType = 'Password'; Position = 6 }
+            @{ Label = 'BitLocker Fixed Data Drive 1 Key ID'; FieldType = 'Text'; Position = 7 }
+            @{ Label = 'BitLocker Fixed Data Drive 1 Recovery Key'; FieldType = 'Password'; Position = 8 }
+        )
+        foreach ($Field in $DesiredFields) { Add-HuduAssetLayoutField -AssetLayoutId 10 @Field }
+
+        $script:Layout.fields[0].label | Should -Be 'LAPS Account'
+        $script:Layout.fields[0].field_type | Should -Be 'Email'
+        $script:Layout.fields[1].label | Should -Be 'LAPS Password'
+        $script:Layout.fields[2].label | Should -Be 'LAPS Backup Date'
+        $script:Layout.fields.label | Should -Contain 'BitLocker OS Drive 1 Key ID'
+        $script:Layout.fields.label | Should -Contain 'BitLocker OS Drive 1 Recovery Key'
+        $script:Layout.fields.label | Should -Contain 'BitLocker Fixed Data Drive 1 Key ID'
+        $script:Layout.fields.label | Should -Contain 'BitLocker Fixed Data Drive 1 Recovery Key'
+        ($script:Layout.fields | Where-Object label -eq 'BitLocker OS Drive 1 Key ID').position | Should -Be 5
+        ($script:Layout.fields | Where-Object label -eq 'BitLocker OS Drive 1 Recovery Key').position | Should -Be 6
+        ($script:Layout.fields | Where-Object label -eq 'BitLocker Fixed Data Drive 1 Key ID').position | Should -Be 7
+        ($script:Layout.fields | Where-Object label -eq 'BitLocker Fixed Data Drive 1 Recovery Key').position | Should -Be 8
+        ($script:Layout.fields | Where-Object label -eq 'BitLocker Keys').id | Should -Be 3
+        ($script:Layout.fields | Where-Object label -eq 'Site Notes').custom_option | Should -Be 'preserve-me'
+
+        $script:SentFields = $null
+        foreach ($Field in $DesiredFields) { Add-HuduAssetLayoutField -AssetLayoutId 10 @Field }
+        $script:SentFields | Should -BeNullOrEmpty
+    }
+}
diff --git a/Tests/Private/BecDelegatedAndSubjects.Tests.ps1 b/Tests/Private/BecDelegatedAndSubjects.Tests.ps1
new file mode 100644
index 0000000000000..19114bc745cae
--- /dev/null
+++ b/Tests/Private/BecDelegatedAndSubjects.Tests.ps1
@@ -0,0 +1,82 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor) }
+    function Get-CIPPMailboxPermissionReport { param($TenantFilter, [switch]$ByUser) }
+    function Get-CIPPCalendarPermissionReport { param($TenantFilter, [switch]$ByUser) }
+    function Get-NormalizedError { param($message) $message }
+    foreach ($File in @('BEC/New-CIPPBecCollectorResult.ps1', 'BEC/Resolve-CIPPBecMessageSubjects.ps1', 'BEC/Get-CIPPBecDelegatedAccess.ps1')) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$File")
+    }
+}
+
+Describe 'Resolve-CIPPBecMessageSubjects' {
+    It 'uses the known subjects first, then traces the rest newest slice first, and stops once all are named' {
+        $script:Slices = [System.Collections.Generic.List[object]]::new()
+        Mock New-ExoRequest {
+            $script:Slices.Add($cmdParams)
+            if ($script:Slices.Count -eq 2) { @([pscustomobject]@{ MessageId = '<b@x>'; Subject = 'Wire details' }, [pscustomobject]@{ MessageId = '<c@x>'; Subject = 'Payroll' }) }
+        }
+        $Result = Resolve-CIPPBecMessageSubjects -TenantFilter 'contoso.com' -MessageIds @('<a@x>', '<b@x>', '<c@x>', '<b@x>') -Known @{ '<a@x>' = 'Invoice' }
+        $Result.Subjects['<a@x>'] | Should -Be 'Invoice'
+        $Result.Subjects['<c@x>'] | Should -Be 'Payroll'
+        $Result.Unresolved | Should -Be 0
+        $script:Slices.Count | Should -Be 2 -Because 'the walk stops as soon as every id is named'
+        $script:Slices[0].MessageId.GetType().IsArray | Should -BeTrue -Because 'a joined string silently matches nothing'
+        @($script:Slices[0].MessageId).Count | Should -Be 2
+        ([datetime]$script:Slices[1].EndDate) | Should -Be ([datetime]$script:Slices[0].StartDate)
+    }
+
+    It 'walks at most the lookback in 10-day slices and leaves older messages unnamed' {
+        $script:Slices = [System.Collections.Generic.List[object]]::new()
+        Mock New-ExoRequest { $script:Slices.Add($cmdParams) }
+        $Result = Resolve-CIPPBecMessageSubjects -TenantFilter 'contoso.com' -MessageIds @('<old@x>') -LookbackDays 30
+        $script:Slices.Count | Should -Be 3
+        $Result.Unresolved | Should -Be 1
+    }
+
+    It 'reports a failed trace and stops' {
+        Mock New-ExoRequest { throw 'Get-MessageTraceV2 throttled' }
+        $Result = Resolve-CIPPBecMessageSubjects -TenantFilter 'contoso.com' -MessageIds @('<a@x>')
+        $Result.Error | Should -Match 'throttled'
+        Should -Invoke New-ExoRequest -Times 1
+    }
+}
+
+Describe 'Get-CIPPBecDelegatedAccess' {
+    It 'joins the permission cache, window grants and delegate activity, and marks what the attacker did in each mailbox' {
+        Mock Get-CIPPMailboxPermissionReport { @(
+                [pscustomobject]@{ User = 'Victim@contoso.com'; Permissions = @([pscustomobject]@{ Mailbox = 'CEO'; MailboxUPN = 'ceo@contoso.com'; AccessRights = 'FullAccess, SendAs' }) }
+                [pscustomobject]@{ User = 'other@contoso.com'; Permissions = @([pscustomobject]@{ MailboxUPN = 'hr@contoso.com'; AccessRights = 'FullAccess' }) }
+            ) }
+        Mock Get-CIPPCalendarPermissionReport { @([pscustomobject]@{ User = 'Victim Person'; Permissions = @([pscustomobject]@{ CalendarUPN = 'cfo@contoso.com'; AccessRights = 'Editor' }) }) }
+        $Changes = @([pscustomobject]@{ Operation = 'Add-MailboxPermission'; Trustee = 'victim@contoso.com'; ObjectId = 'finance@contoso.com'; Permissions = 'FullAccess'; AuditData = $null })
+        $Activity = @([pscustomobject]@{ Operation = 'MailItemsAccessed'; MailboxOwner = 'ceo@contoso.com'; Count = 30 }, [pscustomobject]@{ Operation = 'MailItemsAccessed'; MailboxOwner = 'victim@contoso.com'; Count = 900 })
+        $Attacker = @(
+            [pscustomobject]@{ Operation = 'MailItemsAccessed'; AccessType = 'Bind'; MailboxOwner = 'ceo@contoso.com'; When = '2026-09-20T01:00:00Z' }
+            [pscustomobject]@{ Operation = 'SendAs'; MailboxOwner = 'ceo@contoso.com'; When = '2026-09-20T02:00:00Z' }
+        )
+        $Result = Get-CIPPBecDelegatedAccess -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -UserDisplayName 'Victim Person' -PermissionChanges $Changes -MailActivity $Activity -AttackerMail $Attacker
+        $Result.Complete | Should -BeTrue
+        @($Result.Data.Mailbox) | Should -Not -Contain 'hr@contoso.com'
+        @($Result.Data.Mailbox) | Should -Not -Contain 'victim@contoso.com'
+        $Ceo = $Result.Data | Where-Object Mailbox -EQ 'ceo@contoso.com'
+        $Ceo.AccessRights | Should -Be 'FullAccess, SendAs'
+        $Ceo.KnownFrom | Should -Be 'Delegate activity, Permission cache'
+        $Ceo.DelegateActivity | Should -Be 30
+        $Ceo.AttackerOpened | Should -Be 1
+        $Ceo.AttackerSent | Should -Be 1
+        $Ceo.LastAttackerActivity | Should -Be '2026-09-20T02:00:00Z'
+        $Result.Data[0].Mailbox | Should -Be 'ceo@contoso.com' -Because 'mailboxes the attacker used sort first'
+        ($Result.Data | Where-Object Mailbox -EQ 'finance@contoso.com').GrantedInWindow | Should -BeTrue
+        ($Result.Data | Where-Object Mailbox -EQ 'cfo@contoso.com').AccessRights | Should -Be 'Calendar: Editor' -Because 'calendar delegates are often named by display name'
+    }
+
+    It 'still reports the audit and activity sources when the permission cache has not been built' {
+        Mock Get-CIPPMailboxPermissionReport { throw 'No mailbox data found in reporting database. Sync the mailbox permissions first.' }
+        Mock Get-CIPPCalendarPermissionReport { @() }
+        $Result = Get-CIPPBecDelegatedAccess -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -MailActivity @([pscustomobject]@{ MailboxOwner = 'ceo@contoso.com'; Count = 3 })
+        $Result.Complete | Should -BeFalse
+        $Result.Error | Should -Match 'Sync the mailbox permissions first'
+        $Result.Data[0].Mailbox | Should -Be 'ceo@contoso.com'
+    }
+}
diff --git a/Tests/Private/BecIPCollectors.Tests.ps1 b/Tests/Private/BecIPCollectors.Tests.ps1
new file mode 100644
index 0000000000000..c4ab0ee706425
--- /dev/null
+++ b/Tests/Private/BecIPCollectors.Tests.ps1
@@ -0,0 +1,196 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphBulkRequest { param($Requests, $tenantid, $asapp, $Version, $NoPaginateIds) }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp) }
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor) }
+    function Get-CIPPTenantAllowBlockListItems { param($TenantFilter, $ListType) }
+    function Get-CIPPIPAllowBlockList { param($TenantFilter) }
+    function Get-NormalizedError { param($message) $message }
+    function Search-CIPPBecAuditLog { param($TenantFilter, $StartDate, $EndDate, $Operations, $UserIds, $IPAddresses, $Anchor, $MaxPages) }
+    foreach ($File in @('ConvertTo-CIPPODataFilterValue.ps1', 'Authentication/ConvertTo-CIPPIPRange.ps1', 'BEC/ConvertTo-CIPPBecHostAddress.ps1', 'BEC/New-CIPPBecCollectorResult.ps1', 'BEC/Get-CIPPBecSignInBaseline.ps1', 'BEC/Get-CIPPBecIPPeers.ps1', 'BEC/Get-CIPPBecIPGuidance.ps1', 'BEC/Get-CIPPBecBlastRadius.ps1')) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$File")
+    }
+    function New-SignIn {
+        param($IP, $When, $Ok = $true, $Asn = 1221, $City = 'Sydney', $App = 'Outlook')
+        [pscustomobject]@{ createdDateTime = $When; ipAddress = $IP; autonomousSystemNumber = $Asn; location = [pscustomobject]@{ countryOrRegion = 'AU'; city = $City }; conditionalAccessStatus = 'success'; status = [pscustomobject]@{ errorCode = $(if ($Ok) { 0 } else { 50126 }) }; appDisplayName = $App; resourceDisplayName = 'Office 365 Exchange Online' }
+    }
+}
+
+Describe 'Get-CIPPBecSignInBaseline' {
+    It 'profiles successful sign-ins by address, network and location across interactive and service sign-ins' {
+        Mock New-GraphBulkRequest {
+            @(
+                [pscustomobject]@{ id = 'Interactive'; status = 200; body = [pscustomobject]@{ value = @(
+                            (New-SignIn -IP '203.0.113.10' -When '2026-09-01T01:00:00Z')
+                            (New-SignIn -IP '203.0.113.10' -When '2026-09-02T01:00:00Z')
+                            (New-SignIn -IP '198.51.100.7' -When '2026-09-03T01:00:00Z' -Ok $false -Asn 14061 -City 'Lagos')
+                        ) } }
+                [pscustomobject]@{ id = 'NonInteractive'; status = 200; body = [pscustomobject]@{ value = @(
+                            (New-SignIn -IP '203.0.113.10' -When '2026-09-02T02:00:00Z' -App 'SharePoint Online')
+                            (New-SignIn -IP '192.0.2.44' -When '2026-09-04T01:00:00Z' -City 'Melbourne')
+                        ) } }
+            )
+        }
+        $Result = Get-CIPPBecSignInBaseline -TenantFilter 'contoso.com' -UserId '11111111-1111-1111-1111-111111111111' -StartDate '2026-08-15' -EndDate '2026-09-16'
+        $Result.Complete | Should -BeTrue
+        $Result.Data.Successful | Should -Be 4 -Because 'the failed spray attempt must not teach the baseline an attacker address'
+        $Office = $Result.Data.IPs | Where-Object IP -EQ '203.0.113.10'
+        $Office.SignIns | Should -Be 3
+        $Office.Interactive | Should -Be 2
+        $Office.NonInteractive | Should -Be 1
+        $Office.Days | Should -Be 2
+        $Office.Share | Should -Be 0.75
+        $Office.Apps | Should -Contain 'SharePoint Online'
+        ($Result.Data.IPs | Where-Object IP -EQ '198.51.100.7') | Should -BeNullOrEmpty
+        ($Result.Data.Locations | Where-Object City -EQ 'Sydney').Share | Should -Be 0.75
+        Should -Invoke New-GraphBulkRequest -Times 1 -ParameterFilter { @($Requests).Count -eq 2 -and $Requests[1].url -match "nonInteractiveUser" -and $Requests[0].url -match 'createdDateTime lt ' }
+    }
+
+    It 'reports a failed half and a Graph paging stop without losing the other half' {
+        Mock New-GraphBulkRequest {
+            @(
+                [pscustomobject]@{ id = 'Interactive'; status = 200; PagingIncomplete = $true; body = [pscustomobject]@{ value = @(New-SignIn -IP '203.0.113.10' -When '2026-09-01T01:00:00Z') } }
+                [pscustomobject]@{ id = 'NonInteractive'; status = 403; body = [pscustomobject]@{ error = [pscustomobject]@{ message = 'Tenant does not have a premium licence' } } }
+            )
+        }
+        $Result = Get-CIPPBecSignInBaseline -TenantFilter 'contoso.com' -UserId '11111111-1111-1111-1111-111111111111' -StartDate '2026-08-15' -EndDate '2026-09-16'
+        $Result.Complete | Should -BeFalse
+        $Result.Error | Should -Match 'NonInteractive sign-ins: Tenant does not have a premium licence'
+        $Result.Data.Successful | Should -Be 1
+    }
+}
+
+Describe 'Get-CIPPBecIPPeers' {
+    It 'splits other accounts into before and only-in-window, excluding the investigated user, and samples service sign-ins' {
+        Mock New-GraphBulkRequest {
+            @(
+                [pscustomobject]@{ id = 'i0'; status = 200; body = [pscustomobject]@{ value = @(
+                            [pscustomobject]@{ userId = 'me'; userPrincipalName = 'victim@contoso.com'; createdDateTime = '2026-09-01T00:00:00Z' }
+                            [pscustomobject]@{ userId = 'a'; userPrincipalName = 'a@contoso.com'; createdDateTime = '2026-09-01T00:00:00Z'; status = [pscustomobject]@{ errorCode = 0 } }
+                            [pscustomobject]@{ userId = 'a'; userPrincipalName = 'a@contoso.com'; createdDateTime = '2026-09-03T00:00:00Z'; status = [pscustomobject]@{ errorCode = 50126 } }
+                        ) } }
+                [pscustomobject]@{ id = 'n0'; status = 200; body = [pscustomobject]@{ '@odata.nextLink' = 'more'; value = @([pscustomobject]@{ userId = 'b'; userPrincipalName = 'b@contoso.com'; createdDateTime = '2026-09-02T00:00:00Z' }) } }
+                [pscustomobject]@{ id = 'i1'; status = 200; body = [pscustomobject]@{ value = @([pscustomobject]@{ userId = 'c'; userPrincipalName = 'c@contoso.com'; createdDateTime = '2026-09-20T00:00:00Z' }) } }
+                [pscustomobject]@{ id = 'n1'; status = 200; body = [pscustomobject]@{ value = @() } }
+            )
+        }
+        $Peers = Get-CIPPBecIPPeers -TenantFilter 'contoso.com' -UserId 'me' -IPs @('203.0.113.10', '198.51.100.7') -StartDate '2026-08-15' -WindowStart '2026-09-16'
+        $Peers['203.0.113.10'].OtherUsersBefore | Should -Be 2
+        $Peers['203.0.113.10'].Users | Should -Not -Contain 'victim@contoso.com'
+        $Peers['203.0.113.10'].Sampled | Should -BeTrue
+        $A = $Peers['203.0.113.10'].Accounts | Where-Object UserPrincipalName -EQ 'a@contoso.com'
+        $A.UserId | Should -Be 'a'
+        $A.Successful | Should -Be 1
+        $A.Failed | Should -Be 1
+        $A.FirstSeen | Should -Be '2026-09-01T00:00:00Z'
+        $A.LastSeen | Should -Be '2026-09-03T00:00:00Z'
+        $Peers['203.0.113.10'].Accounts.UserPrincipalName | Should -Not -Contain 'victim@contoso.com'
+        $Peers['198.51.100.7'].OtherUsersInWindowOnly | Should -Be 1
+        Should -Invoke New-GraphBulkRequest -Times 1 -ParameterFilter { @($NoPaginateIds) -contains 'n0' -and @($NoPaginateIds) -contains 'n1' -and $Requests[0].url -match "ipAddress eq '203.0.113.10'" }
+    }
+
+    It 'returns nothing without calling Graph when there are no addresses' {
+        Mock New-GraphBulkRequest { throw 'should not be called' }
+        (Get-CIPPBecIPPeers -TenantFilter 'contoso.com' -UserId 'me' -IPs @() -StartDate '2026-08-15' -WindowStart '2026-09-16').Count | Should -Be 0
+    }
+}
+
+Describe 'Get-CIPPBecBlastRadius' {
+    BeforeAll {
+        $script:Verdicts = @(
+            [pscustomobject]@{ IP = '198.51.100.7'; Verdict = 'LikelyAttacker' }
+            [pscustomobject]@{ IP = '203.0.113.10'; Verdict = 'Suspicious' }
+            [pscustomobject]@{ IP = '192.0.2.50'; Verdict = 'Compromised' }
+        )
+    }
+
+    It 'lists the other accounts the attacker addresses reached from sign-ins and the tenant-wide audit log' {
+        $Peers = @{
+            '198.51.100.7' = [pscustomobject]@{ IP = '198.51.100.7'; OtherUsers = 2; Accounts = @(
+                    [pscustomobject]@{ UserPrincipalName = 'b@contoso.com'; UserId = 'b'; Successful = 2; Failed = 0; FirstSeen = '2026-09-17T01:00:00Z'; LastSeen = '2026-09-18T01:00:00Z' }
+                    [pscustomobject]@{ UserPrincipalName = 'c@contoso.com'; UserId = 'c'; Successful = 0; Failed = 5; FirstSeen = '2026-09-17T02:00:00Z'; LastSeen = '2026-09-17T03:00:00Z' }
+                ) }
+        }
+        # 192.0.2.50 was never looked up (settled outright): the blast radius looks it up itself
+        Mock Get-CIPPBecIPPeers { @{ '192.0.2.50' = [pscustomobject]@{ IP = '192.0.2.50'; OtherUsers = 0; Accounts = @() } } }
+        Mock Search-CIPPBecAuditLog {
+            [pscustomobject]@{ Complete = $true; Cap = $null; Records = @(
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ UserId = 'd@contoso.com'; Operation = 'FileDownloaded'; ClientIP = '192.0.2.50:4431'; CreationTime = '2026-09-19T00:00:00' } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ UserId = 'd@contoso.com'; Operation = 'FileDownloaded'; ClientIP = '192.0.2.50'; CreationTime = '2026-09-19T01:00:00' } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ UserId = 'b@contoso.com'; Operation = 'MailItemsAccessed'; ClientIP = '198.51.100.7'; CreationTime = '2026-09-18T02:00:00' } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ UserId = 'Victim@contoso.com'; Operation = 'MailItemsAccessed'; ClientIP = '198.51.100.7'; CreationTime = '2026-09-18T02:00:00' } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ UserId = 'app@sharepoint'; Operation = 'FileAccessed'; ClientIP = '198.51.100.7'; CreationTime = '2026-09-18T02:00:00' } }
+                ) }
+        }
+        Mock New-GraphBulkRequest { @([pscustomobject]@{ id = 'u0'; status = 200; body = [pscustomobject]@{ id = 'd' } }) }
+
+        $Result = Get-CIPPBecBlastRadius -TenantFilter 'contoso.com' -UserId 'me' -UserPrincipalName 'victim@contoso.com' -Verdicts $script:Verdicts -Peers $Peers -StartDate '2026-09-16' -EndDate '2026-09-23'
+        $Result.Complete | Should -BeTrue
+        @($Result.Data).Count | Should -Be 3 -Because 'the investigated user and service principals are not other accounts'
+        Should -Invoke Get-CIPPBecIPPeers -Times 1 -ParameterFilter { @($IPs) -join ',' -eq '192.0.2.50' }
+        Should -Invoke Search-CIPPBecAuditLog -Times 1 -ParameterFilter { -not $UserIds -and (@($IPAddresses) -join ',') -eq '198.51.100.7,192.0.2.50' } -Because 'Suspicious addresses stay out of the blast radius'
+
+        $B = $Result.Data | Where-Object UserPrincipalName -EQ 'b@contoso.com'
+        $B.Reached | Should -BeTrue
+        $B.SuccessfulSignIns | Should -Be 2
+        $B.Actions | Should -Be 1
+        $B.LastSeen | Should -Be '2026-09-18T02:00:00Z'
+        $D = $Result.Data | Where-Object UserPrincipalName -EQ 'd@contoso.com'
+        $D.UserId | Should -Be 'd' -Because 'an account seen only in the audit log is resolved so it can be investigated'
+        $D.Operations | Should -Be 'FileDownloaded x2'
+        $D.AttackerIPs | Should -Be '192.0.2.50'
+        $C = $Result.Data | Where-Object UserPrincipalName -EQ 'c@contoso.com'
+        $C.Reached | Should -BeFalse -Because 'failed sign-ins alone are an attempt'
+        $Result.Data[-1].UserPrincipalName | Should -Be 'c@contoso.com'
+    }
+
+    It 'does nothing without an attacker address' {
+        Mock Search-CIPPBecAuditLog { throw 'should not be called' }
+        $Result = Get-CIPPBecBlastRadius -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Verdicts @([pscustomobject]@{ IP = '203.0.113.10'; Verdict = 'Unknown' }) -StartDate '2026-09-16' -EndDate '2026-09-23'
+        @($Result.Data).Count | Should -Be 0
+        $Result.Complete | Should -BeTrue
+    }
+
+    It 'reports a capped audit search as partial and a failed one as an error, keeping the sign-in rows' {
+        $Peers = @{ '198.51.100.7' = [pscustomobject]@{ IP = '198.51.100.7'; OtherUsers = 1; Accounts = @([pscustomobject]@{ UserPrincipalName = 'b@contoso.com'; UserId = 'b'; Successful = 1; Failed = 0 }) } }
+        Mock Get-CIPPBecIPPeers { @{} }
+        Mock Search-CIPPBecAuditLog { [pscustomobject]@{ Complete = $false; Cap = '10 pages'; Records = @() } }
+        $Partial = Get-CIPPBecBlastRadius -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Verdicts @($script:Verdicts[0]) -Peers $Peers -StartDate '2026-09-16' -EndDate '2026-09-23'
+        $Partial.Complete | Should -BeFalse
+        $Partial.Cap | Should -Be '10 pages'
+        Mock Search-CIPPBecAuditLog { throw 'UAL down' }
+        $Failed = Get-CIPPBecBlastRadius -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Verdicts @($script:Verdicts[0]) -Peers $Peers -StartDate '2026-09-16' -EndDate '2026-09-23'
+        $Failed.Error | Should -Match 'UAL down'
+        @($Failed.Data).UserPrincipalName | Should -Be 'b@contoso.com'
+    }
+}
+
+Describe 'Get-CIPPBecIPGuidance' {
+    It 'gathers the CIPP list as deciding entries and the named locations and Exchange lists as hints' {
+        Mock Get-CIPPIPAllowBlockList { @([pscustomobject]@{ Range = '198.51.100.0/24'; State = 'Blocked'; Scope = 'AllTenants'; Prefix = 24; Note = 'kit' }) }
+        Mock New-GraphGetRequest { @(
+                [pscustomobject]@{ '@odata.type' = '#microsoft.graph.ipNamedLocation'; displayName = 'HQ'; isTrusted = $true; ipRanges = @([pscustomobject]@{ cidrAddress = '203.0.113.0/24' }) }
+                [pscustomobject]@{ '@odata.type' = '#microsoft.graph.ipNamedLocation'; displayName = 'Blocked countries IPs'; isTrusted = $false; ipRanges = @([pscustomobject]@{ cidrAddress = '192.0.2.0/24' }) }
+            ) }
+        Mock Get-CIPPTenantAllowBlockListItems { @([pscustomobject]@{ Value = '2001:db8::1'; Action = 'Block'; Notes = $null }) }
+        Mock New-ExoRequest { @([pscustomobject]@{ Name = 'Default'; IPAllowList = @('192.0.2.10', '192.0.2.20-192.0.2.30'); IPBlockList = @() }) }
+        $Result = Get-CIPPBecIPGuidance -TenantFilter 'contoso.com'
+        $Result.Complete | Should -BeTrue
+        ($Result.Data | Where-Object Range -EQ '198.51.100.0/24').Strength | Should -Be 'List'
+        ($Result.Data | Where-Object Range -EQ '203.0.113.0/24').Source | Should -Be "Trusted named location 'HQ'"
+        ($Result.Data | Where-Object Range -EQ '192.0.2.0/24') | Should -BeNullOrEmpty -Because 'only trusted named locations say anything about the user'
+        ($Result.Data | Where-Object Range -EQ '2001:db8::1').Verdict | Should -Be 'Blocked'
+        @($Result.Data | Where-Object Source -Like 'Connection filter*').Range | Should -Be @('192.0.2.10') -Because 'hyphenated ranges are skipped'
+    }
+
+    It 'keeps the other sources when one fails and reports it' {
+        Mock Get-CIPPIPAllowBlockList { @([pscustomobject]@{ Range = '198.51.100.7'; State = 'Trusted'; Scope = 'Tenant'; Prefix = 32 }) }
+        Mock New-GraphGetRequest { throw 'Forbidden' }
+        Mock Get-CIPPTenantAllowBlockListItems { @() }
+        Mock New-ExoRequest { @() }
+        $Result = Get-CIPPBecIPGuidance -TenantFilter 'contoso.com'
+        $Result.Complete | Should -BeFalse
+        $Result.Error | Should -Match 'named locations: Forbidden'
+        @($Result.Data).Count | Should -Be 1
+    }
+}
diff --git a/Tests/Private/BecIPReview.Tests.ps1 b/Tests/Private/BecIPReview.Tests.ps1
new file mode 100644
index 0000000000000..821811815b4e7
--- /dev/null
+++ b/Tests/Private/BecIPReview.Tests.ps1
@@ -0,0 +1,190 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    class HttpResponseContext { [int]$StatusCode; [object]$Body }
+    $TypeAccelerators = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')
+    if (-not ([System.Management.Automation.PSTypeName]'HttpStatusCode').Type) {
+        $TypeAccelerators::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+    }
+    function New-GraphBulkRequest { param($Requests, $tenantid, $asapp, $Version, $NoPaginateIds) }
+    function Get-CIPPBecReport { param($TenantFilter, $CaseId, [switch]$IncludeResults) }
+    function Set-CIPPBecReport { param($TenantFilter, $CaseId, $Properties, $Results) }
+    function Get-CIPPBecMailActivity { param($TenantFilter, $UserPrincipalName, $StartDate, $EndDate, $Heuristics, $Anchor) }
+    function Invoke-CIPPBecIPAnalysis { param($TenantFilter, $UserId, $UserPrincipalName, $Results, $Heuristics, $WindowStart, $UsageLocation, $Anchor, $Baseline, $KnownPeers, $Overrides, $ExtraPeers, $TechnicianIPs) }
+    function Get-CIPPBecAttackerActivity { param($TenantFilter, $UserPrincipalName, $StartDate, $EndDate, $Heuristics, $Verdicts, $SignIns, $NonInteractiveSignIns, $MailRecords, $SharingChanges, $KnownSubjects, $Anchor) }
+    function Get-CIPPBecDelegatedAccess { param($TenantFilter, $UserPrincipalName, $UserDisplayName, $PermissionChanges, $MailActivity, $AttackerMail) }
+    function Get-CIPPBecBlastRadius { param($TenantFilter, $UserId, $UserPrincipalName, $Verdicts, $Peers, $StartDate, $EndDate, $Heuristics, $Anchor) }
+    function Start-CIPPBecIPReviewJob { param($TenantFilter, $CaseId, $Overrides, $CorrelateUserIds, $UserPrincipalName, $Headers) }
+    function New-CIPPAsyncDeployment { param($JobId, $Names, $StepTitles, $Source, $TaskId, $TenantFilter) }
+    function Set-CIPPAsyncDeploymentStep { param($JobId, $Name, $StepIndex, $StepStatus, $Message) }
+    function Set-CIPPAsyncDeploymentStatus { param($JobId, $Name, $Status, $Logs) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $sev, $LogData) }
+    function Get-NormalizedError { param($message) $message }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    $env:CIPPRootPath = $RepoRoot
+    foreach ($File in @('ConvertTo-CIPPODataFilterValue.ps1', 'Authentication/ConvertTo-CIPPIPRange.ps1', 'BEC/ConvertTo-CIPPBecHostAddress.ps1', 'BEC/New-CIPPBecCollectorResult.ps1', 'BEC/Get-CIPPBecHeuristics.ps1', 'BEC/Get-CIPPBecErrorInfo.ps1', 'BEC/Get-CIPPBecScore.ps1', 'BEC/Set-CIPPBecIPVerdictStamp.ps1', 'BEC/Get-CIPPBecCorrelatedUserPeers.ps1', 'BEC/Invoke-CIPPBecIPReview.ps1')) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$File")
+    }
+    . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-ExecBECIPReview.ps1' | Select-Object -First 1).FullName
+
+    function New-Request { param($Body) [pscustomobject]@{ Params = [pscustomobject]@{ CIPPEndpoint = 'ExecBECIPReview' }; Headers = $null; Query = $null; Body = [pscustomobject]$Body } }
+    function New-Case {
+        [pscustomobject]@{
+            UserId = 'u1'; UserPrincipalName = 'victim@contoso.com'; DisplayName = 'Victim'; Status = 'Completed'
+            Results = [pscustomobject]@{
+                ExtractedAt        = '2026-09-23T00:00:00Z'
+                AnalysisWindowDays = 7
+                LocationAnalysis   = [pscustomobject]@{ UsageLocation = 'AU' }
+                SuspectUserSignIns = @([pscustomobject]@{ IPAddress = '198.51.100.7' }, [pscustomobject]@{ IPAddress = '203.0.113.10' })
+                IPBaseline         = [pscustomobject]@{ Successful = 40 }
+                IPPeers            = @([pscustomobject]@{ IP = '198.51.100.7'; OtherUsersBefore = 0 })
+                IPVerdicts         = @([pscustomobject]@{ IP = '198.51.100.7'; Verdict = 'Unknown' })
+                IPReviewHistory    = @([pscustomobject]@{ At = 'earlier'; By = 'someone' })
+                Completeness       = [pscustomobject]@{ SignIns = [pscustomobject]@{ Complete = $true } }
+                MailboxPermissionChanges = @()
+                SharingChanges     = @()
+            }
+        }
+    }
+}
+
+AfterAll { $env:CIPPRootPath = $null }
+
+Describe 'Get-CIPPBecCorrelatedUserPeers' {
+    It 'keeps only the addresses of the case, split into before and only in the window' {
+        Mock New-GraphBulkRequest {
+            @(
+                [pscustomobject]@{ id = 'i0'; status = 200; body = [pscustomobject]@{ value = @(
+                            [pscustomobject]@{ ipAddress = '203.0.113.10'; userPrincipalName = 'colleague@contoso.com'; createdDateTime = '2026-09-01T00:00:00Z' }
+                            [pscustomobject]@{ ipAddress = '192.0.2.99'; userPrincipalName = 'colleague@contoso.com'; createdDateTime = '2026-09-01T00:00:00Z' }
+                        ) } }
+                [pscustomobject]@{ id = 'n0'; status = 200; body = [pscustomobject]@{ value = @([pscustomobject]@{ ipAddress = '198.51.100.7'; userPrincipalName = 'colleague@contoso.com'; createdDateTime = '2026-09-20T00:00:00Z' }) } }
+            )
+        }
+        $Peers = Get-CIPPBecCorrelatedUserPeers -TenantFilter 'contoso.com' -UserIds @('11111111-1111-1111-1111-111111111111') -IPs @('203.0.113.10', '198.51.100.7') -StartDate '2026-08-15' -WindowStart '2026-09-16'
+        $Peers.ContainsKey('192.0.2.99') | Should -BeFalse
+        $Peers['203.0.113.10'].OtherUsersBefore | Should -Be 1
+        $Peers['198.51.100.7'].OtherUsersInWindowOnly | Should -Be 1
+    }
+}
+
+Describe 'Invoke-CIPPBecIPReview' {
+    BeforeEach {
+        Mock Get-CIPPBecReport { New-Case }
+        Mock Set-CIPPBecReport { $script:Saved = @{ Results = $Results; Properties = $Properties } }
+        Mock Get-CIPPBecMailActivity { $R = New-CIPPBecCollectorResult -Data @([pscustomobject]@{ Operation = 'MailItemsAccessed'; ClientIP = '198.51.100.7'; Count = 4 }); $R | Add-Member -NotePropertyName Summary -NotePropertyValue ([pscustomobject]@{ Records = 4 }) -Force; $R | Add-Member -NotePropertyName Records -NotePropertyValue @([pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'MailItemsAccessed' } }) -Force; $R }
+        Mock Invoke-CIPPBecIPAnalysis {
+            $script:AnalysisArgs = @{ Overrides = $Overrides; Baseline = $Baseline; KnownPeers = $KnownPeers; ExtraPeers = $ExtraPeers; WindowStart = $WindowStart; TechnicianIPs = $TechnicianIPs }
+            [pscustomobject]@{
+                Baseline = New-CIPPBecCollectorResult -Data $Baseline; Guidance = New-CIPPBecCollectorResult -Data @(); PeersResult = New-CIPPBecCollectorResult -Data @()
+                Peers = @{}; Geo = @{}; Events = @()
+                Verdicts = @([pscustomobject]@{ IP = '198.51.100.7'; Verdict = 'Compromised'; SuccessfulSignIns = 1; Activities = 4 })
+            }
+        }
+        Mock Get-CIPPBecAttackerActivity {
+            $script:AttackerArgs = @{ MailRecords = $MailRecords; Verdicts = $Verdicts }
+            $Mail = New-CIPPBecCollectorResult -Data @([pscustomobject]@{ Operation = 'MailItemsAccessed'; IPVerdict = 'Compromised'; MailboxOwner = 'victim@contoso.com' })
+            $Mail | Add-Member -NotePropertyName Summary -NotePropertyValue ([pscustomobject]@{ MessagesOpened = 1 }) -Force
+            $Forms = New-CIPPBecCollectorResult -Data @(); $Forms | Add-Member -NotePropertyName Summary -NotePropertyValue $null -Force
+            [pscustomobject]@{ Mail = $Mail; Files = (New-CIPPBecCollectorResult -Data @()); LinkUsage = (New-CIPPBecCollectorResult -Data @()); Forms = $Forms }
+        }
+        Mock Get-CIPPBecDelegatedAccess { New-CIPPBecCollectorResult -Data @() }
+        Mock Get-CIPPBecBlastRadius { $script:BlastVerdicts = $Verdicts; New-CIPPBecCollectorResult -Data @([pscustomobject]@{ UserPrincipalName = 'cfo@contoso.com'; Reached = $true }) }
+        Mock New-GraphBulkRequest { @() }
+        $script:Steps = [System.Collections.Generic.List[object]]::new()
+        Mock Set-CIPPAsyncDeploymentStep { $script:Steps.Add(@{ Index = $StepIndex; Status = $StepStatus; Message = $Message }) }
+        Mock Set-CIPPAsyncDeploymentStatus { $script:FinalStatus = $Status }
+        Mock New-CIPPAsyncDeployment { $JobId }
+        Mock Write-LogMessage { }
+    }
+
+    It 're-judges with the overrides, the stored baseline and peers, and replaces only the address-dependent sections' {
+        $Headers = @{ 'x-ms-client-principal' = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('{"userDetails":"tech@msp.com"}')); 'x-forwarded-for' = '192.0.2.77:51000, 10.0.0.1' }
+        $Message = Invoke-CIPPBecIPReview -TenantFilter 'contoso.com' -CaseId 'BEC-1' -Overrides @([pscustomobject]@{ IP = '198.51.100.0/24'; Verdict = 'Compromised'; Note = 'AiTM proxy' }, [pscustomobject]@{ IP = '203.0.113.10'; Verdict = 'Auto' }) -DeploymentId 'job-1' -Headers $Headers
+        $Message | Should -Match 'threat level'
+        @($script:AnalysisArgs.Overrides).Count | Should -Be 1 -Because 'Auto means no override'
+        $script:AnalysisArgs.Overrides[0].Range | Should -Be '198.51.100.0/24'
+        $script:AnalysisArgs.Baseline.Successful | Should -Be 40
+        $script:AnalysisArgs.KnownPeers[0].IP | Should -Be '198.51.100.7'
+        ([datetime]$script:AnalysisArgs.WindowStart).ToUniversalTime().ToString('yyyy-MM-dd') | Should -Be '2026-09-16' -Because 'the case keeps its original window'
+        @($script:AttackerArgs.MailRecords).Count | Should -Be 1 -Because 'the fresh mailbox records feed the detail pass'
+        $R = $script:Saved.Results
+        $R.IPVerdicts[0].Verdict | Should -Be 'Compromised'
+        $R.IPOverrides[0].Note | Should -Be 'AiTM proxy'
+        $script:BlastVerdicts[0].Verdict | Should -Be 'Compromised' -Because 'the blast radius follows the re-judged verdicts'
+        $R.BlastRadius[0].UserPrincipalName | Should -Be 'cfo@contoso.com'
+        $R.SuspectUserSignIns[0].IPVerdict | Should -Be 'Compromised'
+        $R.IPReviewHistory.Count | Should -Be 2
+        $R.IPReviewHistory[-1].By | Should -Be 'tech@msp.com'
+        # the reviewer's address (first x-forwarded-for hop, port stripped) joins the case's technicians
+        $script:AnalysisArgs.TechnicianIPs[0].IP | Should -Be '192.0.2.77'
+        $script:AnalysisArgs.TechnicianIPs[0].By | Should -Be 'tech@msp.com'
+        $R.IPTechnicians[0].IP | Should -Be '192.0.2.77'
+        $R.Completeness.SignIns.Complete | Should -BeTrue -Because 'sections the review does not touch keep their markers'
+        $R.Completeness.AttackerMailActivity.Complete | Should -BeTrue
+        $script:Saved.Properties.Level | Should -Not -BeNullOrEmpty
+        $script:Saved.Properties.LastIPReviewAt | Should -Not -BeNullOrEmpty
+        @($script:Steps | Where-Object Status -EQ 'succeeded').Index | Should -Be @(0..5)
+        $script:FinalStatus | Should -Be 'succeeded'
+    }
+
+    It 'correlates chosen accounts across the addresses of the case' {
+        Mock Get-CIPPBecCorrelatedUserPeers { $script:CorrelateArgs = @{ UserIds = $UserIds; IPs = $IPs }; @{ '198.51.100.7' = [pscustomobject]@{ IP = '198.51.100.7'; OtherUsersBefore = 3 } } }
+        $null = Invoke-CIPPBecIPReview -TenantFilter 'contoso.com' -CaseId 'BEC-1' -CorrelateUserIds @('c1', 'c2')
+        @($script:CorrelateArgs.UserIds) | Should -Be @('c1', 'c2')
+        @($script:CorrelateArgs.IPs | Sort-Object) | Should -Be @('198.51.100.7', '203.0.113.10')
+        $script:AnalysisArgs.ExtraPeers['198.51.100.7'].OtherUsersBefore | Should -Be 3
+    }
+
+    It 'fails the step that broke and leaves the case untouched' {
+        Mock Invoke-CIPPBecIPAnalysis { throw 'Graph 503' }
+        { Invoke-CIPPBecIPReview -TenantFilter 'contoso.com' -CaseId 'BEC-1' -DeploymentId 'job-1' } | Should -Throw '*Graph 503*'
+        ($script:Steps | Where-Object Status -EQ 'failed').Index | Should -Be 3
+        $script:FinalStatus | Should -Be 'failed'
+        Should -Invoke Set-CIPPBecReport -Times 0
+    }
+
+    It 'refuses a case that has not completed' {
+        Mock Get-CIPPBecReport { [pscustomobject]@{ Status = 'Running' } }
+        { Invoke-CIPPBecIPReview -TenantFilter 'contoso.com' -CaseId 'BEC-1' } | Should -Throw '*not a completed investigation*'
+    }
+}
+
+Describe 'Invoke-ExecBECIPReview' {
+    BeforeEach {
+        Mock Get-CIPPBecReport { [pscustomobject]@{ Status = 'Completed'; UserPrincipalName = 'victim@contoso.com' } }
+        Mock Start-CIPPBecIPReviewJob { 'job-1' }
+        Mock Write-LogMessage { }
+    }
+
+    It 'validates and normalises the overrides, keeps the chosen accounts, and returns the DeploymentId' {
+        $Response = Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1'; Overrides = @([pscustomobject]@{ IP = ' 198.51.100.0/24 '; Verdict = [pscustomobject]@{ value = 'Compromised' }; Note = 'proxy' }, [pscustomobject]@{ IP = '203.0.113.10'; Verdict = 'Auto' }); CorrelateUsers = @([pscustomobject]@{ value = 'c1'; label = 'Colleague' }, 'c1') }) -TriggerMetadata $null
+        $Response.StatusCode | Should -Be 200
+        $Response.Body.DeploymentId | Should -Be 'job-1'
+        Should -Invoke Start-CIPPBecIPReviewJob -Times 1 -ParameterFilter { @($Overrides).Count -eq 1 -and $Overrides[0].IP -eq '198.51.100.0/24' -and $Overrides[0].Verdict -eq 'Compromised' -and (@($CorrelateUserIds) -join ',') -eq 'c1' -and $UserPrincipalName -eq 'victim@contoso.com' }
+    }
+
+    It 'refuses a re-run when no verdict changed and no account is to be correlated' {
+        Mock Get-CIPPBecReport { [pscustomobject]@{ Status = 'Completed'; Results = [pscustomobject]@{ IPOverrides = @([pscustomobject]@{ Range = '198.51.100.0/24'; Verdict = 'Compromised'; Note = 'old note' }) } } }
+        $Same = Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1'; Overrides = @([pscustomobject]@{ IP = '198.51.100.0/24'; Verdict = 'Compromised'; Note = 'reworded' }) }) -TriggerMetadata $null
+        $Same.StatusCode | Should -Be 400
+        $Same.Body.Results[0].resultText | Should -Match 'Nothing changed'
+        Mock Get-CIPPBecReport { [pscustomobject]@{ Status = 'Completed'; Results = [pscustomobject]@{ IPOverrides = @() } } }
+        $AllAuto = Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1'; Overrides = @([pscustomobject]@{ IP = '198.51.100.7'; Verdict = 'Auto' }) }) -TriggerMetadata $null
+        $AllAuto.StatusCode | Should -Be 400 -Because 'all Auto is what the case already ran with'
+        $AllAuto.Body.Results[0].resultText | Should -Match 'at least one address'
+        Mock Get-CIPPBecReport { [pscustomobject]@{ Status = 'Completed'; Results = [pscustomobject]@{ IPOverrides = @([pscustomobject]@{ Range = '198.51.100.7'; Verdict = 'Safe' }) } } }
+        (Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1'; Overrides = @([pscustomobject]@{ IP = '198.51.100.7'; Verdict = 'Auto' }) }) -TriggerMetadata $null).StatusCode | Should -Be 400 -Because 'going back to all Auto is not a re-run either'
+        Should -Invoke Start-CIPPBecIPReviewJob -Times 0
+        (Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1'; CorrelateUsers = @('c1') }) -TriggerMetadata $null).StatusCode | Should -Be 200 -Because 'correlating accounts is a change'
+    }
+
+    It 'rejects an invalid address or verdict, an unknown case and an unfinished one without queueing' {
+        (Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1'; Overrides = @([pscustomobject]@{ IP = 'example.com'; Verdict = 'Safe' }) }) -TriggerMetadata $null).StatusCode | Should -Be 400
+        (Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1'; Overrides = @([pscustomobject]@{ IP = '198.51.100.7'; Verdict = 'Maybe' }) }) -TriggerMetadata $null).StatusCode | Should -Be 400
+        Mock Get-CIPPBecReport { $null }
+        (Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-9' }) -TriggerMetadata $null).StatusCode | Should -Be 404
+        Mock Get-CIPPBecReport { [pscustomobject]@{ Status = 'Running' } }
+        (Invoke-ExecBECIPReview -Request (New-Request @{ tenantFilter = 'contoso.com'; CaseId = 'BEC-1' }) -TriggerMetadata $null).StatusCode | Should -Be 400
+        Should -Invoke Start-CIPPBecIPReviewJob -Times 0
+    }
+}
diff --git a/Tests/Private/BecReportStorage.Tests.ps1 b/Tests/Private/BecReportStorage.Tests.ps1
new file mode 100644
index 0000000000000..4c612847f2f24
--- /dev/null
+++ b/Tests/Private/BecReportStorage.Tests.ps1
@@ -0,0 +1,132 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Get-CIPPTable { param($TableName) @{ Context = @{ TableName = $TableName } } }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force, [string]$OperationType, [switch]$CreateTableIfNotExists) }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property, $First) }
+    function Remove-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function New-CIPPAzStorageRequest { param($Service, $Resource, $Method, $Body, $ContentType) throw 'blob storage must not be touched' }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Set-CIPPBecReport.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecReport.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Remove-CIPPBecReport.ps1')
+}
+
+Describe 'Set-CIPPBecReport' {
+    BeforeEach {
+        $script:Writes = [System.Collections.Generic.List[object]]::new()
+        Mock Add-CIPPAzDataTableEntity { $script:Writes.Add(@{ Table = $Context.TableName; Entity = $Entity; Force = $Force.IsPresent; OperationType = $OperationType }) }
+    }
+
+    It 'writes the results to their own BecResults row (replace) and records the size on the merged run row' {
+        $Results = [pscustomobject]@{ CaseId = 'BEC-1'; NewRules = @([pscustomobject]@{ Name = 'r1' }) }
+        $Entity = Set-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-1' -Properties @{ Status = 'Completed' } -Results $Results
+        $ResultsWrite = $script:Writes | Where-Object { $_.Table -eq 'BecResults' }
+        $ResultsWrite | Should -HaveCount 1
+        $ResultsWrite.Force | Should -BeTrue -Because 'replace lets the large-entity writer clean up shrunken part rows'
+        $ResultsWrite.Entity.PartitionKey | Should -Be 'contoso.com'
+        $ResultsWrite.Entity.RowKey | Should -Be 'BEC-1'
+        $ResultsWrite.Entity.Results | Should -Match '"NewRules"'
+        $RowWrite = $script:Writes | Where-Object { $_.Table -eq 'BecReports' }
+        $RowWrite | Should -HaveCount 1
+        $RowWrite.OperationType | Should -Be 'UpsertMerge'
+        $Entity.Keys | Should -Not -Contain 'ResultsBlob'
+    }
+
+    It 'replaces the run row without touching the results table when only properties are given' {
+        Set-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-1' -Replace -Properties @{ Status = 'Waiting'; UserId = 'u1' } | Out-Null
+        @($script:Writes | Where-Object { $_.Table -eq 'BecResults' }).Count | Should -Be 0
+        ($script:Writes | Where-Object { $_.Table -eq 'BecReports' }).Force | Should -BeTrue
+    }
+
+    It 'stores structured properties as compact JSON' {
+        $Entity = Set-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-1' -Properties @{ Containment = @([pscustomobject]@{ At = 'x'; Actions = @('ResetPassword') }) }
+        $Entity.Containment | Should -BeOfType [string]
+        $Entity.Containment | Should -Match '"Actions":\["ResetPassword"\]'
+    }
+}
+
+Describe 'Get-CIPPBecReport' {
+    BeforeEach {
+        $script:RunRows = @(
+            [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-20260801000000-aaaaaa'; UserId = 'u1'; Status = 'Completed'; Containment = '[{"At":"x","Actions":["ResetPassword"]}]'; EvidenceExports = '[{"At":"y","Sha256":"abc"}]'; ETag = 'e1' }
+            [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-20260805000000-bbbbbb'; UserId = 'u2'; Status = 'Completed'; ETag = 'e2' }
+            [pscustomobject]@{ PartitionKey = 'fabrikam.com'; RowKey = 'BEC-20260803000000-cccccc'; UserId = 'u3'; Status = 'Waiting'; ETag = 'e3' }
+        )
+        Mock Get-CIPPAzDataTableEntity {
+            if ($Context.TableName -eq 'BecResults') {
+                if ($Filter -like "*BEC-20260801000000-aaaaaa*") {
+                    return [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-20260801000000-aaaaaa'; Results = '{"CaseId":"BEC-20260801000000-aaaaaa","NewRules":[{"Name":"r"}]}' }
+                }
+                return $null
+            }
+            $Rows = $script:RunRows
+            if ($Filter -match "PartitionKey eq '([^']+)'") { $Rows = $Rows | Where-Object { $_.PartitionKey -eq $Matches[1] } }
+            if ($Filter -match "RowKey eq '([^']+)'") { $Rows = $Rows | Where-Object { $_.RowKey -eq $Matches[1] } }
+            if ($Filter -match "UserId eq '([^']+)'") { $Rows = $Rows | Where-Object { $_.UserId -eq $Matches[1] } }
+            $Rows
+        }
+    }
+
+    It 'lists a tenant newest first with CaseId/Tenant aliases and parsed Containment' {
+        $Rows = @(Get-CIPPBecReport -TenantFilter 'contoso.com')
+        $Rows.Count | Should -Be 2
+        $Rows[0].CaseId | Should -Be 'BEC-20260805000000-bbbbbb'
+        $Rows[1].Tenant | Should -Be 'contoso.com'
+        $Rows[1].Containment[0].Actions | Should -Be @('ResetPassword')
+        # ConvertFrom-Json unrolls a JSON array; a one-entry history must still be a list for the case page
+        $Rows[1].Containment -is [array] | Should -BeTrue
+        @($Rows[1].Containment).Count | Should -Be 1
+    }
+
+    It 'narrows to one user and scans every tenant for AllTenants' {
+        @(Get-CIPPBecReport -TenantFilter 'contoso.com' -UserId 'u1').Count | Should -Be 1
+        @(Get-CIPPBecReport -TenantFilter 'AllTenants').Count | Should -Be 3
+    }
+
+    It 'fetches and parses the results row from the BecResults table for a single run when asked' {
+        $Run = Get-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-20260801000000-aaaaaa' -IncludeResults
+        $Run.Results.NewRules[0].Name | Should -Be 'r'
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -ParameterFilter { $Context.TableName -eq 'BecResults' }
+    }
+
+    It 'throws when a completed run has no results row rather than returning a run without data' {
+        { Get-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-20260805000000-bbbbbb' -IncludeResults } | Should -Throw '*not found in the BecResults table*'
+    }
+
+    It 'attaches nothing for a run that has not completed - polling a queued or running run is not an error' {
+        $Run = Get-CIPPBecReport -TenantFilter 'fabrikam.com' -CaseId 'BEC-20260803000000-cccccc' -IncludeResults
+        $Run.Status | Should -Be 'Waiting'
+        $Run.PSObject.Properties['Results'] | Should -BeNullOrEmpty
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 0 -ParameterFilter { $Context.TableName -eq 'BecResults' }
+    }
+}
+
+Describe 'Remove-CIPPBecReport' {
+    BeforeEach {
+        $script:Removed = [System.Collections.Generic.List[object]]::new()
+        Mock Remove-CIPPAzDataTableEntity { $script:Removed.Add(@{ Table = $Context.TableName; Entity = $Entity }) }
+    }
+
+    It 'removes the BecResults row first, then the run row, through the part-aware remover' {
+        Mock Get-CIPPAzDataTableEntity {
+            if ($Context.TableName -eq 'BecResults') { return [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-1'; Results = '{}'; ETag = 'r1' } }
+            [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-1'; Status = 'Completed'; ETag = 'e1' }
+        }
+        Remove-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-1' | Should -Match 'Deleted BEC run BEC-1'
+        $script:Removed.Count | Should -Be 2
+        $script:Removed[0].Table | Should -Be 'BecResults'
+        $script:Removed[1].Table | Should -Be 'BecReports'
+        $script:Removed[1].Entity.RowKey | Should -Be 'BEC-1'
+    }
+
+    It 'tolerates a run that never stored results and refuses one that does not exist' {
+        Mock Get-CIPPAzDataTableEntity {
+            if ($Context.TableName -eq 'BecResults') { return $null }
+            [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = 'BEC-1'; Status = 'Error'; ETag = 'e1' }
+        }
+        $null = Remove-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-1'
+        $script:Removed.Count | Should -Be 1
+        $script:Removed[0].Table | Should -Be 'BecReports'
+        Mock Get-CIPPAzDataTableEntity { $null }
+        { Remove-CIPPBecReport -TenantFilter 'contoso.com' -CaseId 'BEC-x' } | Should -Throw '*was not found*'
+    }
+}
diff --git a/Tests/Private/BecRunRequest.Tests.ps1 b/Tests/Private/BecRunRequest.Tests.ps1
new file mode 100644
index 0000000000000..1d4b2f518c469
--- /dev/null
+++ b/Tests/Private/BecRunRequest.Tests.ps1
@@ -0,0 +1,68 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Set-CIPPBecReport { param($TenantFilter, $CaseId, $Properties, $Results, [switch]$Replace) }
+    function New-CIPPAsyncDeployment { param($JobId, $Names, $StepTitles, $Source, $TenantFilter) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCaseId.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecRunSteps.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecRunRequest.ps1')
+}
+
+Describe 'New-CIPPBecRunRequest requester address' {
+    It 'records the address of the requesting technician on the case and the run item' {
+        Mock Set-CIPPBecReport { $script:RequestProperties = $Properties }
+        Mock New-CIPPAsyncDeployment { $JobId }
+        $Prepared = New-CIPPBecRunRequest -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -RequestedBy 'tech@msp.com' -RequestedFromIP '192.0.2.77'
+        $Prepared.Item.RequestedFromIP | Should -Be '192.0.2.77'
+        $Prepared.Item.RequestedBy | Should -Be 'tech@msp.com'
+        $script:RequestProperties.RequestedFromIP | Should -Be '192.0.2.77'
+    }
+}
+
+Describe 'Get-CIPPBecRunSteps' {
+    It 'defines the twelve phases of the investigation in order, with the score last' {
+        $Steps = @(Get-CIPPBecRunSteps)
+        $Steps.Key | Should -Be @('AuditLog', 'SignIns', 'MailboxRules', 'SentMail', 'Tenant', 'MailboxInventory', 'Grants', 'TransportRules', 'ReceivedMail', 'Directory', 'Activity', 'IPAnalysis', 'AttackerActivity', 'Score')
+        $Steps | ForEach-Object { $_.Title | Should -Not -BeNullOrEmpty }
+        @($Steps.Key | Select-Object -Unique).Count | Should -Be 14 -Because 'keys index the steps'
+    }
+}
+
+Describe 'New-CIPPBecRunRequest' {
+    BeforeEach {
+        $script:Rows = [System.Collections.Generic.List[object]]::new()
+        Mock Set-CIPPBecReport { $script:Rows.Add(@{ CaseId = $CaseId; Properties = $Properties; Replace = $Replace.IsPresent }) }
+        $script:Jobs = [System.Collections.Generic.List[object]]::new()
+        Mock New-CIPPAsyncDeployment { $script:Jobs.Add(@{ JobId = $JobId; Names = $Names; StepTitles = $StepTitles; Source = $Source }); $JobId }
+    }
+
+    It 'writes the Waiting history row, the queued progress job keyed on the case id, and returns the queue item' {
+        $Prepared = New-CIPPBecRunRequest -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -DisplayName 'Victim' -RequestedBy 'tech@msp.com'
+        $Prepared.CaseId | Should -Match '^BEC-'
+        $script:Rows.Count | Should -Be 1
+        $script:Rows[0].CaseId | Should -Be $Prepared.CaseId
+        $script:Rows[0].Replace | Should -BeTrue
+        $script:Rows[0].Properties.Status | Should -Be 'Waiting'
+        $script:Rows[0].Properties.UserPrincipalName | Should -Be 'victim@contoso.com'
+        $script:Rows[0].Properties.DisplayName | Should -Be 'Victim'
+        $script:Rows[0].Properties.RequestedBy | Should -Be 'tech@msp.com'
+        $script:Rows[0].Properties.ContainsKey('QueueId') | Should -BeFalse
+        $script:Jobs.Count | Should -Be 1
+        $script:Jobs[0].JobId | Should -Be $Prepared.CaseId -Because 'the page polls progress by case id'
+        $script:Jobs[0].Names | Should -Be @('victim@contoso.com')
+        $script:Jobs[0].Source | Should -Be 'BEC'
+        @($script:Jobs[0].StepTitles).Count | Should -Be 14
+        $Prepared.Item.FunctionName | Should -Be 'BECRun'
+        $Prepared.Item.UserID | Should -Be 'u1'
+        $Prepared.Item.userName | Should -Be 'victim@contoso.com'
+        $Prepared.Item.CaseId | Should -Be $Prepared.CaseId
+        $Prepared.Item.ContainsKey('QueueId') | Should -BeFalse
+    }
+
+    It 'carries the queue id for bulk runs and falls back to the object id as the progress name' {
+        $Prepared = New-CIPPBecRunRequest -TenantFilter 'contoso.com' -UserId 'u2' -QueueId 'q-1'
+        $script:Rows[0].Properties.QueueId | Should -Be 'q-1'
+        $script:Jobs[0].Names | Should -Be @('u2')
+        $Prepared.Item.QueueId | Should -Be 'q-1'
+        $Prepared.Item.QueueName | Should -Be 'BEC investigation u2'
+    }
+}
diff --git a/Tests/Private/CIPPIPAllowBlockList.Tests.ps1 b/Tests/Private/CIPPIPAllowBlockList.Tests.ps1
new file mode 100644
index 0000000000000..6018570f939bd
--- /dev/null
+++ b/Tests/Private/CIPPIPAllowBlockList.Tests.ps1
@@ -0,0 +1,69 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Get-CIPPTable { param($TableName) @{ TableName = $TableName } }
+    function Get-CIPPAzDataTableEntity { param($TableName, $Filter) }
+    foreach ($File in @('Authentication/ConvertTo-CIPPIPRange.ps1', 'Authentication/Test-IpInRange.ps1', 'Authentication/Get-CIPPIPAllowBlockList.ps1', 'Authentication/Resolve-CIPPIPAllowBlockList.ps1', 'BEC/ConvertTo-CIPPBecHostAddress.ps1')) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$File")
+    }
+}
+
+Describe 'ConvertTo-CIPPIPRange' {
+    It 'normalises addresses and ranges and drops a single-host prefix' {
+        ConvertTo-CIPPIPRange -Value ' 203.0.113.10 ' | Should -Be '203.0.113.10'
+        ConvertTo-CIPPIPRange -Value '203.0.113.0/24' | Should -Be '203.0.113.0/24'
+        ConvertTo-CIPPIPRange -Value '203.0.113.10/32' | Should -Be '203.0.113.10'
+        ConvertTo-CIPPIPRange -Value '[2001:DB8::1]' | Should -Be '2001:db8::1'
+        ConvertTo-CIPPIPRange -Value '2001:db8::/48' | Should -Be '2001:db8::/48'
+    }
+
+    It 'rejects anything that is not an address or a valid prefix' {
+        { ConvertTo-CIPPIPRange -Value 'example.com' } | Should -Throw
+        { ConvertTo-CIPPIPRange -Value '203.0.113.0/33' } | Should -Throw
+        { ConvertTo-CIPPIPRange -Value '2001:db8::/129' } | Should -Throw
+        { ConvertTo-CIPPIPRange -Value '12345' } | Should -Throw -Because 'a bare integer parses as an IPv4 address in .NET'
+        { ConvertTo-CIPPIPRange -Value '' } | Should -Throw
+    }
+}
+
+Describe 'Get-CIPPIPAllowBlockList' {
+    It 'reads active tenant and AllTenants rows, including legacy key-only rows and underscore-keyed ranges' {
+        Mock Get-CIPPAzDataTableEntity {
+            @(
+                [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = '203.0.113.0_24'; Range = '203.0.113.0/24'; state = 'Trusted'; Note = 'office' }
+                [pscustomobject]@{ PartitionKey = 'AllTenants'; RowKey = '198.51.100.7'; state = 'Blocked' }
+                [pscustomobject]@{ PartitionKey = 'AllTenants'; RowKey = 'garbage'; state = 'Blocked' }
+            )
+        }
+        $List = Get-CIPPIPAllowBlockList -TenantFilter 'contoso.com'
+        $List.Count | Should -Be 2 -Because 'an unparseable row is skipped, not fatal'
+        ($List | Where-Object Range -EQ '203.0.113.0/24').Prefix | Should -Be 24
+        ($List | Where-Object Range -EQ '198.51.100.7').Scope | Should -Be 'AllTenants'
+        Should -Invoke Get-CIPPAzDataTableEntity -ParameterFilter { $Filter -match "PartitionKey eq 'contoso.com' or PartitionKey eq 'AllTenants'" -and $Filter -match "state eq 'Blocked'" }
+    }
+}
+
+Describe 'Resolve-CIPPIPAllowBlockList' {
+    BeforeAll {
+        $script:Entries = @(
+            [pscustomobject]@{ Range = '203.0.113.0/24'; State = 'Blocked'; Scope = 'AllTenants'; Prefix = 24 }
+            [pscustomobject]@{ Range = '203.0.113.0/24'; State = 'Trusted'; Scope = 'Tenant'; Prefix = 24 }
+            [pscustomobject]@{ Range = '203.0.113.66'; State = 'Blocked'; Scope = 'Tenant'; Prefix = 32 }
+            [pscustomobject]@{ Range = '198.51.100.0/22'; State = 'Blocked'; Scope = 'AllTenants'; Prefix = 22 }
+        )
+    }
+
+    It 'lets a tenant allow relax an AllTenants block of the same range' {
+        (Resolve-CIPPIPAllowBlockList -IPAddress '203.0.113.10' -Entries $script:Entries).State | Should -Be 'Trusted'
+    }
+
+    It 'lets the most specific range win, and ignores a client port' {
+        (Resolve-CIPPIPAllowBlockList -IPAddress '203.0.113.66:51234' -Entries $script:Entries).State | Should -Be 'Blocked'
+        (Resolve-CIPPIPAllowBlockList -IPAddress '198.51.101.200' -Entries $script:Entries).Range | Should -Be '198.51.100.0/22'
+    }
+
+    It 'returns nothing for an unlisted, empty or other-family address' {
+        Resolve-CIPPIPAllowBlockList -IPAddress '192.0.2.1' -Entries $script:Entries | Should -BeNullOrEmpty
+        Resolve-CIPPIPAllowBlockList -IPAddress '' -Entries $script:Entries | Should -BeNullOrEmpty
+        Resolve-CIPPIPAllowBlockList -IPAddress '2001:db8::1' -Entries $script:Entries | Should -BeNullOrEmpty
+    }
+}
diff --git a/Tests/Private/Clear-CIPPImmutableId.Tests.ps1 b/Tests/Private/Clear-CIPPImmutableId.Tests.ps1
new file mode 100644
index 0000000000000..1a3b4ae7c5b90
--- /dev/null
+++ b/Tests/Private/Clear-CIPPImmutableId.Tests.ps1
@@ -0,0 +1,67 @@
+# Pester tests for Clear-CIPPImmutableId.
+#
+# Thin wrapper kept for the offboarding job and the delta-query scheduled task that persists its name.
+# It decides whether to clear now or schedule for after deletion, and delegates the clear itself to
+# Clear-CIPPOnPremisesAttributes with the immutable ID only.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Clear-CIPPImmutableId.ps1'
+    if (-not (Test-Path $FunctionPath)) { throw "Could not locate Clear-CIPPImmutableId.ps1 at $FunctionPath" }
+
+    function Clear-CIPPOnPremisesAttributes { param($TenantFilter, $UserID, $Username, $Headers, $APIName, $Attributes) }
+    function Write-LogMessage { param($headers, $API, $APIName, $tenant, $TenantFilter, $message, $Sev, $Severity, $LogData) }
+    function Get-CippException { param($Exception) @{ NormalizedError = "$Exception" } }
+    function Add-CIPPScheduledTask { param($Task, $hidden, $DisallowDuplicateName) }
+
+    . $FunctionPath
+}
+
+Describe 'Clear-CIPPImmutableId' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Add-CIPPScheduledTask -MockWith { }
+        Mock -CommandName Clear-CIPPOnPremisesAttributes -MockWith { "cleared $($Attributes -join ',')" }
+    }
+
+    It 'delegates to the shared helper with the immutable ID only' {
+        $Result = Clear-CIPPImmutableId -UserID 'user-guid' -TenantFilter 'contoso.com' -Username 'ada@contoso.com'
+
+        $Result | Should -Be 'cleared onPremisesImmutableId'
+        Should -Invoke Clear-CIPPOnPremisesAttributes -Times 1 -ParameterFilter {
+            $UserID -eq 'user-guid' -and $TenantFilter -eq 'contoso.com' -and $Username -eq 'ada@contoso.com' -and
+            @($Attributes).Count -eq 1 -and @($Attributes)[0] -eq 'onPremisesImmutableId'
+        }
+    }
+
+    It 'clears immediately when the user object is cloud-only with an immutable ID' {
+        $User = [pscustomobject]@{ onPremisesSyncEnabled = $false; onPremisesImmutableId = 'AbCd==' }
+
+        Clear-CIPPImmutableId -UserID 'user-guid' -TenantFilter 'contoso.com' -User $User
+
+        Should -Invoke Clear-CIPPOnPremisesAttributes -Times 1
+        Should -Invoke Add-CIPPScheduledTask -Times 0
+    }
+
+    It 'schedules a delta-query task instead of clearing when the user is still synced' {
+        $User = [pscustomobject]@{ onPremisesSyncEnabled = $true; onPremisesImmutableId = 'AbCd==' }
+
+        $Result = Clear-CIPPImmutableId -UserID 'user-guid' -TenantFilter 'contoso.com' -User $User -Username 'ada@contoso.com'
+
+        $Result | Should -Match 'Scheduled'
+        Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter {
+            $Task.Command.value -eq 'Clear-CIPPImmutableID' -and $Task.Trigger.EventType -eq 'deleted' -and $Task.Parameters.UserID -eq 'user-guid'
+        }
+        Should -Invoke Clear-CIPPOnPremisesAttributes -Times 0
+    }
+
+    It 'does nothing when the user object has no immutable ID' {
+        $User = [pscustomobject]@{ onPremisesSyncEnabled = $false; onPremisesImmutableId = $null }
+
+        $Result = Clear-CIPPImmutableId -UserID 'user-guid' -TenantFilter 'contoso.com' -User $User
+
+        $Result | Should -Match 'does not have an ImmutableID'
+        Should -Invoke Clear-CIPPOnPremisesAttributes -Times 0
+        Should -Invoke Add-CIPPScheduledTask -Times 0
+    }
+}
diff --git a/Tests/Private/Clear-CIPPOnPremisesAttributes.Tests.ps1 b/Tests/Private/Clear-CIPPOnPremisesAttributes.Tests.ps1
new file mode 100644
index 0000000000000..63d86128339f1
--- /dev/null
+++ b/Tests/Private/Clear-CIPPOnPremisesAttributes.Tests.ps1
@@ -0,0 +1,95 @@
+# Pester tests for Clear-CIPPOnPremisesAttributes.
+#
+# The shared helper behind the Clear On-Premises Attributes action and the immutable-ID wrapper.
+# Pins the PATCH body per attribute selection, the whitelist, the previous-values log entry and
+# the soft-deleted-user restore path.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Clear-CIPPOnPremisesAttributes.ps1'
+    if (-not (Test-Path $FunctionPath)) { throw "Could not locate Clear-CIPPOnPremisesAttributes.ps1 at $FunctionPath" }
+
+    function New-GraphGetRequest { [CmdletBinding()] param($uri, $tenantid) }
+    function New-GraphPostRequest { param($uri, $tenantid, $type, $body, $AsApp) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+    function Get-CippException { param($Exception) @{ NormalizedError = "$Exception" } }
+
+    . $FunctionPath
+
+    $script:AllAttributes = @(
+        'onPremisesDistinguishedName', 'onPremisesDomainName', 'onPremisesImmutableId', 'onPremisesObjectIdentifier',
+        'onPremisesSamAccountName', 'onPremisesSecurityIdentifier', 'onPremisesUserPrincipalName'
+    )
+}
+
+Describe 'Clear-CIPPOnPremisesAttributes' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CippException -MockWith { @{ NormalizedError = "$($Exception.Exception.Message)" } }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [pscustomobject]@{
+                id                          = 'user-guid'
+                userPrincipalName           = 'ada@contoso.com'
+                onPremisesImmutableId       = 'AbCd=='
+                onPremisesSamAccountName    = 'ada'
+                onPremisesDistinguishedName = 'CN=ada,DC=contoso,DC=local'
+            }
+        }
+        $script:CapturedBody = $null
+        Mock -CommandName New-GraphPostRequest -MockWith { $script:CapturedBody = $body }
+    }
+
+    It 'clears every documented attribute when none are specified' {
+        Clear-CIPPOnPremisesAttributes -UserID 'user-guid' -TenantFilter 'contoso.com'
+
+        $Body = $script:CapturedBody | ConvertFrom-Json
+        foreach ($Name in $script:AllAttributes) {
+            $Body.PSObject.Properties.Name | Should -Contain $Name
+            $Body.$Name | Should -BeNullOrEmpty
+        }
+        @($Body.PSObject.Properties).Count | Should -Be 7
+        Should -Invoke New-GraphPostRequest -Times 1 -ParameterFilter {
+            $type -eq 'PATCH' -and $uri -eq 'https://graph.microsoft.com/beta/users/user-guid' -and $tenantid -eq 'contoso.com' -and $AsApp -eq $true
+        }
+    }
+
+    It 'clears only the selected attribute' {
+        $Result = Clear-CIPPOnPremisesAttributes -UserID 'user-guid' -TenantFilter 'contoso.com' -Attributes 'onPremisesImmutableId'
+
+        $script:CapturedBody | Should -BeExactly '{"onPremisesImmutableId":null}'
+        $Result | Should -Match 'onPremisesImmutableId'
+    }
+
+    It 'normalises the casing of a selected attribute' {
+        Clear-CIPPOnPremisesAttributes -UserID 'user-guid' -TenantFilter 'contoso.com' -Attributes 'onpremisessamaccountname'
+
+        $script:CapturedBody | Should -BeExactly '{"onPremisesSamAccountName":null}'
+    }
+
+    It 'rejects an attribute outside the documented list without PATCHing' {
+        { Clear-CIPPOnPremisesAttributes -UserID 'user-guid' -TenantFilter 'contoso.com' -Attributes 'userPrincipalName' } |
+            Should -Throw -ExpectedMessage '*not a clearable on-premises attribute*'
+
+        Should -Invoke New-GraphPostRequest -Times 0
+    }
+
+    It 'records the previous values on the success log entry' {
+        Clear-CIPPOnPremisesAttributes -UserID 'user-guid' -TenantFilter 'contoso.com' -Attributes 'onPremisesImmutableId', 'onPremisesSamAccountName'
+
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter {
+            $Sev -eq 'Info' -and $LogData.onPremisesImmutableId -eq 'AbCd==' -and $LogData.onPremisesSamAccountName -eq 'ada'
+        }
+    }
+
+    It 'restores a soft-deleted user before clearing' {
+        Mock -CommandName New-GraphGetRequest -MockWith { throw 'Request_ResourceNotFound' }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*directory/deletedItems/user-guid' } -MockWith {
+            [pscustomobject]@{ id = 'user-guid' }
+        }
+
+        Clear-CIPPOnPremisesAttributes -UserID 'user-guid' -TenantFilter 'contoso.com' -Attributes 'onPremisesImmutableId'
+
+        Should -Invoke New-GraphPostRequest -Times 1 -ParameterFilter { $type -eq 'POST' -and $uri -like '*deletedItems/user-guid/restore' }
+        Should -Invoke New-GraphPostRequest -Times 1 -ParameterFilter { $type -eq 'PATCH' }
+    }
+}
diff --git a/Tests/Private/Compare-CIPPIntuneAssignments.Tests.ps1 b/Tests/Private/Compare-CIPPIntuneAssignments.Tests.ps1
index c708c75460f69..73762a0c9eb85 100644
--- a/Tests/Private/Compare-CIPPIntuneAssignments.Tests.ps1
+++ b/Tests/Private/Compare-CIPPIntuneAssignments.Tests.ps1
@@ -278,6 +278,48 @@ Describe 'Compare-CIPPIntuneAssignments' {
         }
     }
 
+    Context 'broad targets on a Device Preparation profile' {
+        # Remediation writes the All Users group target, but Intune reports a working "All users"
+        # assignment back as allLicensedUsersAssignmentTarget. Accepting only the written shape
+        # flags the profile as deviated on every run and loops remediation.
+        BeforeAll {
+            $script:AllUsersGroupId = 'acacacac-9df4-4c7d-9d50-4ef0226f57a9'
+        }
+
+        It 'accepts the allLicensedUsers target as the All Users assignment' {
+            $Existing = @(New-BroadAssignment -ODataType '#microsoft.graph.allLicensedUsersAssignmentTarget')
+
+            $Result = Compare-CIPPIntuneAssignments -ExistingAssignments $Existing -ExpectedAssignTo 'allLicensedUsers' -PolicyType 'DevicePrepProfile' -TenantFilter $script:Tenant
+
+            $Result.Matched | Should -BeTrue
+            $Result.MissingIncludeGroups | Should -BeNullOrEmpty
+            $Result.Reasons | Should -BeNullOrEmpty
+        }
+
+        It 'still accepts the group target remediation writes' {
+            $Existing = @(New-GroupAssignment -GroupId $script:AllUsersGroupId)
+
+            (Compare-CIPPIntuneAssignments -ExistingAssignments $Existing -ExpectedAssignTo 'AllDevicesAndUsers' -PolicyType 'DevicePrepProfile' -TenantFilter $script:Tenant).Matched |
+                Should -BeTrue
+        }
+
+        It 'still reports a profile with no assignment at all' {
+            $Result = Compare-CIPPIntuneAssignments -ExistingAssignments @() -ExpectedAssignTo 'allLicensedUsers' -PolicyType 'DevicePrepProfile' -TenantFilter $script:Tenant
+
+            $Result.Matched | Should -BeFalse
+            $Result.MissingIncludeGroups.displayName | Should -Be 'All Users'
+        }
+
+        It 'rejects the same target on a MAM policy, which the service refuses to accept' {
+            $Existing = @(New-BroadAssignment -ODataType '#microsoft.graph.allLicensedUsersAssignmentTarget')
+
+            $Result = Compare-CIPPIntuneAssignments -ExistingAssignments $Existing -ExpectedAssignTo 'allLicensedUsers' -PolicyType 'iosManagedAppProtections' -TenantFilter $script:Tenant
+
+            $Result.Matched | Should -BeFalse
+            $Result.MissingIncludeGroups.displayName | Should -Be 'All Users'
+        }
+    }
+
     Context 'exclusion groups' {
         It 'matches when the configured exclusion is present' {
             $Existing = @(
diff --git a/Tests/Private/ConvertTo-CIPPBecHostAddress.Tests.ps1 b/Tests/Private/ConvertTo-CIPPBecHostAddress.Tests.ps1
new file mode 100644
index 0000000000000..2294c388e9acf
--- /dev/null
+++ b/Tests/Private/ConvertTo-CIPPBecHostAddress.Tests.ps1
@@ -0,0 +1,22 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+}
+
+Describe 'ConvertTo-CIPPBecHostAddress' {
+    It 'drops the port from an IPv4 client address' {
+        ConvertTo-CIPPBecHostAddress -Address '115.70.126.106:28297' | Should -Be '115.70.126.106'
+        ConvertTo-CIPPBecHostAddress -Address ' 115.70.126.106 ' | Should -Be '115.70.126.106'
+    }
+
+    It 'drops the port and brackets from an IPv6 client address' {
+        ConvertTo-CIPPBecHostAddress -Address '[2001:db8::1]:443' | Should -Be '2001:db8::1'
+        ConvertTo-CIPPBecHostAddress -Address '2001:db8::1' | Should -Be '2001:db8::1'
+    }
+
+    It 'returns null for an empty address and leaves other text alone' {
+        ConvertTo-CIPPBecHostAddress -Address '' | Should -BeNullOrEmpty
+        ConvertTo-CIPPBecHostAddress -Address $null | Should -BeNullOrEmpty
+        ConvertTo-CIPPBecHostAddress -Address '<redacted>' | Should -Be '<redacted>'
+    }
+}
diff --git a/Tests/Private/ConvertTo-CIPPSensitivityLabelDomainToken.Tests.ps1 b/Tests/Private/ConvertTo-CIPPSensitivityLabelDomainToken.Tests.ps1
new file mode 100644
index 0000000000000..85820a01742d6
--- /dev/null
+++ b/Tests/Private/ConvertTo-CIPPSensitivityLabelDomainToken.Tests.ps1
@@ -0,0 +1,72 @@
+# Pester tests for ConvertTo-CIPPSensitivityLabelDomainToken
+# A label that encrypts for its own organization names the source tenant's domain in its rights definitions.
+# Captured into a template, that domain has to become %defaultdomain% so a deploy grants the rights to the
+# tenant the label lands in rather than the one it came from.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPSensitivityLabelField.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/ConvertTo-CIPPSensitivityLabelRights.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/ConvertTo-CIPPSensitivityLabelParams.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/ConvertTo-CIPPSensitivityLabelDomainToken.ps1')
+
+    # Get-Label returns each LabelAction as a JSON string whose 'rightsdefinitions' value is itself a JSON string.
+    $RightsJson = '[{"Identity":"contoso.com","Rights":"VIEW,DOCEDIT"},{"Identity":"user@contoso.com","Rights":"VIEW"},{"Identity":"notcontoso.com","Rights":"VIEW"}]'
+    $EncryptAction = [ordered]@{
+        Type     = 'encrypt'
+        SubType  = $null
+        Settings = @(
+            @{ Key = 'protectiontype'; Value = 'template' }
+            @{ Key = 'rightsdefinitions'; Value = $RightsJson }
+        )
+    } | ConvertTo-Json -Depth 5 -Compress
+
+    $Captured = [PSCustomObject]@{
+        Name                        = 'Confidential - Internal'
+        DisplayName                 = 'Confidential - Internal'
+        EncryptionRightsDefinitions = @([PSCustomObject]@{ Identity = 'Contoso.com'; Rights = 'VIEW,DOCEDIT' })
+        LabelActions                = @($EncryptAction)
+    }
+    $Json = $Captured | ConvertTo-Json -Depth 10
+}
+
+Describe 'ConvertTo-CIPPSensitivityLabelDomainToken' {
+
+    Context 'a captured label granting rights to its own tenant domain' {
+        BeforeAll {
+            $Tokenised = ConvertTo-CIPPSensitivityLabelDomainToken -Json $Json -Domains @('contoso.com', 'contoso.onmicrosoft.com')
+            $Template = $Tokenised | ConvertFrom-Json
+            $Result = ConvertTo-CIPPSensitivityLabelParams -Label $Template
+        }
+
+        It 'still produces valid JSON' {
+            $Template | Should -Not -BeNullOrEmpty
+        }
+
+        It 'replaces the domain on the flat property regardless of case' {
+            $Template.EncryptionRightsDefinitions[0].Identity | Should -Be '%defaultdomain%'
+        }
+
+        It 'replaces the domain nested inside the encrypt LabelAction' {
+            @($Result.EncryptionRightsDefinitions)[0] | Should -Be '%defaultdomain%:VIEW,DOCEDIT'
+        }
+
+        It 'leaves users in the source tenant alone' {
+            @($Result.EncryptionRightsDefinitions)[1] | Should -Be 'user@contoso.com:VIEW'
+        }
+
+        It 'leaves other domains alone' {
+            @($Result.EncryptionRightsDefinitions)[2] | Should -Be 'notcontoso.com:VIEW'
+        }
+    }
+
+    Context 'nothing to replace' {
+        It 'returns the template unchanged when no domains are supplied' {
+            ConvertTo-CIPPSensitivityLabelDomainToken -Json $Json -Domains @() | Should -Be $Json
+        }
+
+        It 'returns the template unchanged when the domains do not appear' {
+            ConvertTo-CIPPSensitivityLabelDomainToken -Json $Json -Domains @('fabrikam.com') | Should -Be $Json
+        }
+    }
+}
diff --git a/Tests/Private/Disable-CIPPInboxRules.Tests.ps1 b/Tests/Private/Disable-CIPPInboxRules.Tests.ps1
new file mode 100644
index 0000000000000..0d2cd2f49e035
--- /dev/null
+++ b/Tests/Private/Disable-CIPPInboxRules.Tests.ps1
@@ -0,0 +1,48 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $anchor, $useSystemMailbox, $Compliance, $Select, $AsApp) }
+    function Set-CIPPMailboxRule { param($Username, $UserId, $TenantFilter, $RuleId, $RuleName, [switch]$Disable, [switch]$Enable, $APIName, $Headers) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Disable-CIPPInboxRules.ps1')
+}
+
+Describe 'Disable-CIPPInboxRules' {
+    BeforeEach {
+        Mock New-ExoRequest {
+            @(
+                [pscustomobject]@{ Name = 'Hide invoices'; Identity = 'victim\1'; Enabled = $true }
+                [pscustomobject]@{ Name = 'Junk E-Mail Rule'; Identity = 'victim\junk'; Enabled = $true }
+                [pscustomobject]@{ Name = 'Delegate Rule -1'; Identity = 'victim\d1'; Enabled = $true }
+                [pscustomobject]@{ Name = 'Forward all'; Identity = 'victim\2'; Enabled = $true }
+            )
+        }
+        # the real helper returns its log text; the disable function must not let that leak into its rows
+        Mock Set-CIPPMailboxRule { if ($RuleName -match '^Delegate Rule') { throw 'Cannot modify delegate rule' }; "Successfully set mailbox rule $RuleName for $Username to Disabled" }
+        Mock Write-LogMessage { }
+    }
+
+    It 'returns only typed result rows (no leaked helper output), skipping system and delegate rules' {
+        $Rows = @(Disable-CIPPInboxRules -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com')
+        $Rows | ForEach-Object { $_ | Should -BeOfType [pscustomobject] -Because 'a leaked string becomes a blank row in the containment results' }
+        $Rows.Count | Should -Be 2
+        ($Rows | Where-Object { $_.state -eq 'success' }).resultText | Should -Be 'Disabled 2 inbox rule(s) for victim@contoso.com.'
+        ($Rows | Where-Object { $_.state -eq 'info' }).resultText | Should -Match 'Skipped 1 Exchange-managed delegate rule'
+        Should -Invoke Set-CIPPMailboxRule -Times 3 -ParameterFilter { $Disable.IsPresent }
+        Should -Invoke Set-CIPPMailboxRule -Times 0 -ParameterFilter { $RuleName -eq 'Junk E-Mail Rule' }
+    }
+
+    It 'restricts itself to the requested rules by identity or name' {
+        $Rows = @(Disable-CIPPInboxRules -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -RuleIds @('Forward all'))
+        $Rows.Count | Should -Be 1
+        $Rows[0].state | Should -Be 'success'
+        $Rows[0].resultText | Should -Be 'Disabled 1 inbox rule(s) for victim@contoso.com.'
+        Should -Invoke Set-CIPPMailboxRule -Times 1 -ParameterFilter { $RuleId -eq 'victim\2' }
+    }
+
+    It 'reports a failing rule as an error row and still disables the rest' {
+        Mock Set-CIPPMailboxRule { if ($RuleName -eq 'Hide invoices') { throw 'EXO said no' }; 'ok' }
+        $Rows = @(Disable-CIPPInboxRules -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -RuleIds @('Hide invoices', 'Forward all'))
+        ($Rows | Where-Object { $_.state -eq 'error' }).resultText | Should -Match "Could not disable rule 'Hide invoices': EXO said no"
+        ($Rows | Where-Object { $_.state -eq 'success' }).resultText | Should -Be 'Disabled 1 inbox rule(s) for victim@contoso.com.'
+    }
+}
diff --git a/Tests/Private/Find-HuduDeviceMatch.Tests.ps1 b/Tests/Private/Find-HuduDeviceMatch.Tests.ps1
new file mode 100644
index 0000000000000..530227cdb3a35
--- /dev/null
+++ b/Tests/Private/Find-HuduDeviceMatch.Tests.ps1
@@ -0,0 +1,67 @@
+BeforeAll {
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Find-HuduDeviceMatch.ps1"
+
+    function New-TestHuduDevice {
+        param($Id, $Name, $Serial, $ManageName, $ManageSerial)
+        [PSCustomObject]@{
+            id             = $Id
+            name           = $Name
+            primary_serial = $Serial
+            cards          = @(
+                [PSCustomObject]@{
+                    integrator_name = 'cw_manage'
+                    data            = [PSCustomObject]@{
+                        name         = $ManageName
+                        serialNumber = $ManageSerial
+                    }
+                }
+            )
+        }
+    }
+}
+
+Describe 'Find-HuduDeviceMatch' {
+    BeforeEach {
+        $HuduDevices = @(
+            New-TestHuduDevice -Id 1 -Name 'DEVICE-01' -Serial '' -ManageName @('DEVICE-01') -ManageSerial ''
+            New-TestHuduDevice -Id 2 -Name 'RENAMED-DEVICE' -Serial 'SERIAL-02' -ManageName @('OLD-NAME') -ManageSerial 'CW-SERIAL-02'
+        )
+    }
+
+    It 'does not match an unrelated asset through a blank serial number' {
+        $Result = @(Find-HuduDeviceMatch -Device @{ deviceName = 'UNKNOWN'; serialNumber = '' } -HuduDevices $HuduDevices)
+        $Result | Should -BeNullOrEmpty
+    }
+
+    It 'matches a blank-serial device by name' {
+        $Result = @(Find-HuduDeviceMatch -Device @{ deviceName = 'DEVICE-01'; serialNumber = '' } -HuduDevices $HuduDevices)
+        $Result.id | Should -Be 1
+    }
+
+    It 'prefers a valid serial match over the name' {
+        $Result = @(Find-HuduDeviceMatch -Device @{ deviceName = 'DEVICE-01'; serialNumber = 'SERIAL-02' } -HuduDevices $HuduDevices)
+        $Result.id | Should -Be 2
+    }
+
+    It 'matches a ConnectWise Manage serial' {
+        $Result = @(Find-HuduDeviceMatch -Device @{ deviceName = 'UNKNOWN'; serialNumber = 'CW-SERIAL-02' } -HuduDevices $HuduDevices)
+        $Result.id | Should -Be 2
+    }
+
+    It 'falls back to the name when a usable serial does not match' {
+        $Result = @(Find-HuduDeviceMatch -Device @{ deviceName = 'DEVICE-01'; serialNumber = 'NO-MATCH' } -HuduDevices $HuduDevices)
+        $Result.id | Should -Be 1
+    }
+
+    It 'uses the name for an excluded serial' {
+        $Result = @(Find-HuduDeviceMatch -Device @{ deviceName = 'DEVICE-01'; serialNumber = 'DEFAULT-SERIAL' } -HuduDevices $HuduDevices -ExcludeSerials 'DEFAULT-SERIAL')
+        $Result.id | Should -Be 1
+    }
+
+    It 'returns every duplicate match so the caller can reject ambiguity' {
+        $HuduDevices += New-TestHuduDevice -Id 3 -Name 'DEVICE-01' -Serial 'OTHER' -ManageName @() -ManageSerial 'OTHER'
+        $Result = @(Find-HuduDeviceMatch -Device @{ deviceName = 'DEVICE-01'; serialNumber = '' } -HuduDevices $HuduDevices)
+        $Result.Count | Should -Be 2
+        $Result.id | Should -Be 1, 3
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecAttackerActivity.Tests.ps1 b/Tests/Private/Get-CIPPBecAttackerActivity.Tests.ps1
new file mode 100644
index 0000000000000..1cff6f2f0c9e4
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecAttackerActivity.Tests.ps1
@@ -0,0 +1,123 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Search-CIPPBecAuditLog { param($TenantFilter, $StartDate, $EndDate, $Operations, $UserIds, $RecordType, $ObjectIds, $IPAddresses, $FreeText, $Anchor, $MaxPages) }
+    function Resolve-CIPPBecMessageSubjects { param($TenantFilter, $MessageIds, $Known, $LookbackDays, $Anchor) }
+    function Get-NormalizedError { param($message) $message }
+    foreach ($File in @('BEC/ConvertTo-CIPPBecHostAddress.ps1', 'BEC/New-CIPPBecCollectorResult.ps1', 'BEC/Get-CIPPBecAttackerActivity.ps1')) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$File")
+    }
+    $script:Heuristics = Get-Content (Join-Path $RepoRoot 'Config/BecHeuristics.json') -Raw | ConvertFrom-Json
+    $script:Verdicts = @(
+        [pscustomobject]@{ IP = '198.51.100.7'; Verdict = 'LikelyAttacker' }
+        [pscustomobject]@{ IP = '192.0.2.44'; Verdict = 'Unknown' }
+        [pscustomobject]@{ IP = '203.0.113.10'; Verdict = 'LikelyUser' }
+        [pscustomobject]@{ IP = '40.107.1.1'; Verdict = 'Service' }
+    )
+    $script:SignIns = @([pscustomobject]@{ IPAddress = '198.51.100.7'; UniqueTokenId = 'TOK-ATTACKER'; SessionId = 'ENTRA-1' })
+    function New-Mail {
+        param($Operation, $IP, [hashtable]$Extra = @{})
+        $AD = [ordered]@{ Operation = $Operation; CreationTime = '2026-09-20T01:00:00Z'; UserId = 'victim@contoso.com'; MailboxOwnerUPN = 'victim@contoso.com'; LogonType = 0; ClientInfoString = 'Client=OWA' }
+        if ($IP) { $AD.ClientIPAddress = $IP }
+        foreach ($Key in $Extra.Keys) { $AD[$Key] = $Extra[$Key] }
+        [pscustomobject]@{ Operation = $Operation; AuditData = [pscustomobject]$AD }
+    }
+    function Invoke-Attacker {
+        param($MailRecords = @(), $SharingChanges = @())
+        Get-CIPPBecAttackerActivity -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate '2026-09-16' -EndDate '2026-09-23' -Heuristics $script:Heuristics -Verdicts $script:Verdicts -SignIns $script:SignIns -MailRecords $MailRecords -SharingChanges $SharingChanges -KnownSubjects @{ '<known@x>' = 'Invoice 443' } -Anchor 'victim@contoso.com'
+    }
+}
+
+Describe 'Get-CIPPBecAttackerActivity' {
+    BeforeEach {
+        Mock Search-CIPPBecAuditLog { [pscustomobject]@{ Records = @(); Complete = $true; Cap = $null } }
+        Mock Resolve-CIPPBecMessageSubjects { [pscustomobject]@{ Subjects = @{ '<known@x>' = 'Invoice 443'; '<traced@x>' = 'Wire details' }; Resolved = 2; Unresolved = 1; Error = $null } }
+    }
+
+    It 'details the attacker side item by item and leaves the user side as counts' {
+        $Bind = New-Mail 'MailItemsAccessed' '198.51.100.7:51234' @{ OperationProperties = @([pscustomobject]@{ Name = 'MailAccessType'; Value = 'Bind' }); Folders = @([pscustomobject]@{ Path = '\Inbox'; FolderItems = @([pscustomobject]@{ InternetMessageId = '<known@x>' }, [pscustomobject]@{ InternetMessageId = '<traced@x>' }, [pscustomobject]@{ InternetMessageId = '<old@x>' }) }) }
+        $Sync = New-Mail 'MailItemsAccessed' '192.0.2.44' @{ OperationProperties = @([pscustomobject]@{ Name = 'MailAccessType'; Value = 'Sync' }); Folders = @([pscustomobject]@{ Path = '\Sent Items'; FolderItems = @(1..40 | ForEach-Object { [pscustomobject]@{ InternetMessageId = "<s$_@x>" } }) }) }
+        $Delete = New-Mail 'SoftDelete' '198.51.100.7' @{ AffectedItems = @([pscustomobject]@{ Subject = 'Security alert'; InternetMessageId = '<d1@x>'; ParentFolder = [pscustomobject]@{ Path = '\Inbox' } }) }
+        $Move = New-Mail 'Move' '198.51.100.7' @{ DestFolder = [pscustomobject]@{ Path = '\RSS Feeds' }; AffectedItems = @([pscustomobject]@{ Subject = 'RE: payment'; ParentFolder = [pscustomobject]@{ Path = '\Inbox' } }) }
+        $Send = New-Mail 'Send' '198.51.100.7' @{ Item = [pscustomobject]@{ Subject = 'Updated bank details'; InternetMessageId = '<sent@x>'; ParentFolder = [pscustomobject]@{ Path = '\Sent Items' } } }
+        $UserSide = New-Mail 'MailItemsAccessed' '203.0.113.10' @{ Folders = @([pscustomobject]@{ Path = '\Inbox'; FolderItems = @([pscustomobject]@{ InternetMessageId = '<mine@x>' }) }) }
+        $Result = Invoke-Attacker -MailRecords @($Bind, $Sync, $Delete, $Move, $Send, $UserSide)
+        $Rows = @($Result.Mail.Data)
+        @($Rows | Where-Object InternetMessageId -EQ '<mine@x>').Count | Should -Be 0 -Because "the user's own reads stay counts"
+        ($Rows | Where-Object InternetMessageId -EQ '<known@x>').Subject | Should -Be 'Invoice 443'
+        ($Rows | Where-Object InternetMessageId -EQ '<traced@x>').Subject | Should -Be 'Wire details'
+        ($Rows | Where-Object InternetMessageId -EQ '<old@x>').Subject | Should -BeNullOrEmpty -Because 'older than the trace keeps its id only'
+        $Synced = $Rows | Where-Object AccessType -EQ 'Sync'
+        $Synced.ItemCount | Should -Be 40
+        $Synced.IPVerdict | Should -Be 'Unknown'
+        ($Rows | Where-Object Operation -EQ 'Move').Detail | Should -Be 'to \RSS Feeds'
+        ($Rows | Where-Object Operation -EQ 'SoftDelete').Subject | Should -Be 'Security alert'
+        ($Rows | Where-Object Operation -EQ 'Send').Subject | Should -Be 'Updated bank details'
+        $Result.Mail.Summary.MessagesOpened | Should -Be 3
+        $Result.Mail.Summary.FoldersSynced | Should -Be 1
+        $Result.Mail.Summary.Deleted | Should -Be 1
+        $Result.Mail.Summary.Sent | Should -Be 1
+        Should -Invoke Resolve-CIPPBecMessageSubjects -Times 1 -ParameterFilter { @($MessageIds).Count -eq 3 -and $Known['<known@x>'] -eq 'Invoice 443' }
+    }
+
+    It 'lands a record without an address, or on a Microsoft front end, on the sign-in behind its token or session' {
+        $NoIP = New-Mail 'MailItemsAccessed' $null @{ AppAccessContext = [pscustomobject]@{ UniqueTokenId = 'TOK-ATTACKER' }; Folders = @([pscustomobject]@{ Path = '\Inbox'; FolderItems = @([pscustomobject]@{ InternetMessageId = '<a@x>' }) }) }
+        $FrontEnd = New-Mail 'MailItemsAccessed' '40.107.1.1' @{ AppAccessContext = [pscustomobject]@{ AADSessionId = 'ENTRA-1' }; Folders = @([pscustomobject]@{ Path = '\Inbox'; FolderItems = @([pscustomobject]@{ InternetMessageId = '<b@x>' }) }) }
+        $Orphan = New-Mail 'MailItemsAccessed' $null @{ Folders = @([pscustomobject]@{ Path = '\Inbox'; FolderItems = @([pscustomobject]@{ InternetMessageId = '<c@x>' }) }) }
+        $Result = Invoke-Attacker -MailRecords @($NoIP, $FrontEnd, $Orphan)
+        $A = $Result.Mail.Data | Where-Object InternetMessageId -EQ '<a@x>'
+        $A.IP | Should -Be '198.51.100.7'
+        $A.IPSource | Should -Be 'token'
+        ($Result.Mail.Data | Where-Object InternetMessageId -EQ '<b@x>').IPSource | Should -Be 'Entra session'
+        $Result.Mail.Summary.Unattributed | Should -Be 1 -Because 'a record tied to nothing is counted, not guessed'
+    }
+
+    It 'searches files only for the attacker-side addresses and link usage by item' {
+        Mock Search-CIPPBecAuditLog -ParameterFilter { $IPAddresses } {
+            [pscustomobject]@{ Complete = $true; Records = @([pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'FileDownloaded'; CreationTime = '2026-09-20T02:00:00Z'; SourceFileName = 'payroll.xlsx'; ObjectId = 'https://contoso-my.sharepoint.com/personal/victim/Documents/payroll.xlsx'; SiteUrl = 'https://contoso-my.sharepoint.com/personal/victim'; ClientIP = '198.51.100.7'; UserAgent = 'python-requests/2.31' } }) }
+        }
+        Mock Search-CIPPBecAuditLog -ParameterFilter { $ObjectIds } {
+            [pscustomobject]@{ Complete = $true; Records = @([pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'AnonymousLinkUsed'; CreationTime = '2026-09-21T02:00:00Z'; SourceFileName = 'invoice.pdf'; ObjectId = 'https://contoso-my.sharepoint.com/personal/victim/Documents/invoice.pdf'; UserId = 'urn:spo:anon#1'; ClientIP = '203.0.113.200' } }) }
+        }
+        $Result = Invoke-Attacker -SharingChanges @([pscustomobject]@{ ItemUrl = 'https://contoso-my.sharepoint.com/personal/victim/Documents/invoice.pdf'; Operation = 'AnonymousLinkCreated' })
+        Should -Invoke Search-CIPPBecAuditLog -Times 1 -ParameterFilter { $IPAddresses -and @($IPAddresses | Sort-Object) -join ',' -eq '192.0.2.44,198.51.100.7' -and $Operations -contains 'FileDownloaded' -and $UserIds -contains 'victim@contoso.com' }
+        $Result.Files.Data[0].File | Should -Be 'payroll.xlsx'
+        $Result.Files.Data[0].IPVerdict | Should -Be 'LikelyAttacker'
+        $Result.Files.Summary.Downloaded | Should -Be 1
+        $Result.LinkUsage.Data[0].OpenedBy | Should -Be 'urn:spo:anon#1'
+        Should -Invoke Search-CIPPBecAuditLog -Times 1 -ParameterFilter { $ObjectIds -contains 'https://contoso-my.sharepoint.com/personal/victim/Documents/invoice.pdf' -and $Operations -contains 'AnonymousLinkUsed' }
+    }
+
+    It 'flags Forms built from an attacker address and counts who answered them' {
+        Mock Search-CIPPBecAuditLog -ParameterFilter { $RecordType -eq 'MicrosoftForms' } {
+            [pscustomobject]@{ Complete = $true; Records = @(
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'CreateForm'; CreationTime = '2026-09-20T03:00:00Z'; FormId = 'FORM1'; FormName = 'Microsoft 365 password check'; FormsUserType = 'Owner'; ClientIP = '198.51.100.7' } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'CreateForm'; CreationTime = '2026-09-19T03:00:00Z'; FormId = 'FORM2'; FormName = 'Team lunch'; FormsUserType = 'Owner'; ClientIP = '203.0.113.10' } }
+                ) }
+        }
+        Mock Search-CIPPBecAuditLog -ParameterFilter { $FreeText -eq 'FORM1' } {
+            [pscustomobject]@{ Complete = $true; Records = @(
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'SubmitResponse'; FormId = 'FORM1'; ResponderId = 'r1' } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'SubmitResponse'; FormId = 'FORM1'; ResponderId = $null } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'ViewRuntimeForm'; FormId = 'FORM1' } }
+                    [pscustomobject]@{ AuditData = [pscustomobject]@{ Operation = 'UpdatePhishingStatus'; FormId = 'FORM1' } }
+                ) }
+        }
+        $Result = Invoke-Attacker
+        ($Result.Forms.Data | Where-Object FormId -EQ 'FORM1').Flagged | Should -BeTrue
+        ($Result.Forms.Data | Where-Object FormId -EQ 'FORM2').Flagged | Should -BeFalse
+        $Reach = $Result.Forms.Summary.Forms | Where-Object FormId -EQ 'FORM1'
+        $Reach.Responses | Should -Be 2
+        $Reach.AnonymousResponses | Should -Be 1
+        $Reach.Views | Should -Be 1
+        $Reach.PhishingFlagged | Should -BeTrue
+        Should -Invoke Search-CIPPBecAuditLog -Times 0 -ParameterFilter { $FreeText -eq 'FORM2' }
+    }
+
+    It 'reports a failed search as an error on that section only' {
+        Mock Search-CIPPBecAuditLog -ParameterFilter { $IPAddresses } { throw 'Search-UnifiedAuditLog timed out' }
+        $Result = Invoke-Attacker
+        $Result.Files.Error | Should -Match 'timed out'
+        $Result.Mail.Complete | Should -BeTrue
+        $Result.Forms.Complete | Should -BeTrue
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecDirectoryAudits.Tests.ps1 b/Tests/Private/Get-CIPPBecDirectoryAudits.Tests.ps1
new file mode 100644
index 0000000000000..028a89da4a073
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecDirectoryAudits.Tests.ps1
@@ -0,0 +1,183 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    $env:CIPPRootPath = $RepoRoot
+    function New-GraphBulkRequest { param($Requests, $tenantid, $asapp) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) $Value }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecDirectoryAudits.ps1')
+    $script:Heuristics = Get-CIPPBecHeuristics
+    $script:UserId = 'c0ffee00-0000-4000-8000-000000000001'
+    $script:Start = [datetime]::new(2026, 8, 20, 9, 30, 0, [System.DateTimeKind]::Utc)
+    $script:AdminActor = [pscustomobject]@{ user = [pscustomobject]@{ id = 'admin-id'; userPrincipalName = 'admin@contoso.com'; ipAddress = '198.51.100.7' }; app = $null }
+    $script:AppActor = [pscustomobject]@{ user = $null; app = [pscustomobject]@{ appId = 'app-1'; displayName = 'Sync Tool' } }
+
+    function Get-AuditFixture {
+        param([string]$Id, [string]$Activity, [string]$When = '2026-08-21T10:00:00Z', $InitiatedBy = $script:AdminActor, $Targets = @())
+        [pscustomobject]@{
+            id                  = $Id
+            activityDateTime    = $When
+            activityDisplayName = $Activity
+            category            = 'UserManagement'
+            result              = 'success'
+            resultReason        = ''
+            loggedByService     = 'Core Directory'
+            initiatedBy         = $InitiatedBy
+            targetResources     = @($Targets)
+        }
+    }
+
+    # Fixture-driven stand-in for the Graph batch: each direction answers from its own fixture,
+    # status and nextLink, so a test can degrade one half without touching the other.
+    function Invoke-FakeBulk {
+        param($Requests)
+        foreach ($Request in $Requests) {
+            switch ($Request.id) {
+                'Target' { if (-not $script:TargetMissing) { [pscustomobject]@{ id = 'Target'; status = $script:TargetStatus; body = [pscustomobject]@{ value = @($script:TargetFixture); '@odata.nextLink' = $script:TargetNextLink; error = [pscustomobject]@{ message = 'Insufficient privileges' } } } } }
+                'Actor' { [pscustomobject]@{ id = 'Actor'; status = $script:ActorStatus; body = [pscustomobject]@{ value = @($script:ActorFixture); '@odata.nextLink' = $null; error = [pscustomobject]@{ message = 'Actor lookup failed' } } } }
+            }
+        }
+    }
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Get-CIPPBecDirectoryAudits' {
+    BeforeEach {
+        Mock New-GraphBulkRequest { Invoke-FakeBulk -Requests $Requests }
+        Mock ConvertTo-CIPPODataFilterValue { $Value }
+        $script:TargetFixture = @()
+        $script:ActorFixture = @()
+        $script:TargetStatus = 200
+        $script:ActorStatus = 200
+        $script:TargetNextLink = $null
+        $script:TargetMissing = $false
+    }
+
+    It 'batches one target and one actor query with the escaped user id, window start, page size and eventual consistency' {
+        $null = Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics
+        Should -Invoke ConvertTo-CIPPODataFilterValue -Times 1 -ParameterFilter { $Value -eq $script:UserId -and $Type -eq 'Guid' }
+        Should -Invoke New-GraphBulkRequest -Times 1 -ParameterFilter {
+            $Target = $Requests | Where-Object { $_.id -eq 'Target' }
+            $Actor = $Requests | Where-Object { $_.id -eq 'Actor' }
+            @($Requests).Count -eq 2 -and
+            $tenantid -eq 'contoso.com' -and $asapp -eq $true -and
+            $Target.method -eq 'GET' -and $Actor.method -eq 'GET' -and
+            $Target.url -like "auditLogs/directoryAudits?`$filter=activityDateTime ge 2026-08-20T09:30:00Z and targetResources/any(t:t/id eq '$($script:UserId)')&`$top=999&`$select=id,activityDateTime,*" -and
+            $Actor.url -like "auditLogs/directoryAudits?`$filter=activityDateTime ge 2026-08-20T09:30:00Z and initiatedBy/user/id eq '$($script:UserId)'&`$top=999&`$select=id,activityDateTime,*" -and
+            $Target.headers.ConsistencyLevel -eq 'eventual' -and $Actor.headers.ConsistencyLevel -eq 'eventual'
+        }
+    }
+
+    It 'projects an audit record with its actor, IP, targets and truncated modified properties' {
+        $Long = 'x' * 250
+        $script:TargetFixture = @(
+            Get-AuditFixture -Id 'a1' -Activity 'Update user' -When '2026-08-21T12:00:00+02:00' -Targets @(
+                [pscustomobject]@{ id = $script:UserId; userPrincipalName = 'victim@contoso.com'; modifiedProperties = @(
+                        [pscustomobject]@{ displayName = 'StrongAuthenticationMethod'; newValue = '[{"MethodType":6}]' }
+                        [pscustomobject]@{ displayName = 'Included Updated Properties'; newValue = $Long }
+                        [pscustomobject]@{ displayName = $null; newValue = 'ignored' }
+                    ) }
+                [pscustomobject]@{ id = 'g1'; displayName = 'Finance'; modifiedProperties = @() }
+            )
+        )
+        $Result = Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeTrue
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 1
+        $Row = $Result.Data[0]
+        $Row.Id | Should -Be 'a1'
+        $Row.ActivityDateTime | Should -Be '2026-08-21T10:00:00Z' -Because 'timestamps are normalised to UTC'
+        $Row.Activity | Should -Be 'Update user'
+        $Row.Category | Should -Be 'UserManagement'
+        $Row.Service | Should -Be 'Core Directory'
+        $Row.Result | Should -Be 'success'
+        $Row.InitiatedBy | Should -Be 'admin@contoso.com'
+        $Row.InitiatedByType | Should -Be 'User'
+        $Row.ClientIP | Should -Be '198.51.100.7'
+        $Row.Targets | Should -Be 'victim@contoso.com, Finance'
+        $Row.ModifiedProperties | Should -Match '^StrongAuthenticationMethod=\[\{"MethodType":6\}\]; Included Updated Properties=x{200}\.\.\.$' -Because 'unnamed properties are dropped and long values are cut at 200 characters'
+        $Row.Direction | Should -Be 'Target'
+        $Row.Flagged | Should -BeTrue -Because 'Update user is in the heuristics flag list'
+    }
+
+    It 'flags listed and security-info activities, sorts flagged newest-first, de-duplicates across directions and skips rows without an id' {
+        $script:TargetFixture = @(
+            Get-AuditFixture -Id 'a1' -Activity 'Add member to group' -When '2026-08-22T08:00:00Z'
+            Get-AuditFixture -Id 'a2' -Activity 'User registered some security info' -When '2026-08-21T08:00:00Z'
+            Get-AuditFixture -Id 'a3' -Activity 'Update Strong Authentication policy' -When '2026-08-22T09:00:00Z'
+            Get-AuditFixture -Id 'a4' -Activity 'Register device' -When '2026-08-23T08:00:00Z'
+            Get-AuditFixture -Id $null -Activity 'Update user' -When '2026-08-25T08:00:00Z'
+        )
+        $script:ActorFixture = @(
+            Get-AuditFixture -Id 'a1' -Activity 'Add member to group' -When '2026-08-22T08:00:00Z'
+            Get-AuditFixture -Id 'a5' -Activity 'Update group' -When '2026-08-24T08:00:00Z' -InitiatedBy $script:AppActor -Targets @([pscustomobject]@{ id = 'g2'; displayName = 'Sales' })
+        )
+        $Result = Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeTrue
+        $Result.Data.Id | Should -Be @('a4', 'a3', 'a2', 'a5', 'a1') -Because 'flagged rows sort first, newest first within each group'
+        ($Result.Data | Where-Object { $_.Id -eq 'a2' }).Flagged | Should -BeTrue -Because 'the security-info wildcard catches names outside the list'
+        ($Result.Data | Where-Object { $_.Id -eq 'a3' }).Flagged | Should -BeTrue -Because 'the Strong Authentication wildcard catches names outside the list'
+        ($Result.Data | Where-Object { $_.Id -eq 'a1' }).Flagged | Should -BeFalse
+        ($Result.Data | Where-Object { $_.Id -eq 'a1' }).Direction | Should -Be 'Target' -Because 'the first direction to see an id wins'
+        $App = $Result.Data | Where-Object { $_.Id -eq 'a5' }
+        $App.Direction | Should -Be 'Actor'
+        $App.InitiatedBy | Should -Be 'Sync Tool'
+        $App.InitiatedByType | Should -Be 'Application'
+        $App.ClientIP | Should -BeNullOrEmpty
+        $App.Targets | Should -Be 'Sales'
+    }
+
+    It 'reports partial only when the batch helper flags a failed continuation page - a full page is not a cap' {
+        $script:TargetFixture = @(1..999 | ForEach-Object { Get-AuditFixture -Id "a$_" -Activity 'Update group' })
+        $script:TargetNextLink = 'https://graph.microsoft.com/v1.0/auditLogs/directoryAudits?$skiptoken=abc'
+        $Result = Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeTrue -Because 'the helper already merged every continuation page into the response'
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 999
+
+        $script:TargetFixture = @(Get-AuditFixture -Id 'a1' -Activity 'Update group')
+        Mock New-GraphBulkRequest {
+            foreach ($R in (Invoke-FakeBulk -Requests $Requests)) {
+                if ($R.id -eq 'Target') {
+                    $R | Add-Member -NotePropertyName 'PagingIncomplete' -NotePropertyValue $true -Force
+                    $R | Add-Member -NotePropertyName 'PagingError' -NotePropertyValue 'continuation page returned 429' -Force
+                }
+                $R
+            }
+        }
+        $Result = Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeFalse
+        $Result.Cap | Should -Be 'Target query: continuation page returned 429'
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 1
+    }
+
+    It 'reports a failed or missing direction as an error while keeping the rows from the other direction' {
+        $script:TargetStatus = 403
+        $script:ActorFixture = @(Get-AuditFixture -Id 'a9' -Activity 'Update group')
+        $Result = Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeFalse
+        $Result.Error | Should -Be 'Target query: Insufficient privileges'
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 1
+        $Result.Data[0].Id | Should -Be 'a9'
+
+        $script:TargetStatus = 200
+        $script:TargetMissing = $true
+        $Result = Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeFalse
+        $Result.Error | Should -Be 'Target query returned no response'
+        $Result.Count | Should -Be 1
+    }
+
+    It 'lets a batch transport failure propagate to the caller instead of reporting an empty audit list' {
+        Mock New-GraphBulkRequest { throw 'Graph batch unavailable' }
+        { Get-CIPPBecDirectoryAudits -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -Heuristics $script:Heuristics } | Should -Throw -ExpectedMessage '*Graph batch unavailable*'
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecErrorInfo.Tests.ps1 b/Tests/Private/Get-CIPPBecErrorInfo.Tests.ps1
new file mode 100644
index 0000000000000..3c645602868d2
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecErrorInfo.Tests.ps1
@@ -0,0 +1,56 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecErrorInfo.ps1')
+}
+
+Describe 'Get-CIPPBecErrorInfo' {
+    It 'treats a missing mailbox as not-applicable, not a failure' {
+        $I = Get-CIPPBecErrorInfo -Message 'Ex41BAF5|Microsoft.Exchange.Configuration.Tasks.ManagementObjectNotFoundException|The specified mailbox Identity:"alex@contoso.com" doesn''t exist.'
+        $I.Skipped | Should -BeTrue
+        $I.Message | Should -Be 'This user has no Exchange Online mailbox.'
+        $I.Requirement | Should -Match 'no Exchange Online mailbox'
+    }
+
+    It 'treats a not-a-recipient error as not-applicable' {
+        $I = Get-CIPPBecErrorInfo -Message "Get-RecipientPermission: Ex6F9304|Type|Couldn't find 'alex@contoso.com' as a recipient."
+        $I.Skipped | Should -BeTrue
+    }
+
+    It 'treats an Intune 404 / not-provisioned as not-applicable with a retry hint' {
+        $I = Get-CIPPBecErrorInfo -Message 'Intune returned an unexpected error (HTTP 404). ... the tenant does not have Intune provisioned. Microsoft support reference (Activity ID): 1967-68c5'
+        $I.Skipped | Should -BeTrue
+        $I.Message | Should -Match 'rerun'
+        $I.Message | Should -Not -Match 'Activity ID'
+    }
+
+    It 'treats Intune "not applicable to target tenant" (no Intune licence) as not-applicable' {
+        $I = Get-CIPPBecErrorInfo -Message 'Request not applicable to target tenant. - Operation ID (for customer support): 6f1b - Activity ID: 1967-68c5 - Url: https://fef.msub03.manage.microsoft.com/DeviceFE/StatelessDeviceFEService/deviceManagement/users(''guid'')/managedDevices?api-version=5024-03-01'
+        $I.Skipped | Should -BeTrue
+        $I.Message | Should -Be 'Intune is not licensed for this tenant.'
+        $I.Requirement | Should -Match 'Intune licence'
+    }
+
+    It 'keeps a transient Intune service error as a failure, not a skip' {
+        $I = Get-CIPPBecErrorInfo -Message 'Intune returned an unexpected error (HTTP 503). This is a failure inside the Intune service itself and is usually transient. Rerun the check to retry. Microsoft support reference (Activity ID): 1967-68c5'
+        $I.Skipped | Should -BeFalse
+        $I.Message | Should -Match 'transient'
+        $I.Message | Should -Not -Match 'Activity ID'
+    }
+
+    It 'strips the Exchange diagnostic prefix from a real failure' {
+        $I = Get-CIPPBecErrorInfo -Message 'Ex3F6FA7|Microsoft.Exchange.Management.Tasks.SomeException|The server is busy, try again.'
+        $I.Skipped | Should -BeFalse
+        $I.Message | Should -Be 'The server is busy, try again.'
+    }
+
+    It 'passes a plain message through and drops a support-reference tail' {
+        $I = Get-CIPPBecErrorInfo -Message 'Graph request failed. Microsoft support reference (Activity ID): abc-123'
+        $I.Skipped | Should -BeFalse
+        $I.Message | Should -Be 'Graph request failed.'
+    }
+
+    It 'returns null for an empty error' {
+        (Get-CIPPBecErrorInfo -Message '').Message | Should -BeNullOrEmpty
+        (Get-CIPPBecErrorInfo -Message $null).Skipped | Should -BeFalse
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecHeuristics.Tests.ps1 b/Tests/Private/Get-CIPPBecHeuristics.Tests.ps1
new file mode 100644
index 0000000000000..124aa3ffb356e
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecHeuristics.Tests.ps1
@@ -0,0 +1,66 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    $script:BackendRoot = $RepoRoot
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Get-CIPPBecHeuristics' {
+    BeforeEach {
+        $env:CIPPRootPath = $script:BackendRoot
+    }
+
+    It 'loads the shipped heuristics file with every section the collectors read' {
+        $H = Get-CIPPBecHeuristics
+        foreach ($Section in 'window', 'caps', 'score', 'inboxRules', 'phishingSubjectPatterns', 'typosquat', 'riskyScopes', 'transportRules', 'directoryAudit', 'mailActivity', 'sentMail', 'mailboxAddIns', 'delegations') {
+            $H.$Section | Should -Not -BeNullOrEmpty -Because "$Section is read by a collector"
+        }
+        $H.window.days | Should -BeGreaterThan 0
+        $H.score.thresholds.high | Should -BeGreaterThan $H.score.thresholds.medium
+        @($H.directoryAudit.flaggedActivities) | Should -Contain 'Consent to application'
+        @($H.transportRules.operations) | Should -Contain 'New-TransportRule'
+    }
+
+    It 'ships only regexes that compile' {
+        $H = Get-CIPPBecHeuristics
+        $Patterns = @(
+            $H.inboxRules.lowVisibilityFolderRegex
+            $H.inboxRules.sensitiveNameRegex
+            $H.phishingKeywordPattern
+            $H.riskyScopes.regex
+            $H.transportRules.riskyParameterRegex
+            $H.transportRules.descriptionRegex
+            $H.mailboxAddIns.trustedProviderRegex
+        ) + @($H.phishingSubjectPatterns.PSObject.Properties.Value)
+        $Patterns.Count | Should -BeGreaterThan 10
+        foreach ($Pattern in $Patterns) {
+            { [regex]::new($Pattern) } | Should -Not -Throw -Because "'$Pattern' must be a valid .NET regex"
+        }
+    }
+
+    It 'matches the IR-console fixtures with the shipped regexes' {
+        $H = Get-CIPPBecHeuristics
+        'Mail.ReadWrite' | Should -Match $H.riskyScopes.regex
+        'offline_access' | Should -Match $H.riskyScopes.regex
+        'User.Read' | Should -Not -Match $H.riskyScopes.regex
+        'BlindCopyTo' | Should -Match $H.transportRules.riskyParameterRegex
+        'SubjectContainsWords' | Should -Not -Match $H.transportRules.riskyParameterRegex
+        'RSS Subscriptions' | Should -Match $H.inboxRules.lowVisibilityFolderRegex
+        'Urgent action required' | Should -Match $H.phishingSubjectPatterns.'Urgent action language'
+    }
+
+    It 'merges the delegated names from RiskyPermissions.json into catalogNames' {
+        $H = Get-CIPPBecHeuristics
+        $H.riskyScopes.catalogNames | Should -Not -BeNullOrEmpty
+        @($H.riskyScopes.catalogNames) | Should -Not -Contain 'RoleManagement.ReadWrite.Directory' -Because 'application permissions are not delegated scopes'
+    }
+
+    It 'throws when the file is missing' {
+        $env:CIPPRootPath = Join-Path $TestDrive 'nowhere'
+        { Get-CIPPBecHeuristics } | Should -Throw
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecIPVerdicts.Tests.ps1 b/Tests/Private/Get-CIPPBecIPVerdicts.Tests.ps1
new file mode 100644
index 0000000000000..d1298ff21fbf2
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecIPVerdicts.Tests.ps1
@@ -0,0 +1,177 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    foreach ($File in @('Authentication/ConvertTo-CIPPIPRange.ps1', 'Authentication/Test-IpInRange.ps1', 'Authentication/Resolve-CIPPIPAllowBlockList.ps1', 'BEC/ConvertTo-CIPPBecHostAddress.ps1', 'BEC/Get-CIPPBecIPVerdicts.ps1', 'BEC/ConvertTo-CIPPBecIPEvents.ps1')) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$File")
+    }
+    $script:Heuristics = Get-Content (Join-Path $RepoRoot 'Config/BecHeuristics.json') -Raw | ConvertFrom-Json
+
+    function New-SignIn {
+        param($IP, $Status = 'Success', $Country = 'AU', $City = 'Sydney', $ASN = '1221', $Risk = 'none', $UserAgent = 'Mozilla/5.0', $Compliant = $false, $SessionId = $null, $When = '2026-09-20T01:00:00Z')
+        [pscustomobject]@{ IPAddress = $IP; Status = $Status; Country = $Country; City = $City; ASN = $ASN; RiskLevelDuringSignIn = $Risk; UserAgent = $UserAgent; DeviceCompliant = $Compliant; SessionId = $SessionId; CreatedDateTime = $When }
+    }
+    # 40 successful sign-ins before the window, almost all from the office address
+    $script:Baseline = [pscustomobject]@{
+        Successful = 40
+        IPs        = @([pscustomobject]@{ IP = '203.0.113.10'; SignIns = 38; Share = 0.95; Days = 20 }, [pscustomobject]@{ IP = '203.0.113.99'; SignIns = 1; Share = 0.025; Days = 1 })
+        ASNs       = @([pscustomobject]@{ ASN = '1221'; SignIns = 40; Share = 1.0 })
+        Locations  = @([pscustomobject]@{ Country = 'AU'; City = 'Sydney'; SignIns = 40; Share = 1.0 })
+    }
+    $script:Geo = @{
+        '198.51.100.7' = [pscustomobject]@{ CountryOrRegion = 'NG'; City = 'Lagos'; Proxy = $false; Hosting = $true; ASName = 'DIGITALOCEAN-ASN' }
+        '203.0.113.10' = [pscustomobject]@{ CountryOrRegion = 'AU'; City = 'Sydney'; Proxy = $false; Hosting = $false; ASName = 'TELSTRA' }
+        '40.107.1.1'   = [pscustomobject]@{ CountryOrRegion = 'US'; City = 'Boydton'; Proxy = $false; Hosting = $true; ASName = 'MICROSOFT-CORP-MSN-AS-BLOCK' }
+    }
+    function Get-Verdicts {
+        param($SignIns = @(), $NonInteractive = @(), $Events = @(), $Guidance = @(), $Overrides = @(), $Peers = @{}, $Baseline = $script:Baseline)
+        Get-CIPPBecIPVerdicts -SignIns $SignIns -NonInteractiveSignIns $NonInteractive -Events $Events -Baseline $Baseline -Guidance $Guidance -Overrides $Overrides -Peers $Peers -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics
+    }
+    function Get-Row { param($Rows, $IP) $Rows | Where-Object IP -EQ $IP }
+}
+
+Describe 'Get-CIPPBecIPVerdicts' {
+    It 'calls a new foreign hosting address behind a flagged inbox rule a likely attacker, with its reasons' {
+        $Rows = Get-Verdicts -SignIns @(New-SignIn -IP '198.51.100.7' -Country 'NG' -City 'Lagos' -ASN '14061') -Events @([pscustomobject]@{ IP = '198.51.100.7:51234'; Kind = 'Inbox rule change'; Flagged = $true; ActorKind = 'User'; When = '2026-09-20T01:05:00Z' })
+        $Row = Get-Row $Rows '198.51.100.7'
+        $Row.Verdict | Should -Be 'LikelyAttacker'
+        @($Row.Reasons.Code) | Should -Contain 'FlaggedAction'
+        @($Row.Reasons.Code) | Should -Contain 'HostingOrProxy'
+        @($Row.Reasons.Code) | Should -Contain 'Foreign'
+        @($Row.Reasons.Code) | Should -Contain 'NewToUser'
+        $Row.Kinds | Should -Be @('Inbox rule change')
+        $Row.Activities | Should -Be 1 -Because 'the ported audit address is the same host as the sign-in'
+    }
+
+    It 'calls the regular office address, network and city of the user a likely user' {
+        $Row = Get-Row (Get-Verdicts -SignIns @(New-SignIn -IP '203.0.113.10' -Compliant $true)) '203.0.113.10'
+        $Row.Verdict | Should -Be 'LikelyUser'
+        @($Row.Reasons.Code) | Should -Contain 'BaselineRegular'
+        @($Row.Reasons.Code) | Should -Contain 'CompliantDevice'
+        $Row.BaselineShare | Should -Be 0.95
+    }
+
+    It 'lets an investigator override decide, down to a CIDR range' {
+        $Rows = Get-Verdicts -SignIns @(New-SignIn -IP '203.0.113.10') -Overrides @([pscustomobject]@{ Range = '203.0.113.0/24'; Verdict = 'Compromised'; Note = 'token theft on the office NAT' })
+        $Row = Get-Row $Rows '203.0.113.10'
+        $Row.Verdict | Should -Be 'Compromised'
+        $Row.Source | Should -Match 'Investigator \(203\.0\.113\.0/24\): token theft'
+    }
+
+    It 'follows the CIPP list, where a tenant allow relaxes an AllTenants block' {
+        $Guidance = @(
+            [pscustomobject]@{ Range = '198.51.100.0/24'; Prefix = 24; Verdict = 'Blocked'; Strength = 'List'; Source = 'CIPP IP list (all tenants)'; Scope = 'AllTenants' }
+            [pscustomobject]@{ Range = '198.51.100.0/24'; Prefix = 24; Verdict = 'Trusted'; Strength = 'List'; Source = 'CIPP IP list (this tenant)'; Scope = 'Tenant' }
+        )
+        $Row = Get-Row (Get-Verdicts -SignIns @(New-SignIn -IP '198.51.100.7' -Country 'NG') -Guidance $Guidance) '198.51.100.7'
+        $Row.Verdict | Should -Be 'Safe'
+        $Row.Source | Should -Match 'this tenant'
+    }
+
+    It 'treats a Microsoft address with no sign-ins as a service, but scores one the user signed in from' {
+        $Service = Get-Row (Get-Verdicts -Events @([pscustomobject]@{ IP = '40.107.1.1'; Kind = 'Mailbox MailItemsAccessed'; Flagged = $false; ActorKind = 'User' })) '40.107.1.1'
+        $Service.Verdict | Should -Be 'Service'
+        $Rented = Get-Row (Get-Verdicts -SignIns @(New-SignIn -IP '40.107.1.1' -Country 'US' -ASN '8075')) '40.107.1.1'
+        $Rented.Verdict | Should -Not -Be 'Service'
+        @($Rented.Reasons.Code) | Should -Contain 'HostingOrProxy'
+    }
+
+    It 'never calls an address with only failed sign-ins more than suspicious' {
+        $SignIns = @(1..5 | ForEach-Object { New-SignIn -IP '198.51.100.7' -Status 'Failed' -Country 'NG' -Risk 'high' })
+        $Row = Get-Row (Get-Verdicts -SignIns $SignIns) '198.51.100.7'
+        $Row.Verdict | Should -Be 'Suspicious'
+        @($Row.Reasons.Code) | Should -Contain 'OnlyFailed'
+    }
+
+    It 'lifts an unknown address that shares an Entra session with a likely-attacker address' {
+        $SignIns = @(
+            New-SignIn -IP '198.51.100.7' -Country 'NG' -Risk 'high' -SessionId 'S1'
+            New-SignIn -IP '192.0.2.44' -Country 'AU' -City 'Sydney' -SessionId 'S1'
+        )
+        $Rows = Get-Verdicts -SignIns $SignIns -Events @([pscustomobject]@{ IP = '198.51.100.7'; Kind = 'Directory change'; Flagged = $true })
+        (Get-Row $Rows '198.51.100.7').Verdict | Should -Be 'LikelyAttacker'
+        $Lifted = Get-Row $Rows '192.0.2.44'
+        @($Lifted.Reasons.Code) | Should -Contain 'SharedSession'
+        $Lifted.Verdict | Should -BeIn @('Suspicious', 'LikelyAttacker')
+    }
+
+    It 'reads colleagues before the window as an office exit, and newcomers only in the window as a wider attack' {
+        $Peers = @{
+            '192.0.2.10' = [pscustomobject]@{ OtherUsersBefore = 12; OtherUsersInWindowOnly = 0; Users = @('a@contoso.com') }
+            '192.0.2.20' = [pscustomobject]@{ OtherUsersBefore = 0; OtherUsersInWindowOnly = 3; Users = @('b@contoso.com', 'c@contoso.com', 'd@contoso.com') }
+        }
+        $Rows = Get-Verdicts -SignIns @((New-SignIn -IP '192.0.2.10'), (New-SignIn -IP '192.0.2.20')) -Peers $Peers
+        @((Get-Row $Rows '192.0.2.10').Reasons.Code) | Should -Contain 'Colleagues'
+        @((Get-Row $Rows '192.0.2.20').Reasons.Code) | Should -Contain 'WiderAttack'
+        (Get-Row $Rows '192.0.2.20').OtherUsers.Count | Should -Be 3
+    }
+
+    It 'weighs a trusted named location strongly and exchange list entries lightly' {
+        $Guidance = @(
+            [pscustomobject]@{ Range = '192.0.2.0/24'; Prefix = 24; Verdict = 'Trusted'; Strength = 'Hint'; Source = "Trusted named location 'HQ'" }
+            [pscustomobject]@{ Range = '192.0.2.50'; Prefix = 32; Verdict = 'Blocked'; Strength = 'Hint'; Source = 'Tenant allow/block list (Block)' }
+        )
+        $Rows = Get-Verdicts -SignIns @((New-SignIn -IP '192.0.2.10'), (New-SignIn -IP '192.0.2.50')) -Guidance $Guidance
+        ((Get-Row $Rows '192.0.2.10').Reasons | Where-Object Code -EQ 'AllowHint').Weight | Should -Be -4
+        ((Get-Row $Rows '192.0.2.50').Reasons | Where-Object Code -EQ 'BlockHint').Weight | Should -Be 2
+    }
+
+    It "classes an address whose sign-ins are all the CIPP application's own as a service" {
+        $SignIns = @(1..3 | ForEach-Object { $S = New-SignIn -IP '135.119.241.152' -Status 'Failed' -Country 'US'; $S | Add-Member -NotePropertyName AppId -NotePropertyValue 'cipp-app'; $S })
+        $Rows = Get-CIPPBecIPVerdicts -NonInteractiveSignIns $SignIns -Baseline $script:Baseline -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics -CippAppId 'cipp-app'
+        $Row = Get-Row $Rows '135.119.241.152'
+        $Row.Verdict | Should -Be 'Service'
+        $Row.Source | Should -Match 'CIPP or partner delegated administration'
+        $Mixed = @($SignIns) + @(New-SignIn -IP '135.119.241.152' -Country 'US')
+        (Get-Row (Get-CIPPBecIPVerdicts -NonInteractiveSignIns $Mixed -Baseline $script:Baseline -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics -CippAppId 'cipp-app') '135.119.241.152').Verdict | Should -Not -Be 'Service' -Because 'a sign-in by anything else there is judged'
+        # Microsoft's Partner Customer Delegated Administration app (GDAP) is a service app out of the box
+        $Gdap = @(1..2 | ForEach-Object { $S = New-SignIn -IP '135.119.241.153' -Status 'Failed' -Country 'US'; $S | Add-Member -NotePropertyName AppId -NotePropertyValue '2832473f-ec63-45fb-976f-5d45a7d4bb91'; $S })
+        (Get-Row (Get-CIPPBecIPVerdicts -NonInteractiveSignIns $Gdap -Baseline $script:Baseline -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics -CippAppId 'cipp-app') '135.119.241.153').Verdict | Should -Be 'Service'
+    }
+
+    It 'gives the address of the technician who ran the case a trusted start, but still judges it' {
+        $Tech = @([pscustomobject]@{ IP = '192.0.2.77'; By = 'tech@msp.com' })
+        $AtHome = Get-Row (Get-CIPPBecIPVerdicts -SignIns @(New-SignIn -IP '192.0.2.77:50000' -Country 'AU') -Baseline $script:Baseline -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics -TechnicianIPs $Tech) '192.0.2.77'
+        $AtHome.Verdict | Should -Be 'LikelyUser'
+        $AtHome.Source | Should -Be 'Heuristics'
+        ($AtHome.Reasons | Where-Object Code -EQ 'TechnicianAddress').Text | Should -Match 'tech@msp.com'
+        $SignIns = @(New-SignIn -IP '192.0.2.77:50000' -Country 'NG')
+        $Row = Get-Row (Get-CIPPBecIPVerdicts -SignIns $SignIns -Baseline $script:Baseline -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics -TechnicianIPs $Tech) '192.0.2.77'
+        $Row.Verdict | Should -Not -Be 'Service' -Because 'a technician address is a head start, not a pass'
+        $Row.Score | Should -BeLessThan (Get-Row (Get-CIPPBecIPVerdicts -SignIns $SignIns -Baseline $script:Baseline -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics) '192.0.2.77').Score
+        $Overridden = Get-CIPPBecIPVerdicts -SignIns $SignIns -Baseline $script:Baseline -Geo $script:Geo -UsageLocation 'AU' -Heuristics $script:Heuristics -TechnicianIPs $Tech -Overrides @([pscustomobject]@{ Range = '192.0.2.77'; Verdict = 'Compromised' })
+        (Get-Row $Overridden '192.0.2.77').Verdict | Should -Be 'Compromised' -Because 'an investigator decision still wins'
+    }
+
+    It 'classes an address seen only on CIPP or partner actions as a service' {
+        $Row = Get-Row (Get-Verdicts -Events @([pscustomobject]@{ IP = '20.1.2.3'; Kind = 'Mailbox permission change'; Flagged = $true; ActorKind = 'CIPP' })) '20.1.2.3'
+        $Row.Verdict | Should -Be 'Service'
+    }
+
+    It 'judges nothing as new against an empty baseline and sorts the worst first' {
+        $Rows = Get-Verdicts -Baseline $null -SignIns @((New-SignIn -IP '192.0.2.10'), (New-SignIn -IP '198.51.100.7' -Country 'NG'))
+        @((Get-Row $Rows '192.0.2.10').Reasons.Code) | Should -Not -Contain 'NewToUser'
+        $Rows[0].IP | Should -Be '198.51.100.7'
+    }
+}
+
+Describe 'ConvertTo-CIPPBecIPEvents' {
+    It 'keeps only the actions of this account from the tenant-wide sections and flags the attacker ones' {
+        $Results = [pscustomobject]@{
+            NewRules                 = @([pscustomobject]@{ Name = 'Hide'; Suspicious = $true })
+            InboxRuleChanges         = @([pscustomobject]@{ ClientIP = '198.51.100.7'; RuleName = 'victim\Hide'; Date = 'x'; Operation = 'New-InboxRule' })
+            MailboxPermissionChanges = @(
+                [pscustomobject]@{ ClientIP = '198.51.100.7'; UserId = 'victim@contoso.com'; TargetsSuspect = $true }
+                [pscustomobject]@{ ClientIP = '10.9.9.9'; UserId = 'admin@contoso.com'; TargetsSuspect = $true }
+            )
+            TransportRuleChanges     = @([pscustomobject]@{ ClientIP = '10.9.9.9'; Actor = 'admin@contoso.com'; Flagged = $true })
+            SharingChanges           = @([pscustomobject]@{ ClientIP = '198.51.100.7'; Operation = 'AnonymousLinkCreated' }, [pscustomobject]@{ ClientIP = '203.0.113.10'; Operation = 'SecureLinkCreated' })
+            SentMessages             = @([pscustomobject]@{ FromIP = '198.51.100.7'; Received = 'y' })
+            SentMessageAnalysis      = [pscustomobject]@{ Flagged = $true }
+            MailActivity             = @([pscustomobject]@{ ClientIP = '203.0.113.10'; Operation = 'MailItemsAccessed'; FirstSeen = 'z'; SessionIds = @('M1', 'M2') })
+        }
+        $Events = ConvertTo-CIPPBecIPEvents -Results $Results -UserPrincipalName 'Victim@contoso.com'
+        @($Events | Where-Object IP -EQ '10.9.9.9').Count | Should -Be 0 -Because 'the address of another admin says nothing about this account'
+        @($Events | Where-Object { $_.IP -eq '198.51.100.7' -and $_.Flagged }).Kind | Should -Be @('Inbox rule change', 'Mailbox permission change', 'Sharing change', 'Sent mail')
+        ($Events | Where-Object Kind -EQ 'Mailbox MailItemsAccessed').SessionIds | Should -Be @('M1', 'M2')
+        ($Events | Where-Object { $_.Kind -eq 'Sharing change' -and $_.IP -eq '203.0.113.10' }).Flagged | Should -BeFalse
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecMailActivity.Tests.ps1 b/Tests/Private/Get-CIPPBecMailActivity.Tests.ps1
new file mode 100644
index 0000000000000..ad78d62a9b3e9
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecMailActivity.Tests.ps1
@@ -0,0 +1,222 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    $env:CIPPRootPath = $RepoRoot
+    function Search-CIPPBecAuditLog { param($TenantFilter, $StartDate, $EndDate, $Operations, $UserIds, $RecordType, $ObjectIds, $Anchor, $PageSize, $MaxPages) }
+    function Get-NormalizedError { param($message) $message }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecMailActivity.ps1')
+    $script:Heuristics = Get-CIPPBecHeuristics
+    $script:Upn = 'victim@contoso.com'
+    $script:Start = [datetime]::new(2026, 8, 13, 0, 0, 0, [System.DateTimeKind]::Utc)
+    $script:End = [datetime]::new(2026, 8, 20, 0, 0, 0, [System.DateTimeKind]::Utc)
+
+    # One record the way Search-CIPPBecAuditLog hands it back: AuditData already parsed. MailItemsAccessed
+    # reports its IP as ClientIPAddress; the other mailbox operations use ClientIP.
+    function New-Record {
+        param(
+            [string]$Operation,
+            [string]$Actor = 'victim@contoso.com',
+            [string]$ClientIP = '198.51.100.7',
+            [string]$ClientInfo = 'Client=OWA;Mozilla/5.0',
+            [string]$AccessType,
+            [int]$OperationCount,
+            [string]$Owner,
+            [string]$When = '2026-08-15T09:00:00Z',
+            [string]$SessionId,
+            [switch]$LegacyIPProperty,
+            [switch]$AccessTypeInProperties
+        )
+        $AuditData = [ordered]@{
+            Operation        = $Operation
+            CreationTime     = $When
+            UserId           = $Actor
+            ClientInfoString = $ClientInfo
+            LogonType        = 0
+        }
+        if ($LegacyIPProperty) { $AuditData.ClientIP = $ClientIP } else { $AuditData.ClientIPAddress = $ClientIP }
+        if ($AccessType -and $AccessTypeInProperties) { $AuditData.OperationProperties = @([pscustomobject]@{ Name = 'MailAccessType'; Value = $AccessType }, [pscustomobject]@{ Name = 'IsThrottled'; Value = 'False' }) }
+        elseif ($AccessType) { $AuditData.MailAccessType = $AccessType }
+        if ($SessionId) { $AuditData.SessionId = $SessionId }
+        if ($OperationCount) { $AuditData.OperationCount = $OperationCount }
+        if ($Owner) { $AuditData.MailboxOwnerUPN = $Owner }
+        [pscustomobject]@{
+            Identity  = [guid]::NewGuid().ToString()
+            Operation = $Operation
+            UserId    = $Actor
+            AuditData = [pscustomobject]$AuditData
+        }
+    }
+    function New-Search {
+        param($Records, [bool]$Complete = $true, $Cap = $null)
+        [pscustomobject]@{ Records = @($Records); Complete = $Complete; Cap = $Cap; Pages = 1 }
+    }
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Get-CIPPBecMailActivity' {
+    BeforeEach {
+        $script:UserRecords = @()
+        $script:OwnerRecords = @()
+        $script:UserComplete = $true
+        $script:UserCap = $null
+        # The user-scoped search carries UserIds; the tenant-wide SendAs/SendOnBehalf search does not.
+        Mock Search-CIPPBecAuditLog { New-Search -Records $script:OwnerRecords }
+        Mock Search-CIPPBecAuditLog -ParameterFilter { $null -ne $UserIds } { New-Search -Records $script:UserRecords -Complete $script:UserComplete -Cap $script:UserCap }
+    }
+
+    It 'reduces the user''s records to counts per operation, IP and client with first/last seen, summing aggregated OperationCount' {
+        $script:UserRecords = @(
+            (New-Record -Operation 'MailItemsAccessed' -AccessType 'Bind' -OperationCount 12 -When '2026-08-15T09:00:00Z')
+            (New-Record -Operation 'MailItemsAccessed' -AccessType 'Bind' -OperationCount 8 -When '2026-08-16T11:30:00Z')
+            (New-Record -Operation 'MailItemsAccessed' -AccessType 'Sync' -OperationCount 3 -ClientIP '203.0.113.9' -ClientInfo 'Client=REST;python-requests')
+            (New-Record -Operation 'HardDelete' -ClientIP '203.0.113.9' -ClientInfo 'Client=REST;python-requests' -LegacyIPProperty)
+            (New-Record -Operation 'Send' -When '2026-08-17T08:00:00Z')
+        )
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -Anchor $script:Upn
+
+        Should -Invoke Search-CIPPBecAuditLog -Times 1 -ParameterFilter { $UserIds -contains 'victim@contoso.com' -and $Operations -contains 'MailItemsAccessed' -and $Operations -contains 'Send' -and $MaxPages -eq 10 -and $Anchor -eq 'victim@contoso.com' -and $TenantFilter -eq 'contoso.com' }
+        $Result.Complete | Should -BeTrue
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 4
+        $Result.Data.Count | Should -Be 4
+        $Bind = $Result.Data[0]
+        $Bind.PSObject.Properties.Name | Should -Be @('Operation', 'ClientIP', 'ClientInfoString', 'MailAccessType', 'LogonType', 'Actor', 'MailboxOwner', 'Count', 'Records', 'FirstSeen', 'LastSeen', 'SessionIds')
+        $Bind.Operation | Should -Be 'MailItemsAccessed'
+        $Bind.Count | Should -Be 20 -Because 'aggregated MailItemsAccessed records contribute their OperationCount'
+        $Bind.Records | Should -Be 2
+        $Bind.ClientIP | Should -Be '198.51.100.7'
+        $Bind.MailAccessType | Should -Be 'Bind'
+        $Bind.Actor | Should -Be 'victim@contoso.com'
+        $Bind.MailboxOwner | Should -Be 'victim@contoso.com' -Because 'the actor owns the mailbox when no MailboxOwnerUPN is recorded'
+        $Bind.FirstSeen | Should -Be '2026-08-15T09:00:00Z'
+        $Bind.LastSeen | Should -Be '2026-08-16T11:30:00Z'
+        $Result.Data[1].Count | Should -Be 3 -Because 'groups sort by count, descending'
+        ($Result.Data | Where-Object { $_.Operation -eq 'HardDelete' }).ClientIP | Should -Be '203.0.113.9' -Because 'the ClientIP property is read as well as ClientIPAddress'
+
+        $Result.Summary.Records | Should -Be 5
+        $Result.Summary.MailItemsAccessedCount | Should -Be 23
+        $Result.Summary.HardDeleteCount | Should -Be 1
+        $Result.Summary.SoftDeleteCount | Should -Be 0
+        $Result.Summary.SendCount | Should -Be 1
+        $Result.Summary.ByOperation.MailItemsAccessed | Should -Be 23
+        $Result.Summary.DistinctClientIPs | Should -Be 2
+        $Result.Summary.HardDeleteExceeded | Should -BeFalse
+        $Result.Summary.SendAsByOthersCount | Should -Be 0
+    }
+
+    It 'keeps tenant-wide SendAs/SendOnBehalf records only where the user is the owner or the actor, and counts sends by others' {
+        $script:OwnerRecords = @(
+            (New-Record -Operation 'SendAs' -Actor 'attacker@contoso.com' -Owner $script:Upn -ClientIP '203.0.113.9')
+            (New-Record -Operation 'SendAs' -Actor 'attacker@contoso.com' -Owner $script:Upn -ClientIP '203.0.113.9' -When '2026-08-15T10:00:00Z')
+            (New-Record -Operation 'SendOnBehalf' -Actor 'assistant@contoso.com' -Owner 'other@contoso.com')
+            (New-Record -Operation 'SendAs' -Actor $script:Upn -Owner 'shared@contoso.com')
+            [pscustomobject]@{ Identity = 'no-auditdata'; Operation = 'SendAs'; AuditData = $null }
+        )
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+
+        Should -Invoke Search-CIPPBecAuditLog -Times 1 -ParameterFilter { $null -eq $UserIds -and $Operations -contains 'SendAs' -and $Operations -contains 'SendOnBehalf' -and $Operations -notcontains 'Send' }
+        $Result.Complete | Should -BeTrue
+        $Result.Data.Count | Should -Be 2
+        $Result.Data.Actor | Should -Not -Contain 'assistant@contoso.com' -Because 'a delegation on another mailbox is not this user''s activity'
+        $ByAttacker = $Result.Data | Where-Object { $_.Actor -eq 'attacker@contoso.com' }
+        $ByAttacker.Count | Should -Be 2
+        $ByAttacker.MailboxOwner | Should -Be 'victim@contoso.com'
+        $Result.Summary.Records | Should -Be 3
+        $Result.Summary.ByOperation.SendAs | Should -Be 3
+        $Result.Summary.SendAsByOthersCount | Should -Be 2 -Because 'the user sending as a shared mailbox is not someone else sending as the user'
+    }
+
+    It 'flags HardDeleteExceeded from the heuristics threshold, with the threshold itself counting as exceeded' {
+        $Threshold = [int]$script:Heuristics.mailActivity.hardDeleteThreshold
+        $script:UserRecords = @(1..$Threshold | ForEach-Object { New-Record -Operation 'HardDelete' })
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Summary.HardDeleteCount | Should -Be $Threshold
+        $Result.Summary.HardDeleteThreshold | Should -Be $Threshold
+        $Result.Summary.HardDeleteExceeded | Should -BeTrue
+        $Result.Data.Count | Should -Be 1 -Because 'identical records from one IP and client collapse into one group'
+        $Result.Data[0].Records | Should -Be $Threshold
+
+        $script:UserRecords = @(1..($Threshold - 1) | ForEach-Object { New-Record -Operation 'HardDelete' })
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Summary.HardDeleteCount | Should -Be ($Threshold - 1)
+        $Result.Summary.HardDeleteExceeded | Should -BeFalse
+    }
+
+    It 'stores every group, busiest first, and passes caps.mailActivityPages on as the audit-log slice budget' {
+        $Budget = [pscustomobject]@{
+            mailActivity = $script:Heuristics.mailActivity
+            caps         = [pscustomobject]@{ mailActivityPages = 2 }
+        }
+        $script:UserRecords = @(1..5 | ForEach-Object { New-Record -Operation 'MailItemsAccessed' -ClientIP "203.0.113.$_" -OperationCount $_ })
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $Budget
+
+        Should -Invoke Search-CIPPBecAuditLog -Times 1 -ParameterFilter { $null -ne $UserIds -and $MaxPages -eq 2 }
+        $Result.Data.Count | Should -Be 5
+        @($Result.Data | ForEach-Object Count) | Should -Be @(5, 4, 3, 2, 1)
+        $Result.Count | Should -Be 5
+        $Result.Complete | Should -BeTrue
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Summary.MailItemsAccessedCount | Should -Be 15
+        $Result.Summary.DistinctClientIPs | Should -Be 5
+    }
+
+    It 'reports a capped audit search as incomplete with the search''s own cap text and still returns the partial rows' {
+        $script:UserRecords = @((New-Record -Operation 'SoftDelete'))
+        $script:UserComplete = $false
+        $script:UserCap = '10 pages of 5000 records in a 60-minute slice'
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeFalse
+        $Result.Cap | Should -Be '10 pages of 5000 records in a 60-minute slice'
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Data.Count | Should -Be 1
+        $Result.Summary.SoftDeleteCount | Should -Be 1
+    }
+
+    It 'records a failed user search as an error and still returns what the send-as search found' {
+        Mock Search-CIPPBecAuditLog -ParameterFilter { $null -ne $UserIds } { throw 'UAL unavailable' }
+        $script:OwnerRecords = @((New-Record -Operation 'SendOnBehalf' -Actor 'attacker@contoso.com' -Owner $script:Upn))
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        Should -Invoke Search-CIPPBecAuditLog -Exactly -Times 2
+        $Result.Complete | Should -BeFalse
+        $Result.Error | Should -Be 'user activity search: UAL unavailable'
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Data.Count | Should -Be 1
+        $Result.Data[0].Operation | Should -Be 'SendOnBehalf'
+        $Result.Summary.SendAsByOthersCount | Should -Be 1
+    }
+
+    It 'truncates long client info strings and skips records that carry no AuditData' {
+        $LongInfo = 'Client=REST;' + ('x' * 200)
+        $script:UserRecords = @(
+            (New-Record -Operation 'MailItemsAccessed' -ClientInfo $LongInfo -OperationCount 4)
+            [pscustomobject]@{ Identity = 'broken'; Operation = 'HardDelete'; AuditData = $null }
+        )
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeTrue
+        $Result.Data.Count | Should -Be 1
+        $Result.Data[0].ClientInfoString.Length | Should -Be 123
+        $Result.Data[0].ClientInfoString | Should -BeLike 'Client=REST;x*...'
+        $Result.Summary.HardDeleteCount | Should -Be 0
+        $Result.Summary.MailItemsAccessedCount | Should -Be 4
+    }
+
+    It 'reads the access type from OperationProperties, lists the sessions per row, and hands the raw records on' {
+        $script:UserRecords = @(
+            New-Record -Operation 'MailItemsAccessed' -AccessType 'Sync' -AccessTypeInProperties -SessionId 'S1'
+            New-Record -Operation 'MailItemsAccessed' -AccessType 'Sync' -AccessTypeInProperties -SessionId 'S2'
+            New-Record -Operation 'MailItemsAccessed' -AccessType 'Sync' -AccessTypeInProperties -SessionId 'S1'
+        )
+        $Result = Get-CIPPBecMailActivity -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate '2026-08-14' -EndDate '2026-08-21' -Heuristics $script:Heuristics -Anchor 'victim@contoso.com'
+        $Result.Data[0].MailAccessType | Should -Be 'Sync'
+        @($Result.Data[0].SessionIds | Sort-Object) | Should -Be @('S1', 'S2')
+        $Result.Records.Count | Should -Be 3 -Because 'the attacker-activity pass reads item detail from the same search'
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecMailboxInventory.Tests.ps1 b/Tests/Private/Get-CIPPBecMailboxInventory.Tests.ps1
new file mode 100644
index 0000000000000..18243a2c271c7
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecMailboxInventory.Tests.ps1
@@ -0,0 +1,174 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    $env:CIPPRootPath = $RepoRoot
+    function New-ExoBulkRequest { param($tenantid, $cmdletArray, $useSystemMailbox, $Anchor, $NoAuthCheck, $Select, $ReturnWithCommand, [switch]$Compliance, [switch]$AsApp) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecMailboxInventory.ps1')
+    $script:Heuristics = Get-CIPPBecHeuristics
+    $script:Upn = 'victim@contoso.com'
+
+    # Build the cmdlet-keyed result New-ExoBulkRequest -ReturnWithCommand produces, stamping each row with its OperationGuid.
+    function New-BulkResult {
+        param([hashtable]$Rows)
+        $Result = @{}
+        foreach ($Guid in $Rows.Keys) {
+            $Entry = $Rows[$Guid]
+            $Cmdlet = $Entry.Cmdlet
+            if (-not $Result.ContainsKey($Cmdlet)) { $Result[$Cmdlet] = [System.Collections.Generic.List[object]]::new() }
+            foreach ($Row in @($Entry.Rows)) {
+                $Row | Add-Member -NotePropertyName 'OperationGuid' -NotePropertyValue $Guid -Force
+                $Result[$Cmdlet].Add($Row)
+            }
+        }
+        $Result
+    }
+    function New-Round1 {
+        param([switch]$OmitApps, [switch]$ErrorPermissions)
+        $Rows = @{
+            'Mailbox'             = @{ Cmdlet = 'Get-Mailbox'; Rows = @([pscustomobject]@{ PrimarySmtpAddress = $script:Upn; RecipientTypeDetails = 'UserMailbox'; ForwardingSmtpAddress = 'smtp:attacker@example.org'; ForwardingAddress = $null; DeliverToMailboxAndForward = $true; GrantSendOnBehalfTo = @('Assistant One', 'guest_example.org#EXT#@contoso.onmicrosoft.com'); AuditEnabled = $true }) }
+            'CAS'                 = @{ Cmdlet = 'Get-CASMailbox'; Rows = @([pscustomobject]@{ OWAEnabled = $true; EWSEnabled = $true; IMAPEnabled = $false; POPEnabled = $false; MAPIEnabled = $true; ActiveSyncEnabled = $true; SmtpClientAuthenticationDisabled = $false; ActiveSyncBlockedDeviceIDs = @() }) }
+            'AutoReply'           = @{ Cmdlet = 'Get-MailboxAutoReplyConfiguration'; Rows = @([pscustomobject]@{ AutoReplyState = 'Enabled'; StartTime = $null; EndTime = $null; ExternalAudience = 'All'; InternalMessage = 'SECRET INTERNAL TEXT'; ExternalMessage = 'SECRET EXTERNAL TEXT' }) }
+            'MailboxPermission'   = @{ Cmdlet = 'Get-MailboxPermission'; Rows = @(
+                    [pscustomobject]@{ User = 'NT AUTHORITY\SELF'; AccessRights = @('FullAccess'); IsInherited = $false; Deny = $false }
+                    [pscustomobject]@{ User = 'assistant@contoso.com'; AccessRights = @('FullAccess'); IsInherited = $false; Deny = $false }
+                    [pscustomobject]@{ User = 'outsider@example.org'; AccessRights = @('FullAccess'); IsInherited = $false; Deny = $false }
+                    [pscustomobject]@{ User = 'inherited@contoso.com'; AccessRights = @('FullAccess'); IsInherited = $true; Deny = $false }
+                    # the REST transport returns these as strings, and [bool]'False' is $true
+                    [pscustomobject]@{ User = 'stringy@contoso.com'; AccessRights = @('FullAccess'); IsInherited = 'False'; Deny = 'False' }
+                ) }
+            'RecipientPermission' = @{ Cmdlet = 'Get-RecipientPermission'; Rows = @(
+                    [pscustomobject]@{ Trustee = 'NT AUTHORITY\SELF'; AccessRights = @('SendAs'); IsInherited = $false; AccessControlType = 'Allow' }
+                    [pscustomobject]@{ Trustee = 'assistant@contoso.com'; AccessRights = @('SendAs'); IsInherited = $false; AccessControlType = 'Allow' }
+                ) }
+            'FolderStats-Calendar' = @{ Cmdlet = 'Get-MailboxFolderStatistics'; Rows = @([pscustomobject]@{ FolderType = 'Calendar'; FolderId = 'LgAAAACalendar'; Name = 'Kalender' }, [pscustomobject]@{ FolderType = 'User Created'; FolderId = 'LgAAAASub'; Name = 'Sub' }) }
+            'FolderStats-Inbox'   = @{ Cmdlet = 'Get-MailboxFolderStatistics'; Rows = @([pscustomobject]@{ FolderType = 'Inbox'; FolderId = 'LgAAAAInbox'; Name = 'Posteingang' }) }
+        }
+        if (-not $OmitApps) {
+            $Rows['Apps'] = @{ Cmdlet = 'Get-App'; Rows = @(
+                    [pscustomobject]@{ Identity = 'a1'; DisplayName = 'Contoso Connector'; AppId = 'a1'; Enabled = $true; ProviderName = 'Microsoft'; Scope = 'Organization'; Type = 'MarketPlace'; AppVersion = '1.0' }
+                    [pscustomobject]@{ Identity = 'a2'; DisplayName = 'Mail Harvester'; AppId = 'a2'; Enabled = $true; ProviderName = 'Unknown Dev'; Scope = 'User'; Type = 'Private'; AppVersion = '0.1' }
+                    [pscustomobject]@{ Identity = 'a3'; DisplayName = 'Disabled Thing'; AppId = 'a3'; Enabled = $false; ProviderName = 'Unknown Dev'; Scope = 'User'; Type = 'Private'; AppVersion = '0.1' }
+                    [pscustomobject]@{ Identity = 'a4'; DisplayName = 'Stringly Disabled'; AppId = 'a4'; Enabled = 'False'; ProviderName = 'Unknown Dev'; Scope = 'User'; Type = 'Private'; AppVersion = '0.1' }
+                ) }
+        }
+        if ($ErrorPermissions) {
+            $Rows['MailboxPermission'] = @{ Cmdlet = 'Get-MailboxPermission'; Rows = @([pscustomobject]@{ error = 'The operation could not be performed because object could not be found'; target = $script:Upn }) }
+        }
+        New-BulkResult -Rows $Rows
+    }
+    function New-Round2 {
+        New-BulkResult -Rows @{
+            'FolderPermission-Calendar' = @{ Cmdlet = 'Get-MailboxFolderPermission'; Rows = @(
+                    [pscustomobject]@{ User = [pscustomobject]@{ DisplayName = 'Default' }; AccessRights = @('AvailabilityOnly') }
+                    [pscustomobject]@{ User = [pscustomobject]@{ DisplayName = 'Anonymous' }; AccessRights = @('None') }
+                    [pscustomobject]@{ User = [pscustomobject]@{ DisplayName = 'Assistant One'; ADRecipient = [pscustomobject]@{ PrimarySmtpAddress = 'assistant@contoso.com' } }; AccessRights = @('Editor') }
+                ) }
+            'FolderPermission-Inbox'    = @{ Cmdlet = 'Get-MailboxFolderPermission'; Rows = @(
+                    [pscustomobject]@{ User = [pscustomobject]@{ DisplayName = 'Default' }; AccessRights = @('Reviewer') }
+                ) }
+        }
+    }
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Get-CIPPBecMailboxInventory' {
+    It 'builds the delegation inventory across the five types and flags external, guest and catch-all trustees' {
+        $script:Round = 0
+        Mock New-ExoBulkRequest { $script:Round++; if ($script:Round -eq 1) { New-Round1 } else { New-Round2 } }
+        $Result = Get-CIPPBecMailboxInventory -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com', 'contoso.onmicrosoft.com')
+        $Result.Delegations.Complete | Should -BeTrue
+        $D = $Result.Delegations.Data
+        ($D | Where-Object { $_.PermissionType -eq 'FullAccess' }).Trustee | Should -Not -Contain 'NT AUTHORITY\SELF'
+        ($D | Where-Object { $_.PermissionType -eq 'FullAccess' }).Trustee | Should -Not -Contain 'inherited@contoso.com'
+        ($D | Where-Object { $_.PermissionType -eq 'FullAccess' -and $_.Trustee -eq 'assistant@contoso.com' }).Flagged | Should -BeFalse
+        ($D | Where-Object { $_.PermissionType -eq 'FullAccess' -and $_.Trustee -eq 'outsider@example.org' }).Flagged | Should -BeTrue
+        $Stringy = $D | Where-Object { $_.PermissionType -eq 'FullAccess' -and $_.Trustee -eq 'stringy@contoso.com' }
+        $Stringy | Should -Not -BeNullOrEmpty -Because 'IsInherited "False" (a string) is not inherited'
+        $Stringy.Deny | Should -BeFalse -Because 'Deny "False" (a string) is an allow entry'
+        ($D | Where-Object { $_.PermissionType -eq 'FullAccess' -and $_.Trustee -eq 'assistant@contoso.com' }).Deny | Should -BeFalse
+        ($D | Where-Object { $_.PermissionType -eq 'SendAs' }).Trustee | Should -Be 'assistant@contoso.com'
+        ($D | Where-Object { $_.PermissionType -eq 'SendOnBehalf' -and $_.Trustee -like '*#EXT#*' }).Flagged | Should -BeTrue
+        ($D | Where-Object { $_.PermissionType -eq 'SendOnBehalf' -and $_.Trustee -eq 'Assistant One' }).Flagged | Should -BeFalse
+        $Folders = @($D | Where-Object { $_.PermissionType -eq 'Folder' })
+        $Folders.Trustee | Should -Not -Contain 'Anonymous'
+        ($Folders | Where-Object { $_.Resource -like '*Calendar' }).Trustee | Should -Not -Contain 'Default' -Because 'AvailabilityOnly for Default is the normal calendar default'
+        ($Folders | Where-Object { $_.Resource -like '*Inbox' -and $_.Trustee -eq 'Default' }).Flagged | Should -BeTrue -Because 'Reviewer on the Inbox for everyone is exposure'
+        ($Folders | Where-Object { $_.Trustee -eq 'Assistant One' }).AccessRights | Should -Be 'Editor'
+        $D[0].Flagged | Should -BeTrue -Because 'flagged delegations sort first'
+    }
+
+    It 'reads folder permissions by folder id, not by localised folder name' {
+        $script:Round = 0
+        $script:Round2Array = $null
+        Mock New-ExoBulkRequest { $script:Round++; if ($script:Round -eq 1) { New-Round1 } else { $script:Round2Array = $cmdletArray; New-Round2 } }
+        $null = Get-CIPPBecMailboxInventory -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Identities = @($script:Round2Array | ForEach-Object { $_.CmdletInput.Parameters.Identity })
+        $Identities | Should -Contain "$($script:Upn):LgAAAACalendar"
+        $Identities | Should -Contain "$($script:Upn):LgAAAAInbox"
+        $Identities | Should -Not -Contain "$($script:Upn):LgAAAASub"
+        $Identities -join ' ' | Should -Not -Match 'Kalender|Posteingang'
+    }
+
+    It 'captures forwarding, auto-reply state and protocols without the auto-reply text' {
+        $script:Round = 0
+        Mock New-ExoBulkRequest { $script:Round++; if ($script:Round -eq 1) { New-Round1 } else { New-Round2 } }
+        $Result = Get-CIPPBecMailboxInventory -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $State = $Result.MailboxState.Data
+        $Result.MailboxState.Complete | Should -BeTrue
+        $State.HasForwarding | Should -BeTrue
+        $State.ForwardingSmtpAddress | Should -Be 'smtp:attacker@example.org'
+        $State.DeliverToMailboxAndForward | Should -BeTrue
+        $State.AutoReplyState | Should -Be 'Enabled'
+        $State.AutoReplyHasInternalMessage | Should -BeTrue
+        $State.IMAPEnabled | Should -BeFalse
+        $State.EWSEnabled | Should -BeTrue
+        ($State | ConvertTo-Json -Depth 5) | Should -Not -Match 'SECRET'
+    }
+
+    It 'flags enabled, user-installed, non-Microsoft add-ins only' {
+        $script:Round = 0
+        Mock New-ExoBulkRequest { $script:Round++; if ($script:Round -eq 1) { New-Round1 } else { New-Round2 } }
+        $Result = Get-CIPPBecMailboxInventory -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Result.AddIns.Complete | Should -BeTrue
+        $Result.AddIns.Data.Count | Should -Be 4
+        ($Result.AddIns.Data | Where-Object { $_.DisplayName -eq 'Mail Harvester' }).Flagged | Should -BeTrue
+        $Stringly = $Result.AddIns.Data | Where-Object { $_.DisplayName -eq 'Stringly Disabled' }
+        $Stringly.Enabled | Should -BeFalse -Because 'Enabled "False" (a string) is disabled'
+        $Stringly.Flagged | Should -BeFalse
+        ($Result.AddIns.Data | Where-Object { $_.DisplayName -eq 'Contoso Connector' }).Flagged | Should -BeFalse
+        ($Result.AddIns.Data | Where-Object { $_.DisplayName -eq 'Disabled Thing' }).Flagged | Should -BeFalse
+    }
+
+    It 'reports a missing sub-request as incomplete instead of an empty list' {
+        $script:Round = 0
+        Mock New-ExoBulkRequest { $script:Round++; if ($script:Round -eq 1) { New-Round1 -OmitApps } else { New-Round2 } }
+        $Result = Get-CIPPBecMailboxInventory -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Result.AddIns.Complete | Should -BeFalse
+        $Result.AddIns.Error | Should -Match 'Get-App returned no response'
+        $Result.Delegations.Complete | Should -BeTrue
+    }
+
+    It 'reports an errored sub-request as incomplete with the error text' {
+        $script:Round = 0
+        Mock New-ExoBulkRequest { $script:Round++; if ($script:Round -eq 1) { New-Round1 -ErrorPermissions } else { New-Round2 } }
+        $Result = Get-CIPPBecMailboxInventory -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Result.Delegations.Complete | Should -BeFalse
+        $Result.Delegations.Error | Should -Match 'could not be found'
+        ($Result.Delegations.Data | Where-Object { $_.PermissionType -eq 'SendAs' }).Count | Should -Be 1 -Because 'the other permission types still load'
+        $Result.MailboxState.Complete | Should -BeTrue
+    }
+
+    It 'treats a swallowed transport failure (empty bulk result) as everything incomplete' {
+        Mock New-ExoBulkRequest { @{} }
+        $Result = Get-CIPPBecMailboxInventory -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Result.MailboxState.Complete | Should -BeFalse
+        $Result.Delegations.Complete | Should -BeFalse
+        $Result.AddIns.Complete | Should -BeFalse
+        $Result.Delegations.Data.Count | Should -Be 0
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecMessageTrace.Tests.ps1 b/Tests/Private/Get-CIPPBecMessageTrace.Tests.ps1
new file mode 100644
index 0000000000000..416a014ba1521
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecMessageTrace.Tests.ps1
@@ -0,0 +1,82 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecMessageTrace.ps1')
+
+    function New-TraceRow {
+        param([int]$Index, [string]$Recipient = "r$Index@example.com")
+        [pscustomobject]@{
+            MessageTraceId   = "trace-$Index"
+            RecipientAddress = $Recipient
+            SenderAddress    = 'user@contoso.com'
+            Subject          = "Subject $Index"
+            Status           = 'Delivered'
+            Received         = (Get-Date '2026-08-20T12:00:00Z').AddMinutes(-$Index).ToString('o')
+            FromIP           = '203.0.113.5'
+        }
+    }
+    $script:Start = (Get-Date).AddDays(-7)
+    $script:End = Get-Date
+}
+
+Describe 'Get-CIPPBecMessageTrace' {
+    BeforeEach {
+        $script:Calls = [System.Collections.Generic.List[object]]::new()
+    }
+
+    It 'requires a sender or a recipient' {
+        { Get-CIPPBecMessageTrace -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End } | Should -Throw
+    }
+
+    It 'returns a short page as complete and passes ResultSize and the address' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); 1..2 | ForEach-Object { New-TraceRow -Index $_ } }
+        $Result = Get-CIPPBecMessageTrace -TenantFilter 'contoso.com' -SenderAddress 'user@contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 5
+        $Result.Complete | Should -BeTrue
+        $Result.Rows.Count | Should -Be 2
+        $Result.Pages | Should -Be 1
+        $script:Calls[0].ResultSize | Should -Be 5
+        $script:Calls[0].SenderAddress | Should -Be 'user@contoso.com'
+        $script:Calls[0].Keys | Should -Not -Contain 'RecipientAddress'
+    }
+
+    It 'walks the cursor using the last row''s Received as EndDate and its recipient as StartingRecipientAddress' {
+        Mock New-ExoRequest {
+            $script:Calls.Add(($cmdParams.Clone()))
+            if ($script:Calls.Count -eq 1) { 1..2 | ForEach-Object { New-TraceRow -Index $_ } } else { @(New-TraceRow -Index 3) }
+        }
+        $Result = Get-CIPPBecMessageTrace -TenantFilter 'contoso.com' -RecipientAddress 'user@contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 2
+        $Result.Complete | Should -BeTrue
+        $Result.Rows.Count | Should -Be 3
+        $Result.Pages | Should -Be 2
+        $script:Calls[1].StartingRecipientAddress | Should -Be 'r2@example.com'
+        # the cursor is sent as a sortable UTC string, the same shape the window bounds use
+        $script:Calls[1].EndDate | Should -Be ((Get-Date '2026-08-20T12:00:00Z').ToUniversalTime().AddMinutes(-2).ToString('s'))
+    }
+
+    It 'walks every page until a short page ends the window - there is no page ceiling' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); $Base = ($script:Calls.Count - 1) * 2; if ($script:Calls.Count -le 7) { 1..2 | ForEach-Object { New-TraceRow -Index ($Base + $_) } } else { New-TraceRow -Index ($Base + 1) } }
+        $Result = Get-CIPPBecMessageTrace -TenantFilter 'contoso.com' -SenderAddress 'user@contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 2
+        $Result.Complete | Should -BeTrue
+        $Result.Pages | Should -Be 8
+        $Result.Rows.Count | Should -Be 15
+        $Result.Cap | Should -BeNullOrEmpty
+    }
+
+    It 'stops and reports partial results when the cursor does not advance' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); 1..2 | ForEach-Object { New-TraceRow -Index $_ } }
+        $Result = Get-CIPPBecMessageTrace -TenantFilter 'contoso.com' -SenderAddress 'user@contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 2
+        $Result.Complete | Should -BeFalse
+        $Result.Cap | Should -Match 'stalled'
+        $Result.Rows.Count | Should -Be 2
+    }
+
+    It 'de-duplicates rows that appear on two pages' {
+        Mock New-ExoRequest {
+            $script:Calls.Add($cmdParams)
+            if ($script:Calls.Count -eq 1) { 1..2 | ForEach-Object { New-TraceRow -Index $_ } } else { @((New-TraceRow -Index 2), (New-TraceRow -Index 3)) }
+        }
+        $Result = Get-CIPPBecMessageTrace -TenantFilter 'contoso.com' -SenderAddress 'user@contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 2
+        $Result.Rows.Count | Should -Be 3
+        $Result.Complete | Should -BeFalse -Because 'a full second page with one duplicate is still a full page that hit the cursor; the walk continues until a short page'
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecNonInteractiveSignIns.Tests.ps1 b/Tests/Private/Get-CIPPBecNonInteractiveSignIns.Tests.ps1
new file mode 100644
index 0000000000000..7637387c759e6
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecNonInteractiveSignIns.Tests.ps1
@@ -0,0 +1,129 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination) }
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) $Value }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecNonInteractiveSignIns.ps1')
+    $script:UserId = 'c0ffee00-0000-4000-8000-000000000001'
+    $script:Start = [datetime]::new(2026, 8, 14, 0, 0, 0, [System.DateTimeKind]::Utc)
+
+    function Get-SignInFixture {
+        param([string]$Id, $Country = 'NL', [string]$CaStatus = 'success', $ErrorCode = 0, [string]$When = '2026-08-21T10:00:00Z')
+        [pscustomobject]@{
+            id                           = $Id
+            createdDateTime              = $When
+            appDisplayName               = 'Outlook'
+            resourceDisplayName          = 'Microsoft Graph'
+            clientAppUsed                = 'Mobile Apps and Desktop clients'
+            conditionalAccessStatus      = $CaStatus
+            status                       = [pscustomobject]@{ errorCode = $ErrorCode; failureReason = 'Other.' }
+            ipAddress                    = '203.0.113.9'
+            location                     = if ($null -eq $Country) { $null } else { [pscustomobject]@{ city = 'Amsterdam'; countryOrRegion = $Country } }
+            userAgent                    = 'Mozilla/5.0'
+            incomingTokenType            = 'refreshToken'
+            tokenProtectionStatusDetails = [pscustomobject]@{ signInSessionStatus = 'unbound' }
+            riskLevelDuringSignIn        = 'none'
+            signInEventTypes             = @('nonInteractiveUser')
+        }
+    }
+}
+
+Describe 'Get-CIPPBecNonInteractiveSignIns' {
+    BeforeEach {
+        Mock New-GraphGetRequest { @($script:SignIns) }
+        Mock ConvertTo-CIPPODataFilterValue { $Value }
+        $script:SignIns = @()
+    }
+
+    It 'queries the beta sign-in log for the user''s non-interactive events inside the window, newest first, paged to the end' {
+        $null = Get-CIPPBecNonInteractiveSignIns -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -UsageLocation 'NL'
+        Should -Invoke ConvertTo-CIPPODataFilterValue -Times 1 -ParameterFilter { $Value -eq $script:UserId -and $Type -eq 'Guid' }
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter {
+            $uri -eq "https://graph.microsoft.com/beta/auditLogs/signIns?`$filter=userId eq '$($script:UserId)' and signInEventTypes/any(t: t eq 'nonInteractiveUser') and createdDateTime ge 2026-08-14T00:00:00Z&`$top=999&`$orderby=createdDateTime desc" -and
+            $tenantid -eq 'contoso.com' -and $AsApp -eq $true -and $noPagination -ne $true
+        }
+    }
+
+    It 'projects a sign-in row with a UTC timestamp, token details and the location verdict' {
+        $script:SignIns = @(Get-SignInFixture -Id 's1' -When '2026-08-21T12:00:00+02:00')
+        $Result = Get-CIPPBecNonInteractiveSignIns -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -UsageLocation 'NL'
+        $Result.Complete | Should -BeTrue
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 1
+        $Row = $Result.Data[0]
+        $Row.CreatedDateTime | Should -Be '2026-08-21T10:00:00Z' -Because 'the offset is folded into UTC'
+        $Row.id | Should -Be 's1'
+        $Row.AppDisplayName | Should -Be 'Outlook'
+        $Row.ResourceDisplayName | Should -Be 'Microsoft Graph'
+        $Row.ClientAppUsed | Should -Be 'Mobile Apps and Desktop clients'
+        $Row.Status | Should -Be 'Success'
+        $Row.ErrorCode | Should -Be 0
+        $Row.IPAddress | Should -Be '203.0.113.9'
+        $Row.Country | Should -Be 'NL'
+        $Row.City | Should -Be 'Amsterdam'
+        $Row.UserAgent | Should -Be 'Mozilla/5.0'
+        $Row.IncomingTokenType | Should -Be 'refreshToken'
+        $Row.TokenProtection | Should -Be 'unbound'
+        $Row.RiskLevelDuringSignIn | Should -Be 'none'
+        $Row.ForeignLocation | Should -BeOfType [bool]
+        $Row.ForeignLocation | Should -BeFalse
+    }
+
+    It 'derives Status from the conditional access outcome and the error code' {
+        $script:SignIns = @(
+            Get-SignInFixture -Id 's-ok' -CaStatus 'success' -ErrorCode 0
+            Get-SignInFixture -Id 's-na' -CaStatus 'notApplied' -ErrorCode 0
+            Get-SignInFixture -Id 's-pw' -CaStatus 'success' -ErrorCode 50126
+            Get-SignInFixture -Id 's-ca' -CaStatus 'failure' -ErrorCode 0
+        )
+        $Result = Get-CIPPBecNonInteractiveSignIns -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -UsageLocation 'NL'
+        ($Result.Data | Where-Object { $_.id -eq 's-ok' }).Status | Should -Be 'Success'
+        ($Result.Data | Where-Object { $_.id -eq 's-na' }).Status | Should -Be 'Success' -Because 'no applicable CA policy is still a successful sign-in'
+        ($Result.Data | Where-Object { $_.id -eq 's-pw' }).Status | Should -Be 'Failed' -Because 'a non-zero error code fails the sign-in even when CA passed'
+        ($Result.Data | Where-Object { $_.id -eq 's-pw' }).ErrorCode | Should -Be 50126
+        ($Result.Data | Where-Object { $_.id -eq 's-ca' }).Status | Should -Be 'Failed' -Because 'a CA failure fails the sign-in even with error code 0'
+    }
+
+    It 'compares the sign-in country against the usage location and leaves the verdict undecided when either side is unknown' {
+        $script:SignIns = @(
+            Get-SignInFixture -Id 's-home' -Country 'NL'
+            Get-SignInFixture -Id 's-case' -Country 'nl'
+            Get-SignInFixture -Id 's-away' -Country 'US'
+            Get-SignInFixture -Id 's-unknown' -Country 'Unknown'
+            Get-SignInFixture -Id 's-blank' -Country ''
+            Get-SignInFixture -Id 's-noloc' -Country $null
+        )
+        $Result = Get-CIPPBecNonInteractiveSignIns -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -UsageLocation 'NL'
+        $Result.Count | Should -Be 6
+        $InCountry = $Result.Data | Where-Object { $_.id -eq 's-home' }
+        $InCountry.ForeignLocation | Should -BeOfType [bool]
+        $InCountry.ForeignLocation | Should -BeFalse
+        ($Result.Data | Where-Object { $_.id -eq 's-case' }).ForeignLocation | Should -BeFalse -Because 'the country comparison ignores case'
+        ($Result.Data | Where-Object { $_.id -eq 's-away' }).ForeignLocation | Should -BeTrue
+        ($Result.Data | Where-Object { $_.id -eq 's-unknown' }).ForeignLocation | Should -BeNullOrEmpty
+        ($Result.Data | Where-Object { $_.id -eq 's-blank' }).ForeignLocation | Should -BeNullOrEmpty
+        $NoLoc = $Result.Data | Where-Object { $_.id -eq 's-noloc' }
+        $NoLoc.ForeignLocation | Should -BeNullOrEmpty
+        $NoLoc.Country | Should -BeNullOrEmpty
+        $NoLoc.City | Should -BeNullOrEmpty
+
+        $script:SignIns = @(Get-SignInFixture -Id 's-away' -Country 'US')
+        $Result = Get-CIPPBecNonInteractiveSignIns -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+        $Result.Data[0].ForeignLocation | Should -BeNullOrEmpty -Because 'without a usage location there is nothing to compare against'
+    }
+
+    It 'reports every row Graph paged back as complete - there is no count cap' {
+        $script:SignIns = @(1..1200 | ForEach-Object { Get-SignInFixture -Id "s$_" })
+        $Result = Get-CIPPBecNonInteractiveSignIns -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -UsageLocation 'NL'
+        $Result.Complete | Should -BeTrue
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 1200
+    }
+
+    It 'lets a Graph failure propagate to the caller instead of reporting an empty sign-in list' {
+        Mock New-GraphGetRequest { throw 'Graph unavailable' }
+        { Get-CIPPBecNonInteractiveSignIns -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start -UsageLocation 'NL' } | Should -Throw -ExpectedMessage '*Graph unavailable*'
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecReceivedMailFindings.Tests.ps1 b/Tests/Private/Get-CIPPBecReceivedMailFindings.Tests.ps1
new file mode 100644
index 0000000000000..de686b73320ee
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecReceivedMailFindings.Tests.ps1
@@ -0,0 +1,167 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    $env:CIPPRootPath = $RepoRoot
+    function Get-CIPPBecMessageTrace { param($TenantFilter, $SenderAddress, $RecipientAddress, $StartDate, $EndDate, $Anchor, $PageSize, $MaxPages) }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination, [switch]$Stream) }
+    function Get-NormalizedError { param($message) $message }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Tools/Get-CIPPLevenshteinDistance.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecReceivedMailFindings.ps1')
+    $script:Heuristics = Get-CIPPBecHeuristics
+
+    function New-Row {
+        param([string]$Sender, [string]$Subject, [int]$Index = 1)
+        [pscustomobject]@{
+            MessageTraceId   = "trace-$Index"
+            SenderAddress    = $Sender
+            RecipientAddress = 'victim@contoso.com'
+            Subject          = $Subject
+            Status           = 'Delivered'
+            Received         = '2026-08-20T12:00:00Z'
+            Size             = 1024
+            FromIP           = '203.0.113.9'
+        }
+    }
+    $script:Start = (Get-Date).AddDays(-7)
+    $script:End = Get-Date
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Get-CIPPBecReceivedMailFindings' {
+    It 'flags look-alike sender domains within one or two edits of an accepted domain, never the accepted domain itself' {
+        Mock Get-CIPPBecMessageTrace {
+            [pscustomobject]@{
+                Rows     = @(
+                    (New-Row -Sender 'billing@contos0.com' -Subject 'Your statement' -Index 1)
+                    (New-Row -Sender 'it@c0nt0so.com' -Subject 'Hello' -Index 2)
+                    (New-Row -Sender 'friend@contoso.com' -Subject 'Lunch' -Index 3)
+                    (New-Row -Sender 'news@example.org' -Subject 'Weekly digest' -Index 4)
+                    (New-Row -Sender 'spoof@contoso-secure-login.com' -Subject 'Hi' -Index 5)
+                )
+                Complete = $true; Cap = $null; Pages = 1
+            }
+        }
+        $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com', 'contoso.onmicrosoft.com')
+        $Typos = @($Result.Findings.Data | Where-Object { $_.FindingType -eq 'PossibleTyposquat' })
+        $Typos.SenderDomain | Should -Contain 'contos0.com'
+        $Typos.SenderDomain | Should -Contain 'c0nt0so.com'
+        $Typos.SenderDomain | Should -Not -Contain 'contoso.com'
+        $Typos.SenderDomain | Should -Not -Contain 'example.org'
+        $Typos.SenderDomain | Should -Not -Contain 'contoso-secure-login.com'
+        ($Typos | Where-Object { $_.SenderDomain -eq 'contos0.com' }).Distance | Should -Be 1
+        ($Typos | Where-Object { $_.SenderDomain -eq 'c0nt0so.com' }).ComparedDomain | Should -Be 'contoso.com'
+        $Result.Findings.Summary.TyposquatDomains | Should -Contain 'contos0.com'
+        $Result.Findings.Complete | Should -BeTrue
+    }
+
+    It 'names the phishing-subject pattern that matched and keeps keyword-only hits at Low' {
+        Mock Get-CIPPBecMessageTrace {
+            [pscustomobject]@{
+                Rows     = @(
+                    (New-Row -Sender 'a@example.org' -Subject 'URGENT action is required on your account' -Index 1)
+                    (New-Row -Sender 'b@example.org' -Subject 'Please verify your account today' -Index 2)
+                    (New-Row -Sender 'c@example.org' -Subject 'Suspended: access to your mailbox' -Index 3)
+                    (New-Row -Sender 'd@example.org' -Subject 'You are our lottery winner' -Index 4)
+                    (New-Row -Sender 'e@example.org' -Subject 'Invoice 4471 attached' -Index 5)
+                    (New-Row -Sender 'f@example.org' -Subject 'New password policy' -Index 6)
+                    (New-Row -Sender 'g@example.org' -Subject 'Lunch on Friday?' -Index 7)
+                )
+                Complete = $true; Cap = $null; Pages = 1
+            }
+        }
+        $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Patterns = @($Result.Findings.Data | Where-Object { $_.FindingType -eq 'SubjectPattern' })
+        $Patterns.Reason | Should -Contain 'Urgent action language'
+        $Patterns.Reason | Should -Contain 'Account verification language'
+        $Patterns.Reason | Should -Contain 'Account suspension language'
+        $Patterns.Reason | Should -Contain 'Prize or lottery language'
+        $Patterns.Reason | Should -Contain 'Invoice or payment language'
+        $Keyword = @($Result.Findings.Data | Where-Object { $_.FindingType -eq 'SubjectKeyword' })
+        $Keyword.Count | Should -Be 1
+        $Keyword[0].Subject | Should -Be 'New password policy'
+        $Keyword[0].Severity | Should -Be 'Low'
+        ($Result.Findings.Data | Where-Object { $_.Subject -eq 'Lunch on Friday?' }) | Should -BeNullOrEmpty
+    }
+
+    It 'never stores message content - findings carry trace metadata only' {
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = @((New-Row -Sender 'x@contos0.com' -Subject 'Invoice')); Complete = $true; Cap = $null; Pages = 1 } }
+        $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Names = @($Result.Findings.Data[0].PSObject.Properties.Name)
+        $Names | Should -Not -Contain 'Body'
+        $Names | Should -Not -Contain 'Attachments'
+        $Names | Should -Contain 'MessageTraceId'
+    }
+
+    It 'propagates a capped trace as partial' {
+        Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = @((New-Row -Sender 'x@example.org' -Subject 'hi')); Complete = $false; Cap = '5 pages of 5000 rows'; Pages = 5 } }
+        $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Result.Findings.Complete | Should -BeFalse
+        $Result.Findings.Cap | Should -Be '5 pages of 5000 rows'
+    }
+
+    It 'reports a trace failure as an error, not as a clean mailbox' {
+        Mock Get-CIPPBecMessageTrace { throw 'EXO is down' }
+        $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -AcceptedDomains @('contoso.com')
+        $Result.Findings.Complete | Should -BeFalse
+        $Result.Findings.Error | Should -Match 'EXO is down'
+        $Result.Findings.Data.Count | Should -Be 0
+    }
+
+    Context 'Defender analysed-email metadata' {
+        BeforeEach {
+            Mock Get-CIPPBecMessageTrace { [pscustomobject]@{ Rows = @(); Complete = $true; Cap = $null; Pages = 1 } }
+        }
+
+        It 'is skipped without -IncludeDefender' {
+            Mock New-GraphGetRequest { throw 'Defender must not be queried' }
+            $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+            $Result.Defender.Available | Should -BeFalse
+            # Not querying Defender is a skip (the run's licence preflight found no Defender P2), not a
+            # clean pass: it must never read as complete.
+            $Result.Defender.Complete | Should -BeFalse
+            $Result.Defender.Skipped | Should -BeTrue
+            $Result.Defender.Requirement | Should -Match 'Defender for Office 365 Plan 2'
+            Should -Invoke New-GraphGetRequest -Times 0
+        }
+
+        It 'reads the window tenant-wide, keeps this mailbox''s threat-classified rows and marks delivered ones' {
+            # shape as returned by beta/security/collaboration/analyzedEmails (loggedDateTime, latestDelivery{action,location})
+            Mock New-GraphGetRequest {
+                @(
+                    [pscustomobject]@{ networkMessageId = 'a'; loggedDateTime = '2026-08-20T10:00:00Z'; recipientEmailAddress = 'victim@contoso.com'; subject = 'Phish'; threatTypes = @('phish'); latestDelivery = [pscustomobject]@{ action = 'delivered'; location = 'inbox' }; originalDelivery = [pscustomobject]@{ action = 'delivered'; location = 'inbox' }; senderDetail = [pscustomobject]@{ fromAddress = 'bad@example.org'; ipv4 = '198.51.100.9' } }
+                    [pscustomobject]@{ networkMessageId = 'b'; loggedDateTime = '2026-08-20T11:00:00Z'; recipientEmailAddress = 'VICTIM@contoso.com'; subject = 'Blocked'; threatTypes = @('malware'); latestDelivery = [pscustomobject]@{ action = 'blocked'; location = 'quarantine' }; senderDetail = [pscustomobject]@{ fromAddress = 'bad2@example.org' } }
+                    [pscustomobject]@{ networkMessageId = 'c'; loggedDateTime = '2026-08-20T12:00:00Z'; recipientEmailAddress = 'victim@contoso.com'; subject = 'Clean'; threatTypes = @('none'); latestDelivery = [pscustomobject]@{ action = 'delivered'; location = 'inbox' }; senderDetail = [pscustomobject]@{ fromAddress = 'ok@example.org' } }
+                    [pscustomobject]@{ networkMessageId = 'd'; loggedDateTime = '2026-08-20T13:00:00Z'; recipientEmailAddress = 'someone.else@contoso.com'; subject = 'Phish for someone else'; threatTypes = @('phish'); latestDelivery = [pscustomobject]@{ action = 'delivered'; location = 'inbox' }; senderDetail = [pscustomobject]@{ fromAddress = 'bad@example.org' } }
+                )
+            }
+            $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -IncludeDefender
+            $Result.Defender.Available | Should -BeTrue
+            $Result.Defender.Complete | Should -BeTrue
+            $Result.Defender.Data.Count | Should -Be 2
+            $Result.Defender.Data.NetworkMessageId | Should -Not -Contain 'd' -Because 'other recipients are matched out client-side'
+            $A = $Result.Defender.Data | Where-Object { $_.NetworkMessageId -eq 'a' }
+            $A.Delivered | Should -BeTrue
+            $A.ReceivedDateTime | Should -Be '2026-08-20T10:00:00Z'
+            $A.SenderIP | Should -Be '198.51.100.9'
+            $A.LatestDeliveryLocation | Should -Be 'inbox'
+            ($Result.Defender.Data | Where-Object { $_.NetworkMessageId -eq 'b' }).Delivered | Should -BeFalse
+            $Result.Defender.AnalyzedCount | Should -Be 3 -Because 'three of the four analysed messages were addressed to this mailbox'
+            # the service rejects $filter on the recipient, so the request carries the window only and is streamed page by page
+            Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like '*security/collaboration/analyzedEmails?startTime=*' -and $uri -notlike '*$filter*' -and $uri -like '*$top=1000*' -and $AsApp -eq $true -and $Stream -eq $true -and $noPagination -ne $true }
+        }
+
+        It 'reports a permission error as incomplete with the PermissionError flag, never as "no phishing"' {
+            Mock New-GraphGetRequest { throw 'Authorization_RequestDenied: Insufficient privileges to complete the operation.' }
+            $Result = Get-CIPPBecReceivedMailFindings -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics -IncludeDefender
+            $Result.Defender.Complete | Should -BeFalse
+            $Result.Defender.Available | Should -BeFalse
+            $Result.Defender.PermissionError | Should -BeTrue
+            $Result.Defender.Error | Should -Match 'unavailable'
+        }
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecRegisteredDevices.Tests.ps1 b/Tests/Private/Get-CIPPBecRegisteredDevices.Tests.ps1
new file mode 100644
index 0000000000000..25b34a8257c49
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecRegisteredDevices.Tests.ps1
@@ -0,0 +1,106 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecRegisteredDevices.ps1')
+    $script:UserId = 'c0ffee00-0000-4000-8000-000000000001'
+    $script:Start = [datetime]::new(2026, 8, 20, 0, 0, 0, [System.DateTimeKind]::Utc)
+
+    function Get-DeviceFixture {
+        param([string]$Id, $Registered = $null, [string]$Name = 'DESKTOP-01')
+        [pscustomobject]@{
+            id                            = $Id
+            deviceId                      = "dev-$Id"
+            displayName                   = $Name
+            operatingSystem               = 'Windows'
+            operatingSystemVersion        = '10.0.26100.1'
+            trustType                     = 'AzureAd'
+            registrationDateTime          = $Registered
+            approximateLastSignInDateTime = '2026-08-25T06:00:00Z'
+            accountEnabled                = $true
+            isCompliant                   = $false
+            isManaged                     = $true
+            profileType                   = 'RegisteredDevice'
+            enrollmentType                = 'AzureADJoin'
+            manufacturer                  = 'Dell Inc.'
+            model                         = 'Latitude 5450'
+        }
+    }
+}
+
+Describe 'Get-CIPPBecRegisteredDevices' {
+    BeforeEach {
+        Mock New-GraphGetRequest { @($script:Devices) }
+        $script:Devices = @()
+    }
+
+    It 'reads the user''s registered devices app-only with the device projection' {
+        $null = Get-CIPPBecRegisteredDevices -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter {
+            $uri -like "https://graph.microsoft.com/v1.0/users/$($script:UserId)/registeredDevices/microsoft.graph.device?`$select=id,deviceId,*" -and
+            $uri -match 'registrationDateTime' -and $uri -match 'approximateLastSignInDateTime' -and
+            $tenantid -eq 'contoso.com' -and $AsApp -eq $true
+        }
+    }
+
+    It 'projects a device row with UTC timestamps and no cap' {
+        $script:Devices = @(Get-DeviceFixture -Id 'd1' -Registered '2026-08-21T12:00:00+02:00')
+        $Result = Get-CIPPBecRegisteredDevices -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+        $Result.Complete | Should -BeTrue
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 1
+        $Row = $Result.Data[0]
+        $Row.id | Should -Be 'd1'
+        $Row.deviceId | Should -Be 'dev-d1'
+        $Row.displayName | Should -Be 'DESKTOP-01'
+        $Row.operatingSystem | Should -Be 'Windows'
+        $Row.operatingSystemVersion | Should -Be '10.0.26100.1'
+        $Row.trustType | Should -Be 'AzureAd'
+        $Row.profileType | Should -Be 'RegisteredDevice'
+        $Row.enrollmentType | Should -Be 'AzureADJoin'
+        $Row.manufacturer | Should -Be 'Dell Inc.'
+        $Row.model | Should -Be 'Latitude 5450'
+        $Row.accountEnabled | Should -BeTrue
+        $Row.isCompliant | Should -BeFalse
+        $Row.isManaged | Should -BeTrue
+        $Row.registrationDateTime | Should -Be '2026-08-21T10:00:00Z' -Because 'the offset is folded into UTC'
+        $Row.approximateLastSignInDateTime | Should -Be '2026-08-25T06:00:00Z'
+        $Row.RegisteredInWindow | Should -BeTrue
+    }
+
+    It 'flags registrations at or after the window start, sorts them first and skips rows without an id' {
+        $script:Devices = @(
+            Get-DeviceFixture -Id 'd-old' -Registered '2026-08-19T23:59:59Z'
+            Get-DeviceFixture -Id 'd-edge' -Registered '2026-08-20T00:00:00Z'
+            Get-DeviceFixture -Id 'd-new' -Registered '2026-08-22T00:00:00Z'
+            Get-DeviceFixture -Id 'd-none'
+            Get-DeviceFixture -Id $null -Registered '2026-08-23T00:00:00Z'
+        )
+        $Result = Get-CIPPBecRegisteredDevices -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+        $Result.Count | Should -Be 4
+        $Result.Data[0].id | Should -Be 'd-new' -Because 'in-window registrations sort first, newest first'
+        $Result.Data[1].id | Should -Be 'd-edge' -Because 'a registration exactly at the window start is inside the window'
+        $Result.Data[1].RegisteredInWindow | Should -BeTrue
+        $Old = $Result.Data | Where-Object { $_.id -eq 'd-old' }
+        $Old.RegisteredInWindow | Should -BeFalse -Because 'one second before the window start is outside it'
+        $Old.registrationDateTime | Should -Be '2026-08-19T23:59:59Z'
+        $None = $Result.Data | Where-Object { $_.id -eq 'd-none' }
+        $None.RegisteredInWindow | Should -BeOfType [bool]
+        $None.RegisteredInWindow | Should -BeFalse
+        $None.registrationDateTime | Should -BeNullOrEmpty
+    }
+
+    It 'returns an empty complete result when Graph returns nothing' {
+        Mock New-GraphGetRequest { }
+        $Result = Get-CIPPBecRegisteredDevices -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+        $Result.Complete | Should -BeTrue
+        $Result.Count | Should -Be 0
+        @($Result.Data).Count | Should -Be 0
+    }
+
+    It 'lets a Graph failure propagate to the caller instead of reporting an empty device list' {
+        Mock New-GraphGetRequest { throw 'Graph unavailable' }
+        { Get-CIPPBecRegisteredDevices -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start } | Should -Throw -ExpectedMessage '*Graph unavailable*'
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecRiskState.Tests.ps1 b/Tests/Private/Get-CIPPBecRiskState.Tests.ps1
new file mode 100644
index 0000000000000..60c27123c88bb
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecRiskState.Tests.ps1
@@ -0,0 +1,118 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphGetRequest { param($uri, $tenantid, $noPagination, $AsApp) }
+    function Get-NormalizedError { param($message) $message }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/ConvertTo-CIPPODataFilterValue.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecRiskState.ps1')
+
+    $script:UserId = '3f2504e0-4f89-41d3-9a0c-0305e82c3301'
+    $script:Start = [datetime]::new(2026, 8, 13, 0, 0, 0, [System.DateTimeKind]::Utc)
+    $script:RiskyUser = [pscustomobject]@{ id = $script:UserId; riskLevel = 'high'; riskState = 'atRisk'; riskDetail = 'none'; isProcessing = $false; riskLastUpdatedDateTime = '2026-08-18T07:15:00Z' }
+    # Two detections plus one without an id, which Graph never returns but the mapper must not turn into a blank row.
+    $script:Detections = @(
+        [pscustomobject]@{ id = 'd1'; detectedDateTime = '2026-08-18T07:00:00Z'; riskEventType = 'unfamiliarFeatures'; riskLevel = 'medium'; riskState = 'atRisk'; riskDetail = 'none'; detectionTimingType = 'realtime'; activity = 'signin'; ipAddress = '203.0.113.9'; location = [pscustomobject]@{ city = 'Lagos'; countryOrRegion = 'NG' }; source = 'IdentityProtection' }
+        [pscustomobject]@{ id = 'd2'; detectedDateTime = '2026-08-17T22:40:00Z'; riskEventType = 'anonymizedIPAddress'; riskLevel = 'high'; riskState = 'atRisk'; riskDetail = 'none'; detectionTimingType = 'offline'; activity = 'signin'; ipAddress = '198.51.100.7'; location = $null; source = 'IdentityProtection' }
+        [pscustomobject]@{ detectedDateTime = '2026-08-17T22:40:00Z'; riskEventType = 'ghost' }
+    )
+}
+
+Describe 'Get-CIPPBecRiskState' {
+    BeforeEach {
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskyUsers/*' } { $script:RiskyUser }
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskDetections*' } { $script:Detections }
+    }
+
+    It 'reports a listed risky user with its detections mapped to the report shape, asking Graph for the whole window' {
+        $Result = Get-CIPPBecRiskState -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/identityProtection/riskyUsers/3f2504e0-4f89-41d3-9a0c-0305e82c3301' -and $tenantid -eq 'contoso.com' -and $noPagination -eq $true }
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -eq "https://graph.microsoft.com/v1.0/identityProtection/riskDetections?`$filter=userId eq '3f2504e0-4f89-41d3-9a0c-0305e82c3301' and detectedDateTime ge 2026-08-13T00:00:00Z&`$orderby=detectedDateTime desc" -and $tenantid -eq 'contoso.com' -and $noPagination -ne $true }
+        $Result.Complete | Should -BeTrue
+        $Result.Skipped | Should -BeFalse
+        $Result.Requirement | Should -BeNullOrEmpty
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Count | Should -Be 2
+        $Result.Data.Listed | Should -BeTrue
+        $Result.Data.RiskLevel | Should -Be 'high'
+        $Result.Data.RiskState | Should -Be 'atRisk'
+        $Result.Data.RiskDetail | Should -Be 'none'
+        $Result.Data.IsProcessing | Should -BeFalse
+        $Result.Data.RiskLastUpdatedDateTime | Should -Be '2026-08-18T07:15:00Z'
+        $Result.Data.Detections.Count | Should -Be 2 -Because 'a detection without an id is dropped'
+        $First = $Result.Data.Detections[0]
+        $First.PSObject.Properties.Name | Should -Be @('id', 'DetectedDateTime', 'RiskEventType', 'RiskLevel', 'RiskState', 'RiskDetail', 'DetectionTiming', 'Activity', 'IPAddress', 'Country', 'City', 'Source')
+        $First.id | Should -Be 'd1'
+        $First.DetectedDateTime | Should -Be '2026-08-18T07:00:00Z'
+        $First.RiskEventType | Should -Be 'unfamiliarFeatures'
+        $First.RiskLevel | Should -Be 'medium'
+        $First.DetectionTiming | Should -Be 'realtime'
+        $First.IPAddress | Should -Be '203.0.113.9'
+        $First.Country | Should -Be 'NG'
+        $First.City | Should -Be 'Lagos'
+        $Result.Data.Detections[1].Country | Should -BeNullOrEmpty -Because 'a detection without a location still maps'
+    }
+
+    It 'treats a riskyUsers 404 as not listed, stays complete, and still reads the detections without a count cap' {
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskyUsers/*' } { throw "Request_ResourceNotFound: Resource '3f2504e0-4f89-41d3-9a0c-0305e82c3301' does not exist or one of its queried reference-property objects are not present." }
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskDetections*' } { @() }
+        $Result = Get-CIPPBecRiskState -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like '*/riskDetections?*' -and $uri -notlike '*top=*' -and $noPagination -ne $true }
+        $Result.Complete | Should -BeTrue
+        $Result.Error | Should -BeNullOrEmpty
+        $Result.Skipped | Should -BeFalse
+        $Result.Count | Should -Be 0
+        $Result.Data.Listed | Should -BeFalse
+        $Result.Data.RiskLevel | Should -BeNullOrEmpty
+        $Result.Data.RiskState | Should -BeNullOrEmpty
+        $Result.Data.RiskLastUpdatedDateTime | Should -BeNullOrEmpty
+        $Result.Data.Detections.Count | Should -Be 0
+    }
+
+    It 'classifies a licence error as Skipped with the Entra ID P2 requirement instead of "not risky"' {
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskyUsers/*' } { throw 'UnknownError: Tenant is not licensed for this feature' }
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskDetections*' } { throw 'UnknownError: Tenant is not licensed for this feature' }
+        $Result = Get-CIPPBecRiskState -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+
+        $Result.Skipped | Should -BeTrue
+        $Result.Complete | Should -BeFalse
+        $Result.Requirement | Should -Be 'requires Entra ID P2 (Identity Protection)'
+        $Result.Error | Should -Match 'Entra ID P2 licence or consent missing'
+        $Result.Error | Should -Match 'riskDetections: UnknownError'
+        $Result.Data.Listed | Should -BeFalse
+        $Result.Data.Detections.Count | Should -Be 0
+        $Result.Count | Should -Be 0
+    }
+
+    It 'marks the collector Skipped when only the detections call is denied, keeping the riskyUsers outcome' {
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskDetections*' } { throw 'Authorization_RequestDenied: Insufficient privileges to complete the operation.' }
+        $Result = Get-CIPPBecRiskState -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+
+        $Result.Data.Listed | Should -BeTrue
+        $Result.Data.RiskLevel | Should -Be 'high'
+        $Result.Data.Detections.Count | Should -Be 0
+        $Result.Skipped | Should -BeTrue
+        $Result.Requirement | Should -Be 'requires Entra ID P2 (Identity Protection)'
+        $Result.Error | Should -Be 'riskDetections: Authorization_RequestDenied: Insufficient privileges to complete the operation.'
+        $Result.Complete | Should -BeFalse
+    }
+
+    It 'reports an unexpected riskyUsers failure as an error, not a skip, and still collects the detections' {
+        Mock New-GraphGetRequest -ParameterFilter { $uri -like '*/identityProtection/riskyUsers/*' } { throw 'Gateway Timeout' }
+        $Result = Get-CIPPBecRiskState -TenantFilter 'contoso.com' -UserId $script:UserId -StartDate $script:Start
+
+        $Result.Complete | Should -BeFalse
+        $Result.Skipped | Should -BeFalse
+        $Result.Requirement | Should -BeNullOrEmpty
+        $Result.Error | Should -Be 'riskyUsers: Gateway Timeout'
+        $Result.Data.Listed | Should -BeFalse
+        $Result.Data.Detections.Count | Should -Be 2
+        $Result.Count | Should -Be 2
+    }
+
+    It 'rejects a user id that is not a GUID before calling Graph' {
+        { Get-CIPPBecRiskState -TenantFilter 'contoso.com' -UserId "x' or 1 eq 1" -StartDate $script:Start } | Should -Throw -ExpectedMessage '*Invalid GUID*'
+        Should -Invoke New-GraphGetRequest -Times 0
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecScore.Tests.ps1 b/Tests/Private/Get-CIPPBecScore.Tests.ps1
new file mode 100644
index 0000000000000..c0de519bea771
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecScore.Tests.ps1
@@ -0,0 +1,159 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    # The shipped heuristics file is the contract: the weights below must match what the PDF report used.
+    $env:CIPPRootPath = $RepoRoot
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecScore.ps1')
+    $script:Heuristics = Get-CIPPBecHeuristics
+
+    function New-Results {
+        param([hashtable]$Overrides = @{})
+        $Base = @{
+            ExtractedAt              = '2026-08-20T12:00:00Z'
+            AnalysisWindowDays       = 7
+            NewRules                 = @()
+            InboxRuleChanges         = @()
+            MailboxPermissionChanges = @()
+            AddedApps                = @()
+            MaliciousSPs             = @()
+            NewUsers                 = @()
+            SafelistChanges          = @()
+            SharingChanges           = @()
+            SentMessageAnalysis      = [pscustomobject]@{ Flagged = $false }
+            MFADevices               = @()
+            IntuneDevices            = @()
+            LocationAnalysis         = [pscustomobject]@{ ForeignSuccessfulSignInCount = 0; ForeignRuleChangeCount = 0; ForeignSafelistChangeCount = 0; ForeignSharingChangeCount = 0; ForeignSentMessageCount = 0 }
+        }
+        foreach ($Key in $Overrides.Keys) { $Base[$Key] = $Overrides[$Key] }
+        [pscustomobject]$Base
+    }
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Get-CIPPBecScore' {
+    It 'scores an empty result as Low with zero and lists every signal unapplied' {
+        $Score = Get-CIPPBecScore -Results (New-Results) -Heuristics $script:Heuristics
+        $Score.Value | Should -Be 0
+        $Score.Level | Should -Be 'Low'
+        @($Score.Breakdown | Where-Object { $_.Applied }).Count | Should -Be 0
+        $Score.Thresholds.High | Should -Be 7
+        $Score.Thresholds.Medium | Should -Be 4
+    }
+
+    It 'reproduces the original report weights exactly when every original signal fires' {
+        $Results = New-Results @{
+            NewRules                 = @([pscustomobject]@{ Name = 'Hide'; MoveToFolder = 'RSS Feeds' })
+            InboxRuleChanges         = @([pscustomobject]@{ Operation = 'New-InboxRule' })
+            MailboxPermissionChanges = @([pscustomobject]@{ TargetsSuspect = $true }, [pscustomobject]@{ TargetsSuspect = $false })
+            AddedApps                = @([pscustomobject]@{ displayName = 'x'; MaliciousMatch = $null })
+            MaliciousSPs             = @([pscustomobject]@{ appId = 'a' })
+            NewUsers                 = @(1..6 | ForEach-Object { [pscustomobject]@{ id = $_ } })
+            SafelistChanges          = @([pscustomobject]@{ Operation = 'Set-MailboxJunkEmailConfiguration' })
+            SharingChanges           = @([pscustomobject]@{ Operation = 'AnonymousLinkCreated' })
+            SentMessageAnalysis      = [pscustomobject]@{ Flagged = $true }
+            MFADevices               = @([pscustomobject]@{ createdDateTime = '2026-08-19T00:00:00Z' })
+            IntuneDevices            = @([pscustomobject]@{ enrolledDateTime = '2026-08-18T00:00:00Z' })
+            LocationAnalysis         = [pscustomobject]@{ ForeignSuccessfulSignInCount = 2; ForeignRuleChangeCount = 1; ForeignSafelistChangeCount = 0; ForeignSharingChangeCount = 0; ForeignSentMessageCount = 0 }
+        }
+        $Score = Get-CIPPBecScore -Results $Results -Heuristics $script:Heuristics
+        # 3+3+2+1+1+2+5+5+3+3+3+3+2+2 - the PDF's additive score with 'targeting' taking precedence over 'other'
+        $Score.Value | Should -Be 38
+        $Score.Level | Should -Be 'High'
+        ($Score.Breakdown | Where-Object { $_.Signal -eq 'PermissionChanges' }).Applied | Should -BeFalse
+        ($Score.Breakdown | Where-Object { $_.Signal -eq 'PermissionChangesTargetingUser' }).Applied | Should -BeTrue
+    }
+
+    It 'gives unrelated tenant permission churn +1 and a change targeting the mailbox +2, never both' {
+        $Other = Get-CIPPBecScore -Results (New-Results @{ MailboxPermissionChanges = @([pscustomobject]@{ TargetsSuspect = $false }) }) -Heuristics $script:Heuristics
+        $Other.Value | Should -Be 1
+        $Target = Get-CIPPBecScore -Results (New-Results @{ MailboxPermissionChanges = @([pscustomobject]@{ TargetsSuspect = $true }, [pscustomobject]@{ TargetsSuspect = $false }) }) -Heuristics $script:Heuristics
+        $Target.Value | Should -Be 2
+    }
+
+    It 'only counts new users above the threshold' {
+        $Five = Get-CIPPBecScore -Results (New-Results @{ NewUsers = @(1..5 | ForEach-Object { [pscustomobject]@{ id = $_ } }) }) -Heuristics $script:Heuristics
+        $Five.Value | Should -Be 0
+        $Six = Get-CIPPBecScore -Results (New-Results @{ NewUsers = @(1..6 | ForEach-Object { [pscustomobject]@{ id = $_ } }) }) -Heuristics $script:Heuristics
+        $Six.Value | Should -Be 1
+    }
+
+    It 'ignores MFA methods and Intune devices registered before the window' {
+        $Results = New-Results @{
+            MFADevices    = @([pscustomobject]@{ createdDateTime = '2026-08-01T00:00:00Z' })
+            IntuneDevices = @([pscustomobject]@{ enrolledDateTime = '2026-07-01T00:00:00Z' })
+        }
+        (Get-CIPPBecScore -Results $Results -Heuristics $script:Heuristics).Value | Should -Be 0
+    }
+
+    It 'applies the thresholds: 4 is Medium, 7 is High, 3 is Low' {
+        # rules(3) + anonymous link(3) = 6... use perm change other (1) + rules (3) = 4
+        (Get-CIPPBecScore -Results (New-Results @{ NewRules = @([pscustomobject]@{ Name = 'a' }); MailboxPermissionChanges = @([pscustomobject]@{ TargetsSuspect = $false }) }) -Heuristics $script:Heuristics).Level | Should -Be 'Medium'
+        (Get-CIPPBecScore -Results (New-Results @{ NewRules = @([pscustomobject]@{ Name = 'a' }) }) -Heuristics $script:Heuristics).Level | Should -Be 'Low'
+        (Get-CIPPBecScore -Results (New-Results @{ NewRules = @([pscustomobject]@{ Name = 'a' }); InboxRuleChanges = @([pscustomobject]@{ Operation = 'x' }); MailboxPermissionChanges = @([pscustomobject]@{ TargetsSuspect = $false }) }) -Heuristics $script:Heuristics).Level | Should -Be 'High'
+    }
+
+    It 'weights the full-scope signals' {
+        $Cases = @(
+            @{ Key = 'Delegations'; Value = @([pscustomobject]@{ Flagged = $true }, [pscustomobject]@{ Flagged = $false }); Expected = 2; Signal = 'FlaggedDelegations' }
+            @{ Key = 'UserGrants'; Value = @([pscustomobject]@{ Risk = 'High' }); Expected = 3; Signal = 'RiskyUserGrants' }
+            @{ Key = 'UserGrants'; Value = @([pscustomobject]@{ Risk = 'CatalogMatch' }); Expected = 5; Signal = 'CatalogUserGrants' }
+            @{ Key = 'TransportRuleChanges'; Value = @([pscustomobject]@{ Flagged = $true }); Expected = 4; Signal = 'RiskyTransportRuleChanges' }
+            @{ Key = 'MailboxAddIns'; Value = @([pscustomobject]@{ Flagged = $true }); Expected = 1; Signal = 'FlaggedMailboxAddIns' }
+            @{ Key = 'ReceivedMailFindings'; Value = @([pscustomobject]@{ FindingType = 'PossibleTyposquat' }, [pscustomobject]@{ FindingType = 'SubjectPattern' }); Expected = 3; Signal = 'TyposquatSenders' }
+            @{ Key = 'DefenderDetections'; Value = @([pscustomobject]@{ Delivered = $true }); Expected = 3; Signal = 'DefenderDetections' }
+            @{ Key = 'DirectoryAudits'; Value = @([pscustomobject]@{ Flagged = $true }); Expected = 2; Signal = 'FlaggedDirectoryAudits' }
+            @{ Key = 'RegisteredDevices'; Value = @([pscustomobject]@{ RegisteredInWindow = $true }); Expected = 2; Signal = 'RecentRegisteredDevices' }
+            @{ Key = 'NonInteractiveSignIns'; Value = @([pscustomobject]@{ ForeignLocation = $true; Status = 'Success' }, [pscustomobject]@{ ForeignLocation = $true; Status = 'Failed' }); Expected = 3; Signal = 'ForeignNonInteractiveSignIns' }
+            @{ Key = 'MailActivitySummary'; Value = [pscustomobject]@{ HardDeleteExceeded = $true }; Expected = 2; Signal = 'SuspiciousMailActivity' }
+            @{ Key = 'RiskState'; Value = [pscustomobject]@{ Listed = $true; RiskState = 'atRisk'; RiskLevel = 'high' }; Expected = 4; Signal = 'RiskyUserHigh' }
+            @{ Key = 'RiskState'; Value = [pscustomobject]@{ Listed = $true; RiskState = 'atRisk'; RiskLevel = 'medium' }; Expected = 2; Signal = 'RiskyUserMedium' }
+            @{ Key = 'RiskState'; Value = [pscustomobject]@{ Listed = $true; RiskState = 'confirmedCompromised'; RiskLevel = 'high' }; Expected = 5; Signal = 'ConfirmedCompromised' }
+            # an attacker address that only failed to sign in, or a suspicious one, does not count
+            @{ Key = 'IPVerdicts'; Value = @([pscustomobject]@{ Verdict = 'LikelyAttacker'; SuccessfulSignIns = 1; Activities = 0 }, [pscustomobject]@{ Verdict = 'Compromised'; SuccessfulSignIns = 0; Activities = 0 }, [pscustomobject]@{ Verdict = 'Suspicious'; SuccessfulSignIns = 3; Activities = 2 }); Expected = 4; Signal = 'AttackerIPs' }
+            # item-level activity counts only from addresses judged the attacker's
+            @{ Key = 'AttackerMailActivity'; Value = @([pscustomobject]@{ IPVerdict = 'LikelyAttacker'; MailboxOwner = 'victim@contoso.com' }, [pscustomobject]@{ IPVerdict = 'Unknown'; MailboxOwner = 'victim@contoso.com' }); Expected = 3; Signal = 'AttackerMailAccess' }
+            @{ Key = 'AttackerFileActivity'; Value = @([pscustomobject]@{ IPVerdict = 'Compromised' }); Expected = 2; Signal = 'AttackerFileAccess' }
+            @{ Key = 'FormsActivity'; Value = @([pscustomobject]@{ Flagged = $true; IPVerdict = 'LikelyAttacker' }, [pscustomobject]@{ Flagged = $true; IPVerdict = 'Suspicious' }); Expected = 3; Signal = 'AttackerForms' }
+        )
+        foreach ($Case in $Cases) {
+            $Score = Get-CIPPBecScore -Results (New-Results @{ $Case.Key = $Case.Value }) -Heuristics $script:Heuristics
+            $Score.Value | Should -Be $Case.Expected -Because "$($Case.Signal) should add $($Case.Expected)"
+            ($Score.Breakdown | Where-Object { $_.Signal -eq $Case.Signal }).Applied | Should -BeTrue -Because "$($Case.Signal) should be applied"
+        }
+    }
+
+    It 'scores attacker access to another mailbox through delegation on top of the mail access itself' {
+        $Mail = @(
+            [pscustomobject]@{ IPVerdict = 'LikelyAttacker'; MailboxOwner = 'ceo@contoso.com' }
+            [pscustomobject]@{ IPVerdict = 'LikelyAttacker'; MailboxOwner = 'Victim@contoso.com' }
+        )
+        $Score = Get-CIPPBecScore -Results (New-Results @{ UserPrincipalName = 'victim@contoso.com'; AttackerMailActivity = $Mail }) -Heuristics $script:Heuristics
+        ($Score.Breakdown | Where-Object Signal -EQ 'DelegatedMailboxAttackerAccess').Count | Should -Be 1 -Because 'the own mailbox, in any case, is not a delegated one'
+        $Score.Value | Should -Be 6
+    }
+
+    It 'counts only the other accounts an attacker address reached, not the attempts' {
+        $Blast = @([pscustomobject]@{ UserPrincipalName = 'a@contoso.com'; Reached = $true }, [pscustomobject]@{ UserPrincipalName = 'b@contoso.com'; Reached = $false })
+        $Score = Get-CIPPBecScore -Results (New-Results @{ BlastRadius = $Blast }) -Heuristics $script:Heuristics
+        $Signal = $Score.Breakdown | Where-Object Signal -EQ 'OtherAccountsReached'
+        $Signal.Count | Should -Be 1
+        $Signal.Applied | Should -BeTrue
+        $Signal.Weight | Should -Be 3
+    }
+
+    It 'does not score a Defender detection that was blocked, or a dismissed risky user' {
+        (Get-CIPPBecScore -Results (New-Results @{ DefenderDetections = @([pscustomobject]@{ Delivered = $false }) }) -Heuristics $script:Heuristics).Value | Should -Be 0
+        (Get-CIPPBecScore -Results (New-Results @{ RiskState = [pscustomobject]@{ Listed = $true; RiskState = 'dismissed'; RiskLevel = 'high' } }) -Heuristics $script:Heuristics).Value | Should -Be 0
+    }
+
+    It 'scores an old cached payload that has none of the full-scope keys' {
+        $Legacy = [pscustomobject]@{ ExtractedAt = '2026-08-20T12:00:00Z'; NewRules = @([pscustomobject]@{ Name = 'a'; MoveToFolder = 'RSS' }) }
+        $Score = Get-CIPPBecScore -Results $Legacy -Heuristics $script:Heuristics
+        $Score.Value | Should -Be 8
+        $Score.Level | Should -Be 'High'
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecTransportRules.Tests.ps1 b/Tests/Private/Get-CIPPBecTransportRules.Tests.ps1
new file mode 100644
index 0000000000000..f604f787489e2
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecTransportRules.Tests.ps1
@@ -0,0 +1,110 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $script:OriginalRoot = $env:CIPPRootPath
+    $env:CIPPRootPath = $RepoRoot
+    function Search-CIPPBecAuditLog { param($TenantFilter, $StartDate, $EndDate, $Operations, $UserIds, $RecordType, $ObjectIds, $Anchor, $PageSize, $MaxPages) }
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor) }
+    function Get-NormalizedError { param($message) $message }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecHeuristics.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecTransportRules.ps1')
+    $script:Heuristics = Get-CIPPBecHeuristics
+    $script:Start = (Get-Date).AddDays(-7)
+    $script:End = Get-Date
+
+    function New-Record {
+        param([string]$Operation, [hashtable]$Parameters, [string]$Actor = 'admin@contoso.com')
+        [pscustomobject]@{
+            Identity  = [guid]::NewGuid().ToString()
+            Operation = $Operation
+            AuditData = [pscustomobject]@{
+                Operation    = $Operation
+                CreationTime = '2026-08-20T09:00:00Z'
+                UserId       = $Actor
+                ClientIP     = '198.51.100.7'
+                ObjectId     = 'Rule'
+                Parameters   = @($Parameters.Keys | ForEach-Object { [pscustomobject]@{ Name = $_; Value = $Parameters[$_] } })
+            }
+        }
+    }
+}
+
+AfterAll {
+    $env:CIPPRootPath = $script:OriginalRoot
+}
+
+Describe 'Get-CIPPBecTransportRules' {
+    It 'flags New/Set/Enable changes that set a diversion or suppression action and leaves the rest unflagged' {
+        Mock Search-CIPPBecAuditLog {
+            [pscustomobject]@{
+                Records  = @(
+                    (New-Record -Operation 'New-TransportRule' -Parameters @{ Name = 'Exfil'; BlindCopyTo = 'attacker@example.org'; SentTo = 'cfo@contoso.com' })
+                    (New-Record -Operation 'Set-TransportRule' -Parameters @{ Identity = 'Disclaimer'; Name = 'Disclaimer'; Priority = '3' })
+                    (New-Record -Operation 'Remove-TransportRule' -Parameters @{ Identity = 'Old rule'; BlindCopyTo = 'x@example.org' })
+                    (New-Record -Operation 'Set-TransportRule' -Parameters @{ Identity = 'Spam'; SetSCL = '9' })
+                )
+                Complete = $true; Cap = $null; Pages = 1
+            }
+        }
+        Mock New-ExoRequest { @() }
+        $Result = Get-CIPPBecTransportRules -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Changes.Complete | Should -BeTrue
+        $Result.Changes.Data.Count | Should -Be 4
+        $Exfil = $Result.Changes.Data | Where-Object { $_.RuleName -eq 'Exfil' }
+        $Exfil.Flagged | Should -BeTrue
+        $Exfil.RiskyParameters | Should -Contain 'BlindCopyTo'
+        $Exfil.RiskyParameters | Should -Not -Contain 'SentTo'
+        $Exfil.Actor | Should -Be 'admin@contoso.com'
+        $Exfil.ClientIP | Should -Be '198.51.100.7'
+        ($Result.Changes.Data | Where-Object { $_.RuleName -eq 'Disclaimer' }).Flagged | Should -BeFalse
+        ($Result.Changes.Data | Where-Object { $_.RuleName -eq 'Old rule' }).Flagged | Should -BeFalse -Because 'removing a rule is not persistence'
+        ($Result.Changes.Data | Where-Object { $_.RuleName -eq 'Spam' }).Flagged | Should -BeTrue
+        $Result.Changes.Data[0].Flagged | Should -BeTrue -Because 'flagged changes sort first'
+        Should -Invoke Search-CIPPBecAuditLog -Times 1 -ParameterFilter { $RecordType -eq 'ExchangeAdmin' -and $Operations -contains 'New-TransportRule' -and $null -eq $UserIds }
+    }
+
+    It 'returns only the current rules with a diversion action, or a suppression action changed in the window, with the total rule count' {
+        Mock Search-CIPPBecAuditLog { [pscustomobject]@{ Records = @(); Complete = $true; Cap = $null; Pages = 1 } }
+        Mock New-ExoRequest {
+            @(
+                [pscustomobject]@{ Identity = 'Exfil'; Guid = 'g1'; Name = 'Exfil'; State = 'Enabled'; Mode = 'Enforce'; Priority = 0; WhenChanged = (Get-Date).AddDays(-1).ToString('o'); Description = 'If the message is sent to cfo@contoso.com, Blind carbon copy (Bcc) the message to attacker@example.org'; BlindCopyTo = @('attacker@example.org'); RedirectMessageTo = @(); DeleteMessage = $false }
+                [pscustomobject]@{ Identity = 'Disclaimer'; Guid = 'g2'; Name = 'Disclaimer'; State = 'Enabled'; Mode = 'Enforce'; Priority = 1; WhenChanged = '2025-01-01T00:00:00Z'; Description = 'Append a disclaimer'; BlindCopyTo = @(); RedirectMessageTo = @(); DeleteMessage = $false; ApplyHtmlDisclaimerText = '<div>External</div>' }
+                [pscustomobject]@{ Identity = 'Junk'; Guid = 'g3'; Name = 'Junk'; State = 'Disabled'; Mode = 'Audit'; Priority = 2; WhenChanged = '2025-01-01T00:00:00Z'; Description = 'Quarantine the message'; BlindCopyTo = @(); RedirectMessageTo = @(); DeleteMessage = $false; Quarantine = $false }
+                [pscustomobject]@{ Identity = 'Plain'; Guid = 'g4'; Name = 'Plain'; State = 'Disabled'; Mode = 'Enforce'; Priority = 3; WhenChanged = '2025-01-01T00:00:00Z'; Description = 'Prepend the subject'; BlindCopyTo = @(); RedirectMessageTo = @(); DeleteMessage = $false }
+                [pscustomobject]@{ Identity = 'OldDelete'; Guid = 'g5'; Name = 'OldDelete'; State = 'Enabled'; Mode = 'Enforce'; Priority = 4; WhenChanged = '2025-01-01T00:00:00Z'; Description = 'Delete the message without notifying anyone'; BlindCopyTo = @(); RedirectMessageTo = @(); DeleteMessage = $true; RemoveHeader = 'Disposition-Notification-To' }
+                [pscustomobject]@{ Identity = 'RecentDelete'; Guid = 'g6'; Name = 'RecentDelete'; State = 'Enabled'; Mode = 'Enforce'; Priority = 5; WhenChanged = (Get-Date).AddHours(-3).ToString('o'); Description = 'Delete the message without notifying anyone'; BlindCopyTo = @(); RedirectMessageTo = @(); DeleteMessage = 'True' }
+            )
+        }
+        $Result = Get-CIPPBecTransportRules -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Flagged.Data.Name | Should -Be @('Exfil', 'RecentDelete') -Because 'rules changed in the window sort first and only action-bearing rules are flagged'
+        $Exfil = $Result.Flagged.Data | Where-Object { $_.Name -eq 'Exfil' }
+        $Exfil.RiskReasons | Should -Contain 'BlindCopyTo = attacker@example.org'
+        $Exfil.RiskReasons | Should -Contain 'Description mentions a routing or disposition action'
+        $Exfil.ChangedInWindow | Should -BeTrue
+        $Recent = $Result.Flagged.Data | Where-Object { $_.Name -eq 'RecentDelete' }
+        $Recent.RiskReasons | Should -Contain 'DeleteMessage = True'
+        $Recent.RiskReasons | Should -Contain 'Changed within the investigation window'
+        $Result.Flagged.Data.Name | Should -Not -Contain 'OldDelete' -Because 'a long-standing delete/header rule is admin hygiene, not persistence'
+        $Result.Flagged.Data.Name | Should -Not -Contain 'Junk' -Because 'a description alone never flags a rule'
+        $Result.Flagged.Data.Name | Should -Not -Contain 'Disclaimer'
+        $Result.Flagged.Data.Name | Should -Not -Contain 'Plain'
+    }
+
+    It 'reports each half independently when the other fails' {
+        Mock Search-CIPPBecAuditLog { throw 'UAL unavailable' }
+        Mock New-ExoRequest { @([pscustomobject]@{ Identity = 'r'; Guid = 'g'; Name = 'r'; State = 'Enabled'; Mode = 'Enforce'; Description = 'redirect the message'; RedirectMessageTo = @('x@example.org') }) }
+        $Result = Get-CIPPBecTransportRules -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Changes.Complete | Should -BeFalse
+        $Result.Changes.Error | Should -Match 'UAL unavailable'
+        $Result.Flagged.Complete | Should -BeTrue
+        $Result.Flagged.Data.Count | Should -Be 1
+
+        Mock Search-CIPPBecAuditLog { [pscustomobject]@{ Records = @(); Complete = $true; Cap = $null; Pages = 1 } }
+        Mock New-ExoRequest { throw 'EXO down' }
+        $Result = Get-CIPPBecTransportRules -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -Heuristics $script:Heuristics
+        $Result.Changes.Complete | Should -BeTrue
+        $Result.Flagged.Complete | Should -BeFalse
+        $Result.Flagged.Error | Should -Match 'EXO down'
+    }
+}
diff --git a/Tests/Private/Get-CIPPBecUserGrants.Tests.ps1 b/Tests/Private/Get-CIPPBecUserGrants.Tests.ps1
new file mode 100644
index 0000000000000..697fff32bab59
--- /dev/null
+++ b/Tests/Private/Get-CIPPBecUserGrants.Tests.ps1
@@ -0,0 +1,126 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphBulkRequest { param($Requests, $tenantid, $asapp) }
+    function Get-CIPPBecRogueAppFeed { param($MaxAgeHours, [switch]$Force) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecCollectorResult.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecUserGrants.ps1')
+
+    $script:Heuristics = [pscustomobject]@{
+        riskyScopes = [pscustomobject]@{
+            regex        = '(?i)(\.ReadWrite(\.All)?$|\.All$|Mail\.|Files\.|Directory\.|RoleManagement\.|offline_access)'
+            catalogNames = @('EWS.AccessAsUser.All')
+        }
+    }
+    $script:CatalogAppId = '2ef68ccc-8a4d-42ff-ae88-2d7bb89ad139'
+    $script:Feed = [pscustomobject]@{
+        Apps              = @{ $script:CatalogAppId = [pscustomobject]@{ Name = 'Mail_Backup'; Source = 'CIPP'; Categories = @('Mailbox exfiltration'); Description = 'x' } }
+        HuntressAvailable = $true
+    }
+    $script:Sps = @{
+        'sp-rogue'  = [pscustomobject]@{ id = 'sp-rogue'; appId = $script:CatalogAppId.ToUpperInvariant(); displayName = 'Mail_Backup'; publisherName = $null; verifiedPublisher = [pscustomobject]@{ verifiedPublisherId = $null }; appOwnerOrganizationId = 'aaaa'; accountEnabled = $true; createdDateTime = '2026-08-01T00:00:00Z' }
+        'sp-shady'  = [pscustomobject]@{ id = 'sp-shady'; appId = '11111111-1111-1111-1111-111111111111'; displayName = 'Shady Sync'; publisherName = 'Shady Ltd'; verifiedPublisher = [pscustomobject]@{ verifiedPublisherId = $null }; appOwnerOrganizationId = 'bbbb'; accountEnabled = $true; createdDateTime = '2026-08-02T00:00:00Z' }
+        'sp-ms'     = [pscustomobject]@{ id = 'sp-ms'; appId = '22222222-2222-2222-2222-222222222222'; displayName = 'Microsoft Teams'; publisherName = 'Microsoft'; verifiedPublisher = [pscustomobject]@{ verifiedPublisherId = 'ms' }; appOwnerOrganizationId = 'f8cdef31-a31e-4b4a-93e4-5f571e91255a'; accountEnabled = $true; createdDateTime = '2020-01-01T00:00:00Z' }
+        'sp-benign' = [pscustomobject]@{ id = 'sp-benign'; appId = '33333333-3333-3333-3333-333333333333'; displayName = 'Survey Tool'; publisherName = 'Survey Inc'; verifiedPublisher = [pscustomobject]@{ verifiedPublisherId = 'sv' }; appOwnerOrganizationId = 'cccc'; accountEnabled = $true; createdDateTime = '2026-08-03T00:00:00Z' }
+        'sp-graph'  = [pscustomobject]@{ id = 'sp-graph'; appId = '00000003-0000-0000-c000-000000000000'; displayName = 'Microsoft Graph'; publisherName = 'Microsoft'; verifiedPublisher = [pscustomobject]@{ verifiedPublisherId = 'ms' }; appOwnerOrganizationId = 'f8cdef31-a31e-4b4a-93e4-5f571e91255a'; accountEnabled = $true; createdDateTime = '2020-01-01T00:00:00Z' }
+    }
+
+    # Fixture-driven stand-in for the Graph batch: grants/app roles come from script-scope fixtures,
+    # service principal lookups resolve against $script:Sps.
+    function Invoke-FakeBulk {
+        param($Requests)
+        foreach ($Request in $Requests) {
+            switch -Wildcard ($Request.id) {
+                'Grants' { [pscustomobject]@{ id = 'Grants'; status = $script:GrantStatus; body = [pscustomobject]@{ value = @($script:GrantsFixture); error = [pscustomobject]@{ message = 'grants failed' } } } }
+                'AppRoles' { [pscustomobject]@{ id = 'AppRoles'; status = $script:AppRoleStatus; body = [pscustomobject]@{ value = @($script:AppRolesFixture); error = [pscustomobject]@{ message = 'roles failed' } } } }
+                'sp*' {
+                    $script:SpRequests.Add($Request)
+                    $Ids = [regex]::Matches($Request.url, "'([^']+)'") | ForEach-Object { $_.Groups[1].Value }
+                    [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ value = @($Ids | ForEach-Object { $script:Sps[$_] } | Where-Object { $_ }) } }
+                }
+            }
+        }
+    }
+}
+
+Describe 'Get-CIPPBecUserGrants' {
+    BeforeEach {
+        Mock Get-CIPPBecRogueAppFeed { $script:Feed }
+        Mock New-GraphBulkRequest { Invoke-FakeBulk -Requests $Requests }
+        $script:GrantsFixture = @()
+        $script:AppRolesFixture = @()
+        $script:GrantStatus = 200
+        $script:AppRoleStatus = 200
+        $script:SpRequests = [System.Collections.Generic.List[object]]::new()
+    }
+
+    It 'flags catalog matches, high-risk scopes from unverified publishers, and leaves Microsoft and verified apps alone' {
+        $script:GrantsFixture = @(
+            [pscustomobject]@{ id = 'g1'; clientId = 'sp-rogue'; resourceId = 'sp-graph'; consentType = 'Principal'; scope = 'User.Read Mail.Read offline_access' }
+            [pscustomobject]@{ id = 'g2'; clientId = 'sp-shady'; resourceId = 'sp-graph'; consentType = 'Principal'; scope = 'Mail.ReadWrite offline_access' }
+            [pscustomobject]@{ id = 'g3'; clientId = 'sp-ms'; resourceId = 'sp-graph'; consentType = 'Principal'; scope = 'Files.ReadWrite.All offline_access' }
+            [pscustomobject]@{ id = 'g4'; clientId = 'sp-benign'; resourceId = 'sp-graph'; consentType = 'Principal'; scope = 'User.Read openid' }
+        )
+        $Result = Get-CIPPBecUserGrants -TenantFilter 'contoso.com' -UserId 'user-1' -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeTrue
+        $Result.Data.Count | Should -Be 4
+        $Rogue = $Result.Data | Where-Object { $_.Id -eq 'g1' }
+        $Rogue.Risk | Should -Be 'CatalogMatch'
+        $Rogue.Flagged | Should -BeTrue
+        $Rogue.CatalogMatch.Name | Should -Be 'Mail_Backup'
+        $Rogue.HighRiskScopes | Should -Contain 'Mail.Read'
+        $Shady = $Result.Data | Where-Object { $_.Id -eq 'g2' }
+        $Shady.Risk | Should -Be 'High'
+        $Shady.Flagged | Should -BeTrue
+        $Shady.PublisherVerified | Should -BeFalse
+        $Ms = $Result.Data | Where-Object { $_.Id -eq 'g3' }
+        $Ms.Risk | Should -Be 'Review'
+        $Ms.Flagged | Should -BeFalse
+        $Ms.IsMicrosoft | Should -BeTrue
+        $Benign = $Result.Data | Where-Object { $_.Id -eq 'g4' }
+        $Benign.Risk | Should -Be 'Low'
+        $Benign.HighRiskScopes.Count | Should -Be 0
+        $Result.Data[0].Flagged | Should -BeTrue -Because 'flagged rows sort first'
+        $Result.Data[0].ResourceDisplayName | Should -Be 'Microsoft Graph'
+    }
+
+    It 'matches scope names from the RiskyPermissions catalog as well as the regex' {
+        $script:GrantsFixture = @([pscustomobject]@{ id = 'g1'; clientId = 'sp-shady'; resourceId = 'sp-graph'; consentType = 'Principal'; scope = 'EWS.AccessAsUser.All' })
+        $Result = Get-CIPPBecUserGrants -TenantFilter 'contoso.com' -UserId 'user-1' -Heuristics $script:Heuristics
+        $Result.Data[0].HighRiskScopes | Should -Contain 'EWS.AccessAsUser.All'
+        $Result.Data[0].Risk | Should -Be 'High'
+    }
+
+    It 'flags an app role assignment to a catalog application' {
+        $script:AppRolesFixture = @([pscustomobject]@{ id = 'a1'; resourceId = 'sp-rogue'; resourceDisplayName = 'Mail_Backup'; appRoleId = '00000000-0000-0000-0000-000000000000'; createdDateTime = '2026-08-10T00:00:00Z' })
+        $Result = Get-CIPPBecUserGrants -TenantFilter 'contoso.com' -UserId 'user-1' -Heuristics $script:Heuristics
+        $Result.Data.Count | Should -Be 1
+        $Result.Data[0].Type | Should -Be 'AppRoleAssignment'
+        $Result.Data[0].Risk | Should -Be 'CatalogMatch'
+        $Result.Data[0].Flagged | Should -BeTrue
+    }
+
+    It 'reports a failed Graph query as incomplete instead of an empty grant list' {
+        $script:GrantStatus = 403
+        $Result = Get-CIPPBecUserGrants -TenantFilter 'contoso.com' -UserId 'user-1' -Heuristics $script:Heuristics
+        $Result.Complete | Should -BeFalse
+        $Result.Error | Should -Match 'grants failed'
+        $Result.Data.Count | Should -Be 0
+    }
+
+    It 'resolves service principals in chunks of at most 15 ids' {
+        $script:GrantsFixture = @(1..40 | ForEach-Object { [pscustomobject]@{ id = "g$_"; clientId = "sp-$_"; resourceId = 'sp-graph'; consentType = 'Principal'; scope = 'User.Read' } })
+        $null = Get-CIPPBecUserGrants -TenantFilter 'contoso.com' -UserId 'user-1' -Heuristics $script:Heuristics
+        $script:SpRequests.Count | Should -Be 3
+        foreach ($Request in $script:SpRequests) {
+            ([regex]::Matches($Request.url, "'([^']+)'").Count) | Should -BeLessOrEqual 15
+        }
+    }
+
+    It 'fetches the rogue-app feed itself when none is supplied and still works when the feed is down' {
+        Mock Get-CIPPBecRogueAppFeed { [pscustomobject]@{ Apps = @{}; HuntressAvailable = $false } }
+        $script:GrantsFixture = @([pscustomobject]@{ id = 'g1'; clientId = 'sp-rogue'; resourceId = 'sp-graph'; consentType = 'Principal'; scope = 'User.Read' })
+        $Result = Get-CIPPBecUserGrants -TenantFilter 'contoso.com' -UserId 'user-1' -Heuristics $script:Heuristics
+        $Result.Data[0].CatalogMatch | Should -BeNullOrEmpty
+        Should -Invoke Get-CIPPBecRogueAppFeed -Times 1
+    }
+}
diff --git a/Tests/Private/Get-CIPPIntuneAdminTemplateDefinitionValue.Tests.ps1 b/Tests/Private/Get-CIPPIntuneAdminTemplateDefinitionValue.Tests.ps1
new file mode 100644
index 0000000000000..ec90976d32b2a
--- /dev/null
+++ b/Tests/Private/Get-CIPPIntuneAdminTemplateDefinitionValue.Tests.ps1
@@ -0,0 +1,111 @@
+# Pester tests for Get-CIPPIntuneAdminTemplateDefinitionValue.
+#
+# The updateDefinitionValues payload an administrative template stores and deploys. With
+# -IncludeIdentity each setting also carries its name, category path, class and the position of each
+# presentation within its definition, which is what lets a template deploy to a tenant whose imported
+# ADMX minted different definition ids.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    # Stubs mirror the real signatures so signature drift fails loudly here.
+    function New-GraphGETRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp, $ComplexFilter) }
+    function New-GraphBulkRequest { [CmdletBinding()] param($tenantid, $NoAuthCheck, $scope, $asapp, $Requests, $NoPaginateIds, $Version, $Headers) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneAdminTemplateDefinitionValue.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:PolicyId = '236811d6-6d40-4972-aec3-43624535508e'
+    $script:FirefoxId = 'f65370a6-bc40-40af-b0f3-b6f5481478c0'
+    $script:OneDriveId = '81c07ba0-7512-402d-b1f6-00856975cfab'
+    $script:ListPresentationId = 'a73dada5-9cfc-44e7-b560-ebc1e1a1f1a9'
+}
+
+Describe 'Get-CIPPIntuneAdminTemplateDefinitionValue' {
+    BeforeEach {
+        Mock -CommandName New-GraphGETRequest -MockWith {
+            if ($uri -like "*definitionValues?`$expand=definition") {
+                @(
+                    [pscustomobject]@{ id = 'dv-firefox'; enabled = $true; definition = [pscustomobject]@{ id = $script:FirefoxId; displayName = 'SPNEGO'; classType = 'machine'; policyType = 'admxIngested' } }
+                    [pscustomobject]@{ id = 'dv-onedrive'; enabled = $false; definition = [pscustomobject]@{ id = $script:OneDriveId; displayName = 'Silently sign in users'; classType = 'machine'; policyType = 'admxIngested' } }
+                )
+            } elseif ($uri -like "*definitionValues('dv-firefox')/presentationValues*") {
+                @(
+                    [pscustomobject]@{ id = 'pv-1'; '@odata.type' = '#microsoft.graph.groupPolicyPresentationValueList'; values = @(@{ name = 'https://intranet.example' }); presentation = [pscustomobject]@{ id = $script:ListPresentationId; label = ''; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox' } }
+                )
+            } elseif ($uri -like "*definitionValues('dv-onedrive')/presentationValues*") {
+                @()
+            } else { throw "unexpected GET $uri" }
+        }
+        Mock -CommandName New-GraphBulkRequest -MockWith {
+            foreach ($Request in $Requests) {
+                switch -Wildcard ($Request.id) {
+                    "definition-$($script:FirefoxId)" { [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ id = $script:FirefoxId; displayName = 'SPNEGO'; categoryPath = '\Mozilla\Firefox\Authentication'; classType = 'machine'; policyType = 'admxIngested' } } }
+                    "definition-$($script:OneDriveId)" { [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ id = $script:OneDriveId; displayName = 'Silently sign in users'; categoryPath = '\OneDrive'; classType = 'machine'; policyType = 'admxIngested' } } }
+                    "presentations-$($script:FirefoxId)" {
+                        [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ value = @(
+                                    [pscustomobject]@{ id = 'p-check'; label = 'Enable'; '@odata.type' = '#microsoft.graph.groupPolicyPresentationCheckBox' }
+                                    [pscustomobject]@{ id = $script:ListPresentationId; label = ''; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox' }
+                                ) }
+                        }
+                    }
+                    "presentations-$($script:OneDriveId)" { [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ value = @() } } }
+                }
+            }
+        }
+    }
+
+    Context 'the payload a live policy is compared with' {
+        It 'binds each setting to its definition and keeps the values, with no identity metadata' {
+            $Payload = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $script:PolicyId -TenantFilter $script:Tenant
+
+            @($Payload.added).Count | Should -Be 2
+            $Payload.added[0].'definition@odata.bind' | Should -Be "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($script:FirefoxId)')"
+            $Payload.added[0].enabled | Should -BeTrue
+            $Payload.added[0].presentationValues[0].'presentation@odata.bind' | Should -Be "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$($script:FirefoxId)')/presentations('$($script:ListPresentationId)')"
+            $Payload.added[0].presentationValues[0].values[0].name | Should -Be 'https://intranet.example'
+            $Payload.added[0].PSObject.Properties.Name | Should -Not -Contain 'definition'
+            $Payload.added[0].presentationValues[0].PSObject.Properties.Name | Should -Not -Contain 'presentation'
+            $Payload.added[1].enabled | Should -BeFalse
+            @($Payload.added[1].presentationValues).Count | Should -Be 0
+            @($Payload.updated).Count | Should -Be 0
+            @($Payload.deletedIds).Count | Should -Be 0
+            Should -Invoke New-GraphBulkRequest -Times 0 -Exactly
+        }
+
+        It 'uses definition values the caller already read instead of reading them again' {
+            $Values = @([pscustomobject]@{ id = 'dv-onedrive'; enabled = $true; definition = [pscustomobject]@{ id = $script:OneDriveId } })
+            $Payload = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $script:PolicyId -TenantFilter $script:Tenant -DefinitionValues $Values
+
+            @($Payload.added).Count | Should -Be 1
+            Should -Invoke New-GraphGETRequest -Times 0 -Exactly -ParameterFilter { $uri -like '*expand=definition' }
+        }
+    }
+
+    Context 'the payload a template stores (-IncludeIdentity)' {
+        It 'records each setting''s name, category path and class next to its bind' {
+            $Payload = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $script:PolicyId -TenantFilter $script:Tenant -IncludeIdentity
+
+            $Payload.added[0].definition.id | Should -Be $script:FirefoxId
+            $Payload.added[0].definition.displayName | Should -Be 'SPNEGO'
+            $Payload.added[0].definition.categoryPath | Should -Be '\Mozilla\Firefox\Authentication'
+            $Payload.added[0].definition.classType | Should -Be 'machine'
+            $Payload.added[1].definition.categoryPath | Should -Be '\OneDrive'
+        }
+
+        It 'records each presentation''s label, type and position within its definition' {
+            $Payload = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $script:PolicyId -TenantFilter $script:Tenant -IncludeIdentity
+
+            $Presentation = $Payload.added[0].presentationValues[0].presentation
+            $Presentation.id | Should -Be $script:ListPresentationId
+            $Presentation.'@odata.type' | Should -Be '#microsoft.graph.groupPolicyPresentationListBox'
+            $Presentation.index | Should -Be 1
+        }
+
+        It 'reads the definitions and their presentations in one batch' {
+            $null = Get-CIPPIntuneAdminTemplateDefinitionValue -PolicyId $script:PolicyId -TenantFilter $script:Tenant -IncludeIdentity
+
+            Should -Invoke New-GraphBulkRequest -Times 1 -Exactly -ParameterFilter { @($Requests).Count -eq 4 -and $tenantid -eq $script:Tenant }
+        }
+    }
+}
diff --git a/Tests/Private/Get-CIPPIntuneAssignmentTarget.Tests.ps1 b/Tests/Private/Get-CIPPIntuneAssignmentTarget.Tests.ps1
index 650b695f6fb5d..29854054f9e00 100644
--- a/Tests/Private/Get-CIPPIntuneAssignmentTarget.Tests.ps1
+++ b/Tests/Private/Get-CIPPIntuneAssignmentTarget.Tests.ps1
@@ -89,6 +89,11 @@ Describe 'Get-CIPPIntuneAssignmentTarget' {
             $Result.Dropped | Should -Be @('All Devices')
         }
 
+        It 'declares no equivalent type - the MAM service rejects allLicensedUsersAssignmentTarget' {
+            (Get-CIPPIntuneAssignmentTarget -AssignTo 'allLicensedUsers' -PolicyType 'iosManagedAppProtections').Equivalents.Count |
+                Should -Be 0
+        }
+
         It 'emits no allLicensedUsers or allDevices target for any option' {
             foreach ($AssignTo in 'allLicensedUsers', 'AllDevices', 'AllDevicesAndUsers') {
                 $Result = Get-CIPPIntuneAssignmentTarget -AssignTo $AssignTo -PolicyType 'iosManagedAppProtections'
@@ -132,5 +137,21 @@ Describe 'Get-CIPPIntuneAssignmentTarget' {
             (Get-CIPPIntuneAssignmentTarget -AssignTo 'allLicensedUsers' -PolicyType 'DevicePrepProfile').IsMam |
                 Should -BeFalse
         }
+
+        It 'accepts allLicensedUsersAssignmentTarget as an equivalent of the All Users group' {
+            # A working All users assignment is reported back under that type, so a comparison
+            # that only accepts the group target flags it as a deviation on every run.
+            $Result = Get-CIPPIntuneAssignmentTarget -AssignTo 'allLicensedUsers' -PolicyType 'DevicePrepProfile'
+
+            $Result.Equivalents[$script:AllUsersGroupId] | Should -Be @('#microsoft.graph.allLicensedUsersAssignmentTarget')
+        }
+
+        It 'declares no equivalents when no broad target was produced' -ForEach @(
+            @{ AssignTo = 'customGroup' }
+            @{ AssignTo = 'AllDevices' }
+        ) {
+            (Get-CIPPIntuneAssignmentTarget -AssignTo $AssignTo -PolicyType 'DevicePrepProfile').Equivalents.Count |
+                Should -Be 0
+        }
     }
 }
diff --git a/Tests/Private/Get-CIPPLegacyInfrastructureNotice.Tests.ps1 b/Tests/Private/Get-CIPPLegacyInfrastructureNotice.Tests.ps1
new file mode 100644
index 0000000000000..ce3da7a6c9205
--- /dev/null
+++ b/Tests/Private/Get-CIPPLegacyInfrastructureNotice.Tests.ps1
@@ -0,0 +1,74 @@
+# Get-CIPPLegacyInfrastructureNotice runs on every page load, so it has to be cheap, never throw,
+# and stay silent on the new infrastructure, on CyberDrain-hosted instances (all migrated) and on
+# local dev. The alert it emits has to carry the
+# same fields Get-CIPPMaintenanceNotice does, because the frontend renders both through the same
+# banner and picks the alert by its "maintenance" flag.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPLegacyInfrastructureNotice.ps1')
+
+    $script:EnvNames = @('CIPPNG', 'CIPP_HOSTED', 'AzureWebJobsStorage', 'NonLocalHostAzurite')
+    $script:MigrationGuide = 'https://docs.cipp.app/setup/maintaining-cipp/migrating-to-the-new-infrastructure'
+}
+
+Describe 'Get-CIPPLegacyInfrastructureNotice' {
+    BeforeEach {
+        $script:SavedEnv = @{}
+        foreach ($Name in $script:EnvNames) {
+            $script:SavedEnv[$Name] = [Environment]::GetEnvironmentVariable($Name)
+            [Environment]::SetEnvironmentVariable($Name, $null)
+        }
+    }
+
+    AfterEach {
+        foreach ($Name in $script:EnvNames) {
+            [Environment]::SetEnvironmentVariable($Name, $script:SavedEnv[$Name])
+        }
+    }
+
+    It 'returns nothing on the new infrastructure' {
+        $env:CIPPNG = 'true'
+        Get-CIPPLegacyInfrastructureNotice | Should -BeNullOrEmpty
+    }
+
+    It 'returns nothing for local development against Azurite' {
+        $env:AzureWebJobsStorage = 'UseDevelopmentStorage=true'
+        Get-CIPPLegacyInfrastructureNotice | Should -BeNullOrEmpty
+    }
+
+    It 'returns nothing for local development against a remote Azurite' {
+        $env:NonLocalHostAzurite = 'true'
+        Get-CIPPLegacyInfrastructureNotice | Should -BeNullOrEmpty
+    }
+
+    It 'warns a self-hosted Function App instance and links the migration guide' {
+        $Notice = Get-CIPPLegacyInfrastructureNotice
+
+        $Notice | Should -Not -BeNullOrEmpty
+        $Notice.type | Should -Be 'warning'
+        $Notice.title | Should -Be 'Legacy infrastructure'
+        $Notice.Alert | Should -BeLike '*legacy Function App infrastructure*'
+        $Notice.Alert | Should -BeLike '*stop receiving updates*'
+        $Notice.link | Should -Be $script:MigrationGuide
+        $Notice.linkText | Should -Be 'Migration guide'
+    }
+
+    It 'returns nothing for a CyberDrain-hosted instance because hosted is fully migrated' {
+        $env:CIPP_HOSTED = 'true'
+        Get-CIPPLegacyInfrastructureNotice | Should -BeNullOrEmpty
+    }
+
+    It 'is shaped like a maintenance notice so the banner can render it' {
+        $Notice = Get-CIPPLegacyInfrastructureNotice
+
+        $Notice.maintenance | Should -BeTrue
+        $Notice.noticeId | Should -Be 'legacy-function-app-infrastructure'
+        $Notice.dismissible | Should -BeFalse
+        $Notice.active | Should -BeFalse
+        $Notice.Keys | Should -Contain 'startTime'
+        $Notice.Keys | Should -Contain 'endTime'
+        $Notice.startTime | Should -BeNullOrEmpty
+        $Notice.endTime | Should -BeNullOrEmpty
+    }
+}
diff --git a/Tests/Private/Get-CIPPLicensePrice.Tests.ps1 b/Tests/Private/Get-CIPPLicensePrice.Tests.ps1
index 5f768c16f6c9a..92a273468c105 100644
--- a/Tests/Private/Get-CIPPLicensePrice.Tests.ps1
+++ b/Tests/Private/Get-CIPPLicensePrice.Tests.ps1
@@ -1,4 +1,4 @@
-# Pester tests for Get-CIPPLicensePrice — estimates from CSV, overrides win, unknown SKUs.
+# Pester tests for Get-CIPPLicensePrice — estimates from the catalog, overrides win, unknown SKUs.
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -8,11 +8,12 @@ BeforeAll {
 
     function Get-CIPPTable { param($TableName) }
     function Get-CIPPAzDataTableEntity { param($Filter, $Property) }
+    function Get-CIPPLicenseCatalog { param([switch]$Force) }
 
     . $FunctionPath
 
-    # The function joins $env:CIPPRootPath to locate the defaults CSV; the CSV read itself is
-    # mocked, so any non-empty base path is enough to get past Join-Path.
+    # The function joins $env:CIPPRootPath to locate the SKU list; the read itself is mocked, so
+    # any non-empty base path is enough to get past Join-Path.
     $script:SavedRoot = $env:CIPPRootPath
     $env:CIPPRootPath = "$TestDrive"
 
@@ -27,12 +28,15 @@ AfterAll {
 
 Describe 'Get-CIPPLicensePrice' {
     BeforeEach {
-        Mock -CommandName Test-Path -MockWith { $true }
-        Mock -CommandName Import-Csv -MockWith {
-            @(
-                [pscustomobject]@{ skuId = $script:E5; skuPartNumber = 'ENTERPRISEPREMIUM'; Product_Display_Name = 'Office 365 E5'; MonthlyPrice = '38.00'; Currency = 'USD' }
-                [pscustomobject]@{ skuId = $script:E3; skuPartNumber = 'ENTERPRISEPACK'; Product_Display_Name = 'Office 365 E3'; MonthlyPrice = '23.00'; Currency = 'USD' }
-            )
+        # No SKU list on disk unless a case provides one
+        Mock -CommandName Test-Path -MockWith { $false }
+        Mock -CommandName Get-CIPPLicenseCatalog -MockWith {
+            [pscustomobject]@{
+                products = @(
+                    [pscustomobject]@{ skuId = $script:E5; skuPartNumber = 'ENTERPRISEPREMIUM'; name = 'Office 365 E5'; prices = [pscustomobject]@{ USD = 38.00 } }
+                    [pscustomobject]@{ skuId = $script:E3; skuPartNumber = 'ENTERPRISEPACK'; name = 'Office 365 E3'; prices = [pscustomobject]@{ USD = 23.00 } }
+                )
+            }
         }
         Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'fake' } }
         # Default: no overrides
@@ -79,6 +83,25 @@ Describe 'Get-CIPPLicensePrice' {
         ($Result.skuId | Sort-Object) | Should -Be (@($script:E3, $script:E5) | Sort-Object)
     }
 
+    It 'lists every SKU from the shipped SKU list when IncludeUnknown is set, named from that list' {
+        Mock -CommandName Test-Path -MockWith { $true }
+        Mock -CommandName Get-Content -MockWith {
+            "Product_Display_Name,String_Id,GUID,Service_Plan_Name,Service_Plan_Id`nOffice 365 E5 (from list),ENTERPRISEPREMIUM,$($script:E5),EXCHANGE_S_ENTERPRISE,efb87545`nExchange Online Kiosk,EXCHANGEDESKLESS,80b2d799-d2ba-4d2a-8842-fb0d0f3a4b82,EXCHANGE_S_DESKLESS,4a82b400`nExchange Online Kiosk,EXCHANGEDESKLESS,80b2d799-d2ba-4d2a-8842-fb0d0f3a4b82,INTUNE_O365,882e1d05"
+        }
+
+        $Result = @(Get-CIPPLicensePrice -IncludeUnknown)
+
+        $Result.Count | Should -Be 3
+        $Kiosk = $Result | Where-Object { $_.skuId -eq '80b2d799-d2ba-4d2a-8842-fb0d0f3a4b82' }
+        $Kiosk.Source | Should -Be 'Unknown'
+        $Kiosk.MonthlyPrice | Should -BeNullOrEmpty
+        $Kiosk.skuPartNumber | Should -Be 'EXCHANGEDESKLESS'
+        # The SKU list wins for the display name; the catalog carries prices only
+        ($Result | Where-Object { $_.skuId -eq $script:E5 }).Product_Display_Name | Should -Be 'Office 365 E5 (from list)'
+        # Without IncludeUnknown the unpriced Kiosk row is omitted
+        @(Get-CIPPLicensePrice).Count | Should -Be 2
+    }
+
     It 'merges an override-only SKU into the full list' {
         Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
             @([pscustomobject]@{ PartitionKey = 'Price'; RowKey = 'aaaa1111-2222-3333-4444-555566667777'; skuId = 'aaaa1111-2222-3333-4444-555566667777'; skuPartNumber = 'CUSTOM'; Product_Display_Name = 'Custom SKU'; MonthlyPrice = 5.0; Currency = 'USD' })
@@ -93,14 +116,15 @@ Describe 'Get-CIPPLicensePrice' {
 
 Describe 'Get-CIPPLicensePrice - multi-currency' {
     BeforeEach {
-        Mock -CommandName Test-Path -MockWith { $true }
+        Mock -CommandName Test-Path -MockWith { $false }
         # E5 priced in USD and AUD; E3 in USD only
-        Mock -CommandName Import-Csv -MockWith {
-            @(
-                [pscustomobject]@{ skuId = $script:E5; skuPartNumber = 'ENTERPRISEPREMIUM'; Product_Display_Name = 'Office 365 E5'; MonthlyPrice = '38.00'; Currency = 'USD' }
-                [pscustomobject]@{ skuId = $script:E5; skuPartNumber = 'ENTERPRISEPREMIUM'; Product_Display_Name = 'Office 365 E5'; MonthlyPrice = '60.00'; Currency = 'AUD' }
-                [pscustomobject]@{ skuId = $script:E3; skuPartNumber = 'ENTERPRISEPACK'; Product_Display_Name = 'Office 365 E3'; MonthlyPrice = '23.00'; Currency = 'USD' }
-            )
+        Mock -CommandName Get-CIPPLicenseCatalog -MockWith {
+            [pscustomobject]@{
+                products = @(
+                    [pscustomobject]@{ skuId = $script:E5; skuPartNumber = 'ENTERPRISEPREMIUM'; name = 'Office 365 E5'; prices = [pscustomobject]@{ USD = 38.00; AUD = 60.00 } }
+                    [pscustomobject]@{ skuId = $script:E3; skuPartNumber = 'ENTERPRISEPACK'; name = 'Office 365 E3'; prices = [pscustomobject]@{ USD = 23.00 } }
+                )
+            }
         }
         Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'fake' } }
         Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { @() }
diff --git a/Tests/Private/Get-CIPPLicenseRecommendation.Tests.ps1 b/Tests/Private/Get-CIPPLicenseRecommendation.Tests.ps1
new file mode 100644
index 0000000000000..2fdbab195190b
--- /dev/null
+++ b/Tests/Private/Get-CIPPLicenseRecommendation.Tests.ps1
@@ -0,0 +1,372 @@
+# Pester tests for Get-CIPPLicenseRecommendation — downgrade targets from usage evidence,
+# consolidation / protection upgrades, and the annual-vs-monthly term split.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Get-CIPPLicenseRecommendation.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Get-CIPPLicenseRecommendation.ps1 under Modules/' }
+
+    function Get-CIPPLicensePrice { param($SkuId, $Currency, [switch]$ListCurrencies) }
+    function Get-CIPPLicenseCatalog { param([switch]$Force) }
+    function Get-CIPPLicenseOptimization { param($TenantFilter, $Licenses, $Users, $ActivityDetail, $InactiveDays, $Currency) }
+    function New-CIPPDbRequest { param($TenantFilter, $Type, $Fields) }
+    function New-GraphGetRequest { param($uri, $tenantid, [switch]$ComplexFilter) }
+    function Get-CIPPLicenseOverview { param($TenantFilter) }
+
+    . $FunctionPath
+
+    # SKUs
+    $script:Basic = '3b555118-da6a-4418-894f-7df1e2096870'
+    $script:Standard = 'f245ecc8-75af-4f8e-b61f-27d8114de5f3'
+    $script:Premium = 'cbdc14ab-d96c-4c30-b9f4-6ada7cdc1d46'
+    $script:AppsBiz = 'cdd28e44-67e3-425e-be4c-737fab2899d3'
+    $script:ExP1 = '4b9405b0-7788-4568-add1-99614e613b69'
+    $script:Copilot = '639dec6b-bb19-468b-871c-c5c441c4b0cb'
+
+    # Service plans
+    $script:PlanExchange = '9aaf7827-d63c-4b61-89c3-182f06f82e5c'
+    $script:PlanTeams = '57ff2da0-773e-42df-b2af-ffb7a2317929'
+    $script:PlanSpo = 'c7699d2e-19aa-44de-8edf-1736da088ca1'
+    $script:PlanOfficeBiz = '094e7854-93fc-4d55-b2c0-3ab5369ebdc1'
+    $script:PlanIntune = 'c1ec4a95-1f05-45b3-a911-aa3fa01094f5'
+    $script:PlanAadP1 = '41781fb2-bc02-4b7c-bd55-b576c07bb09d'
+    $script:PlanMde = 'bfc1bbd9-981b-4f71-9b82-17c35fd0e2a4'
+    $script:PlanCopilot = 'a62f8878-de10-42f3-b68f-6149a25ceb97'
+
+    $script:PlanIds = @{
+        $script:Basic    = @($script:PlanExchange, $script:PlanTeams, $script:PlanSpo)
+        $script:Standard = @($script:PlanExchange, $script:PlanTeams, $script:PlanSpo, $script:PlanOfficeBiz)
+        $script:Premium  = @($script:PlanExchange, $script:PlanTeams, $script:PlanSpo, $script:PlanOfficeBiz, $script:PlanIntune, $script:PlanAadP1, $script:PlanMde)
+        $script:AppsBiz  = @($script:PlanOfficeBiz)
+        $script:ExP1     = @($script:PlanExchange)
+        $script:Copilot  = @($script:PlanCopilot)
+    }
+
+    function New-Lic { param($SkuId, $Name, $Total, $Used, $Terms = @())
+        [pscustomobject]@{ skuId = $SkuId; License = $Name; TotalLicenses = "$Total"; CountUsed = "$Used"; ServicePlans = @(); TermInfo = @($Terms) }
+    }
+    function New-User { param($Upn, $Skus, $AssignedSince, $Created = (Get-Date).AddYears(-2).ToString('o'), $Enabled = $true)
+        [pscustomobject]@{
+            userPrincipalName       = $Upn
+            displayName             = $Upn
+            accountEnabled          = $Enabled
+            userType                = 'Member'
+            isResourceAccount       = $false
+            createdDateTime         = $Created
+            signInActivity          = [pscustomobject]@{ lastSignInDateTime = (Get-Date).AddDays(-2).ToString('o'); lastNonInteractiveSignInDateTime = $null }
+            assignedLicenses        = @($Skus | ForEach-Object { [pscustomobject]@{ skuId = $_; disabledPlans = @() } })
+            licenseAssignmentStates = @($Skus | ForEach-Object { [pscustomobject]@{ skuId = $_; state = 'Active'; lastUpdatedDateTime = $AssignedSince } })
+        }
+    }
+    function New-Activity { param($Upn, $Exchange, $Teams, $Files)
+        $Recent = (Get-Date).AddDays(-3).ToString('yyyy-MM-dd')
+        [pscustomobject]@{
+            userPrincipalName          = $Upn
+            exchangeLastActivityDate   = if ($Exchange) { $Recent } else { '' }
+            teamsLastActivityDate      = if ($Teams) { $Recent } else { '' }
+            oneDriveLastActivityDate   = if ($Files) { $Recent } else { '' }
+            sharePointLastActivityDate = ''
+            yammerLastActivityDate     = ''
+        }
+    }
+    function New-AppUsage { param($Upn, $Windows)
+        [pscustomobject]@{ userPrincipalName = $Upn; details = @([pscustomobject]@{ reportPeriod = 180; windows = $Windows; mac = $false; web = $true; mobile = $false }) }
+    }
+}
+
+Describe 'Get-CIPPLicenseRecommendation' {
+    BeforeEach {
+        Mock -CommandName Get-CIPPLicenseCatalog -MockWith {
+            [pscustomobject]@{
+                meta         = [pscustomobject]@{ monthlyCommitmentUplift = 0.2; seatLimits = [pscustomobject]@{ business = 300 } }
+                capabilities = @(
+                    [pscustomobject]@{ id = 'email'; label = 'Email and calendar'; signal = 'exchange'; servicePlanIds = @($script:PlanExchange) }
+                    [pscustomobject]@{ id = 'teams'; label = 'Teams chat and meetings'; signal = 'teams'; servicePlanIds = @($script:PlanTeams) }
+                    [pscustomobject]@{ id = 'files'; label = 'File storage and sharing'; signal = 'files'; servicePlanIds = @($script:PlanSpo) }
+                    [pscustomobject]@{ id = 'desktopApps'; label = 'Office desktop apps'; signal = 'desktopApps'; servicePlanIds = @($script:PlanOfficeBiz) }
+                    [pscustomobject]@{ id = 'copilot'; label = 'Microsoft 365 Copilot'; signal = 'copilot'; servicePlanIds = @($script:PlanCopilot) }
+                    [pscustomobject]@{ id = 'deviceManagement'; label = 'Device management'; signal = $null; servicePlanIds = @($script:PlanIntune) }
+                    [pscustomobject]@{ id = 'signInSecurity'; label = 'Advanced sign-in security'; signal = $null; servicePlanIds = @($script:PlanAadP1) }
+                    [pscustomobject]@{ id = 'endpointSecurity'; label = 'Device threat protection'; signal = $null; servicePlanIds = @($script:PlanMde) }
+                )
+                families     = @()
+                products     = @(
+                    [pscustomobject]@{ skuId = $script:Basic; skuPartNumber = 'O365_BUSINESS_ESSENTIALS'; name = 'Business Basic'; family = 'business'; tier = 1; eligibleTarget = $true }
+                    [pscustomobject]@{ skuId = $script:Standard; skuPartNumber = 'O365_BUSINESS_PREMIUM'; name = 'Business Standard'; family = 'business'; tier = 2; eligibleTarget = $true }
+                    [pscustomobject]@{ skuId = $script:Premium; skuPartNumber = 'SPB'; name = 'Business Premium'; family = 'business'; tier = 3; eligibleTarget = $true }
+                    [pscustomobject]@{ skuId = $script:AppsBiz; skuPartNumber = 'O365_BUSINESS'; name = 'Apps for Business'; family = 'apps'; tier = 1; eligibleTarget = $true }
+                    [pscustomobject]@{ skuId = $script:ExP1; skuPartNumber = 'EXCHANGESTANDARD'; name = 'Exchange P1'; family = 'exchange'; tier = 1; eligibleTarget = $true }
+                    [pscustomobject]@{ skuId = $script:Copilot; skuPartNumber = 'Microsoft_365_Copilot'; name = 'Copilot'; family = 'addon'; tier = 0; eligibleTarget = $false }
+                )
+            }
+        }
+        Mock -CommandName Get-CIPPLicensePrice -MockWith {
+            @(
+                [pscustomobject]@{ skuId = $script:Basic; Product_Display_Name = 'Business Basic'; MonthlyPrice = 7.0; Currency = 'USD'; Source = 'Estimate' }
+                [pscustomobject]@{ skuId = $script:Standard; Product_Display_Name = 'Business Standard'; MonthlyPrice = 14.0; Currency = 'USD'; Source = 'Estimate' }
+                [pscustomobject]@{ skuId = $script:Premium; Product_Display_Name = 'Business Premium'; MonthlyPrice = 22.0; Currency = 'USD'; Source = 'Estimate' }
+                [pscustomobject]@{ skuId = $script:AppsBiz; Product_Display_Name = 'Apps for Business'; MonthlyPrice = 10.0; Currency = 'USD'; Source = 'Estimate' }
+                [pscustomobject]@{ skuId = $script:ExP1; Product_Display_Name = 'Exchange P1'; MonthlyPrice = 4.0; Currency = 'USD'; Source = 'Estimate' }
+                [pscustomobject]@{ skuId = $script:Copilot; Product_Display_Name = 'Copilot'; MonthlyPrice = 30.0; Currency = 'USD'; Source = 'Estimate' }
+            )
+        }
+        Mock -CommandName Get-CIPPLicenseOptimization -MockWith {
+            [pscustomobject]@{
+                Summary       = [pscustomobject]@{ MonthlySpend = 100.0; ReclaimableMonthly = 10.0; ReclaimableSeats = 1; AssignedSeats = 5; PriceCoverage = 1; AnonymizedReports = $false; DataAvailable = $true }
+                # The reclaimable money is recounted from the findings, so the summary and the list agree
+                Opportunities = @(
+                    [pscustomobject]@{ Tier = 'UnassignedSeats'; FindingLabel = 'Unassigned'; License = 'Apps for Business'; skuId = $script:AppsBiz; Seats = 1; UnitCost = 10.0; MonthlySaving = 10.0; SuggestedAction = 'Reduce seat count'; Users = @(); PriceKnown = $true }
+                )
+            }
+        }
+
+        $script:Old = (Get-Date).AddMonths(-9).ToString('o')
+        $script:New = (Get-Date).AddMonths(-1).ToString('o')
+        $script:Licenses = @(
+            New-Lic $script:Standard 'Business Standard' 10 4 @(
+                [pscustomobject]@{ Status = 'Enabled'; Term = 'Monthly'; TotalLicenses = 6; DaysUntilRenew = 12 }
+                [pscustomobject]@{ Status = 'Enabled'; Term = 'Yearly'; TotalLicenses = 4; DaysUntilRenew = 200 }
+            )
+            New-Lic $script:Premium 'Business Premium' 2 1
+            New-Lic $script:Basic 'Business Basic' 2 1
+            New-Lic $script:AppsBiz 'Apps for Business' 2 1
+            New-Lic $script:Copilot 'Copilot' 1 1
+        )
+        $script:Users = @(
+            # Standard, never opens the desktop apps -> Basic
+            New-User 'mailonly@contoso.com' @($script:Standard) $script:Old
+            # Standard, uses desktop apps -> stays
+            New-User 'power@contoso.com' @($script:Standard) $script:Old
+            # Standard, new hire (1 month), uses apps -> stays, but not stable for annual
+            New-User 'newhire@contoso.com' @($script:Standard) $script:New
+            # Standard, no usage data at all -> no claim
+            New-User 'unknown@contoso.com' @($script:Standard) $script:Old
+            # Premium, only email -> protected security features keep it on Premium
+            New-User 'premium@contoso.com' @($script:Premium) $script:Old
+            # Basic + Apps for Business (17) -> consolidate into Standard (14)
+            New-User 'combo@contoso.com' @($script:Basic, $script:AppsBiz) $script:Old
+            # Copilot never used -> remove
+            New-User 'copilot@contoso.com' @($script:Copilot, $script:Premium) $script:Old
+        )
+        $script:Activity = @(
+            New-Activity 'mailonly@contoso.com' $true $false $false
+            New-Activity 'power@contoso.com' $true $true $true
+            New-Activity 'newhire@contoso.com' $true $true $true
+            New-Activity 'premium@contoso.com' $true $false $false
+            New-Activity 'combo@contoso.com' $true $true $true
+            New-Activity 'copilot@contoso.com' $true $true $true
+        )
+        $script:Apps = @(
+            New-AppUsage 'mailonly@contoso.com' $false
+            New-AppUsage 'power@contoso.com' $true
+            New-AppUsage 'newhire@contoso.com' $true
+            New-AppUsage 'premium@contoso.com' $false
+            New-AppUsage 'combo@contoso.com' $true
+            New-AppUsage 'copilot@contoso.com' $true
+        )
+    }
+
+    It 'recommends the cheapest plan with a mailbox for a Standard user who only uses email' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        # Only email is in evidence, so Exchange P1 (4) beats Business Basic (7)
+        $Row = $Report.Downgrades | Where-Object { $_.FromSkuId -eq $script:Standard -and $_.ToSkuId -eq $script:ExP1 }
+        $Row | Should -Not -BeNullOrEmpty
+        $Row.Seats | Should -Be 1
+        $Row.Users.userPrincipalName | Should -Be 'mailonly@contoso.com'
+        $Row.UnitSaving | Should -Be 10.0
+        $Row.Loses | Should -Contain 'Office desktop apps'
+        $Row.Loses | Should -Contain 'Teams chat and meetings'
+        $Row.Keeps | Should -Contain 'Email and calendar'
+    }
+
+    It 'makes no claim about a user with no usage data and keeps a desktop-app user on Standard' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Upns = @($Report.Downgrades | ForEach-Object { $_.Users.userPrincipalName })
+        $Upns | Should -Not -Contain 'unknown@contoso.com'
+        $Upns | Should -Not -Contain 'power@contoso.com'
+    }
+
+    It 'keeps a Premium user on Premium while security features are protected, and downgrades when they are not' {
+        $Protected = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+        @($Protected.Downgrades | Where-Object { $_.FromSkuId -eq $script:Premium }) | Should -BeNullOrEmpty
+
+        $Open = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -ProtectSecurityFeatures $false -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+        $Row = $Open.Downgrades | Where-Object { $_.FromSkuId -eq $script:Premium -and $_.Users.userPrincipalName -contains 'premium@contoso.com' }
+        $Row | Should -Not -BeNullOrEmpty
+        # Only email is in evidence, so the cheapest plan with a mailbox wins
+        $Row.ToSkuId | Should -Be $script:ExP1
+        $Row.Loses | Should -Contain 'Device management'
+    }
+
+    It 'recommends removing an unused Copilot add-on' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Row = $Report.Downgrades | Where-Object { $_.FromSkuId -eq $script:Copilot }
+        $Row | Should -Not -BeNullOrEmpty
+        $Row.Action | Should -Be 'Remove'
+        $Row.UnitSaving | Should -Be 30.0
+    }
+
+    It 'consolidates Basic + Apps for Business into Standard' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Row = $Report.Upgrades | Where-Object { $_.Type -eq 'Consolidate' -and $_.ToSkuId -eq $script:Standard }
+        $Row | Should -Not -BeNullOrEmpty
+        $Row.UnitCost | Should -Be 17.0
+        $Row.UnitDelta | Should -Be (-3.0)
+        $Row.Users.userPrincipalName | Should -Be 'combo@contoso.com'
+        $Report.Summary.ConsolidationMonthly | Should -Be 3.0
+    }
+
+    It 'flags unprotected users with the cheapest plan that adds security, as an investment' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Rows = @($Report.Upgrades | Where-Object { $_.Type -eq 'Protect' })
+        $Rows.Count | Should -BeGreaterThan 0
+        ($Rows | ForEach-Object { $_.ToSkuId } | Select-Object -Unique) | Should -Be $script:Premium
+        $Report.Summary.ProtectInvestmentMonthly | Should -BeGreaterThan 0
+        # Premium holders are never in the protect list
+        @($Rows | ForEach-Object { $_.Users.userPrincipalName }) | Should -Not -Contain 'premium@contoso.com'
+    }
+
+    It 'recommends the annual/monthly split from assignment tenure and values the convertible seats' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -TenureMonths 6 -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Row = $Report.Terms | Where-Object { $_.skuId -eq $script:Standard }
+        $Row | Should -Not -BeNullOrEmpty
+        $Row.AssignedSeats | Should -Be 4
+        # mailonly, power, unknown are 9 months in; newhire is 1 month in
+        $Row.StableSeats | Should -Be 3
+        $Row.RecommendedAnnual | Should -Be 3
+        $Row.RecommendedMonthly | Should -Be 1
+        $Row.MonthlySeats | Should -Be 6
+        $Row.YearlySeats | Should -Be 4
+        # 4 seats already annual cover the 3 stable ones: nothing left to convert
+        $Row.ConvertibleSeats | Should -Be 0
+        # 4 annual seats but only 4 assigned -> nothing locked and unused
+        $Row.LockedUnusedSeats | Should -Be 0
+        $Row.NextRenewalDays | Should -Be 12
+    }
+
+    It 'values monthly seats that should move to annual at the commitment uplift' {
+        $Licenses = @(New-Lic $script:Standard 'Business Standard' 4 4 @([pscustomobject]@{ Status = 'Enabled'; Term = 'Monthly'; TotalLicenses = 4; DaysUntilRenew = 12 }))
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Row = $Report.Terms | Where-Object { $_.skuId -eq $script:Standard }
+        $Row.ConvertibleSeats | Should -Be 3
+        # 3 seats x 14 x 20%
+        $Row.MonthlySaving | Should -Be 8.4
+        $Report.Summary.TermMonthly | Should -Be 8.4
+    }
+
+    It 'skips each analysis when its switch is off' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -RecommendDowngrades $false -RecommendUpgrades $false -RecommendTerms $false -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        @($Report.Downgrades).Count | Should -Be 0
+        @($Report.Upgrades).Count | Should -Be 0
+        @($Report.Terms).Count | Should -Be 0
+        $Report.Summary.TotalPotentialMonthly | Should -Be 10.0
+    }
+
+    It 'makes no downgrade claims when usage reports are anonymized' {
+        $Anon = @(New-Activity 'AB6E27EA1F9A4C00' $true $false $false)
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $Anon -AppUsage @() -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Report.Summary.AnonymizedReports | Should -BeTrue
+        @($Report.Downgrades).Count | Should -Be 0
+    }
+
+    It 'flattens every finding into one suggestion list with a user, an action and a reason' {
+        Mock -CommandName Get-CIPPLicenseOptimization -MockWith {
+            [pscustomobject]@{
+                Summary       = [pscustomobject]@{ MonthlySpend = 100.0; ReclaimableMonthly = 21.0; ReclaimableSeats = 2; AssignedSeats = 5; PriceCoverage = 1; AnonymizedReports = $false; DataAvailable = $true }
+                Opportunities = @(
+                    [pscustomobject]@{ Tier = 'UnassignedSeats'; FindingLabel = 'Unassigned'; License = 'Business Standard'; skuId = $script:Standard; Seats = 6; UnitCost = 14.0; MonthlySaving = 84.0; SuggestedAction = 'Reduce seat count'; Users = @(); PriceKnown = $true }
+                    [pscustomobject]@{ Tier = 'Inactive'; FindingLabel = 'Inactive 90d+'; License = 'Business Basic'; skuId = $script:Basic; Seats = 1; UnitCost = 7.0; MonthlySaving = 7.0; SuggestedAction = 'Review / remove'; Users = @('power@contoso.com'); PriceKnown = $true }
+                )
+            }
+        }
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Rows = @($Report.Suggestions)
+        $Rows.Count | Should -Be $Report.Summary.SuggestionCount
+        ($Rows | Where-Object { $_.Type -eq 'Reduce seats' }).Suggestion | Should -Be 'Reduce the seat count by 6'
+        $Inactive = $Rows | Where-Object { $_.Type -eq 'Remove license' -and $_.User -eq 'power@contoso.com' -and $_.skuId -eq $script:Basic }
+        $Inactive.Reason | Should -Match 'No sign-in for \d+ days'
+        $Inactive.MonthlySaving | Should -Be 7.0
+        $Change = $Rows | Where-Object { $_.Type -eq 'Change license' -and $_.User -eq 'mailonly@contoso.com' }
+        $Change.TargetLicense | Should -Be 'Exchange P1'
+        $Change.Reason | Should -Match 'Used only Email and calendar'
+        ($Rows | Where-Object { $_.Type -eq 'Combine licenses' }).User | Should -Be 'combo@contoso.com'
+        ($Rows | Where-Object { $_.Type -eq 'Add protection' }).MonthlySaving | ForEach-Object { $_ | Should -BeLessThan 0 }
+        # Sorted by saving, biggest first
+        $Rows[0].MonthlySaving | Should -Be 84.0
+    }
+
+    It 'falls back to usage-report activity when the tenant has no sign-in data (no Entra ID P1)' {
+        # Strip sign-in data from everyone; "unknown" has no activity row, "mailonly" has activity
+        $Users = @($script:Users | ForEach-Object { $_.signInActivity = $null; $_ })
+        $Idle = New-User 'idle@contoso.com' @($script:Standard) $script:Old
+        $Idle.signInActivity = $null
+        $Users = @($Users) + $Idle
+        $Activity = @($script:Activity) + (New-Activity 'idle@contoso.com' $false $false $false)
+
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $Users -ActivityDetail $Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Report.Summary.SignInDataAvailable | Should -BeFalse
+        $Row = $Report.Suggestions | Where-Object { $_.User -eq 'idle@contoso.com' }
+        $Row.Type | Should -Be 'Remove license'
+        $Row.Reason | Should -Match 'No activity in email, Teams, OneDrive or SharePoint'
+        $Row.MonthlySaving | Should -Be 14.0
+        # A user with activity keeps getting plan recommendations; one with no report row is left alone
+        @($Report.Suggestions | Where-Object { $_.User -eq 'mailonly@contoso.com' -and $_.Type -eq 'Change license' }).Count | Should -Be 1
+        @($Report.Suggestions | Where-Object { $_.User -eq 'unknown@contoso.com' -and $_.Type -eq 'Remove license' }).Count | Should -Be 0
+        $Report.Summary.ReclaimableMonthly | Should -Be 24.0
+    }
+
+    It 'never reports unassigned seats of tenant-level SKUs (storage, server protection) as waste' {
+        $Storage = '99049c9c-6011-4908-bf17-15f496e6519d'
+        Mock -CommandName Get-CIPPLicenseCatalog -MockWith {
+            [pscustomobject]@{
+                meta         = [pscustomobject]@{ monthlyCommitmentUplift = 0.2; seatLimits = [pscustomobject]@{ business = 300 }; tenantLevelSkus = @($Storage) }
+                capabilities = @()
+                families     = @()
+                products     = @([pscustomobject]@{ skuId = $script:Standard; family = 'business'; tier = 2; eligibleTarget = $true })
+            }
+        }
+        Mock -CommandName Get-CIPPLicenseOptimization -MockWith {
+            [pscustomobject]@{
+                Summary       = [pscustomobject]@{ MonthlySpend = 100.0; ReclaimableMonthly = 100.0; ReclaimableSeats = 7; AssignedSeats = 5; PriceCoverage = 1; AnonymizedReports = $false; DataAvailable = $true }
+                Opportunities = @(
+                    [pscustomobject]@{ Tier = 'UnassignedSeats'; FindingLabel = 'Unassigned'; License = 'Office 365 Extra File Storage'; skuId = $Storage; Seats = 5; UnitCost = 0.2; MonthlySaving = 1.0; SuggestedAction = 'Reduce seat count'; Users = @(); PriceKnown = $true }
+                    [pscustomobject]@{ Tier = 'UnassignedSeats'; FindingLabel = 'Unassigned'; License = 'Business Standard'; skuId = $script:Standard; Seats = 2; UnitCost = 14.0; MonthlySaving = 28.0; SuggestedAction = 'Reduce seat count'; Users = @(); PriceKnown = $true }
+                )
+            }
+        }
+        $Licenses = @($script:Licenses) + (New-Lic $Storage 'Office 365 Extra File Storage' 500 0)
+
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -RecommendDowngrades $false -RecommendUpgrades $false -Licenses $Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        @($Report.Suggestions | Where-Object { $_.skuId -eq $Storage }).Count | Should -Be 0
+        @($Report.Suggestions | Where-Object { $_.Type -eq 'Reduce seats' }).Count | Should -Be 1
+        $Report.Summary.ReclaimableMonthly | Should -Be 28.0
+        $Report.Summary.ReclaimableSeats | Should -Be 2
+        ($Report.Products | Where-Object { $_.skuId -eq $Storage }).UnusedSeats | Should -Be 0
+        ($Report.Products | Where-Object { $_.skuId -eq $Storage }).TenantLevel | Should -BeTrue
+        @($Report.Terms | Where-Object { $_.skuId -eq $Storage }).Count | Should -Be 0
+    }
+
+    It 'sums the potential into the summary and lists what is paid for' {
+        $Report = Get-CIPPLicenseRecommendation -TenantFilter 'contoso.com' -Licenses $script:Licenses -Users $script:Users -ActivityDetail $script:Activity -AppUsage $script:Apps -MailboxUsage @() -CopilotUsage @() -PlanIdsBySku $script:PlanIds
+
+        $Report.Summary.TotalPotentialMonthly | Should -Be ([math]::Round(10.0 + $Report.Summary.DowngradeMonthly + $Report.Summary.ConsolidationMonthly + $Report.Summary.TermMonthly, 2))
+        $Report.Summary.TotalPotentialAnnual | Should -Be ([math]::Round($Report.Summary.TotalPotentialMonthly * 12, 2))
+        $Report.Summary.ReportPeriodDays | Should -Be 180
+        @($Report.Products).Count | Should -Be 5
+        ($Report.Products | Where-Object { $_.skuId -eq $script:Premium }).Capabilities | Should -Contain 'Device management'
+        ($Report.Products | Where-Object { $_.skuId -eq $script:Standard }).MonthlySpend | Should -Be 56.0
+    }
+}
diff --git a/Tests/Private/Get-CIPPPartnerUserLookup.Tests.ps1 b/Tests/Private/Get-CIPPPartnerUserLookup.Tests.ps1
new file mode 100644
index 0000000000000..f84016f483351
--- /dev/null
+++ b/Tests/Private/Get-CIPPPartnerUserLookup.Tests.ps1
@@ -0,0 +1,42 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Get-CIPPTable { param($TableName) @{ TableName = $TableName } }
+    function Get-CIPPAzDataTableEntity { param($TableName, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($TableName, $Entity, [switch]$Force) }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $NoAuthCheck) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Webhooks/Get-CIPPPartnerUserLookup.ps1')
+}
+
+Describe 'Get-CIPPPartnerUserLookup' {
+    BeforeEach {
+        # the per-worker memo lives in the dot-sourcing scope here; start each test cold
+        $script:PartnerUserMemo = $null
+        Mock Get-CIPPAzDataTableEntity { $null }
+        Mock Add-CIPPAzDataTableEntity {}
+        Mock New-GraphGetRequest { @() }
+    }
+
+    It 'serves the day-old table cache without touching Graph' {
+        Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ Format = 'hashtable'; Data = (@{ 'id-1' = @{ userPrincipalName = 'tech@msp.example' } } | ConvertTo-Json -Compress) } }
+        $Lookup = Get-CIPPPartnerUserLookup
+        $Lookup['id-1'].userPrincipalName | Should -Be 'tech@msp.example'
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -ParameterFilter { $Filter -like "PartitionKey eq '_partner' and RowKey eq 'users'*" }
+        Should -Invoke New-GraphGetRequest -Times 0
+    }
+
+    It 'reads the partner tenant from Graph on a cache miss, keys by id, and writes the cache row back' {
+        Mock New-GraphGetRequest { @([pscustomobject]@{ id = 'id-2'; userPrincipalName = 'two@msp.example' }, [pscustomobject]@{ id = ''; userPrincipalName = 'ghost' }) }
+        $Lookup = Get-CIPPPartnerUserLookup
+        @($Lookup.Keys) | Should -Be @('id-2')
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like 'https://graph.microsoft.com/beta/users?*' -and $AsApp -eq $true -and $NoAuthCheck -eq $true }
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1 -ParameterFilter { $Entity.PartitionKey -eq '_partner' -and $Entity.RowKey -eq 'users' -and $Entity.Format -eq 'hashtable' -and $Entity.Data -like '*two@msp.example*' }
+    }
+
+    It 'memoises the answer for the worker so a second call inside the window reads nothing' {
+        Mock Get-CIPPAzDataTableEntity { [pscustomobject]@{ Format = 'hashtable'; Data = (@{ 'id-1' = @{ userPrincipalName = 'tech@msp.example' } } | ConvertTo-Json -Compress) } }
+        $null = Get-CIPPPartnerUserLookup
+        $Again = Get-CIPPPartnerUserLookup
+        $Again['id-1'].userPrincipalName | Should -Be 'tech@msp.example'
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -Exactly
+    }
+}
diff --git a/Tests/Private/Get-CIPPSAMCertificateVersions.Tests.ps1 b/Tests/Private/Get-CIPPSAMCertificateVersions.Tests.ps1
new file mode 100644
index 0000000000000..acffda68cc95b
--- /dev/null
+++ b/Tests/Private/Get-CIPPSAMCertificateVersions.Tests.ps1
@@ -0,0 +1,63 @@
+# Pester tests for Get-CIPPSAMCertificateVersions (dev-mode current/previous)
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $VersionsPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPSAMCertificateVersions.ps1'
+    $NewCertPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/New-CIPPSAMCertificate.ps1'
+
+    function Get-CIPPTable { param($TableName) }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+    function Get-CippKeyVaultName { }
+    function Get-CIPPAzIdentityToken { param($ResourceUrl) }
+    function Invoke-CIPPRestMethod { }
+
+    . $NewCertPath
+    . $VersionsPath
+
+    $script:CertA = New-CIPPSAMCertificate -SubjectName 'CN=CIPP-SAM-A'
+    $script:CertB = New-CIPPSAMCertificate -SubjectName 'CN=CIPP-SAM-B'
+}
+
+Describe 'Get-CIPPSAMCertificateVersions dev-mode' {
+    BeforeEach {
+        $script:OriginalStorage = $env:AzureWebJobsStorage
+        $script:OriginalNonLocal = $env:NonLocalHostAzurite
+        $env:AzureWebJobsStorage = 'UseDevelopmentStorage=true'
+        $env:NonLocalHostAzurite = $null
+        Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'stub-table' } }
+    }
+
+    AfterEach {
+        $env:AzureWebJobsStorage = $script:OriginalStorage
+        $env:NonLocalHostAzurite = $script:OriginalNonLocal
+    }
+
+    It 'returns empty when DevSecrets has no SAMCertificate' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+
+        $Result = Get-CIPPSAMCertificateVersions
+
+        $Result.Current | Should -BeNullOrEmpty
+        $Result.Previous | Should -BeNullOrEmpty
+        $Result.HistoricalThumbprints.Count | Should -Be 0
+    }
+
+    It 'returns current and previous from DevSecrets properties' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [PSCustomObject]@{
+                PartitionKey            = 'Secret'
+                RowKey                  = 'Secret'
+                SAMCertificate          = $script:CertA.PfxBase64
+                SAMCertificatePrevious  = $script:CertB.PfxBase64
+            }
+        }
+
+        $Result = Get-CIPPSAMCertificateVersions
+
+        $Result.Current.Thumbprint | Should -Be $script:CertA.Thumbprint
+        $Result.Previous.Thumbprint | Should -Be $script:CertB.Thumbprint
+        $Result.AllKnownThumbprints | Should -Contain $script:CertA.Thumbprint
+        $Result.AllKnownThumbprints | Should -Contain $script:CertB.Thumbprint
+        $Result.HistoricalThumbprints.Count | Should -Be 0
+    }
+}
diff --git a/Tests/Private/Get-GraphRequestList.Paging.Tests.ps1 b/Tests/Private/Get-GraphRequestList.Paging.Tests.ps1
index f618f77f44897..fe5c17649f121 100644
--- a/Tests/Private/Get-GraphRequestList.Paging.Tests.ps1
+++ b/Tests/Private/Get-GraphRequestList.Paging.Tests.ps1
@@ -16,6 +16,7 @@ BeforeAll {
     function New-CippQueueEntry { param($Name, $Link, $Reference, $TotalTasks) }
     function Start-CIPPOrchestrator { param($InputObject) }
     function New-GraphGetRequest { param($uri, $tenantid) }
+    function Test-CIPPGraphEndpointBlocked { param($Uri, $Expand, [switch]$Throw) }
 
     . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/ConvertTo-CIPPODataFilterValue.ps1')
     . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphRequests/Get-GraphRequestList.ps1')
diff --git a/Tests/Private/HuduBitLockerDriveGroups.Tests.ps1 b/Tests/Private/HuduBitLockerDriveGroups.Tests.ps1
new file mode 100644
index 0000000000000..eeb8c7b17e7f7
--- /dev/null
+++ b/Tests/Private/HuduBitLockerDriveGroups.Tests.ps1
@@ -0,0 +1,38 @@
+BeforeAll {
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerKeySlot.ps1"
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerSyncField.ps1"
+    function Get-CIPPBitLockerKey { }
+}
+Describe 'BitLocker drive groups' {
+    BeforeEach {
+        $Metadata = @(@{ id = 'a'; volumeType = 1 }, @{ id = 'b'; volumeType = 'fixedDataVolume' }, @{ id = 'c'; volumeType = 'operatingSystemVolume' })
+        Mock Get-CIPPBitLockerKey {
+            @(@{ keyId = 'c'; copyField = 'secret-c'; state = 'success' }, @{ keyId = 'a'; copyField = 'secret-a'; state = 'success' }, @{ keyId = 'b'; copyField = 'secret-b'; state = 'success' })
+        }
+    }
+    It 'groups numeric and named volume types with stable numbering' {
+        $Slots = @(Get-HuduBitLockerKeySlot -KeyMetadata $Metadata)
+        $Slots[0].IdLabel | Should -Be 'BitLocker OS Drive 1 Key ID'
+        $Slots[1].PasswordLabel | Should -Be 'BitLocker Fixed Data Drive 1 Recovery Key'
+        $Slots[2].IdLabel | Should -Be 'BitLocker OS Drive 2 Key ID'
+        @(Get-HuduBitLockerKeySlot -KeyMetadata @(@{ id = 'd'; volumeType = 3 }))[0].IdLabel | Should -Be 'BitLocker Removable Data Drive 1 Key ID'
+        @(Get-HuduBitLockerKeySlot -KeyMetadata @(@{ id = 'e' }))[0].IdLabel | Should -Be 'BitLocker Unknown Drive 1 Key ID'
+    }
+    It 'pairs secrets with the correct IDs and clears legacy values after retrieval' {
+        $Fields = Get-HuduBitLockerSyncField -KeyMetadata $Metadata -ExistingFields @(@{ label = 'BitLocker Recovery Keys'; value = 'old' }) -DeviceId 'device-1' -TenantFilter 'contoso.onmicrosoft.com'
+        $Fields.bitlocker_os_drive_1_recovery_key | Should -Be 'secret-a'
+        $Fields.bitlocker_os_drive_2_recovery_key | Should -Be 'secret-c'
+        $Fields.bitlocker_fixed_data_drive_1_key_id | Should -Be 'b'
+        $Fields.bitlocker_fixed_data_drive_1_recovery_key | Should -Be 'secret-b'
+        $Fields.bitlocker_recovery_keys | Should -Be ''
+    }
+    It 'rejects partial retrieval without returning any field updates' {
+        Mock Get-CIPPBitLockerKey { @{ keyId = 'a'; copyField = 'secret-a'; state = 'success' } }
+        { Get-HuduBitLockerSyncField -KeyMetadata $Metadata -DeviceId 'device-1' -TenantFilter 'contoso.onmicrosoft.com' } | Should -Throw '*did not match*'
+    }
+    It 'clears obsolete slots when metadata confirms no keys remain without revealing keys' {
+        $Fields = Get-HuduBitLockerSyncField -KeyMetadata @() -ExistingFields @(@{ label = 'BitLocker OS Drive 2 Recovery Key'; value = 'old' }) -DeviceId 'device-1' -TenantFilter 'contoso.onmicrosoft.com'
+        $Fields.bitlocker_os_drive_2_recovery_key | Should -Be ''
+        Should -Invoke Get-CIPPBitLockerKey -Times 0 -Exactly
+    }
+}
diff --git a/Tests/Private/HuduCredentialRecovery.Tests.ps1 b/Tests/Private/HuduCredentialRecovery.Tests.ps1
new file mode 100644
index 0000000000000..85e5300dc5e5e
--- /dev/null
+++ b/Tests/Private/HuduCredentialRecovery.Tests.ps1
@@ -0,0 +1,88 @@
+BeforeAll {
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerKeySlot.ps1"
+    . "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Get-HuduBitLockerSyncField.ps1"
+    $Source = Get-Content -Raw "$PSScriptRoot/../../Modules/CippExtensions/Public/Hudu/Invoke-HuduExtensionSync.ps1"
+    $Start = $Source.IndexOf('                    $DeviceAssetFields = @{')
+    $End = $Source.IndexOf('                    $NewHash = Get-StringHash', $Start)
+    $CredentialBlock = [ScriptBlock]::Create($Source.Substring($Start, $End - $Start))
+    $Tokens = $null
+    $Errors = $null
+    $Ast = [System.Management.Automation.Language.Parser]::ParseInput($Source, [ref]$Tokens, [ref]$Errors)
+    $UpdateIf = $Ast.Find({ param($Node)
+        $Node -is [System.Management.Automation.Language.IfStatementAst] -and
+        $Node.Clauses[0].Item1.Extent.Text -like '*!$ExistingAsset -or $ExistingAsset.Hash*'
+    }, $true)
+    $UpdateCondition = [ScriptBlock]::Create($UpdateIf.Clauses[0].Item1.Extent.Text)
+    function Get-CIPPLapsPassword { }
+    function Get-CIPPBitLockerKey { }
+    function Get-CippException { param($Exception) return [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } }
+}
+
+Describe 'Hudu missing credential recovery' {
+    BeforeEach {
+        $Configuration = @{ IncludeLAPS = $false; IncludeBitLocker = $false }
+        $TenantFilter = 'contoso.onmicrosoft.com'
+        $Device = @{ operatingSystem = 'Windows'; azureADDeviceId = 'device-1' }
+        $HuduDevice = @{ id = 1; fields = @(
+            @{ label = 'LAPS Account'; value = 'Administrator' }
+            @{ label = 'LAPS Backup Date'; value = '2026-09-07T00:00:00Z' }
+            @{ label = 'BitLocker OS Drive 1 Key ID'; value = 'key-1' }
+        ) }
+        $LAPSMetadataAvailable = $true
+        $LAPSMetadataByDeviceId = @{ 'device-1' = @{ lastBackupDateTime = '2026-09-07T00:00:00Z' } }
+        $BitLockerMetadataAvailable = $true
+        $BitLockerKeyMetadata = @(@{ deviceId = 'device-1'; id = 'key-1'; volumeType = 1 })
+        $ExistingAsset = @{ Hash = 'unchanged' }
+        $NewHash = 'unchanged'
+        Mock Get-CIPPLapsPassword { @{ state = 'success'; accountName = 'Administrator'; copyField = 'test-password'; backupDateTime = '2026-09-07T00:00:00Z' } }
+        Mock Get-CIPPBitLockerKey { @{ state = 'success'; keyId = 'key-1'; copyField = 'test-key' } }
+    }
+
+    It 'saves a recovered LAPS password when metadata and cached hash match' {
+        $Configuration.IncludeLAPS = $true
+        . $CredentialBlock
+        $DeviceAssetFields.laps_account | Should -Be '.\Administrator'
+        $DeviceAssetFields.laps_password | Should -Be 'test-password'
+        $DeviceHashMaterial | Should -Match 'LAPS Account:Administrator'
+        $DeviceHashMaterial | Should -Not -Match 'LAPS Account:\.\\Administrator'
+        (& $UpdateCondition) | Should -BeTrue
+        Should -Invoke Get-CIPPLapsPassword -Times 1 -Exactly
+    }
+
+    It 'does not duplicate an existing local-account prefix returned by Graph' {
+        $Configuration.IncludeLAPS = $true
+        Mock Get-CIPPLapsPassword { @{ state = 'success'; accountName = '.\Administrator'; copyField = 'test-password'; backupDateTime = '2026-09-07T00:00:00Z' } }
+        . $CredentialBlock
+        $DeviceAssetFields.laps_account | Should -Be '.\Administrator'
+        $DeviceHashMaterial | Should -Match 'LAPS Account:Administrator'
+    }
+
+    It 'migrates an existing bare account without retrieving its password' {
+        $Configuration.IncludeLAPS = $true
+        $HuduDevice.fields += @{ label = 'LAPS Password'; value = 'present' }
+        . $CredentialBlock
+        $DeviceAssetFields.laps_account | Should -Be '.\Administrator'
+        (& $UpdateCondition) | Should -BeTrue
+        Should -Invoke Get-CIPPLapsPassword -Times 0 -Exactly
+    }
+
+    It 'retrieves and saves missing BitLocker keys when key IDs and hash match' {
+        $Configuration.IncludeBitLocker = $true
+        . $CredentialBlock
+        $DeviceAssetFields.bitlocker_os_drive_1_recovery_key | Should -Be 'test-key'
+        (& $UpdateCondition) | Should -BeTrue
+        Should -Invoke Get-CIPPBitLockerKey -Times 1 -Exactly
+    }
+
+    It 'does not retrieve unchanged credentials that are already present' {
+        $Configuration.IncludeLAPS = $true
+        $Configuration.IncludeBitLocker = $true
+        $HuduDevice.fields[0].value = '.\Administrator'
+        $HuduDevice.fields += @{ label = 'LAPS Password'; value = 'present' }
+        $HuduDevice.fields += @{ label = 'BitLocker OS Drive 1 Recovery Key'; value = 'present' }
+        . $CredentialBlock
+        (& $UpdateCondition) | Should -BeFalse
+        Should -Invoke Get-CIPPLapsPassword -Times 0 -Exactly
+        Should -Invoke Get-CIPPBitLockerKey -Times 0 -Exactly
+    }
+}
diff --git a/Tests/Private/Import-CommunityTemplate.Tests.ps1 b/Tests/Private/Import-CommunityTemplate.Tests.ps1
index 37178b3832d56..a96af217e6bfb 100644
--- a/Tests/Private/Import-CommunityTemplate.Tests.ps1
+++ b/Tests/Private/Import-CommunityTemplate.Tests.ps1
@@ -14,6 +14,7 @@ BeforeAll {
     function Get-CIPPAzDataTableEntity {}
     function Add-CIPPAzDataTableEntity { param($Entity) $null = $Entity }
 
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1')
     . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Tools/Import-CommunityTemplate.ps1')
 
     function Get-RepoTemplate {
@@ -24,6 +25,15 @@ BeforeAll {
             JSON         = (@{ Displayname = 'Baseline'; Description = $Description } | ConvertTo-Json -Compress)
         }
     }
+
+    function Get-RepoStandardsTemplate {
+        param([string]$Description = 'Description from the repo')
+        [PSCustomObject]@{
+            RowKey       = '9a1b2c3d-4e5f-6071-8293-a4b5c6d7e8f9'
+            PartitionKey = 'StandardsTemplateV2'
+            JSON         = (@{ templateName = 'Baseline'; Description = $Description } | ConvertTo-Json -Compress)
+        }
+    }
 }
 
 Describe 'Import-CommunityTemplate direct-write path' {
@@ -84,6 +94,54 @@ Describe 'Import-CommunityTemplate direct-write path' {
         }
     }
 
+    Context 'source path' {
+        It 'stamps SourcePath when passed' {
+            Mock Get-CIPPAzDataTableEntity {
+                [PSCustomObject]@{
+                    RowKey       = '7f3a91c2-4d1e-4b8a-9c3f-2e5d6a8b1f04'
+                    PartitionKey = 'IntuneTemplate'
+                    SHA          = 'abc123'
+                    JSON         = (@{ Displayname = 'Baseline' } | ConvertTo-Json -Compress)
+                }
+            }
+            $script:Written = $null
+            Mock Add-CIPPAzDataTableEntity { $script:Written = $Entity }
+
+            $null = Import-CommunityTemplate -Template (Get-RepoTemplate) -SHA 'def456' -Source 'owner/repo' -Path 'IntuneTemplate/Baseline.json'
+            $script:Written.SourcePath | Should -Be 'IntuneTemplate/Baseline.json'
+        }
+
+        It 'writes no SourcePath when not passed' {
+            Mock Get-CIPPAzDataTableEntity { $null }
+            $script:Written = $null
+            Mock Add-CIPPAzDataTableEntity { $script:Written = $Entity }
+
+            $null = Import-CommunityTemplate -Template (Get-RepoTemplate) -SHA 'abc123' -Source 'owner/repo'
+            $script:Written.PSObject.Properties.Name | Should -Not -Contain 'SourcePath'
+        }
+    }
+
+    Context 'ContentHash' {
+        It 'is stamped for a StandardsTemplateV2 row' {
+            Mock Get-CIPPAzDataTableEntity { $null }
+            $script:Written = $null
+            Mock Add-CIPPAzDataTableEntity { $script:Written = $Entity }
+
+            $null = Import-CommunityTemplate -Template (Get-RepoStandardsTemplate) -SHA 'abc123' -Source 'owner/repo'
+            $script:Written.ContentHash | Should -Not -BeNullOrEmpty
+            $script:Written.ContentHash | Should -Match '^[0-9a-f]{64}$'
+        }
+
+        It 'is not stamped for a non-StandardsTemplateV2 row' {
+            Mock Get-CIPPAzDataTableEntity { $null }
+            $script:Written = $null
+            Mock Add-CIPPAzDataTableEntity { $script:Written = $Entity }
+
+            $null = Import-CommunityTemplate -Template (Get-RepoTemplate) -SHA 'abc123' -Source 'owner/repo'
+            $script:Written.PSObject.Properties.Name | Should -Not -Contain 'ContentHash'
+        }
+    }
+
     Context 'package membership' {
         It 'is kept when the repo file does not carry it' {
             Mock Get-CIPPAzDataTableEntity {
diff --git a/Tests/Private/Invoke-CIPPBecContainment.Tests.ps1 b/Tests/Private/Invoke-CIPPBecContainment.Tests.ps1
new file mode 100644
index 0000000000000..e7982f1ad2967
--- /dev/null
+++ b/Tests/Private/Invoke-CIPPBecContainment.Tests.ps1
@@ -0,0 +1,261 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    # Every mutator the dispatcher can reach is a stub so a run can prove exactly which ones are invoked.
+    function Set-CIPPResetPassword { param($UserID, $DisplayName, $TenantFilter, $APIName, $Headers, $forceChangePasswordNextSignIn) }
+    function Set-CIPPSignInState { param($UserID, $AccountEnabled, $TenantFilter, $APIName, $Headers) }
+    function Revoke-CIPPSessions { param($userid, $username, $Headers, $APIName, $tenantFilter) }
+    function Remove-CIPPUserMFA { param($UserPrincipalName, $TenantFilter, $MethodId, $Headers, $APIName) }
+    function Remove-CIPPUserOAuthGrant { param($TenantFilter, $UserId, $GrantIds, $AppRoleAssignmentIds, $Headers, $APIName) }
+    function Disable-CIPPInboxRules { param($TenantFilter, $UserPrincipalName, $RuleIds, $Headers, $APIName) }
+    function Set-CIPPForwarding { param($UserID, $ForwardingSMTPAddress, $TenantFilter, $Username, $Headers, $APIName, $Forward, $KeepCopy, $Disable) }
+    function Set-CIPPOutOfOffice { param($UserID, $InternalMessage, $ExternalMessage, $TenantFilter, $State, $APIName, $Headers) }
+    function Remove-CIPPMailboxDelegation { param($TenantFilter, $UserPrincipalName, $Delegations, $Headers, $APIName) }
+    function Set-CIPPMobileDevice { param($Headers, $Quarantine, $UserId, $DeviceId, $TenantFilter, $Delete, $Guid, $APIName) }
+    function Set-CIPPDeviceState { param($Action, $DeviceID, $TenantFilter, $Headers, $APIName) }
+    function New-GraphPOSTRequest { param($uri, $tenantid, $type, $body, $AsApp) }
+    function New-CIPPBecTargetedCAPolicy { param($TenantFilter, $UserId, $UserPrincipalName, $State, $Controls, $ExpiresHours, $CaseId, $Headers, $APIName) }
+    function Set-CIPPOneDriveSharing { param($UserId, $TenantFilter, $SharingCapability, $APIName, $Headers, $URL) }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination) }
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor, $useSystemMailbox, $NoAuthCheck) }
+    function Remove-CIPPBecSharingLinks { param($TenantFilter, $UserPrincipalName, $ItemUrls, $Headers, $APIName) }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    function Set-CippBecCaseContext { param($CaseId) }
+    function Get-CIPPBecReport { param($TenantFilter, $CaseId, $UserId, [switch]$IncludeResults) }
+    function Set-CIPPBecReport { param($TenantFilter, $CaseId, $Properties, $Results, [switch]$Replace) }
+    function New-CIPPAsyncDeployment { param($JobId, $Names, $StepTitles, $Source, $TaskId, $TenantFilter) }
+    function Set-CIPPAsyncDeploymentStep { param($JobId, $Name, $StepIndex, $StepStatus, $Message) }
+    function Set-CIPPAsyncDeploymentStatus { param($JobId, $Name, $Status, $Logs) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Get-CIPPBecContainmentActions.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Invoke-CIPPBecContainment.ps1')
+
+    $script:Mutators = @('Set-CIPPResetPassword', 'Set-CIPPSignInState', 'Revoke-CIPPSessions', 'Remove-CIPPUserMFA', 'Remove-CIPPUserOAuthGrant', 'Disable-CIPPInboxRules', 'Set-CIPPForwarding', 'Set-CIPPOutOfOffice', 'Remove-CIPPMailboxDelegation', 'Set-CIPPMobileDevice', 'Set-CIPPDeviceState', 'New-CIPPBecTargetedCAPolicy', 'Set-CIPPOneDriveSharing', 'New-ExoRequest', 'New-GraphPOSTRequest')
+    $script:Run = [pscustomobject]@{
+        UserGrants            = @([pscustomobject]@{ Id = 'g-bad'; Type = 'DelegatedGrant'; Flagged = $true; Risk = 'CatalogMatch'; ClientServicePrincipalId = 'sp-bad' }, [pscustomobject]@{ Id = 'g-ok'; Type = 'DelegatedGrant'; Flagged = $false; Risk = 'Low' }, [pscustomobject]@{ Id = 'a-bad'; Type = 'AppRoleAssignment'; Flagged = $true; Risk = 'CatalogMatch'; ClientServicePrincipalId = 'sp-bad' })
+        Delegations           = @([pscustomobject]@{ PermissionType = 'FullAccess'; Trustee = 'outsider@example.org'; Resource = 'victim@contoso.com'; Identity = 'victim@contoso.com'; Flagged = $true }, [pscustomobject]@{ PermissionType = 'SendAs'; Trustee = 'assistant@contoso.com'; Resource = 'victim@contoso.com'; Flagged = $false })
+        NewRules              = @([pscustomobject]@{ Name = 'Hide'; Identity = 'r1' })
+        TransportRulesFlagged = @([pscustomobject]@{ Guid = 'tr-1'; Name = 'Exfil'; ChangedInWindow = $true }, [pscustomobject]@{ Guid = 'tr-2'; Name = 'Old'; ChangedInWindow = $false })
+        MailboxAddIns         = @([pscustomobject]@{ Identity = 'addin-1'; Flagged = $true })
+        SuspectUserDevices    = @([pscustomobject]@{ DeviceID = 'dev-1'; Guid = 'guid-1'; DeviceModel = 'Phone' })
+        RegisteredDevices     = @([pscustomobject]@{ id = 'entra-1'; RegisteredInWindow = $true }, [pscustomobject]@{ id = 'entra-old'; RegisteredInWindow = $false })
+        MailboxState          = [pscustomobject]@{ HasForwarding = $true; ForwardingSmtpAddress = 'smtp:x@example.org'; AutoReplyState = 'Enabled' }
+        ReceivedMailFindings  = @([pscustomobject]@{ FindingType = 'Typosquat'; SenderAddress = 'ceo@contos0.com'; SenderDomain = 'contos0.com' }, [pscustomobject]@{ FindingType = 'SubjectPattern'; SenderAddress = 'billing@evil.example'; SenderDomain = 'evil.example' }, [pscustomobject]@{ FindingType = 'Keyword'; SenderAddress = 'ceo@contos0.com'; SenderDomain = 'contos0.com' })
+        SharingChanges        = @([pscustomobject]@{ Operation = 'AnonymousLinkCreated'; ItemUrl = 'https://contoso-my.sharepoint.com/personal/victim/Documents/payroll.xlsx'; FileName = 'payroll.xlsx' }, [pscustomobject]@{ Operation = 'CompanyLinkCreated'; ItemUrl = 'https://contoso-my.sharepoint.com/personal/victim/Documents/contracts.docx'; FileName = 'contracts.docx' })
+    }
+}
+
+Describe 'Invoke-CIPPBecContainment' {
+    BeforeEach {
+        foreach ($Name in $script:Mutators) { Mock $Name { "$Name ran" } }
+        Mock Set-CIPPResetPassword { [pscustomobject]@{ resultText = 'Successfully reset the password. The new password is Hunter2!'; copyField = 'Hunter2!'; state = 'success' } }
+        Mock Remove-CIPPUserOAuthGrant { @(foreach ($G in $GrantIds) { [pscustomobject]@{ Target = $G; state = 'success'; resultText = "Deleted $G" } }) + @(foreach ($A in $AppRoleAssignmentIds) { [pscustomobject]@{ Target = $A; state = 'success'; resultText = "Deleted $A" } }) }
+        Mock Disable-CIPPInboxRules { @([pscustomobject]@{ resultText = 'Disabled 1 inbox rule(s)'; state = 'success' }) }
+        Mock Remove-CIPPMailboxDelegation { @(foreach ($D in $Delegations) { [pscustomobject]@{ Target = "$($D.PermissionType) $($D.Trustee)"; state = 'success'; resultText = 'removed' } }) }
+        Mock Write-LogMessage { }
+        Mock Set-CippBecCaseContext { }
+        Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-1'; Containment = @() } }
+        Mock Set-CIPPBecReport { }
+        Mock New-GraphGetRequest { [pscustomobject]@{ id = 'user-guid' } }
+        Mock Remove-CIPPBecSharingLinks { @(foreach ($Url in $ItemUrls) { [pscustomobject]@{ Target = $Url; state = 'success'; resultText = "Removed link on $Url" } }) }
+    }
+
+    It 'reports one progress step per action, in run order, when given a DeploymentId' {
+        Mock New-CIPPAsyncDeployment { $JobId }
+        Mock Set-CIPPAsyncDeploymentStep { }
+        Mock Set-CIPPAsyncDeploymentStatus { }
+        Mock Revoke-CIPPSessions { throw 'Graph said no' }
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -Actions @('ClearAutoReply', 'ResetPassword', 'RevokeSessions') -Confirmed -DeploymentId 'job-1'
+        Should -Invoke New-CIPPAsyncDeployment -Times 1 -ParameterFilter { $JobId -eq 'job-1' -and $Names -contains 'victim@contoso.com' -and (@($StepTitles) -join '|') -eq 'Reset password|Revoke sessions|Turn off automatic replies' }
+        Should -Invoke Set-CIPPAsyncDeploymentStep -Times 3 -ParameterFilter { $StepStatus -eq 'running' }
+        # the step message keeps the password so a background run can still hand it to the operator
+        Should -Invoke Set-CIPPAsyncDeploymentStep -Times 1 -ParameterFilter { $StepIndex -eq 0 -and $StepStatus -eq 'succeeded' -and $Message -match 'Hunter2!' }
+        Should -Invoke Set-CIPPAsyncDeploymentStep -Times 1 -ParameterFilter { $StepIndex -eq 1 -and $StepStatus -eq 'failed' -and $Message -match 'Graph said no' }
+        Should -Invoke Set-CIPPAsyncDeploymentStep -Times 1 -ParameterFilter { $StepIndex -eq 2 -and $StepStatus -eq 'succeeded' }
+        Should -Invoke Set-CIPPAsyncDeploymentStatus -Times 1 -ParameterFilter { $Status -eq 'running' }
+        Should -Invoke Set-CIPPAsyncDeploymentStatus -Times 1 -ParameterFilter { $Status -eq 'failed' }
+    }
+
+    It 'loads the case results itself when only a CaseId is given' {
+        Mock Get-CIPPBecReport { [pscustomobject]@{ CaseId = 'BEC-1'; Containment = @(); Results = $script:Run } } -ParameterFilter { $IncludeResults.IsPresent }
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveOAuthGrants') -Confirmed -CaseId 'BEC-1'
+        Should -Invoke Remove-CIPPUserOAuthGrant -Times 1 -ParameterFilter { @($GrantIds) -contains 'g-bad' -and @($AppRoleAssignmentIds) -contains 'a-bad' }
+    }
+
+    It 'touches no progress row without a DeploymentId' {
+        Mock Set-CIPPAsyncDeploymentStep { }
+        Mock Set-CIPPAsyncDeploymentStatus { }
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions')
+        Should -Invoke Set-CIPPAsyncDeploymentStep -Times 0
+        Should -Invoke Set-CIPPAsyncDeploymentStatus -Times 0
+    }
+
+    It 'runs the built-in default set in order when no actions are selected' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -Confirmed
+        @($Rows.Action | Select-Object -Unique) | Should -Be @('ResetPassword', 'DisableAccount', 'RevokeSessions', 'RemoveMFA', 'DisableInboxRules', 'BlockProtocols')
+        Should -Invoke Set-CIPPResetPassword -Times 1
+        Should -Invoke Set-CIPPSignInState -Times 1 -ParameterFilter { $AccountEnabled -eq $false }
+        Should -Invoke Revoke-CIPPSessions -Times 1
+        Should -Invoke Remove-CIPPUserMFA -Times 1 -ParameterFilter { -not $MethodId }
+        Should -Invoke Disable-CIPPInboxRules -Times 1
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $cmdlet -eq 'Set-CASMailbox' -and $cmdParams.EWSEnabled -eq $false -and $cmdParams.IMAPEnabled -eq $false -and $cmdParams.POPEnabled -eq $false -and $cmdParams.ActiveSyncEnabled -eq $false -and $cmdParams.SmtpClientAuthenticationDisabled -eq $true }
+        Should -Invoke Set-CIPPOneDriveSharing -Times 0
+        Should -Invoke Remove-CIPPUserOAuthGrant -Times 0
+        ($Rows | Where-Object { $_.Action -eq 'ResetPassword' }).copyField | Should -Be 'Hunter2!'
+    }
+
+    It 'refuses Critical actions without confirmation and names them' {
+        { Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' } | Should -Throw '*Confirmation is required*ResetPassword*'
+        { Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions') } | Should -Not -Throw
+        foreach ($Name in $script:Mutators) { if ($Name -ne 'Revoke-CIPPSessions') { Should -Invoke $Name -Times 0 } }
+    }
+
+    It 'rejects an unknown action before doing anything' {
+        { Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions', 'FormatDisk') -Confirmed } | Should -Throw "*Unknown containment action 'FormatDisk'*"
+        Should -Invoke Revoke-CIPPSessions -Times 0
+    }
+
+    It 'prefers explicit parameters over the run''s flagged items' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveOAuthGrants', 'DisableTransportRules', 'BlockProtocols', 'RemoveMFA') -Confirmed -RunResults $script:Run -Parameters @{ GrantIds = @('g-ok'); TransportRuleIds = @('tr-2'); Protocols = @('IMAP'); MfaMethodIds = @('m1', 'm2') }
+        Should -Invoke Remove-CIPPUserOAuthGrant -Times 1 -ParameterFilter { $GrantIds -contains 'g-ok' -and $GrantIds -notcontains 'g-bad' -and $UserId -eq 'u1' }
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $cmdlet -eq 'Disable-TransportRule' -and $cmdParams.Identity -eq 'tr-2' }
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $cmdlet -eq 'Set-CASMailbox' -and $cmdParams.IMAPEnabled -eq $false -and $cmdParams.Keys.Count -eq 2 }
+        Should -Invoke Remove-CIPPUserMFA -Times 2
+        Should -Invoke Remove-CIPPUserMFA -Times 1 -ParameterFilter { $MethodId -eq 'm2' }
+        ($Rows | Where-Object { $_.Action -eq 'RemoveOAuthGrants' }).Target | Should -Be 'g-ok'
+    }
+
+    It 'reads parameters from a deserialised object as well as a hashtable' {
+        $Params = [pscustomobject]@{ protocols = @('OWA', 'MAPI') }
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('BlockProtocols') -Parameters $Params
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $cmdlet -eq 'Set-CASMailbox' -and $cmdParams.OWAEnabled -eq $false -and $cmdParams.MAPIEnabled -eq $false }
+    }
+
+    It 'keeps going when one action fails and reports it as an error row' {
+        Mock Revoke-CIPPSessions { throw 'Graph is down' }
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions', 'DisableOneDriveSharing', 'ClearAutoReply')
+        ($Rows | Where-Object { $_.Action -eq 'RevokeSessions' }).state | Should -Be 'error'
+        ($Rows | Where-Object { $_.Action -eq 'RevokeSessions' }).resultText | Should -Match 'Graph is down'
+        Should -Invoke Set-CIPPOneDriveSharing -Times 1
+        Should -Invoke Set-CIPPOutOfOffice -Times 1 -ParameterFilter { $State -eq 'Disabled' }
+        ($Rows | Where-Object { $_.Action -eq 'ClearAutoReply' }).state | Should -Be 'success'
+    }
+
+    It 'maps the AD-sync throw of Set-CIPPSignInState to a warning, not an error' {
+        Mock Set-CIPPSignInState { throw 'WARNING: User victim@contoso.com is AD Sync enabled. Please enable/disable in the local AD.' }
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('DisableAccount') -Confirmed
+        $Rows[0].state | Should -Be 'warning'
+        $Rows[0].resultText | Should -Match 'directory-synced'
+    }
+
+    It 'maps a partial MFA removal to a warning and a full failure to an error' {
+        Mock Remove-CIPPUserMFA { throw 'Successfully removed MFA methods (phone) for user victim@contoso.com. However, failed to remove (fido2). User may still have MFA methods assigned.' }
+        (Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveMFA'))[0].state | Should -Be 'warning'
+        Mock Remove-CIPPUserMFA { throw 'Failed to remove MFA methods (phone) for user victim@contoso.com' }
+        (Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveMFA'))[0].state | Should -Be 'error'
+    }
+
+    It 'never writes the password to the log or the stored run, but still returns it to the caller' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('ResetPassword') -Confirmed -CaseId 'BEC-1'
+        $Rows[0].copyField | Should -Be 'Hunter2!'
+        $Rows[0].resultText | Should -Match 'Hunter2!'
+        Should -Invoke Write-LogMessage -Times 0 -ParameterFilter { ($LogData | ConvertTo-Json -Depth 5) -match 'Hunter2' }
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $LogData -and ($LogData | ConvertTo-Json -Depth 5) -match '\[redacted\]' }
+        Should -Invoke Set-CIPPBecReport -Times 0 -ParameterFilter { ($Properties.Containment | ConvertTo-Json -Depth 6) -match 'Hunter2' }
+        Should -Invoke Set-CIPPBecReport -Times 1 -ParameterFilter { ($Properties.Containment | ConvertTo-Json -Depth 6) -match '\[redacted\]' -and -not ($Properties.Containment | ConvertTo-Json -Depth 6).Contains('copyField') }
+    }
+
+    It 'reports info rows instead of acting when a targeted action has nothing to target' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveOAuthGrants', 'RemoveDelegations', 'DisableTransportRules') -Confirmed -RunResults ([pscustomobject]@{ UserGrants = @(); Delegations = @(); TransportRulesFlagged = @() })
+        @($Rows | Where-Object { $_.state -eq 'info' }).Count | Should -Be 3
+        Should -Invoke Remove-CIPPUserOAuthGrant -Times 0
+        Should -Invoke Remove-CIPPMailboxDelegation -Times 0
+        Should -Invoke New-ExoRequest -Times 0
+    }
+
+    It 'resolves the user object id when a Graph action needs it and none was supplied' {
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('TargetedCAPolicy') -Parameters @{ CAPolicy = @{ State = 'reportOnly'; Controls = 'mfaAndCompliantDevice'; ExpiresHours = 4 } }
+        Should -Invoke New-GraphGetRequest -Times 1
+        Should -Invoke New-CIPPBecTargetedCAPolicy -Times 1 -ParameterFilter { $UserId -eq 'user-guid' -and $State -eq 'enabledForReportingButNotEnabled' -and $Controls -eq 'mfaAndCompliantDevice' -and $ExpiresHours -eq 4 }
+    }
+
+    It 'disables the run''s catalog-matched applications and deletes in-window devices through the platform helpers' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('DisableServicePrincipals', 'RemoveRegisteredDevices', 'DisableMailboxAddIns') -Confirmed -RunResults $script:Run
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -like '*/servicePrincipals/sp-bad' -and $type -eq 'PATCH' -and $body -match '"accountEnabled":false' }
+        Should -Invoke Set-CIPPDeviceState -Times 1 -ParameterFilter { $Action -eq 'Delete' -and $DeviceID -eq 'entra-1' }
+        Should -Invoke Set-CIPPDeviceState -Times 0 -ParameterFilter { $DeviceID -eq 'entra-old' }
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $cmdlet -eq 'Disable-App' -and $cmdParams.Identity -eq 'addin-1' -and $cmdParams.Mailbox -eq 'victim@contoso.com' }
+        @($Rows | Where-Object { $_.state -eq 'success' }).Count | Should -Be 3
+    }
+
+    It 'returns the redacted rows for automation with -Redacted' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('ResetPassword') -Confirmed -Redacted
+        $Rows[0].resultText | Should -Match '\[redacted\]'
+        $Rows[0].resultText | Should -Not -Match 'Hunter2'
+        $Rows[0].PSObject.Properties['copyField'] | Should -BeNullOrEmpty
+    }
+
+    It 'looks a mobile device up on the mailbox when the run does not know it, so removal gets the partnership Guid' {
+        Mock New-ExoRequest { @([pscustomobject]@{ DeviceId = 'dev-live'; Guid = 'guid-live'; Identity = 'victim\ExchangeActiveSyncDevices\dev-live'; DeviceModel = 'Phone' }) } -ParameterFilter { $cmdlet -eq 'Get-MobileDevice' }
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveMobileDevices') -Parameters @{ MobileDeviceIds = @('dev-live', 'dev-missing') }
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $cmdlet -eq 'Get-MobileDevice' -and $cmdParams.Mailbox -eq 'victim@contoso.com' }
+        Should -Invoke Set-CIPPMobileDevice -Times 1 -ParameterFilter { $Delete -eq 'true' -and $Guid -eq 'guid-live' -and $DeviceId -eq 'dev-live' }
+        Should -Invoke Set-CIPPMobileDevice -Times 1
+        ($Rows | Where-Object { $_.Target -eq 'dev-missing' }).state | Should -Be 'error'
+    }
+
+    It 'uses the run''s device inventory without a live lookup when it covers the picks' {
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('BlockMobileDevices') -RunResults $script:Run -Parameters @{ MobileDeviceIds = @('dev-1') }
+        Should -Invoke New-ExoRequest -Times 0 -ParameterFilter { $cmdlet -eq 'Get-MobileDevice' }
+        Should -Invoke Set-CIPPMobileDevice -Times 1 -ParameterFilter { $Quarantine -eq 'true' -and $DeviceId -eq 'dev-1' -and $Guid -eq 'guid-1' }
+    }
+
+    It 'sets and clears the case log context' {
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions') -CaseId 'BEC-9'
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { $CaseId -eq 'BEC-9' }
+        Should -Invoke Set-CippBecCaseContext -Times 1 -ParameterFilter { [string]::IsNullOrEmpty($CaseId) }
+    }
+
+    It 'blocks the distinct phishing senders from the run in one tenant Block-list call' {
+        Mock New-ExoRequest { }
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('BlockSenders') -RunResults $script:Run
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { $cmdlet -eq 'New-TenantAllowBlockListItems' -and $cmdParams.ListType -eq 'Sender' -and $cmdParams.Block -eq $true -and $cmdParams.NoExpiration -eq $true -and @($cmdParams.Entries).Count -eq 2 -and $cmdParams.Entries -contains 'ceo@contos0.com' -and $cmdParams.Entries -contains 'billing@evil.example' }
+        @($Rows | Where-Object { $_.Action -eq 'BlockSenders' -and $_.state -eq 'success' }).Count | Should -Be 2
+    }
+
+    It 'prefers explicit sender picks over the run findings when blocking senders' {
+        Mock New-ExoRequest { }
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('BlockSenders') -RunResults $script:Run -Parameters @{ BlockSenders = @('only@picked.example') }
+        Should -Invoke New-ExoRequest -Times 1 -ParameterFilter { @($cmdParams.Entries) -eq 'only@picked.example' }
+    }
+
+    It 'reports an info row and blocks nothing when the run found no phishing senders' {
+        Mock New-ExoRequest { }
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('BlockSenders') -RunResults ([pscustomobject]@{ ReceivedMailFindings = @() })
+        $Rows[0].state | Should -Be 'info'
+        Should -Invoke New-ExoRequest -Times 0
+    }
+
+    It 'reports an error row per sender when the tenant Block-list call fails' {
+        Mock New-ExoRequest { throw 'EXO unavailable' }
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('BlockSenders') -RunResults $script:Run
+        @($Rows | Where-Object { $_.Action -eq 'BlockSenders' -and $_.state -eq 'error' }).Count | Should -Be 2
+        ($Rows | Where-Object { $_.Action -eq 'BlockSenders' })[0].resultText | Should -Match 'EXO unavailable'
+    }
+
+    It 'removes the sharing links recorded in the run' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveSharingLinks') -RunResults $script:Run
+        Should -Invoke Remove-CIPPBecSharingLinks -Times 1 -ParameterFilter { @($ItemUrls).Count -eq 2 -and $ItemUrls -contains 'https://contoso-my.sharepoint.com/personal/victim/Documents/payroll.xlsx' }
+        @($Rows | Where-Object { $_.Action -eq 'RemoveSharingLinks' -and $_.state -eq 'success' }).Count | Should -Be 2
+    }
+
+    It 'prefers explicit sharing-link URLs over the run findings' {
+        $null = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveSharingLinks') -RunResults $script:Run -Parameters @{ SharingLinkUrls = @('https://contoso-my.sharepoint.com/personal/victim/Documents/only.txt') }
+        Should -Invoke Remove-CIPPBecSharingLinks -Times 1 -ParameterFilter { @($ItemUrls) -eq 'https://contoso-my.sharepoint.com/personal/victim/Documents/only.txt' }
+    }
+
+    It 'reports an info row and removes nothing when the run recorded no sharing changes' {
+        $Rows = Invoke-CIPPBecContainment -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RemoveSharingLinks') -RunResults ([pscustomobject]@{ SharingChanges = @() })
+        $Rows[0].state | Should -Be 'info'
+        Should -Invoke Remove-CIPPBecSharingLinks -Times 0
+    }
+}
diff --git a/Tests/Private/Invoke-CIPPBecIPAnalysis.Tests.ps1 b/Tests/Private/Invoke-CIPPBecIPAnalysis.Tests.ps1
new file mode 100644
index 0000000000000..8ef64d059b07c
--- /dev/null
+++ b/Tests/Private/Invoke-CIPPBecIPAnalysis.Tests.ps1
@@ -0,0 +1,81 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Get-CIPPBecIPGuidance { param($TenantFilter, $Anchor) }
+    function Get-CIPPBecSignInBaseline { param($TenantFilter, $UserId, $StartDate, $EndDate) }
+    function Get-CIPPBecIPPeers { param($TenantFilter, $UserId, $IPs, $StartDate, $WindowStart) }
+    function Get-CIPPBecColleagueSample { param($TenantFilter, $ExcludeUserId, $StartDate, $Count) }
+    function Get-CIPPBecCorrelatedUserPeers { param($TenantFilter, $UserIds, $IPs, $StartDate, $WindowStart) }
+    function Get-CIPPGeoIPLocationBatch { param([string[]]$IPs) }
+    function Get-NormalizedError { param($message) $message }
+    foreach ($File in @('Authentication/ConvertTo-CIPPIPRange.ps1', 'Authentication/Test-IpInRange.ps1', 'Authentication/Resolve-CIPPIPAllowBlockList.ps1', 'BEC/ConvertTo-CIPPBecHostAddress.ps1', 'BEC/New-CIPPBecCollectorResult.ps1', 'BEC/Get-CIPPBecIPVerdicts.ps1', 'BEC/ConvertTo-CIPPBecIPEvents.ps1', 'BEC/Invoke-CIPPBecIPAnalysis.ps1')) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$File")
+    }
+    $script:Heuristics = Get-Content (Join-Path $RepoRoot 'Config/BecHeuristics.json') -Raw | ConvertFrom-Json
+    $script:Results = [pscustomobject]@{
+        SuspectUserSignIns    = @(
+            [pscustomobject]@{ IPAddress = '203.0.113.10'; Status = 'Success'; Country = 'AU'; City = 'Sydney'; ASN = '1221'; CreatedDateTime = '2026-09-20T01:00:00Z' }
+            [pscustomobject]@{ IPAddress = '198.51.100.7'; Status = 'Success'; Country = 'NG'; City = 'Lagos'; ASN = '14061'; CreatedDateTime = '2026-09-20T02:00:00Z' }
+        )
+        NonInteractiveSignIns = @()
+        InboxRuleChanges      = @([pscustomobject]@{ ClientIP = '198.51.100.7'; RuleName = 'Hide'; Date = '2026-09-20T02:05:00Z' })
+        NewRules              = @([pscustomobject]@{ Name = 'Hide'; Suspicious = $true })
+    }
+    $script:Baseline = [pscustomobject]@{ Successful = 30; IPs = @([pscustomobject]@{ IP = '203.0.113.10'; SignIns = 30; Share = 1.0; Days = 15 }); ASNs = @([pscustomobject]@{ ASN = '1221'; Share = 1.0 }); Locations = @([pscustomobject]@{ Country = 'AU'; City = 'Sydney'; Share = 1.0 }) }
+    function Invoke-Analysis { param([hashtable]$Extra = @{}) Invoke-CIPPBecIPAnalysis -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -Results $script:Results -Heuristics $script:Heuristics -WindowStart ([datetime]'2026-09-16') -UsageLocation 'AU' @Extra }
+}
+
+Describe 'Invoke-CIPPBecIPAnalysis' {
+    BeforeEach {
+        Mock Get-CIPPBecIPGuidance { New-CIPPBecCollectorResult -Data @() }
+        Mock Get-CIPPBecSignInBaseline { New-CIPPBecCollectorResult -Data $script:Baseline -Count 30 }
+        Mock Get-CIPPGeoIPLocationBatch { @{ '198.51.100.7' = [pscustomobject]@{ CountryOrRegion = 'NG'; City = 'Lagos'; Hosting = $true; Proxy = $false; ASName = 'DIGITALOCEAN-ASN' } } }
+        Mock Get-CIPPBecIPPeers { $R = @{}; foreach ($IP in $IPs) { $R[$IP] = [pscustomobject]@{ IP = $IP; OtherUsersBefore = 0; OtherUsersInWindowOnly = 2; Users = @('x@contoso.com', 'y@contoso.com') } }; $R }
+    }
+
+    It 'looks up other accounts only for addresses that are not already settled, and judges with them' {
+        $Analysis = Invoke-Analysis
+        Should -Invoke Get-CIPPBecIPPeers -Times 1 -ParameterFilter { @($IPs) -contains '198.51.100.7' -and @($IPs) -notcontains '203.0.113.10' }
+        ($Analysis.Verdicts | Where-Object IP -EQ '198.51.100.7').Verdict | Should -Be 'LikelyAttacker'
+        @(($Analysis.Verdicts | Where-Object IP -EQ '198.51.100.7').Reasons.Code) | Should -Contain 'WiderAttack'
+        ($Analysis.Verdicts | Where-Object IP -EQ '203.0.113.10').Verdict | Should -Be 'LikelyUser'
+        $Analysis.Baseline.Complete | Should -BeTrue
+        $Analysis.PeersResult.Complete | Should -BeTrue
+    }
+
+    It 're-uses the stored baseline and peers of the case instead of fetching them again' {
+        $Known = @([pscustomobject]@{ IP = '198.51.100.7'; OtherUsersBefore = 0; OtherUsersInWindowOnly = 0; Users = @() })
+        $null = Invoke-Analysis -Extra @{ Baseline = $script:Baseline; KnownPeers = $Known }
+        Should -Invoke Get-CIPPBecSignInBaseline -Times 0
+        Should -Invoke Get-CIPPBecIPPeers -Times 0
+    }
+
+    It 'merges the evidence of correlated users into the tenant-wide peers' {
+        $Extra = @{ '198.51.100.7' = [pscustomobject]@{ IP = '198.51.100.7'; OtherUsersBefore = 3; OtherUsersInWindowOnly = 0; Users = @('colleague@contoso.com') } }
+        $Analysis = Invoke-Analysis -Extra @{ ExtraPeers = $Extra }
+        $Peer = $Analysis.Peers['198.51.100.7']
+        $Peer.OtherUsersBefore | Should -Be 3
+        $Peer.Users | Should -Contain 'colleague@contoso.com'
+        $Peer.Users | Should -Contain 'x@contoso.com'
+    }
+
+    It 'samples colleagues only when asked, and never counts the same colleague twice' {
+        Mock Get-CIPPBecColleagueSample { @('c1', 'c2') }
+        Mock Get-CIPPBecCorrelatedUserPeers { @{ '198.51.100.7' = [pscustomobject]@{ IP = '198.51.100.7'; OtherUsersBefore = 1; OtherUsersInWindowOnly = 2; Users = @('x@contoso.com') } } }
+        $null = Invoke-Analysis
+        Should -Invoke Get-CIPPBecColleagueSample -Times 0
+        $Analysis = Invoke-Analysis -Extra @{ SampleColleagues = $true }
+        Should -Invoke Get-CIPPBecCorrelatedUserPeers -Times 1 -ParameterFilter { @($UserIds) -join ',' -eq 'c1,c2' -and @($IPs) -contains '198.51.100.7' }
+        $Peer = $Analysis.Peers['198.51.100.7']
+        $Peer.OtherUsersInWindowOnly | Should -Be 2 -Because 'x@contoso.com is found by both lookups'
+        $Peer.OtherUsersBefore | Should -Be 1
+    }
+
+    It 'still judges from what it has when the baseline and peer lookups fail' {
+        Mock Get-CIPPBecSignInBaseline { throw 'Graph 429' }
+        Mock Get-CIPPBecIPPeers { throw 'Graph 503' }
+        $Analysis = Invoke-Analysis
+        $Analysis.Baseline.Error | Should -Match 'Graph 429'
+        $Analysis.PeersResult.Error | Should -Match 'Graph 503'
+        @($Analysis.Verdicts).Count | Should -Be 2
+    }
+}
diff --git a/Tests/Private/New-CIPPBecEvidencePackage.Tests.ps1 b/Tests/Private/New-CIPPBecEvidencePackage.Tests.ps1
new file mode 100644
index 0000000000000..a02043172e7c1
--- /dev/null
+++ b/Tests/Private/New-CIPPBecEvidencePackage.Tests.ps1
@@ -0,0 +1,116 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Get-CIPPBecReport { param($TenantFilter, $CaseId, $UserId, [switch]$IncludeResults) }
+    function Set-CIPPBecReport { param($TenantFilter, $CaseId, $Properties, $Results, [switch]$Replace) }
+    function Get-CIPPTable { param($TableName) }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property, $First) }
+    # Nothing in the evidence path may touch blob storage
+    function New-CIPPAzStorageRequest { throw 'blob storage must not be touched' }
+    function Write-LogMessage { param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    # The reports are rendered server-side through the report builder + kit; stub them so the unit test
+    # never loads OfficeIMO - the package's job here is collation, not the kit's PDF bytes.
+    function Get-CippReportTenantName { param($TenantFilter) }
+    function Build-CippBecReportTree { param($UserData, $BecData, $TenantName, $Variant) }
+    function ConvertTo-CippReportPdf { param($Blocks, $Variables, $TenantName, $TenantFilter, $ReportName, $Branding, $BrandingPresetId, $GeneratedOn, $PageSize, [switch]$Landscape) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecEvidencePackage.ps1')
+
+    $script:Run = [pscustomobject]@{
+        CaseId = 'BEC-20260820120000-ev0001'; Status = 'Completed'; UserPrincipalName = 'victim@contoso.com'; UserId = 'u1'; ExtractedAt = '2026-08-20T12:05:00Z'; RequestedAt = '2026-08-20T12:00:00Z'; Score = 12; Level = 'High'
+        Containment = @([pscustomobject]@{ At = '2026-08-20T13:00:00Z'; By = 'tech'; Actions = @('ResetPassword'); Results = @([pscustomobject]@{ Action = 'ResetPassword'; state = 'success'; resultText = 'The new password is [redacted]' }) })
+        Results = [pscustomobject]@{
+            CaseId = 'BEC-20260820120000-ev0001'
+            NewRules = @([pscustomobject]@{ Name = 'Hide'; RiskReasons = @('Forwards or redirects messages', 'Deletes messages'); Nested = [pscustomobject]@{ a = 1 } })
+            Delegations = @([pscustomobject]@{ PermissionType = 'FullAccess'; Trustee = 'x@example.org'; Flagged = $true })
+            SentMessages = @()
+            RiskState = [pscustomobject]@{ Listed = $true; Detections = @([pscustomobject]@{ RiskEventType = 'unfamiliarFeatures' }) }
+            Score = [pscustomobject]@{ Value = 12; Level = 'High' }
+        }
+    }
+    $script:FakePdf = [System.Text.Encoding]::ASCII.GetBytes('%PDF-1.4 fake')
+
+    function Read-Zip {
+        param([byte[]]$Bytes)
+        $Stream = [System.IO.MemoryStream]::new($Bytes)
+        $Archive = [System.IO.Compression.ZipArchive]::new($Stream, [System.IO.Compression.ZipArchiveMode]::Read)
+        $Entries = @{}
+        foreach ($Entry in $Archive.Entries) {
+            $EntryStream = $Entry.Open()
+            $Ms = [System.IO.MemoryStream]::new()
+            $EntryStream.CopyTo($Ms)
+            $Entries[$Entry.FullName] = $Ms.ToArray()
+            $EntryStream.Dispose(); $Ms.Dispose()
+        }
+        $Archive.Dispose(); $Stream.Dispose()
+        $Entries
+    }
+}
+
+Describe 'New-CIPPBecEvidencePackage' {
+    BeforeEach {
+        Mock Get-CIPPBecReport { $script:Run }
+        Mock Set-CIPPBecReport { }
+        Mock Get-CIPPTable { @{ Context = @{ TableName = $TableName } } }
+        Mock Get-CIPPAzDataTableEntity {
+            @(
+                [pscustomobject]@{ Timestamp = '2026-08-20T12:01:00Z'; Tenant = 'contoso.com'; API = 'BECRun'; Severity = 'Info'; Username = 'tech'; Message = 'BEC Check run'; LogData = ''; RowKey = 'l1' }
+                [pscustomobject]@{ Timestamp = '2026-08-20T13:00:00Z'; Tenant = 'contoso.com'; API = 'BECRemediate'; Severity = 'Info'; Username = 'tech'; Message = 'Executed containment'; LogData = '[{"Action":"ResetPassword","copyField":"Hunter2!","resultText":"x"}]'; RowKey = 'l2' }
+            )
+        }
+        Mock Write-LogMessage { }
+        Mock Get-CippReportTenantName { 'Contoso' }
+        Mock Build-CippBecReportTree { @{ Blocks = @(@{ type = 'blank' }); Variables = @{ coverlabel = 'Security Incident Report' } } }
+        Mock ConvertTo-CippReportPdf { $script:FakePdf }
+    }
+
+    It 'builds a ZIP with the results, per-finding CSVs, score, containment, logbook and both server-rendered PDFs, and stores nothing' {
+        $Package = New-CIPPBecEvidencePackage -TenantFilter 'contoso.com' -CaseId 'BEC-20260820120000-ev0001'
+        $Package.Bytes | Should -BeGreaterThan 0
+        $Entries = Read-Zip -Bytes $Package.ZipBytes
+        $Entries.Keys | Should -Contain 'results.json'
+        $Entries.Keys | Should -Contain 'findings/NewRules.csv'
+        $Entries.Keys | Should -Contain 'findings/Delegations.csv'
+        $Entries.Keys | Should -Contain 'findings/RiskDetections.csv'
+        $Entries.Keys | Should -Not -Contain 'findings/SentMessages.csv' -Because 'empty sections are skipped'
+        $Entries.Keys | Should -Contain 'score.json'
+        $Entries.Keys | Should -Contain 'containment.json'
+        $Entries.Keys | Should -Contain 'logbook.json'
+        $Entries.Keys | Should -Contain 'report-full.pdf'
+        $Entries.Keys | Should -Contain 'report-summary.pdf'
+        $Entries.Count | Should -Be $Package.FileCount
+        # rendered server-side: the full report and the summary variant, no browser round-trip
+        Should -Invoke ConvertTo-CippReportPdf -Times 2
+        Should -Invoke Build-CippBecReportTree -Times 1 -ParameterFilter { $Variant -eq 'summary' }
+        Should -Invoke Set-CIPPBecReport -Times 0 -Because 'an export leaves no record on the run'
+    }
+
+    It 'flattens arrays and nested objects into CSV cells' {
+        $Package = New-CIPPBecEvidencePackage -TenantFilter 'contoso.com' -CaseId 'BEC-20260820120000-ev0001'
+        $Entries = Read-Zip -Bytes $Package.ZipBytes
+        $Csv = [System.Text.Encoding]::UTF8.GetString($Entries['findings/NewRules.csv'])
+        $Csv | Should -Match 'Forwards or redirects messages; Deletes messages'
+        $Csv | Should -Match '\{""a"":1\}'
+    }
+
+    It 'still ships the rest of the package when the PDF render fails' {
+        Mock ConvertTo-CippReportPdf { throw 'render boom' }
+        $Package = New-CIPPBecEvidencePackage -TenantFilter 'contoso.com' -CaseId 'BEC-20260820120000-ev0001'
+        $Entries = Read-Zip -Bytes $Package.ZipBytes
+        $Entries.Keys | Should -Contain 'results.json'
+        $Entries.Keys | Should -Not -Contain 'report-full.pdf'
+        $Entries.Keys | Should -Not -Contain 'report-summary.pdf'
+    }
+
+    It 'scrubs any password copy field from the logbook copy and queries the case id across day partitions' {
+        $Package = New-CIPPBecEvidencePackage -TenantFilter 'contoso.com' -CaseId 'BEC-20260820120000-ev0001'
+        $Entries = Read-Zip -Bytes $Package.ZipBytes
+        $Log = [System.Text.Encoding]::UTF8.GetString($Entries['logbook.json'])
+        $Log | Should -Not -Match 'Hunter2'
+        $Log | Should -Match '\[redacted\]'
+        Should -Invoke Get-CIPPAzDataTableEntity -Times 1 -ParameterFilter { $Filter -like "BecCaseId eq 'BEC-20260820120000-ev0001'*" -and $Filter -like "*PartitionKey ge '20260819'*" }
+    }
+
+    It 'refuses an incomplete run' {
+        Mock Get-CIPPBecReport { [pscustomobject]@{ Status = 'Waiting' } }
+        { New-CIPPBecEvidencePackage -TenantFilter 'contoso.com' -CaseId 'BEC-x' } | Should -Throw '*only completed runs*'
+    }
+}
diff --git a/Tests/Private/New-CIPPBecTargetedCAPolicy.Tests.ps1 b/Tests/Private/New-CIPPBecTargetedCAPolicy.Tests.ps1
new file mode 100644
index 0000000000000..9259c59be1524
--- /dev/null
+++ b/Tests/Private/New-CIPPBecTargetedCAPolicy.Tests.ps1
@@ -0,0 +1,91 @@
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '', Justification = 'Stubs exist only so Pester can mock them.')]
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification = 'Stubs exist only so Pester can mock them.')]
+param()
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination) }
+    function New-GraphPOSTRequest { param($uri, $tenantid, $type, $body, $AsApp) }
+    function Add-CIPPScheduledTask { param($Task, $Hidden, $Headers) }
+    function Write-LogMessage { param($message, $tenant, $API, $headers, $Sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/New-CIPPBecTargetedCAPolicy.ps1')
+
+    $script:Common = @{ TenantFilter = 'contoso.com'; UserId = 'u1'; UserPrincipalName = 'victim@contoso.com'; CaseId = 'BEC-1'; Headers = @{ 'x-ms-client-principal' = 'p' } }
+    $script:PoliciesUri = 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies'
+}
+
+Describe 'New-CIPPBecTargetedCAPolicy' {
+    BeforeEach {
+        Mock New-GraphGetRequest { @() }
+        Mock New-GraphPOSTRequest { [pscustomobject]@{ id = 'pol-1' } }
+        Mock Add-CIPPScheduledTask { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'creates an enabled policy that targets only the user, every application and client, and requires MFA' {
+        $Message = New-CIPPBecTargetedCAPolicy @script:Common
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter { $uri -eq $script:PoliciesUri -and $tenantid -eq 'contoso.com' -and $type -eq 'POST' -and $AsApp -eq $true }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $Policy = $body | ConvertFrom-Json; (@($Policy.conditions.users.PSObject.Properties.Name) -join ',') -eq 'includeUsers' -and (@($Policy.conditions.users.includeUsers) -join ',') -eq 'u1' } -Because 'the users condition must name the one user and nothing else'
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $Policy = $body | ConvertFrom-Json; (@($Policy.conditions.applications.includeApplications) -join ',') -eq 'All' -and (@($Policy.conditions.clientAppTypes) -join ',') -eq 'all' }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $Policy = $body | ConvertFrom-Json; $Policy.state -eq 'enabled' -and (@($Policy.grantControls.builtInControls) -join ',') -eq 'mfa' -and $Policy.grantControls.operator -eq 'OR' }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $Policy = $body | ConvertFrom-Json; $Policy.displayName -like 'CIPP BEC containment - victim@contoso.com - expires ????-??-?? ??:??Z' -and $Policy.description -like 'ManagedBy=CIPP-BEC;Target=u1;CaseId=BEC-1;ExpiresUtc=*' }
+        $Message | Should -Match "^Created Conditional Access policy 'CIPP BEC containment - victim@contoso\.com - expires .+Z' \(enabled, mfa\) for victim@contoso\.com; removal scheduled for \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}Z$"
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Info' -and $message -like 'Created Conditional Access policy*' -and $tenant -eq 'contoso.com' -and $API -eq 'BECRemediate' }
+    }
+
+    It 'maps mfaAndCompliantDevice to both controls ANDed and passes the report-only state through' {
+        $Message = New-CIPPBecTargetedCAPolicy @script:Common -State 'enabledForReportingButNotEnabled' -Controls 'mfaAndCompliantDevice'
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter { $Policy = $body | ConvertFrom-Json; $Policy.state -eq 'enabledForReportingButNotEnabled' -and (@($Policy.grantControls.builtInControls) -join ',') -eq 'mfa,compliantDevice' -and $Policy.grantControls.operator -eq 'AND' }
+        $Message | Should -Match '\(enabledForReportingButNotEnabled, mfa \+ compliantDevice\)'
+    }
+
+    It 'schedules Remove-CIPPBecTargetedCAPolicy for the new policy at the expiry, referenced to the case' {
+        $script:Expected = [DateTimeOffset]::UtcNow.AddHours(4).ToUnixTimeSeconds()
+        $Message = New-CIPPBecTargetedCAPolicy @script:Common -ExpiresHours 4
+        Should -Invoke Add-CIPPScheduledTask -Times 1 -Exactly -ParameterFilter { $Task.Command.value -eq 'Remove-CIPPBecTargetedCAPolicy' -and $Task.Parameters.PolicyId -eq 'pol-1' -and $Task.Parameters.TenantFilter -eq 'contoso.com' -and $Task.TenantFilter -eq 'contoso.com' -and $Task.Reference -eq 'BEC-1' -and $Task.Name -like '*victim@contoso.com*' -and $Hidden -eq $false }
+        Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter { [math]::Abs([int64]$Task.ScheduledTime - $script:Expected) -le 120 } -Because 'ScheduledTime is the expiry as unix seconds'
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $Policy = $body | ConvertFrom-Json; [math]::Abs(([DateTimeOffset]($Policy.description -split 'ExpiresUtc=')[1]).ToUnixTimeSeconds() - $script:Expected) -le 120 } -Because 'the description carries the same expiry'
+        $Message | Should -Match '; removal scheduled for \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}Z$'
+    }
+
+    It 'still reports the created policy, with a WARNING to remove it by hand, when the removal cannot be scheduled' {
+        Mock Add-CIPPScheduledTask { throw 'scheduler down' }
+        $Message = New-CIPPBecTargetedCAPolicy @script:Common
+        $Message | Should -Match "^Created Conditional Access policy .+; WARNING: could not schedule its removal \(scheduler down\) - remove it manually after \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}Z$"
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Warning' -and $message -eq 'Could not schedule removal of CA policy pol-1: scheduler down' }
+        Should -Invoke Write-LogMessage -Times 0 -ParameterFilter { $Sev -eq 'Error' }
+    }
+
+    It 'throws with the normalized Graph error, logs it and schedules nothing when the policy cannot be created' {
+        Mock New-GraphPOSTRequest { throw 'Insufficient privileges to complete the operation.' }
+        { New-CIPPBecTargetedCAPolicy @script:Common } | Should -Throw 'Failed to create the targeted Conditional Access policy for victim@contoso.com: Insufficient privileges to complete the operation.'
+        Should -Invoke Add-CIPPScheduledTask -Times 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Error' -and $message -like 'Failed to create the targeted Conditional Access policy for victim@contoso.com:*' -and $LogData.NormalizedError -like 'Insufficient privileges*' }
+    }
+
+    It 'reuses an existing containment policy for the same user, but not one that belongs to another user' {
+        Mock New-GraphGetRequest { @([pscustomobject]@{ id = 'pol-old'; displayName = 'CIPP BEC containment - victim@contoso.com - expires 2026-09-07 10:00Z'; description = 'ManagedBy=CIPP-BEC;Target=u1;CaseId=BEC-0;ExpiresUtc=2026-09-07T10:00:00.0000000Z'; state = 'enabled' }, [pscustomobject]@{ id = 'pol-admins'; displayName = 'Require MFA for admins'; description = $null; state = 'enabled' }) }
+        $Message = New-CIPPBecTargetedCAPolicy @script:Common
+        $Message | Should -Be "A CIPP BEC containment policy already exists for victim@contoso.com ('CIPP BEC containment - victim@contoso.com - expires 2026-09-07 10:00Z', enabled); not creating another."
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like "$script:PoliciesUri?*" -and $tenantid -eq 'contoso.com' -and $AsApp -eq $true }
+        Should -Invoke New-GraphPOSTRequest -Times 0
+        Should -Invoke Add-CIPPScheduledTask -Times 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Info' -and $message -like '*already exists*' }
+
+        Mock New-GraphGetRequest { @([pscustomobject]@{ id = 'pol-u2'; displayName = 'CIPP BEC containment - other@contoso.com - expires 2026-09-07 10:00Z'; description = 'ManagedBy=CIPP-BEC;Target=u2;CaseId=BEC-0;ExpiresUtc=2026-09-07T10:00:00.0000000Z'; state = 'enabled' }) }
+        $null = New-CIPPBecTargetedCAPolicy @script:Common
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -Because 'another user''s containment policy is not a reason to skip this one'
+    }
+
+    It 'creates nothing under -WhatIf and rejects an out-of-range lifetime or unknown control before touching Graph' {
+        $null = New-CIPPBecTargetedCAPolicy @script:Common -WhatIf
+        Should -Invoke New-GraphPOSTRequest -Times 0
+        Should -Invoke Add-CIPPScheduledTask -Times 0
+        { New-CIPPBecTargetedCAPolicy @script:Common -ExpiresHours 0 } | Should -Throw
+        { New-CIPPBecTargetedCAPolicy @script:Common -ExpiresHours 169 } | Should -Throw
+        { New-CIPPBecTargetedCAPolicy @script:Common -Controls 'passwordless' } | Should -Throw
+        Should -Invoke New-GraphGetRequest -Times 1 -Exactly -Because 'only the -WhatIf run got past parameter binding'
+    }
+}
diff --git a/Tests/Private/New-CIPPIntuneAppDeployment.Assignments.Tests.ps1 b/Tests/Private/New-CIPPIntuneAppDeployment.Assignments.Tests.ps1
new file mode 100644
index 0000000000000..d18aa8c8dd541
--- /dev/null
+++ b/Tests/Private/New-CIPPIntuneAppDeployment.Assignments.Tests.ps1
@@ -0,0 +1,105 @@
+# Pester tests for how New-CIPPIntuneAppDeployment forwards group targets to
+# Set-CIPPAssignedApplication.
+#
+# The Application Deployment drawer queues assignTo/excludeGroup as display names. When a single
+# tenant is selected it picks groups by id instead and queues GroupIds/ExcludeGroupIds alongside
+# the names; those ids must reach Set-CIPPAssignedApplication, which prefers them over name
+# resolution. Callers that queue names only (templates, standards, baselines) must see no new
+# parameters at all, so their name-based resolution is untouched.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    # Stubs mirror the real signatures so signature drift fails loudly here.
+    function New-GraphGetRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp, $ComplexFilter) }
+    function New-GraphPostRequest { [CmdletBinding()] param($uri, $tenantid, $type, $body, $AddedHeaders) }
+    function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $Sev2, $LogData) }
+    function Get-CIPPTextReplacement { [CmdletBinding()] param([string]$TenantFilter, $Text, [switch]$EscapeForJson) }
+    function Get-CIPPMSPAppInstallCommand { [CmdletBinding()] param($RmmName, $Params, $Tenant, $PackageName) }
+    function Add-CIPPWinGetApp { [CmdletBinding()] param($AppBody, $TenantFilter) }
+    function Add-CIPPPackagedApplication { [CmdletBinding()] param($TenantFilter, $Intunexml, $Infile, $EncryptionInfo, $DisplayName, $IntuneBody) }
+    function Add-CIPPW32ScriptApplication { [CmdletBinding()] param($TenantFilter, $Properties) }
+    function Get-CIPPOfficeAppBody { [CmdletBinding()] param($Config) }
+    function Get-CIPPEdgeAppBody { [CmdletBinding()] param($Config) }
+    function Set-CIPPAssignedApplication { [CmdletBinding()] param($GroupName, $ExcludeGroup, $ExcludeGroupIds, $ExcludeGroupNames, $Intent, $AppType, $ApplicationId, $TenantFilter, $GroupIds, $AssignmentMode, $AssignmentDirection, $APIName, $Headers, $AssignmentFilterName, $AssignmentFilterType) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+
+    # A queued Store (WinGet) app: IntuneBody is pre-built by Invoke-AddStoreApp, so the function
+    # only has to create it and assign it.
+    function New-QueuedStoreApp {
+        param([hashtable]$Extra = @{})
+        $Config = [ordered]@{
+            tenant          = $script:Tenant
+            Applicationname = 'Contoso Viewer'
+            assignTo        = 'Sales, Marketing'
+            excludeGroup    = 'Interns'
+            type            = 'WinGet'
+            IntuneBody      = [pscustomobject]@{ '@odata.type' = '#microsoft.graph.winGetApp'; displayName = 'Contoso Viewer' }
+        }
+        foreach ($Key in $Extra.Keys) { $Config[$Key] = $Extra[$Key] }
+        # Round-trip through JSON the way the apps table does, so arrays arrive as they would at run time.
+        return ([pscustomobject]$Config | ConvertTo-Json -Depth 15 | ConvertFrom-Json)
+    }
+}
+
+Describe 'New-CIPPIntuneAppDeployment group id forwarding' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        # No app with this name exists yet, so the create path is taken.
+        Mock -CommandName New-GraphGetRequest -MockWith { @() }
+        Mock -CommandName Add-CIPPWinGetApp -MockWith { [pscustomobject]@{ Id = 'app-0001' } }
+        Mock -CommandName Set-CIPPAssignedApplication -MockWith { }
+    }
+
+    Context 'a queue entry from the single-tenant picker (ids next to the names)' {
+        It 'passes GroupIds and ExcludeGroupIds through, keeping the names as GroupName/ExcludeGroup' {
+            $AppConfig = New-QueuedStoreApp -Extra @{
+                GroupIds        = @('11111111-1111-1111-1111-111111111111', '22222222-2222-2222-2222-222222222222')
+                ExcludeGroupIds = @('33333333-3333-3333-3333-333333333333')
+            }
+
+            $null = New-CIPPIntuneAppDeployment -AppConfig $AppConfig -TenantFilter $script:Tenant
+
+            Should -Invoke Set-CIPPAssignedApplication -Times 1 -Exactly -ParameterFilter {
+                $ApplicationId -eq 'app-0001' -and
+                $GroupName -eq 'Sales, Marketing' -and
+                $ExcludeGroup -eq 'Interns' -and
+                @($GroupIds).Count -eq 2 -and
+                $GroupIds[0] -eq '11111111-1111-1111-1111-111111111111' -and
+                @($ExcludeGroupIds).Count -eq 1 -and
+                $ExcludeGroupIds[0] -eq '33333333-3333-3333-3333-333333333333'
+            }
+        }
+    }
+
+    Context 'a queue entry with names only (multi-tenant deploy, templates, standards)' {
+        It 'does not bind GroupIds or ExcludeGroupIds at all, so name resolution is untouched' {
+            $AppConfig = New-QueuedStoreApp
+
+            $null = New-CIPPIntuneAppDeployment -AppConfig $AppConfig -TenantFilter $script:Tenant
+
+            Should -Invoke Set-CIPPAssignedApplication -Times 1 -Exactly -ParameterFilter {
+                $GroupName -eq 'Sales, Marketing' -and
+                $ExcludeGroup -eq 'Interns' -and
+                $null -eq $GroupIds -and
+                $null -eq $ExcludeGroupIds
+            }
+        }
+    }
+
+    Context 'a queue entry with empty id arrays (picker shown but nothing picked)' {
+        It 'treats empty arrays as absent' {
+            $AppConfig = New-QueuedStoreApp -Extra @{ GroupIds = @(); ExcludeGroupIds = @() }
+
+            $null = New-CIPPIntuneAppDeployment -AppConfig $AppConfig -TenantFilter $script:Tenant
+
+            Should -Invoke Set-CIPPAssignedApplication -Times 1 -Exactly -ParameterFilter {
+                $null -eq $GroupIds -and
+                $null -eq $ExcludeGroupIds
+            }
+        }
+    }
+}
diff --git a/Tests/Private/New-CIPPMcpResourceApp.Tests.ps1 b/Tests/Private/New-CIPPMcpResourceApp.Tests.ps1
new file mode 100644
index 0000000000000..2c96d96b76cc5
--- /dev/null
+++ b/Tests/Private/New-CIPPMcpResourceApp.Tests.ps1
@@ -0,0 +1,110 @@
+# Pester tests for New-CIPPMcpResourceApp - the dedicated, CIPP-managed CIPP-MCP resource app that is
+# the MCP token audience (holds the host identifier URIs + user_impersonation; never an OAuth client).
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Authentication/New-CIPPMcpResourceApp.ps1')
+
+    function New-GraphGetRequest { param($uri, $NoAuthCheck, $AsApp, [switch]$ComplexFilter) }
+    function New-GraphPOSTRequest { param($uri, $body, $type, $NoAuthCheck, $asapp) }
+    function Get-CippTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Filter) }
+    function Add-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
+    function Remove-CIPPAzDataTableEntity { param($Entity, [switch]$Force) }
+    function Write-LogMessage { param($headers, $API, $message, $Sev) }
+}
+
+Describe 'New-CIPPMcpResourceApp' {
+    BeforeEach {
+        $script:OriginalHostname = $env:WEBSITE_HOSTNAME
+        $env:WEBSITE_HOSTNAME = 'cipp-backend.azurewebsites.net'
+
+        Mock -CommandName Get-CippTable -MockWith { @{} }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName Write-LogMessage -MockWith { }
+
+        # Discovery (by the instance-unique host identifier URI) finds nothing; SP exists; default null.
+        Mock -CommandName New-GraphGetRequest -MockWith { $null }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*identifierUris/any*' } -MockWith { @() }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*servicePrincipals*' } -MockWith { [PSCustomObject]@{ id = 'sp-id' } }
+
+        # Create returns the new app already carrying the user_impersonation scope + v2.
+        Mock -CommandName New-GraphPOSTRequest -MockWith { }
+        Mock -CommandName New-GraphPOSTRequest -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/applications' -and $type -eq 'POST' } -MockWith {
+            [PSCustomObject]@{
+                id             = 'res-obj'
+                appId          = 'res-app'
+                identifierUris = @()
+                api            = [PSCustomObject]@{ requestedAccessTokenVersion = 2; oauth2PermissionScopes = @([PSCustomObject]@{ value = 'user_impersonation'; id = 'uimp-id' }) }
+            }
+        }
+    }
+
+    AfterEach {
+        $env:WEBSITE_HOSTNAME = $script:OriginalHostname
+    }
+
+    It 'creates the resource app, adds host identifier URIs, stores it, and returns the scope id' {
+        $Result = New-CIPPMcpResourceApp -Headers @{}
+
+        $Result.AppId | Should -Be 'res-app'
+        $Result.ScopeId | Should -Be 'uimp-id'
+
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+            $uri -eq 'https://graph.microsoft.com/v1.0/applications' -and $type -eq 'POST'
+        }
+        # A follow-up PATCH adds api://<appId> + the two host identifier URIs.
+        Should -Invoke -CommandName New-GraphPOSTRequest -ParameterFilter {
+            $type -eq 'PATCH' -and
+            (@(($body | ConvertFrom-Json).identifierUris) -contains 'https://cipp-backend.azurewebsites.net/api/ExecMcp')
+        }
+        Should -Invoke -CommandName Add-CIPPAzDataTableEntity -Times 1 -Exactly
+    }
+
+    It 'throws when WEBSITE_HOSTNAME is not set' {
+        $env:WEBSITE_HOSTNAME = ''
+        { New-CIPPMcpResourceApp -Headers @{} } | Should -Throw
+    }
+
+    It 'warns and throws without creating when a FOREIGN app holds the host URI' {
+        # Discovery (name + URI) finds nothing; the conflict check finds a holder that is NOT a
+        # CIPP-managed API client (Get-CIPPAzDataTableEntity returns nothing for it). Warn + throw.
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*displayName eq*' } -MockWith { @() }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*identifierUris/any*' -and $uri -notlike '*displayName eq*' } -MockWith {
+            @([PSCustomObject]@{ id = 'foreign-obj'; appId = 'foreign-app'; displayName = 'Some Other App' })
+        }
+
+        { New-CIPPMcpResourceApp -Headers @{} } | Should -Throw
+
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 0 -Exactly -ParameterFilter {
+            $uri -eq 'https://graph.microsoft.com/v1.0/applications' -and $type -eq 'POST'
+        }
+        Should -Invoke -CommandName Write-LogMessage -ParameterFilter { $Sev -eq 'Warning' }
+    }
+
+    It 'self-heals by freeing the host URI from an OWNED API client, then creates the resource app' {
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*displayName eq*' } -MockWith { @() }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*identifierUris/any*' -and $uri -notlike '*displayName eq*' } -MockWith {
+            @([PSCustomObject]@{ id = 'old-obj'; appId = 'old-client'; displayName = 'MCP-NG3.0' })
+        }
+        # The holder is a CIPP-managed API client.
+        Mock -CommandName Get-CIPPAzDataTableEntity -ParameterFilter { $Filter -like "*old-client*" } -MockWith { [PSCustomObject]@{ RowKey = 'old-client' } }
+        # The holder app read (for stripping its host URIs).
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like "*appId='old-client'*" } -MockWith {
+            [PSCustomObject]@{ id = 'old-obj'; identifierUris = @('api://old-client', 'https://cipp-backend.azurewebsites.net', 'https://cipp-backend.azurewebsites.net/api/ExecMcp') }
+        }
+
+        { New-CIPPMcpResourceApp -Headers @{} } | Should -Not -Throw
+
+        # Freed the host URIs from the owned client (PATCH on old-obj that no longer includes them).
+        Should -Invoke -CommandName New-GraphPOSTRequest -ParameterFilter {
+            $type -eq 'PATCH' -and $uri -like '*applications/old-obj*' -and
+            (@(($body | ConvertFrom-Json).identifierUris) -notcontains 'https://cipp-backend.azurewebsites.net/api/ExecMcp')
+        }
+        # Then created the dedicated resource app.
+        Should -Invoke -CommandName New-GraphPOSTRequest -ParameterFilter {
+            $uri -eq 'https://graph.microsoft.com/v1.0/applications' -and $type -eq 'POST'
+        }
+    }
+}
diff --git a/Tests/Private/New-CIPPRestoreTask.Tests.ps1 b/Tests/Private/New-CIPPRestoreTask.Tests.ps1
new file mode 100644
index 0000000000000..9be12a2487642
--- /dev/null
+++ b/Tests/Private/New-CIPPRestoreTask.Tests.ps1
@@ -0,0 +1,179 @@
+# Pester tests for the 'teamsvoice' branch of New-CIPPRestoreTask.
+#
+# The branch re-assigns backed-up Teams phone numbers through the Graph teamsAdministration
+# actions. What matters is the decision per number: skip when already in place, assign when
+# free, and only move a number away from another holder when overwrite is on, waiting for the
+# async unassign to land first. These tests pin that decision table and the request bodies.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'New-CIPPRestoreTask.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate New-CIPPRestoreTask.ps1 under Modules/' }
+
+    function Get-CIPPBackup { param($Type, $Name) }
+    function New-GraphGetRequest { param($uri, $tenantid) }
+    function New-GraphPOSTRequest { param($uri, $tenantid, $body, $type) }
+    function Write-LogMessage { param($Headers, $API, $tenant, $message, $Sev, $LogData) }
+    function Get-CippException { param($Exception) @{ NormalizedError = "$Exception" } }
+    function Get-NormalizedError { param($Message) $Message }
+
+    # Real helper: the number type must reach Graph in camelCase.
+    $NumberTypePath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Get-CippTeamsNumberType.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $NumberTypePath) { throw 'Could not locate Get-CippTeamsNumberType.ps1 under Modules/' }
+    . $NumberTypePath
+
+    . $FunctionPath
+
+    $script:BaseUri = 'https://graph.microsoft.com/v1.0/admin/teams/telephoneNumberManagement/numberAssignments'
+    $script:UserA = '11111111-1111-1111-1111-111111111111'
+    $script:UserB = '22222222-2222-2222-2222-222222222222'
+
+    function New-BackedUpNumber {
+        [pscustomobject]@{
+            telephoneNumber    = '+4512345678'
+            assignmentTargetId = $script:UserA
+            assignmentStatus   = 'userAssigned'
+            assignmentCategory = 'primary'
+            numberType         = 'directRouting'
+            locationId         = 'loc-1'
+        }
+    }
+
+    function New-LiveNumber {
+        param($TargetId, $Status, $LocationId, $Category)
+        [pscustomobject]@{
+            telephoneNumber    = '+4512345678'
+            assignmentTargetId = $TargetId
+            assignmentStatus   = $Status
+            numberType         = 'directRouting'
+            locationId         = $LocationId
+            assignmentCategory = $Category
+        }
+    }
+
+    function Invoke-Restore {
+        param($Live, [bool]$Overwrite = $false)
+        Mock Get-CIPPBackup { [pscustomobject]@{ teamsvoice = @(New-BackedUpNumber) } }
+        Mock New-GraphGetRequest { $Live }
+        Mock New-GraphPOSTRequest { }
+        Mock Write-LogMessage { }
+        Mock Start-Sleep { }
+        New-CIPPRestoreTask -Task 'teamsvoice' -TenantFilter 'contoso.onmicrosoft.com' -backup 'contoso_2026-09-16-0100' -overwrite $Overwrite -APINAME 'Restore' -Headers @{}
+    }
+}
+
+Describe 'New-CIPPRestoreTask teamsvoice' {
+    It 'assigns a number that is currently unassigned, with the backed-up attributes' {
+        $Result = Invoke-Restore -Live (New-LiveNumber -TargetId $null -Status 'unassigned')
+
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+            $uri -eq "$script:BaseUri/assignNumber" -and
+            ($body | ConvertFrom-Json).telephoneNumber -eq '+4512345678' -and
+            ($body | ConvertFrom-Json).assignmentTargetId -eq $script:UserA -and
+            ($body | ConvertFrom-Json).numberType -eq 'directRouting' -and
+            ($body | ConvertFrom-Json).assignmentCategory -eq 'primary' -and
+            ($body | ConvertFrom-Json).locationId -eq 'loc-1'
+        }
+        $Result | Should -Contain 'Restored: 1 TeamsPhoneNumber from backup'
+    }
+
+    It 'skips a number already assigned to the backed-up target' {
+        $Result = Invoke-Restore -Live (New-LiveNumber -TargetId $script:UserA -Status 'userAssigned')
+
+        Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly
+        $Result | Should -Contain "Teams phone number +4512345678 is already assigned to $script:UserA"
+        $Result | Should -Contain 'No items were restored from backup.'
+    }
+
+    It 'leaves a number held by someone else alone when overwrite is off' {
+        $Result = Invoke-Restore -Live (New-LiveNumber -TargetId $script:UserB -Status 'userAssigned')
+
+        Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly
+        $Result | Should -Contain "Teams phone number +4512345678 is assigned to $script:UserB and overwrite is disabled"
+    }
+
+    It 'unassigns, waits for the unassign to land, then assigns when overwrite is on' {
+        # First GET is the live snapshot (held by B); the poll after unassign sees it free.
+        $script:GetCalls = 0
+        Mock Get-CIPPBackup { [pscustomobject]@{ teamsvoice = @(New-BackedUpNumber) } }
+        Mock New-GraphGetRequest {
+            $script:GetCalls++
+            if ($script:GetCalls -eq 1) { New-LiveNumber -TargetId $script:UserB -Status 'userAssigned' } else { New-LiveNumber -TargetId $null -Status 'unassigned' }
+        }
+        Mock New-GraphPOSTRequest { }
+        Mock Write-LogMessage { }
+        Mock Start-Sleep { }
+
+        $Result = New-CIPPRestoreTask -Task 'teamsvoice' -TenantFilter 'contoso.onmicrosoft.com' -backup 'contoso_2026-09-16-0100' -overwrite $true -APINAME 'Restore' -Headers @{}
+
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+            $uri -eq "$script:BaseUri/unassignNumber" -and ($body | ConvertFrom-Json).numberType -eq 'directRouting'
+        }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter { $uri -eq "$script:BaseUri/assignNumber" }
+        Should -Invoke Start-Sleep -Times 1 -Exactly
+        $Result | Should -Contain 'Restored: 1 TeamsPhoneNumber from backup'
+    }
+
+    It 'reports the failure and keeps going when the unassign never lands' {
+        Mock Get-CIPPBackup { [pscustomobject]@{ teamsvoice = @(New-BackedUpNumber) } }
+        Mock New-GraphGetRequest { New-LiveNumber -TargetId $script:UserB -Status 'userAssigned' }
+        Mock New-GraphPOSTRequest { }
+        Mock Write-LogMessage { }
+        Mock Start-Sleep { }
+
+        $Result = New-CIPPRestoreTask -Task 'teamsvoice' -TenantFilter 'contoso.onmicrosoft.com' -backup 'contoso_2026-09-16-0100' -overwrite $true -APINAME 'Restore' -Headers @{}
+
+        Should -Invoke Start-Sleep -Times 10 -Exactly
+        Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly -ParameterFilter { $uri -eq "$script:BaseUri/assignNumber" }
+        ($Result | Where-Object { $_ -like 'Could not restore Teams phone number +4512345678 : Unassignment*' }).Count | Should -Be 1
+    }
+
+    It 'updates the emergency location when the holder matches but the location changed and overwrite is on' {
+        $Result = Invoke-Restore -Live (New-LiveNumber -TargetId $script:UserA -Status 'userAssigned' -LocationId 'loc-old') -Overwrite $true
+
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+            $uri -eq "$script:BaseUri/updateNumber" -and
+            ($body | ConvertFrom-Json).telephoneNumber -eq '+4512345678' -and
+            ($body | ConvertFrom-Json).locationId -eq 'loc-1'
+        }
+        $Result | Should -Contain 'Restored: 1 TeamsPhoneNumber from backup'
+    }
+
+    It 'leaves a matching holder with a changed location alone when overwrite is off' {
+        $Result = Invoke-Restore -Live (New-LiveNumber -TargetId $script:UserA -Status 'userAssigned' -LocationId 'loc-old')
+
+        Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly
+        $Result | Should -Contain "Teams phone number +4512345678 is already assigned to $script:UserA"
+    }
+
+    It 'reassigns through unassign + assign when the holder matches but the category changed and overwrite is on' {
+        # updateNumber cannot change assignmentCategory, so this has to take the move path.
+        $script:GetCalls = 0
+        Mock Get-CIPPBackup { [pscustomobject]@{ teamsvoice = @(New-BackedUpNumber) } }
+        Mock New-GraphGetRequest {
+            $script:GetCalls++
+            if ($script:GetCalls -eq 1) { New-LiveNumber -TargetId $script:UserA -Status 'userAssigned' -Category 'private' } else { New-LiveNumber -TargetId $null -Status 'unassigned' }
+        }
+        Mock New-GraphPOSTRequest { }
+        Mock Write-LogMessage { }
+        Mock Start-Sleep { }
+
+        $Result = New-CIPPRestoreTask -Task 'teamsvoice' -TenantFilter 'contoso.onmicrosoft.com' -backup 'contoso_2026-09-16-0100' -overwrite $true -APINAME 'Restore' -Headers @{}
+
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter { $uri -eq "$script:BaseUri/unassignNumber" }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+            $uri -eq "$script:BaseUri/assignNumber" -and ($body | ConvertFrom-Json).assignmentCategory -eq 'primary'
+        }
+        Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly -ParameterFilter { $uri -eq "$script:BaseUri/updateNumber" }
+        $Result | Should -Contain 'Restored: 1 TeamsPhoneNumber from backup'
+    }
+
+    It 'leaves a matching holder with a changed category alone when overwrite is off' {
+        $Result = Invoke-Restore -Live (New-LiveNumber -TargetId $script:UserA -Status 'userAssigned' -Category 'private')
+
+        Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly
+        $Result | Should -Contain "Teams phone number +4512345678 is already assigned to $script:UserA"
+    }
+}
diff --git a/Tests/Private/New-CIPPSharepointSite.Tests.ps1 b/Tests/Private/New-CIPPSharepointSite.Tests.ps1
new file mode 100644
index 0000000000000..8fa5af7c5e678
--- /dev/null
+++ b/Tests/Private/New-CIPPSharepointSite.Tests.ps1
@@ -0,0 +1,91 @@
+# Pester tests for New-CIPPSharepointSite
+#
+# SPSiteManager/create can only make Communication and group-less Team sites. The TeamGroup
+# template creates the Microsoft 365 group app-only through Graph (SharePoint's own
+# GroupSiteManager/CreateGroupEx rejects the GDAP/SAM caller) and waits for the site URL.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    function Get-SharePointAdminLink { param($Public, $tenantFilter) }
+    function New-GraphGetRequest { param($uri, $tenantid, $scope, $extraHeaders, $UseCertificate, $AsApp) }
+    function New-GraphPOSTRequest { param($uri, $tenantid, $scope, $body, $type, $contentType, $AddedHeaders, $AsApp) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $sev, $LogData) }
+    function Get-CippException { param($Exception) [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/New-CIPPSharepointSite.ps1')
+
+    $script:Common = @{
+        SiteName        = 'Project Alpha!'
+        SiteDescription = 'desc'
+        SiteOwner       = 'owner@contoso.com'
+        TenantFilter    = 'contoso.onmicrosoft.com'
+    }
+}
+
+Describe 'New-CIPPSharepointSite' {
+    BeforeEach {
+        Mock Get-SharePointAdminLink { [PSCustomObject]@{ AdminUrl = 'https://contoso-admin.sharepoint.com'; SharePointUrl = 'https://contoso.sharepoint.com' } }
+        Mock Write-LogMessage {}
+        Mock Start-Sleep {}
+        Mock New-GraphGetRequest { [PSCustomObject]@{ webUrl = 'https://contoso.sharepoint.com/sites/ProjectAlpha' } }
+        Mock New-GraphPOSTRequest {
+            if ($uri -eq 'https://graph.microsoft.com/v1.0/groups') {
+                [PSCustomObject]@{ id = 'group-id' }
+            } elseif ($uri -like '*SPSiteManager/create') {
+                [PSCustomObject]@{ SiteStatus = 2 }
+            }
+        }
+    }
+
+    Context 'TeamGroup template' {
+        It 'creates a private Unified group app-only with the chosen owner and returns the site URL' {
+            New-CIPPSharepointSite @Common -TemplateName TeamGroup | Should -Match 'sites/ProjectAlpha'
+
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                $uri -eq 'https://graph.microsoft.com/v1.0/groups' -and $AsApp -eq $true -and
+                ($body | ConvertFrom-Json).mailNickname -eq 'ProjectAlpha' -and
+                ($body | ConvertFrom-Json).groupTypes -contains 'Unified' -and
+                ($body | ConvertFrom-Json).visibility -eq 'Private' -and
+                ($body | ConvertFrom-Json).'owners@odata.bind' -contains 'https://graph.microsoft.com/v1.0/users/owner@contoso.com'
+            }
+            Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like '*groups/group-id/sites/root*' }
+            Should -Invoke New-GraphPOSTRequest -Times 0 -ParameterFilter { $uri -like '*SPSiteManager/create' }
+        }
+
+        It 'honours -IsPublic and applies the sensitivity label' {
+            New-CIPPSharepointSite @Common -TemplateName TeamGroup -IsPublic -SensitivityLabel 'label-guid'
+
+            Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter {
+                $uri -eq 'https://graph.microsoft.com/v1.0/groups' -and
+                ($body | ConvertFrom-Json).visibility -eq 'Public' -and
+                ($body | ConvertFrom-Json).assignedLabels[0].labelId -eq 'label-guid'
+            }
+        }
+
+        It 'reports the group as provisioning when the site URL is not available yet' {
+            Mock New-GraphGetRequest { throw 'not found' }
+
+            New-CIPPSharepointSite @Common -TemplateName TeamGroup | Should -Match 'still being provisioned'
+            Should -Invoke New-GraphGetRequest -Times 10 -Exactly
+        }
+
+        It 'throws when the group cannot be created' {
+            Mock New-GraphPOSTRequest { throw 'mailNickname already exists' }
+
+            { New-CIPPSharepointSite @Common -TemplateName TeamGroup } | Should -Throw '*mailNickname already exists*'
+        }
+    }
+
+    Context 'existing templates' {
+        It 'still creates a group-less Team site through SPSiteManager/create' {
+            New-CIPPSharepointSite @Common -TemplateName Team
+
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                $uri -eq 'https://contoso-admin.sharepoint.com/_api/SPSiteManager/create' -and
+                ($body | ConvertFrom-Json).request.WebTemplate -eq 'STS#3'
+            }
+            Should -Invoke New-GraphPOSTRequest -Times 0 -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/groups' }
+        }
+    }
+}
diff --git a/Tests/Private/New-CIPPUserTask.Tests.ps1 b/Tests/Private/New-CIPPUserTask.Tests.ps1
index 33e2d9c86ba8b..77df9de7e31a2 100644
--- a/Tests/Private/New-CIPPUserTask.Tests.ps1
+++ b/Tests/Private/New-CIPPUserTask.Tests.ps1
@@ -2,6 +2,7 @@
 # Covers the shared-calendar onboarding block: one scheduled Set-CIPPCalendarPermission task per
 # calendar, the sharing-invitation flag, the Editor fallback, plain-string calendar entries, the
 # no-calendars case, and the guard that only shared mailboxes of the tenant can be targeted.
+# Also covers scheduling SharePoint site membership from the template.
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
@@ -25,13 +26,13 @@ BeforeAll {
 
     # Minimal user object: only the shared-calendar branch should do anything.
     function New-TestUserObj {
-        param($SharedCalendars, $SharedCalendarPermission, $SharedMailboxes, $SharedMailboxPermission)
+        param($SharedCalendars, $SharedCalendarPermission, $SharedMailboxes, $SharedMailboxPermission, $SharePointSites, $SharePointSiteRole)
         $UserObj = [pscustomobject]@{
             tenantFilter = 'contoso.com'
             givenName    = 'New'
             surname      = 'User'
         }
-        foreach ($Field in @('SharedCalendars', 'SharedCalendarPermission', 'SharedMailboxes', 'SharedMailboxPermission')) {
+        foreach ($Field in @('SharedCalendars', 'SharedCalendarPermission', 'SharedMailboxes', 'SharedMailboxPermission', 'SharePointSites', 'SharePointSiteRole')) {
             if ($PSBoundParameters.ContainsKey($Field)) {
                 # The request body uses camelCase, matching what the Add User form posts.
                 $Name = $Field.Substring(0, 1).ToLower() + $Field.Substring(1)
@@ -309,4 +310,59 @@ Describe 'New-CIPPUserTask' {
             }
         }
     }
+
+    Context 'SharePoint site onboarding' {
+        It 'schedules one site membership task per site, carrying the site type and backing group' {
+            $UserObj = New-TestUserObj -SharePointSites @(
+                [pscustomobject]@{ label = 'HR'; value = 'https://contoso.sharepoint.com/sites/hr'; addedFields = [pscustomobject]@{ rootWebTemplate = 'Group'; ownerPrincipalName = 'hr@contoso.com' } }
+                [pscustomobject]@{ label = 'Intranet'; value = 'https://contoso.sharepoint.com/sites/intranet'; addedFields = [pscustomobject]@{ rootWebTemplate = 'Communication Site'; ownerPrincipalName = $null } }
+            ) -SharePointSiteRole ([pscustomobject]@{ label = 'Visitors'; value = 'Visitors' })
+
+            $Result = New-CIPPUserTask -UserObj $UserObj
+
+            Should -Invoke Add-CIPPScheduledTask -Times 2 -Exactly
+            Should -Invoke Add-CIPPScheduledTask -Times 1 -Exactly -ParameterFilter {
+                $Task.Command.value -eq 'Set-CIPPSharePointSiteMember' -and
+                $Task.Parameters.SiteUrl -eq 'https://contoso.sharepoint.com/sites/hr' -and
+                $Task.Parameters.UserPrincipalName -eq 'new.user@contoso.com' -and
+                $Task.Parameters.Role -eq 'Visitors' -and
+                $Task.Parameters.SharePointType -eq 'Group' -and
+                $Task.Parameters.GroupId -eq 'hr@contoso.com'
+            }
+            $Result.Results | Should -Contain 'Scheduled Visitors access to the SharePoint site HR in 15 minutes.'
+        }
+
+        It 'schedules the membership 15 minutes out so the account can replicate to SharePoint first' {
+            $UserObj = New-TestUserObj -SharePointSites @([pscustomobject]@{ label = 'HR'; value = 'https://contoso.sharepoint.com/sites/hr' })
+            $Before = [int64](([datetime]::UtcNow).AddMinutes(15) - (Get-Date '1/1/1970')).TotalSeconds
+
+            $null = New-CIPPUserTask -UserObj $UserObj
+
+            Should -Invoke Add-CIPPScheduledTask -Times 1 -Exactly -ParameterFilter {
+                $Task.ScheduledTime -ge $Before -and $Task.ScheduledTime -le ($Before + 60)
+            }
+        }
+
+        It 'falls back to Members and accepts a plain string role' {
+            $null = New-CIPPUserTask -UserObj (New-TestUserObj -SharePointSites @([pscustomobject]@{ label = 'HR'; value = 'https://contoso.sharepoint.com/sites/hr' }))
+            Should -Invoke Add-CIPPScheduledTask -Times 1 -Exactly -ParameterFilter { $Task.Parameters.Role -eq 'Members' }
+
+            $null = New-CIPPUserTask -UserObj (New-TestUserObj -SharePointSites @([pscustomobject]@{ label = 'HR'; value = 'https://contoso.sharepoint.com/sites/hr' }) -SharePointSiteRole 'Owners')
+            Should -Invoke Add-CIPPScheduledTask -Times 1 -Exactly -ParameterFilter { $Task.Parameters.Role -eq 'Owners' }
+        }
+
+        It 'reports a failure when the scheduler rejects the task instead of throwing' {
+            Mock -CommandName Add-CIPPScheduledTask -MockWith { 'Error - duplicate task name' }
+            $UserObj = New-TestUserObj -SharePointSites @([pscustomobject]@{ label = 'HR'; value = 'https://contoso.sharepoint.com/sites/hr' })
+
+            $Result = New-CIPPUserTask -UserObj $UserObj
+
+            $Result.Results | Should -Contain 'Failed to schedule SharePoint access to HR: Error - duplicate task name'
+        }
+
+        It 'schedules nothing when no sites are configured' {
+            $null = New-CIPPUserTask -UserObj (New-TestUserObj)
+            Should -Invoke Add-CIPPScheduledTask -Times 0 -Exactly
+        }
+    }
 }
diff --git a/Tests/Private/Remove-CIPPBecSharingLinks.Tests.ps1 b/Tests/Private/Remove-CIPPBecSharingLinks.Tests.ps1
new file mode 100644
index 0000000000000..2be81a6452191
--- /dev/null
+++ b/Tests/Private/Remove-CIPPBecSharingLinks.Tests.ps1
@@ -0,0 +1,72 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination) }
+    function New-GraphPostRequest { param($uri, $tenantid, $type, $AsApp, $body) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    function Write-LogMessage { param($message, $tenant, $API, $headers, $Sev) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Remove-CIPPBecSharingLinks.ps1')
+
+    # A drive item carrying every permission shape: an anonymous link, an org link, a direct user grant
+    # (no .link), and an inherited link. Only the two own link permissions should be deleted.
+    $script:ItemWithLinks = {
+        [pscustomobject]@{
+            id              = 'item1'
+            name            = 'payroll.xlsx'
+            parentReference = [pscustomobject]@{ driveId = 'drive1' }
+            permissions     = @(
+                [pscustomobject]@{ id = 'perm-anon'; link = [pscustomobject]@{ scope = 'anonymous' } }
+                [pscustomobject]@{ id = 'perm-org'; link = [pscustomobject]@{ scope = 'organization' } }
+                [pscustomobject]@{ id = 'perm-user'; grantedToV2 = [pscustomobject]@{ user = [pscustomobject]@{ id = 'u1' } } }
+                [pscustomobject]@{ id = 'perm-inherited'; link = [pscustomobject]@{ scope = 'anonymous' }; inheritedFrom = [pscustomobject]@{ id = 'root' } }
+            )
+        }
+    }
+}
+
+Describe 'Remove-CIPPBecSharingLinks' {
+    BeforeEach {
+        Mock New-GraphPostRequest { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'resolves each URL through the shares endpoint and deletes only the own link permissions' {
+        Mock New-GraphGetRequest { & $script:ItemWithLinks }
+        $Rows = Remove-CIPPBecSharingLinks -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -ItemUrls @('https://contoso-my.sharepoint.com/personal/victim/Documents/payroll.xlsx')
+
+        Should -Invoke New-GraphGetRequest -Times 1 -ParameterFilter { $uri -like 'https://graph.microsoft.com/v1.0/shares/u!*/driveItem*' }
+        # the direct grant and the inherited link are left alone
+        Should -Invoke New-GraphPostRequest -Times 2 -ParameterFilter { $type -eq 'DELETE' }
+        Should -Invoke New-GraphPostRequest -Times 1 -ParameterFilter { $uri -like '*/drives/drive1/items/item1/permissions/perm-anon' }
+        Should -Invoke New-GraphPostRequest -Times 1 -ParameterFilter { $uri -like '*/permissions/perm-org' }
+        Should -Invoke New-GraphPostRequest -Times 0 -ParameterFilter { $uri -like '*perm-user' -or $uri -like '*perm-inherited' }
+        @($Rows | Where-Object { $_.state -eq 'success' }).Count | Should -Be 2
+    }
+
+    It 'de-duplicates repeated URLs so a link is only resolved once' {
+        Mock New-GraphGetRequest { & $script:ItemWithLinks }
+        $null = Remove-CIPPBecSharingLinks -TenantFilter 'contoso.com' -ItemUrls @('https://x/a', 'https://x/a', 'https://x/a')
+        Should -Invoke New-GraphGetRequest -Times 1
+    }
+
+    It 'returns an info row and deletes nothing when the item has no link permissions' {
+        Mock New-GraphGetRequest { [pscustomobject]@{ id = 'i'; name = 'clean.txt'; parentReference = [pscustomobject]@{ driveId = 'd' }; permissions = @([pscustomobject]@{ id = 'g'; grantedToV2 = [pscustomobject]@{ user = [pscustomobject]@{ id = 'u' } } }) } }
+        $Rows = Remove-CIPPBecSharingLinks -TenantFilter 'contoso.com' -ItemUrls @('https://x/clean.txt')
+        $Rows[0].state | Should -Be 'info'
+        Should -Invoke New-GraphPostRequest -Times 0
+    }
+
+    It 'returns an error row when the item cannot be resolved' {
+        Mock New-GraphGetRequest { throw 'Item not found' }
+        $Rows = Remove-CIPPBecSharingLinks -TenantFilter 'contoso.com' -ItemUrls @('https://x/gone.txt')
+        $Rows[0].state | Should -Be 'error'
+        $Rows[0].resultText | Should -Match 'Item not found'
+    }
+
+    It 'keeps going to the next URL when one delete fails' {
+        Mock New-GraphGetRequest { & $script:ItemWithLinks }
+        Mock New-GraphPostRequest { throw 'Access denied' }
+        $Rows = Remove-CIPPBecSharingLinks -TenantFilter 'contoso.com' -ItemUrls @('https://x/a')
+        @($Rows | Where-Object { $_.state -eq 'error' }).Count | Should -Be 2
+        $Rows[0].resultText | Should -Match 'Access denied'
+    }
+}
diff --git a/Tests/Private/Remove-CIPPBecTargetedCAPolicy.Tests.ps1 b/Tests/Private/Remove-CIPPBecTargetedCAPolicy.Tests.ps1
new file mode 100644
index 0000000000000..23b93cbb43ee6
--- /dev/null
+++ b/Tests/Private/Remove-CIPPBecTargetedCAPolicy.Tests.ps1
@@ -0,0 +1,86 @@
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSReviewUnusedParameter', '', Justification = 'Stubs exist only so Pester can mock them.')]
+[Diagnostics.CodeAnalysis.SuppressMessageAttribute('PSUseShouldProcessForStateChangingFunctions', '', Justification = 'Stubs exist only so Pester can mock them.')]
+param()
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp, $noPagination) }
+    function New-GraphPOSTRequest { param($uri, $tenantid, $type, $body, $AsApp) }
+    function Write-LogMessage { param($message, $tenant, $API, $headers, $Sev, $LogData) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Remove-CIPPBecTargetedCAPolicy.ps1')
+
+    # Two containment policies for u1, one for u2, and an unmanaged policy without a description.
+    $script:Policies = @(
+        [pscustomobject]@{ id = 'pol-a'; description = 'ManagedBy=CIPP-BEC;Target=u1;CaseId=BEC-1;ExpiresUtc=2026-09-07T10:00:00.0000000Z' }
+        [pscustomobject]@{ id = 'pol-b'; description = 'ManagedBy=CIPP-BEC;Target=u1;CaseId=BEC-2;ExpiresUtc=2026-09-08T10:00:00.0000000Z' }
+        [pscustomobject]@{ id = 'pol-c'; description = 'ManagedBy=CIPP-BEC;Target=u2;CaseId=BEC-3;ExpiresUtc=2026-09-08T10:00:00.0000000Z' }
+        [pscustomobject]@{ id = 'pol-d'; description = $null }
+    )
+}
+
+Describe 'Remove-CIPPBecTargetedCAPolicy' {
+    BeforeEach {
+        Mock New-GraphGetRequest { $script:Policies }
+        Mock New-GraphPOSTRequest { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'deletes the policy by id as the application, without listing policies, and logs it' {
+        $Message = Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' -PolicyId 'pol-1' -Headers @{ 'x-ms-client-principal' = 'p' }
+        $Message | Should -Be 'Removed BEC containment Conditional Access policy pol-1'
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies/pol-1' -and $type -eq 'DELETE' -and $tenantid -eq 'contoso.com' -and $AsApp -eq $true }
+        Should -Invoke New-GraphGetRequest -Times 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Info' -and $message -eq 'Removed BEC containment Conditional Access policy pol-1' -and $tenant -eq 'contoso.com' -and $API -eq 'BECRemediate' -and $headers.'x-ms-client-principal' -eq 'p' }
+    }
+
+    It 'reports a policy that is already gone instead of failing' {
+        Mock New-GraphPOSTRequest { throw 'Request_ResourceNotFound: Resource pol-1 does not exist or one of its queried reference-property objects are not present.' }
+        $Message = Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' -PolicyId 'pol-1'
+        $Message | Should -Be 'BEC containment Conditional Access policy pol-1 was already removed'
+        Should -Invoke Write-LogMessage -Times 0 -ParameterFilter { $Sev -eq 'Error' }
+    }
+
+    It 'throws with the normalized error and logs it when the delete fails for another reason' {
+        Mock New-GraphPOSTRequest { throw 'Insufficient privileges to complete the operation.' }
+        { Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' -PolicyId 'pol-1' } | Should -Throw 'Failed to remove BEC containment Conditional Access policy pol-1: Insufficient privileges to complete the operation.'
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Error' -and $message -like 'Failed to remove BEC containment Conditional Access policy pol-1:*' -and $LogData.NormalizedError -like 'Insufficient privileges*' }
+    }
+
+    It 'requires a PolicyId or a UserId before touching Graph' {
+        { Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' } | Should -Throw 'PolicyId or UserId is required'
+        Should -Invoke New-GraphGetRequest -Times 0
+        Should -Invoke New-GraphPOSTRequest -Times 0
+    }
+
+    It 'removes every CIPP-BEC policy targeting the user, and only those, when given a UserId' {
+        $Message = Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' -UserId 'u1'
+        Should -Invoke New-GraphGetRequest -Times 1 -Exactly -ParameterFilter { $uri -like 'https://graph.microsoft.com/v1.0/identity/conditionalAccess/policies?*' -and $tenantid -eq 'contoso.com' -and $AsApp -eq $true }
+        Should -Invoke New-GraphPOSTRequest -Times 2 -Exactly -ParameterFilter { $type -eq 'DELETE' }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -like '*/policies/pol-a' }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -like '*/policies/pol-b' }
+        Should -Invoke New-GraphPOSTRequest -Times 0 -ParameterFilter { $uri -like '*/pol-c' -or $uri -like '*/pol-d' }
+        $Message | Should -Be 'Removed BEC containment Conditional Access policy pol-a; Removed BEC containment Conditional Access policy pol-b'
+    }
+
+    It 'reports when the user has no containment policy and deletes nothing' {
+        $Message = Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' -UserId 'u9'
+        $Message | Should -Be 'No CIPP BEC containment policy exists for user u9'
+        Should -Invoke New-GraphPOSTRequest -Times 0
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Info' -and $message -eq 'No CIPP BEC containment policy exists for user u9' }
+    }
+
+    It 'keeps going past a policy that is already gone when removing by user' {
+        Mock New-GraphPOSTRequest { throw 'Response status code does not indicate success: 404 (Not Found).' } -ParameterFilter { $uri -like '*/pol-a' }
+        $Message = Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' -UserId 'u1'
+        $Message | Should -Be 'BEC containment Conditional Access policy pol-a was already removed; Removed BEC containment Conditional Access policy pol-b'
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -like '*/pol-b' }
+    }
+
+    It 'deletes nothing under -WhatIf' {
+        $Message = Remove-CIPPBecTargetedCAPolicy -TenantFilter 'contoso.com' -UserId 'u1' -WhatIf
+        Should -Invoke New-GraphGetRequest -Times 1
+        Should -Invoke New-GraphPOSTRequest -Times 0
+        $Message | Should -BeNullOrEmpty
+    }
+}
diff --git a/Tests/Private/Remove-CIPPMailboxDelegation.Tests.ps1 b/Tests/Private/Remove-CIPPMailboxDelegation.Tests.ps1
new file mode 100644
index 0000000000000..2419561bcd873
--- /dev/null
+++ b/Tests/Private/Remove-CIPPMailboxDelegation.Tests.ps1
@@ -0,0 +1,129 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function Set-CIPPMailboxPermission { param($UserId, $AccessUser, $PermissionLevel, $Action, $AutoMap, $TenantFilter, $APIName, $Headers, [switch]$AsCmdletObject) }
+    function Remove-CIPPFolderPermission { param($TenantFilter, $FolderIdentity, $User, $AccessRights, $Anchor) }
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Remove-CIPPMailboxDelegation.ps1')
+    $script:Upn = 'victim@contoso.com'
+
+    # A row shaped like Get-CIPPBecMailboxInventory's Delegations output.
+    function New-Delegation {
+        param([string]$PermissionType, [string]$Trustee, [string]$Identity = 'victim@contoso.com', [string]$Resource = 'victim@contoso.com', [string]$AccessRights = $PermissionType)
+        [pscustomobject]@{ PermissionType = $PermissionType; Resource = $Resource; Identity = $Identity; Trustee = $Trustee; AccessRights = $AccessRights }
+    }
+}
+
+Describe 'Remove-CIPPMailboxDelegation' {
+    BeforeEach {
+        Mock Set-CIPPMailboxPermission { }
+        Mock Remove-CIPPFolderPermission { }
+        Mock New-ExoRequest { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'routes FullAccess, SendAs and SendOnBehalf through Set-CIPPMailboxPermission as a Remove of the trustee on the mailbox' {
+        $Delegations = @(
+            (New-Delegation -PermissionType 'FullAccess' -Trustee 'assistant@contoso.com')
+            (New-Delegation -PermissionType 'SendAs' -Trustee 'outsider@example.org')
+            (New-Delegation -PermissionType 'SendOnBehalf' -Trustee 'guest_example.org#EXT#@contoso.onmicrosoft.com')
+        )
+        $Rows = @(Remove-CIPPMailboxDelegation -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Delegations $Delegations -Headers @{ 'x-ms-client-principal' = 'test' })
+
+        Should -Invoke Set-CIPPMailboxPermission -Exactly -Times 3 -ParameterFilter { $UserId -eq 'victim@contoso.com' -and $Action -eq 'Remove' -and $TenantFilter -eq 'contoso.com' -and $APIName -eq 'BECRemediate' -and $Headers.'x-ms-client-principal' -eq 'test' }
+        Should -Invoke Set-CIPPMailboxPermission -Times 1 -ParameterFilter { $PermissionLevel -eq 'FullAccess' -and $AccessUser -eq 'assistant@contoso.com' }
+        Should -Invoke Set-CIPPMailboxPermission -Times 1 -ParameterFilter { $PermissionLevel -eq 'SendAs' -and $AccessUser -eq 'outsider@example.org' }
+        Should -Invoke Set-CIPPMailboxPermission -Times 1 -ParameterFilter { $PermissionLevel -eq 'SendOnBehalf' -and $AccessUser -eq 'guest_example.org#EXT#@contoso.onmicrosoft.com' }
+        Should -Invoke Remove-CIPPFolderPermission -Times 0
+        Should -Invoke New-ExoRequest -Times 0
+        $Rows.Count | Should -Be 3
+        $Rows.state | Should -Be @('success', 'success', 'success')
+        $Rows.Target | Should -Be @('FullAccess assistant@contoso.com', 'SendAs outsider@example.org', 'SendOnBehalf guest_example.org#EXT#@contoso.onmicrosoft.com')
+        $Rows[0].resultText | Should -Be 'Removed FullAccess for assistant@contoso.com from victim@contoso.com'
+        $Rows[0].PSObject.Properties.Name | Should -Be @('Target', 'state', 'resultText')
+    }
+
+    It 'removes a folder right by folder id through Remove-CIPPFolderPermission, anchored on the mailbox, and names the folder in the result' {
+        $Delegations = @(
+            (New-Delegation -PermissionType 'Folder' -Trustee 'assistant@contoso.com' -Identity 'victim@contoso.com:LgAAAACalendar' -Resource 'victim@contoso.com:\Calendar' -AccessRights 'Editor')
+            ([pscustomobject]@{ PermissionType = 'Folder'; Trustee = 'Default'; Resource = 'victim@contoso.com:\Inbox'; AccessRights = 'Reviewer' })
+        )
+        $Rows = @(Remove-CIPPMailboxDelegation -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Delegations $Delegations)
+
+        Should -Invoke Remove-CIPPFolderPermission -Exactly -Times 2 -ParameterFilter { $TenantFilter -eq 'contoso.com' -and $Anchor -eq 'victim@contoso.com' }
+        Should -Invoke Remove-CIPPFolderPermission -Times 1 -ParameterFilter { $FolderIdentity -eq 'victim@contoso.com:LgAAAACalendar' -and $User -eq 'assistant@contoso.com' -and $AccessRights -eq 'Editor' }
+        Should -Invoke Remove-CIPPFolderPermission -Times 1 -ParameterFilter { $FolderIdentity -eq 'victim@contoso.com:\Inbox' -and $User -eq 'Default' -and $AccessRights -eq 'Reviewer' } -Because 'a row without a folder id falls back to the resource path'
+        Should -Invoke Set-CIPPMailboxPermission -Times 0
+        Should -Invoke New-ExoRequest -Times 0
+        Should -Invoke Write-LogMessage -Exactly -Times 2 -ParameterFilter { $Sev -eq 'Info' -and $API -eq 'BECRemediate' -and $tenant -eq 'contoso.com' }
+        $Rows.state | Should -Be @('success', 'success')
+        $Rows[0].Target | Should -Be 'Folder assistant@contoso.com'
+        $Rows[0].resultText | Should -Be 'Removed folder permission for assistant@contoso.com on victim@contoso.com:\Calendar'
+        $Rows[1].resultText | Should -Be 'Removed folder permission for Default on victim@contoso.com:\Inbox'
+    }
+
+    It 'removes a resource delegate with Set-CalendarProcessing on the resource mailbox' {
+        $Rows = @(Remove-CIPPMailboxDelegation -TenantFilter 'contoso.com' -UserPrincipalName 'room@contoso.com' -Delegations @((New-Delegation -PermissionType 'ResourceDelegate' -Trustee 'assistant@contoso.com' -Identity 'room@contoso.com' -Resource 'room@contoso.com')))
+
+        Should -Invoke New-ExoRequest -Exactly -Times 1 -ParameterFilter { $tenantid -eq 'contoso.com' -and $cmdlet -eq 'Set-CalendarProcessing' -and $Anchor -eq 'room@contoso.com' -and $cmdParams.Identity -eq 'room@contoso.com' -and $cmdParams.ResourceDelegates['@odata.type'] -eq '#Exchange.GenericHashTable' -and $cmdParams.ResourceDelegates['remove'] -contains 'assistant@contoso.com' }
+        Should -Invoke Set-CIPPMailboxPermission -Times 0
+        Should -Invoke Remove-CIPPFolderPermission -Times 0
+        Should -Invoke Write-LogMessage -Exactly -Times 1 -ParameterFilter { $Sev -eq 'Info' -and $message -eq 'Removed resource delegate assistant@contoso.com from room@contoso.com' }
+        $Rows.Count | Should -Be 1
+        $Rows[0].state | Should -Be 'success'
+        $Rows[0].Target | Should -Be 'ResourceDelegate assistant@contoso.com'
+        $Rows[0].resultText | Should -Be 'Removed resource delegate assistant@contoso.com from room@contoso.com'
+    }
+
+    It 'reports an unknown delegation type as an error row without touching Exchange' {
+        $Rows = @(Remove-CIPPMailboxDelegation -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Delegations @((New-Delegation -PermissionType 'Forwarding' -Trustee 'x@example.org')))
+
+        $Rows.Count | Should -Be 1
+        $Rows[0].state | Should -Be 'error'
+        $Rows[0].Target | Should -Be 'Forwarding x@example.org'
+        $Rows[0].resultText | Should -Be "Failed to remove Forwarding for x@example.org from victim@contoso.com: Unknown delegation type 'Forwarding'"
+        Should -Invoke Set-CIPPMailboxPermission -Times 0
+        Should -Invoke Remove-CIPPFolderPermission -Times 0
+        Should -Invoke New-ExoRequest -Times 0
+        Should -Invoke Write-LogMessage -Exactly -Times 1 -ParameterFilter { $Sev -eq 'Error' -and $null -ne $LogData }
+    }
+
+    It 'skips a row without a trustee with an error, ignores null rows, and continues with the rest' {
+        $Delegations = @(
+            (New-Delegation -PermissionType 'SendAs' -Trustee '')
+            $null
+            (New-Delegation -PermissionType 'FullAccess' -Trustee 'assistant@contoso.com')
+        )
+        $Rows = @(Remove-CIPPMailboxDelegation -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Delegations $Delegations)
+
+        $Rows.Count | Should -Be 2
+        $Rows[0].state | Should -Be 'error'
+        $Rows[0].resultText | Should -Be 'A SendAs delegation without a trustee cannot be removed'
+        $Rows[1].state | Should -Be 'success'
+        Should -Invoke Set-CIPPMailboxPermission -Exactly -Times 1 -ParameterFilter { $PermissionLevel -eq 'FullAccess' -and $AccessUser -eq 'assistant@contoso.com' }
+    }
+
+    It 'turns a helper failure into an error row and keeps going with the next delegation' {
+        Mock Set-CIPPMailboxPermission -ParameterFilter { $PermissionLevel -eq 'FullAccess' } { throw 'The operation could not be performed because object could not be found' }
+        $Delegations = @(
+            (New-Delegation -PermissionType 'FullAccess' -Trustee 'gone@contoso.com')
+            (New-Delegation -PermissionType 'SendAs' -Trustee 'assistant@contoso.com')
+        )
+        $Rows = @(Remove-CIPPMailboxDelegation -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Delegations $Delegations)
+
+        $Rows.Count | Should -Be 2
+        $Rows[0].state | Should -Be 'error'
+        $Rows[0].resultText | Should -Be 'Failed to remove FullAccess for gone@contoso.com from victim@contoso.com: The operation could not be performed because object could not be found'
+        $Rows[1].state | Should -Be 'success'
+        Should -Invoke Set-CIPPMailboxPermission -Exactly -Times 2
+        Should -Invoke Write-LogMessage -Exactly -Times 1 -ParameterFilter { $Sev -eq 'Error' -and $null -ne $LogData -and $message -like 'Failed to remove FullAccess for gone@contoso.com*' }
+    }
+
+    It 'removes nothing and returns no rows under -WhatIf' {
+        $Rows = @(Remove-CIPPMailboxDelegation -TenantFilter 'contoso.com' -UserPrincipalName $script:Upn -Delegations @((New-Delegation -PermissionType 'FullAccess' -Trustee 'assistant@contoso.com')) -WhatIf)
+        $Rows.Count | Should -Be 0
+        Should -Invoke Set-CIPPMailboxPermission -Times 0
+        Should -Invoke Write-LogMessage -Times 0
+    }
+}
diff --git a/Tests/Private/Remove-CIPPUserOAuthGrant.Tests.ps1 b/Tests/Private/Remove-CIPPUserOAuthGrant.Tests.ps1
new file mode 100644
index 0000000000000..8534da7b18160
--- /dev/null
+++ b/Tests/Private/Remove-CIPPUserOAuthGrant.Tests.ps1
@@ -0,0 +1,71 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-GraphPOSTRequest { param($uri, $tenantid, $type, $AsApp, $body) }
+    function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = [string]$Exception.Exception.Message } }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Remove-CIPPUserOAuthGrant.ps1')
+}
+
+Describe 'Remove-CIPPUserOAuthGrant' {
+    BeforeEach {
+        Mock New-GraphPOSTRequest { }
+        Mock Write-LogMessage { }
+    }
+
+    It 'deletes each consent grant and app-role assignment at its own Graph URI and returns a success row per id' {
+        $Rows = Remove-CIPPUserOAuthGrant -TenantFilter 'contoso.com' -UserId 'user-1' -GrantIds @('g1', 'g2') -AppRoleAssignmentIds @('a1') -Headers @{ 'x-ms-client-principal' = 'test' }
+
+        Should -Invoke New-GraphPOSTRequest -Exactly -Times 3 -ParameterFilter { $type -eq 'DELETE' -and $AsApp -eq $true -and $tenantid -eq 'contoso.com' }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/oauth2PermissionGrants/g1' }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/oauth2PermissionGrants/g2' }
+        Should -Invoke New-GraphPOSTRequest -Times 1 -ParameterFilter { $uri -eq 'https://graph.microsoft.com/v1.0/users/user-1/appRoleAssignments/a1' }
+        Should -Invoke Write-LogMessage -Exactly -Times 3 -ParameterFilter { $Sev -eq 'Info' -and $API -eq 'BECRemediate' -and $tenant -eq 'contoso.com' -and $headers.'x-ms-client-principal' -eq 'test' }
+        $Rows.Count | Should -Be 3
+        $Rows.Target | Should -Be @('g1', 'g2', 'a1')
+        $Rows.state | Should -Be @('success', 'success', 'success')
+        $Rows[0].resultText | Should -Be 'Deleted consent grant g1'
+        $Rows[2].resultText | Should -Be 'Deleted app-role assignment a1'
+        $Rows[0].PSObject.Properties.Name | Should -Be @('Target', 'state', 'resultText')
+    }
+
+    It 'refuses an app-role assignment without the user object id and never calls Graph for it, while still deleting the grants' {
+        $Rows = Remove-CIPPUserOAuthGrant -TenantFilter 'contoso.com' -GrantIds @('g1') -AppRoleAssignmentIds @('a1')
+
+        Should -Invoke New-GraphPOSTRequest -Exactly -Times 1 -ParameterFilter { $uri -like '*/oauth2PermissionGrants/g1' }
+        Should -Invoke New-GraphPOSTRequest -Times 0 -ParameterFilter { $uri -like '*appRoleAssignments*' }
+        $Rows.Count | Should -Be 2
+        ($Rows | Where-Object { $_.Target -eq 'g1' }).state | Should -Be 'success'
+        $Assignment = $Rows | Where-Object { $_.Target -eq 'a1' }
+        $Assignment.state | Should -Be 'error'
+        $Assignment.resultText | Should -Be 'The user object id is required to remove an app-role assignment'
+        Should -Invoke Write-LogMessage -Exactly -Times 1 -Because 'the refused assignment is a validation result, not an audit event'
+    }
+
+    It 'turns a Graph failure into an error row and carries on with the next id' {
+        Mock New-GraphPOSTRequest -ParameterFilter { $uri -like '*/oauth2PermissionGrants/g1' } { throw 'Insufficient privileges to complete the operation.' }
+        $Rows = Remove-CIPPUserOAuthGrant -TenantFilter 'contoso.com' -UserId 'user-1' -GrantIds @('g1', 'g2') -AppRoleAssignmentIds @('a1')
+
+        Should -Invoke New-GraphPOSTRequest -Exactly -Times 3
+        $Rows.Count | Should -Be 3
+        $Rows[0].state | Should -Be 'error'
+        $Rows[0].resultText | Should -Be 'Failed to delete consent grant g1: Insufficient privileges to complete the operation.'
+        $Rows[1].state | Should -Be 'success'
+        $Rows[2].state | Should -Be 'success'
+        Should -Invoke Write-LogMessage -Exactly -Times 1 -ParameterFilter { $Sev -eq 'Error' -and $null -ne $LogData -and $message -like 'Failed to delete consent grant g1*' }
+        Should -Invoke Write-LogMessage -Exactly -Times 2 -ParameterFilter { $Sev -eq 'Info' }
+    }
+
+    It 'returns an empty array for empty input and ignores blank ids' {
+        @(Remove-CIPPUserOAuthGrant -TenantFilter 'contoso.com' -UserId 'user-1').Count | Should -Be 0
+        @(Remove-CIPPUserOAuthGrant -TenantFilter 'contoso.com' -UserId 'user-1' -GrantIds @('', $null) -AppRoleAssignmentIds @()).Count | Should -Be 0
+        Should -Invoke New-GraphPOSTRequest -Times 0
+        Should -Invoke Write-LogMessage -Times 0
+    }
+
+    It 'deletes nothing and returns no rows under -WhatIf' {
+        $Rows = Remove-CIPPUserOAuthGrant -TenantFilter 'contoso.com' -UserId 'user-1' -GrantIds @('g1') -AppRoleAssignmentIds @('a1') -WhatIf
+        @($Rows).Count | Should -Be 0
+        Should -Invoke New-GraphPOSTRequest -Times 0
+        Should -Invoke Write-LogMessage -Times 0
+    }
+}
diff --git a/Tests/Private/Request-CIPPSPOPersonalSite.Tests.ps1 b/Tests/Private/Request-CIPPSPOPersonalSite.Tests.ps1
new file mode 100644
index 0000000000000..59826bde2f343
--- /dev/null
+++ b/Tests/Private/Request-CIPPSPOPersonalSite.Tests.ps1
@@ -0,0 +1,87 @@
+# Pester tests for Request-CIPPSPOPersonalSite - OneDrive pre-provisioning must run DELEGATED. SharePoint
+# refuses every app-only token on both CSOM routes (pnp/powershell#4329, CyberDrain/CIPP#592), so these
+# pin: no app-only/certificate auth, User Profile Service route first, RequestPersonalSites as fallback,
+# CSOM ErrorInfo surfaced instead of a false success.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Request-CIPPSPOPersonalSite.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $FunctionPath) { throw 'Could not locate Request-CIPPSPOPersonalSite.ps1 under Modules/' }
+
+    function Get-SharePointAdminLink { param($Public, $TenantFilter) }
+    function New-GraphPostRequest { param($scope, $tenantid, $Uri, $Type, $Body, $ContentType, $AsApp, [switch]$UseCertificate) }
+    function Write-LogMessage { param($headers, $API, $message, $Sev, $tenant, $LogData) }
+    function Get-CippException { param($Exception) [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } }
+
+    . $FunctionPath
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:AdminUrl = 'https://contoso-admin.sharepoint.com'
+    $script:Ok = @([PSCustomObject]@{ SchemaVersion = '15.0.0.0'; ErrorInfo = $null; IsComplete = $true })
+    $script:Refused = @([PSCustomObject]@{ ErrorInfo = [PSCustomObject]@{ ErrorMessage = 'Attempted to perform an unauthorized operation.'; ErrorTypeName = 'System.UnauthorizedAccessException' }; IsComplete = $false })
+}
+
+Describe 'Request-CIPPSPOPersonalSite' {
+    BeforeEach {
+        Mock Get-SharePointAdminLink { [PSCustomObject]@{ AdminUrl = $script:AdminUrl; TenantName = 'contoso'; SharePointDomain = 'sharepoint.com' } }
+        Mock Write-LogMessage { }
+        Mock New-GraphPostRequest { $script:Ok }
+    }
+
+    It 'enqueues through the User Profile Service DELEGATED on the admin site - never app-only or certificate' {
+        $Result = Request-CIPPSPOPersonalSite -TenantFilter $script:Tenant -UserEmails 'user1@contoso.com'
+        $Result | Should -Be 'Successfully requested personal site for user1@contoso.com'
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter {
+            -not $AsApp -and -not $UseCertificate -and
+            $scope -eq "$($script:AdminUrl)/.default" -and
+            $Uri -eq "$($script:AdminUrl)/_vti_bin/client.svc/ProcessQuery" -and
+            $Body -match 'StaticMethod[^>]+Name="GetProfileLoader"[^>]+TypeId="\{9c42543a-91b3-4902-b2fe-14ccdefb6e2b\}"' -and
+            $Body -match 'Name="CreatePersonalSiteEnqueueBulk"' -and
+            $Body -notmatch 'RequestPersonalSites' -and
+            $Body -match "<Object Type='String'>user1@contoso.com</Object>"
+        }
+    }
+
+    It 'falls back to Tenant.RequestPersonalSites when the User Profile route is refused' {
+        Mock New-GraphPostRequest { if ($Body -match 'CreatePersonalSiteEnqueueBulk') { $script:Refused } else { $script:Ok } }
+        $Result = Request-CIPPSPOPersonalSite -TenantFilter $script:Tenant -UserEmails 'user1@contoso.com'
+        $Result | Should -Be 'Successfully requested personal site for user1@contoso.com'
+        Should -Invoke New-GraphPostRequest -Times 2 -Exactly
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter {
+            -not $AsApp -and -not $UseCertificate -and
+            $Body -match 'Constructor[^>]+TypeId="\{268004ae-ef6b-4e9b-8425-127220d84719\}"' -and
+            $Body -match 'Name="RequestPersonalSites"' -and
+            $Body -match "<Object Type='String'>user1@contoso.com</Object>"
+        }
+        Should -Invoke Write-LogMessage -Times 1 -Exactly -ParameterFilter { $Sev -eq 'Warning' -and $message -like 'ProfileLoader.CreatePersonalSiteEnqueueBulk refused*' }
+    }
+
+    It 'escapes user values so a UPN cannot break out of the CSOM XML' {
+        Request-CIPPSPOPersonalSite -TenantFilter $script:Tenant -UserEmails "o'brien<x>@contoso.com" | Out-Null
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter {
+            $Body -match "o&apos;brien&lt;x&gt;@contoso.com" -and $Body -notmatch '<x>'
+        }
+    }
+
+    It 'splits more than 200 users across calls' {
+        $Users = 1..201 | ForEach-Object { "user$_@contoso.com" }
+        Request-CIPPSPOPersonalSite -TenantFilter $script:Tenant -UserEmails $Users | Out-Null
+        Should -Invoke New-GraphPostRequest -Times 2 -Exactly
+        Should -Invoke New-GraphPostRequest -Times 1 -Exactly -ParameterFilter { $Body -match 'user201@contoso.com' -and $Body -notmatch 'user1@contoso.com<' }
+    }
+
+    It 'fails with both refusals and the SharePoint Administrator hint when every route is refused' {
+        Mock New-GraphPostRequest { $script:Refused }
+        { Request-CIPPSPOPersonalSite -TenantFilter $script:Tenant -UserEmails 'user1@contoso.com' } |
+            Should -Throw -ExpectedMessage "*ProfileLoader.CreatePersonalSiteEnqueueBulk - Attempted to perform an unauthorized operation.*Tenant.RequestPersonalSites - Attempted*SharePoint Administrator role in $($script:Tenant)*"
+        Should -Invoke New-GraphPostRequest -Times 2 -Exactly
+        Should -Invoke Write-LogMessage -Times 1 -Exactly -ParameterFilter { $Sev -eq 'Error' }
+    }
+
+    It 'fails when SharePoint answers without IsComplete on every route' {
+        Mock New-GraphPostRequest { @([PSCustomObject]@{ ErrorInfo = $null; IsComplete = $false }) }
+        { Request-CIPPSPOPersonalSite -TenantFilter $script:Tenant -UserEmails 'user1@contoso.com' } |
+            Should -Throw -ExpectedMessage '*did not confirm the personal site request*'
+    }
+}
diff --git a/Tests/Private/Resolve-CIPPAuditActor.Tests.ps1 b/Tests/Private/Resolve-CIPPAuditActor.Tests.ps1
new file mode 100644
index 0000000000000..e6d4254e16172
--- /dev/null
+++ b/Tests/Private/Resolve-CIPPAuditActor.Tests.ps1
@@ -0,0 +1,64 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/AuditLogs/Resolve-CIPPAuditActor.ps1')
+    $script:OriginalAppId = $env:ApplicationID
+    $script:OriginalTenantId = $env:TenantID
+    $env:ApplicationID = '11111111-2222-4333-8444-555555555555'
+    $env:TenantID = '99999999-8888-4777-8666-555555555555'
+    # partner-tenant object id 0123abcd-4567-4890-8abc-def012345678, as it appears without dashes in Entra records
+    $script:Lookup = @{ '0123abcd-4567-4890-8abc-def012345678' = @{ userPrincipalName = 'tech@msp.example'; displayName = 'Tech' } }
+}
+
+AfterAll {
+    $env:ApplicationID = $script:OriginalAppId
+    $env:TenantID = $script:OriginalTenantId
+}
+
+Describe 'Resolve-CIPPAuditActor' {
+    It 'leaves an ordinary user principal name as the tenant''s own user' {
+        $R = Resolve-CIPPAuditActor -Actor 'victim@contoso.com' -PartnerUserLookup $script:Lookup
+        $R.Kind | Should -Be 'User'
+        $R.Actor | Should -Be 'victim@contoso.com'
+        $R.PartnerTenantId | Should -BeNullOrEmpty
+    }
+
+    It 'resolves the Entra partner shape (user_<id>@tenant) to the partner user' {
+        $R = Resolve-CIPPAuditActor -Actor 'user_0123abcd456748908abcdef012345678@contoso.onmicrosoft.com' -PartnerUserLookup $script:Lookup
+        $R.Kind | Should -Be 'Partner'
+        $R.Actor | Should -Be 'tech@msp.example'
+    }
+
+    It 'calls an unknown id in the partner shape another partner when this partner''s users are known' {
+        $R = Resolve-CIPPAuditActor -Actor 'user_ffffffffffff4fff8fffffffffffffff@contoso.onmicrosoft.com' -PartnerUserLookup $script:Lookup
+        $R.Kind | Should -Be 'OtherPartner'
+        $R.Actor | Should -Be 'user_ffffffffffff4fff8fffffffffffffff@contoso.onmicrosoft.com'
+        # without a lookup the shape alone still says partner, and nothing can say which
+        (Resolve-CIPPAuditActor -Actor 'user_ffffffffffff4fff8fffffffffffffff@contoso.onmicrosoft.com').Kind | Should -Be 'Partner'
+    }
+
+    It 'tells this partner tenant from another by the tenant id in the Exchange shape' {
+        $Mine = Resolve-CIPPAuditActor -Actor 'contoso.onmicrosoft.com\tenant: 99999999-8888-4777-8666-555555555555, object: 0123abcd-4567-4890-8abc-def012345678' -PartnerUserLookup $script:Lookup
+        $Mine.Kind | Should -Be 'Partner'
+        $Mine.Actor | Should -Be 'tech@msp.example'
+        $Mine.PartnerTenantId | Should -Be '99999999-8888-4777-8666-555555555555'
+
+        $Other = Resolve-CIPPAuditActor -Actor 'contoso.onmicrosoft.com\tenant: 12345678-1234-4123-8123-123456789012, object: 0123abcd-4567-4890-8abc-def012345678' -PartnerUserLookup $script:Lookup
+        $Other.Kind | Should -Be 'OtherPartner'
+        $Other.PartnerTenantId | Should -Be '12345678-1234-4123-8123-123456789012'
+    }
+
+    It 'recognises CIPP''s own application by app id, in either position' {
+        (Resolve-CIPPAuditActor -Actor 'CIPP-SAM' -ActorType 'Application' -AppId '11111111-2222-4333-8444-555555555555').Kind | Should -Be 'CIPP'
+        (Resolve-CIPPAuditActor -Actor '11111111-2222-4333-8444-555555555555').Kind | Should -Be 'CIPP'
+        (Resolve-CIPPAuditActor -Actor 'CIPP-SAM' -ActorType 'Application' -AppId '11111111-2222-4333-8444-555555555555').Actor | Should -Be 'CIPP (service principal)'
+    }
+
+    It 'classifies other applications, system accounts and empty actors without guessing' {
+        $App = Resolve-CIPPAuditActor -Actor 'Sync Tool' -ActorType 'Application' -AppId 'app-1'
+        $App.Kind | Should -Be 'Application'
+        $App.Actor | Should -Be 'Sync Tool'
+        (Resolve-CIPPAuditActor -Actor 'aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee').Kind | Should -Be 'Application'
+        (Resolve-CIPPAuditActor -Actor 'NT AUTHORITY\SYSTEM (Microsoft.Exchange.ServiceHost)').Kind | Should -Be 'System'
+        (Resolve-CIPPAuditActor -Actor '').Kind | Should -Be 'User'
+    }
+}
diff --git a/Tests/Private/Resolve-CIPPIntuneAdminTemplateBinding.Tests.ps1 b/Tests/Private/Resolve-CIPPIntuneAdminTemplateBinding.Tests.ps1
new file mode 100644
index 0000000000000..c2c6d5dada66d
--- /dev/null
+++ b/Tests/Private/Resolve-CIPPIntuneAdminTemplateBinding.Tests.ps1
@@ -0,0 +1,213 @@
+# Pester tests for Resolve-CIPPIntuneAdminTemplateBinding.
+#
+# An administrative template stores its settings as groupPolicyDefinitions('<id>') binds. Built-in
+# definitions have one id everywhere, but a definition from an imported ADMX file is minted with a new
+# id in every tenant (and on every re-import), so the bind captured in one tenant does not exist in
+# another. The resolver finds the same setting in the target tenant by the identity the template
+# recorded next to the bind (name, category path, class) and rewrites the binds before deployment.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    # Stubs mirror the real signatures so signature drift fails loudly here.
+    function New-GraphGETRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp, $ComplexFilter) }
+    function New-GraphBulkRequest { [CmdletBinding()] param($tenantid, $NoAuthCheck, $scope, $asapp, $Requests, $NoPaginateIds, $Version, $Headers) }
+    function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $Sev2, $LogData) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/ConvertTo-CIPPODataFilterValue.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Resolve-CIPPIntuneAdminTemplateBinding.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:BuiltInId = '81c07ba0-7512-402d-b1f6-00856975cfab'
+    $script:SourceFirefoxId = 'f65370a6-bc40-40af-b0f3-b6f5481478c0'
+    $script:SourcePresentationId = 'a73dada5-9cfc-44e7-b560-ebc1e1a1f1a9'
+    $script:TargetFirefoxId = '11111111-2222-3333-4444-555555555555'
+    $script:TargetPresentationId = '66666666-7777-8888-9999-000000000000'
+
+    function New-Bind([string]$DefinitionId, [string]$PresentationId) {
+        $Bind = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('$DefinitionId')"
+        if ($PresentationId) { $Bind += "/presentations('$PresentationId')" }
+        $Bind
+    }
+
+    # A template as New-CIPPIntuneTemplate stores it: one built-in setting and one imported (Firefox)
+    # setting with a list presentation, each carrying its identity next to the bind.
+    function New-Template {
+        param([switch]$WithoutIdentity, $PresentationIdentity)
+        $Firefox = [ordered]@{
+            'definition@odata.bind' = New-Bind $script:SourceFirefoxId
+            enabled                 = $true
+            presentationValues      = @(
+                [ordered]@{
+                    '@odata.type'             = '#microsoft.graph.groupPolicyPresentationValueList'
+                    id                        = 'pv-1'
+                    'presentation@odata.bind' = New-Bind $script:SourceFirefoxId $script:SourcePresentationId
+                    values                    = @(@{ name = 'https://intranet.example' })
+                }
+            )
+        }
+        if (-not $WithoutIdentity) {
+            $Firefox.definition = [ordered]@{ id = $script:SourceFirefoxId; displayName = 'SPNEGO'; categoryPath = '\Mozilla\Firefox\Authentication'; classType = 'machine'; policyType = 'admxIngested' }
+            $Firefox.presentationValues[0].presentation = if ($PSBoundParameters.ContainsKey('PresentationIdentity')) { $PresentationIdentity } else {
+                [ordered]@{ id = $script:SourcePresentationId; label = ''; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox'; index = 0 }
+            }
+        }
+        [ordered]@{
+            added      = @(
+                [ordered]@{ 'definition@odata.bind' = New-Bind $script:BuiltInId; enabled = $true; presentationValues = @(); definition = [ordered]@{ id = $script:BuiltInId; displayName = 'Silently sign in users'; categoryPath = '\OneDrive'; classType = 'machine'; policyType = 'admxIngested' } }
+                $Firefox
+            )
+            updated    = @()
+            deletedIds = @()
+        } | ConvertTo-Json -Depth 10 -Compress
+    }
+
+    # The batch reply for the existence check: 200 for ids the tenant has, 404 for the rest.
+    function New-ExistenceReply($Requests, [string[]]$Present) {
+        foreach ($Request in $Requests) {
+            $Id = [regex]::Match($Request.url, "groupPolicyDefinitions\('([0-9a-f-]{36})'\)").Groups[1].Value
+            if ($Present -contains $Id) {
+                [pscustomobject]@{ id = $Request.id; status = 200; body = [pscustomobject]@{ id = $Id } }
+            } else {
+                [pscustomobject]@{ id = $Request.id; status = 404; body = [pscustomobject]@{ error = @{ code = 'NotFound' } } }
+            }
+        }
+    }
+}
+
+Describe 'Resolve-CIPPIntuneAdminTemplateBinding' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+    }
+
+    Context 'every definition already exists in the target tenant' {
+        BeforeEach {
+            Mock -CommandName New-GraphBulkRequest -MockWith { New-ExistenceReply -Requests $Requests -Present @($script:BuiltInId, $script:SourceFirefoxId) }
+            Mock -CommandName New-GraphGETRequest -MockWith { throw "unexpected GET $uri" }
+        }
+
+        It 'keeps the binds as they are and strips the identity metadata Graph does not accept' {
+            $Result = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template) -TenantFilter $script:Tenant -DisplayName 'Firefox'
+            $Policy = $Result | ConvertFrom-Json
+
+            $Policy.added[1].'definition@odata.bind' | Should -Be (New-Bind $script:SourceFirefoxId)
+            $Policy.added[1].presentationValues[0].'presentation@odata.bind' | Should -Be (New-Bind $script:SourceFirefoxId $script:SourcePresentationId)
+            $Policy.added[1].presentationValues[0].values[0].name | Should -Be 'https://intranet.example'
+            $Policy.added[1].PSObject.Properties.Name | Should -Not -Contain 'definition'
+            $Policy.added[1].presentationValues[0].PSObject.Properties.Name | Should -Not -Contain 'presentation'
+            $Policy.added[0].PSObject.Properties.Name | Should -Not -Contain 'definition'
+            Should -Invoke New-GraphGETRequest -Times 0 -Exactly
+        }
+    }
+
+    Context 'an imported definition is missing and the template recorded its identity' {
+        BeforeEach {
+            Mock -CommandName New-GraphBulkRequest -MockWith { New-ExistenceReply -Requests $Requests -Present @($script:BuiltInId) }
+            Mock -CommandName New-GraphGETRequest -MockWith {
+                if ($uri -match 'presentations$') {
+                    @(
+                        [pscustomobject]@{ id = $script:TargetPresentationId; label = ''; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox' }
+                    )
+                } elseif ($uri -match '\$filter=') {
+                    @(
+                        [pscustomobject]@{ id = 'aaaaaaaa-0000-0000-0000-000000000001'; displayName = 'NTLM'; categoryPath = '\Mozilla\Firefox\Authentication'; classType = 'machine' }
+                        [pscustomobject]@{ id = $script:TargetFirefoxId; displayName = 'SPNEGO'; categoryPath = '\Mozilla\Firefox\Authentication'; classType = 'machine' }
+                    )
+                } else { throw "unexpected GET $uri" }
+            }
+        }
+
+        It 'rewrites the definition and presentation binds to the target tenant ids' {
+            $Result = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template) -TenantFilter $script:Tenant -DisplayName 'Firefox'
+            $Policy = $Result | ConvertFrom-Json
+
+            $Policy.added[0].'definition@odata.bind' | Should -Be (New-Bind $script:BuiltInId)
+            $Policy.added[1].'definition@odata.bind' | Should -Be (New-Bind $script:TargetFirefoxId)
+            $Policy.added[1].presentationValues[0].'presentation@odata.bind' | Should -Be (New-Bind $script:TargetFirefoxId $script:TargetPresentationId)
+            $Policy.added[1].presentationValues[0].'@odata.type' | Should -Be '#microsoft.graph.groupPolicyPresentationValueList'
+            $Policy.added[1].presentationValues[0].values[0].name | Should -Be 'https://intranet.example'
+            $Policy.added[1].enabled | Should -BeTrue
+            $Policy.added[1].PSObject.Properties.Name | Should -Not -Contain 'definition'
+            $Policy.added[1].presentationValues[0].PSObject.Properties.Name | Should -Not -Contain 'presentation'
+        }
+
+        It 'looks the setting up by class and category path' {
+            $null = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template) -TenantFilter $script:Tenant -DisplayName 'Firefox'
+
+            Should -Invoke New-GraphGETRequest -Times 1 -Exactly -ParameterFilter {
+                $uri -like '*groupPolicyDefinitions?*' -and $uri -like "*classType eq 'machine'*" -and $uri -like "*categoryPath eq '\Mozilla\Firefox\Authentication'*" -and $tenantid -eq $script:Tenant
+            }
+        }
+    }
+
+    Context 'the target definition has several presentations' {
+        BeforeEach {
+            Mock -CommandName New-GraphBulkRequest -MockWith { New-ExistenceReply -Requests $Requests -Present @($script:BuiltInId) }
+            Mock -CommandName New-GraphGETRequest -MockWith {
+                if ($uri -match 'presentations$') {
+                    @(
+                        [pscustomobject]@{ id = 'p-text'; label = 'Realm'; '@odata.type' = '#microsoft.graph.groupPolicyPresentationTextBox' }
+                        [pscustomobject]@{ id = 'p-list'; label = 'Servers'; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox' }
+                    )
+                } else {
+                    @([pscustomobject]@{ id = $script:TargetFirefoxId; displayName = 'SPNEGO'; categoryPath = '\Mozilla\Firefox\Authentication'; classType = 'machine' })
+                }
+            }
+        }
+
+        It 'prefers a label match over the recorded position' {
+            $Identity = [ordered]@{ id = $script:SourcePresentationId; label = 'Servers'; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox'; index = 0 }
+            $Policy = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template -PresentationIdentity $Identity) -TenantFilter $script:Tenant -DisplayName 'Firefox' | ConvertFrom-Json
+
+            $Policy.added[1].presentationValues[0].'presentation@odata.bind' | Should -Be (New-Bind $script:TargetFirefoxId 'p-list')
+        }
+
+        It 'falls back to the recorded position when the label is empty' {
+            $Identity = [ordered]@{ id = $script:SourcePresentationId; label = ''; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox'; index = 1 }
+            $Policy = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template -PresentationIdentity $Identity) -TenantFilter $script:Tenant -DisplayName 'Firefox' | ConvertFrom-Json
+
+            $Policy.added[1].presentationValues[0].'presentation@odata.bind' | Should -Be (New-Bind $script:TargetFirefoxId 'p-list')
+        }
+
+        It 'matches by type when the recorded position points at a field of another type' {
+            $Identity = [ordered]@{ id = $script:SourcePresentationId; label = ''; '@odata.type' = '#microsoft.graph.groupPolicyPresentationListBox'; index = 0 }
+            $Policy = Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template -PresentationIdentity $Identity) -TenantFilter $script:Tenant -DisplayName 'Firefox' | ConvertFrom-Json
+
+            $Policy.added[1].presentationValues[0].'presentation@odata.bind' | Should -Be (New-Bind $script:TargetFirefoxId 'p-list')
+        }
+    }
+
+    Context 'the ADMX has not been imported into the target tenant' {
+        BeforeEach {
+            Mock -CommandName New-GraphBulkRequest -MockWith { New-ExistenceReply -Requests $Requests -Present @($script:BuiltInId) }
+            Mock -CommandName New-GraphGETRequest -MockWith { @() }
+        }
+
+        It 'names the missing setting and says to import the ADMX into that tenant' {
+            { Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template) -TenantFilter $script:Tenant -DisplayName 'Firefox' } |
+                Should -Throw -ExpectedMessage "*'SPNEGO'*\Mozilla\Firefox\Authentication*Import the same ADMX*$($script:Tenant)*"
+        }
+    }
+
+    Context 'a template captured before the identity was recorded' {
+        BeforeEach {
+            Mock -CommandName New-GraphBulkRequest -MockWith { New-ExistenceReply -Requests $Requests -Present @($script:BuiltInId) }
+            Mock -CommandName New-GraphGETRequest -MockWith { throw "unexpected GET $uri" }
+        }
+
+        It 'explains that the template must be re-created from the source tenant' {
+            { Resolve-CIPPIntuneAdminTemplateBinding -RawJSON (New-Template -WithoutIdentity) -TenantFilter $script:Tenant -DisplayName 'Firefox' } |
+                Should -Throw -ExpectedMessage "*$($script:SourceFirefoxId)*Re-create the template*"
+        }
+    }
+
+    Context 'a template with no settings' {
+        It 'returns the payload untouched without calling Graph' {
+            Mock -CommandName New-GraphBulkRequest -MockWith { throw 'unexpected batch' }
+            $RawJSON = '{"added":[],"updated":[],"deletedIds":[]}'
+
+            @((Resolve-CIPPIntuneAdminTemplateBinding -RawJSON $RawJSON -TenantFilter $script:Tenant | ConvertFrom-Json).added).Count | Should -Be 0
+            Should -Invoke New-GraphBulkRequest -Times 0 -Exactly
+        }
+    }
+}
diff --git a/Tests/Private/Search-CIPPBecAuditLog.Tests.ps1 b/Tests/Private/Search-CIPPBecAuditLog.Tests.ps1
new file mode 100644
index 0000000000000..dc26eb8d180ea
--- /dev/null
+++ b/Tests/Private/Search-CIPPBecAuditLog.Tests.ps1
@@ -0,0 +1,162 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams, $Anchor) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Search-CIPPBecAuditLog.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/ConvertTo-CIPPBecHostAddress.ps1')
+
+    function New-Page {
+        param([int]$From, [int]$Count, [int]$Total, [string]$Prefix = 'id')
+        foreach ($i in $From..($From + $Count - 1)) {
+            [pscustomobject]@{
+                Identity     = "$Prefix$i"
+                CreationDate = '2026-08-20T10:00:00Z'
+                Operations   = 'New-InboxRule'
+                UserIds      = 'user@contoso.com'
+                RecordType   = 'ExchangeAdmin'
+                ResultIndex  = $i
+                ResultCount  = $Total
+                AuditData    = "{`"Operation`":`"New-InboxRule`",`"Id`":$i}"
+            }
+        }
+    }
+    $script:Start = (Get-Date).AddDays(-7)
+    $script:End = Get-Date
+}
+
+Describe 'Search-CIPPBecAuditLog' {
+    BeforeEach {
+        $script:Calls = [System.Collections.Generic.List[object]]::new()
+    }
+
+    It 'returns a short page as complete with parsed AuditData' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); New-Page -From 1 -Count 3 -Total 3 }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -Operations @('New-InboxRule') -UserIds @('user@contoso.com') -PageSize 5000
+        $Result.Complete | Should -BeTrue
+        $Result.Pages | Should -Be 1
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Records.Count | Should -Be 3
+        $Result.Records[0].AuditData.Id | Should -Be 1
+        $Result.Records[0].Operation | Should -Be 'New-InboxRule'
+    }
+
+    It 'sends ReturnLargeSet, ResultSize and an array UserIds with a stable session id' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); New-Page -From 1 -Count 1 -Total 1 }
+        $null = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -Operations @('A') -UserIds 'user@contoso.com' -PageSize 100
+        $script:Calls[0].SessionCommand | Should -Be 'ReturnLargeSet'
+        $script:Calls[0].ResultSize | Should -Be 100
+        $script:Calls[0].UserIds -is [array] | Should -BeTrue
+        $script:Calls[0].SessionId | Should -Match '^CIPP-BEC-'
+    }
+
+    It 'follows full pages until the service reports the last row and reuses the session id' {
+        Mock New-ExoRequest {
+            $script:Calls.Add($cmdParams)
+            switch ($script:Calls.Count) {
+                1 { New-Page -From 1 -Count 4 -Total 10 }
+                2 { New-Page -From 5 -Count 4 -Total 10 }
+                default { New-Page -From 9 -Count 2 -Total 10 }
+            }
+        }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 4 -MaxPages 10
+        $Result.Complete | Should -BeTrue
+        $Result.Pages | Should -Be 3
+        $Result.Records.Count | Should -Be 10
+        ($script:Calls | ForEach-Object { $_.SessionId } | Select-Object -Unique).Count | Should -Be 1
+    }
+
+    It 'stops at an exact multiple of the page size when ResultIndex reaches ResultCount' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); New-Page -From 1 -Count 4 -Total 4 }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 4 -MaxPages 10
+        $Result.Complete | Should -BeTrue
+        $Result.Pages | Should -Be 1
+        $Result.Records.Count | Should -Be 4
+    }
+
+    It 'reports partial results when a leaf slice (below MinSliceMinutes) still hits the page cap' {
+        # A window smaller than MinSliceMinutes cannot be bisected further, so it caps as before.
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); New-Page -From (($script:Calls.Count - 1) * 4 + 1) -Count 4 -Total 100 }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:End.AddMinutes(-30) -EndDate $script:End -PageSize 4 -MaxPages 2 -MinSliceMinutes 60
+        $Result.Complete | Should -BeFalse
+        $Result.Pages | Should -Be 2
+        $Result.Cap | Should -Match '2 pages'
+        $Result.Records.Count | Should -Be 8
+    }
+
+    It 'bisects a page-capped window on time and covers each half with its own budget' {
+        # Full pages for a window wider than one slice => the top window caps; each 60-minute half comes
+        # back short => complete. Coverage is by time, so the whole window is searched despite the cap.
+        Mock New-ExoRequest {
+            $script:Calls.Add($cmdParams)
+            $Minutes = [int](New-TimeSpan -Start $cmdParams.StartDate -End $cmdParams.EndDate).TotalMinutes
+            # Unique ids per call so a wide window caps (rather than stalling on a repeated page).
+            if ($Minutes -gt 61) { New-Page -From ($script:Calls.Count * 4) -Count 4 -Total 100 }
+            else { New-Page -From (5000 + 10 * $script:Calls.Count) -Count 2 -Total 2 }
+        }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:End.AddMinutes(-120) -EndDate $script:End -PageSize 4 -MaxPages 2 -MinSliceMinutes 60
+        $Result.Complete | Should -BeTrue
+        $Result.Cap | Should -BeNullOrEmpty
+        $Result.Records.Count | Should -Be 4
+        # the top window paged twice (capped), then each of the two 60-minute halves was searched
+        @($script:Calls | Where-Object { [int](New-TimeSpan -Start $_.StartDate -End $_.EndDate).TotalMinutes -le 61 }).Count | Should -Be 2
+    }
+
+    It 'terminates and reports incomplete when even the smallest slice stays dense' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); New-Page -From (($script:Calls.Count - 1) * 4 + 1) -Count 4 -Total 100 }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:End.AddMinutes(-240) -EndDate $script:End -PageSize 4 -MaxPages 2 -MinSliceMinutes 60
+        $Result.Complete | Should -BeFalse
+        # bounded recursion: a 240-minute window bisected to 60-minute leaves is a handful of slices, not unbounded
+        $script:Calls.Count | Should -BeLessThan 40
+    }
+
+    It 'keeps the pages already collected when a later page errors, and reports it partial' {
+        Mock New-ExoRequest {
+            $script:Calls.Add($cmdParams)
+            if ($script:Calls.Count -eq 1) { New-Page -From 1 -Count 4 -Total 100 }
+            else { throw 'EXO transient failure' }
+        }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:End.AddMinutes(-30) -EndDate $script:End -PageSize 4 -MaxPages 5 -MinSliceMinutes 60
+        $Result.Complete | Should -BeFalse
+        $Result.Records.Count | Should -Be 4
+        $Result.Cap | Should -Match 'page error'
+        $Result.Cap | Should -Match 'EXO transient failure'
+    }
+
+    It 'stops and reports partial results when the service replays the same page' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); New-Page -From 1 -Count 4 -Total 100 }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -PageSize 4 -MaxPages 10
+        $Result.Complete | Should -BeFalse
+        $Result.Cap | Should -Match 'stalled'
+        $Result.Records.Count | Should -Be 4
+        $Result.Pages | Should -Be 2
+    }
+
+    It 'returns an empty, complete result when the search has no hits' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); $null }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End -Operations @('X')
+        $Result.Complete | Should -BeTrue
+        $Result.Records.Count | Should -Be 0
+    }
+
+    It 'keeps a record whose AuditData is not JSON instead of failing the search' {
+        Mock New-ExoRequest { $script:Calls.Add($cmdParams); [pscustomobject]@{ Identity = 'x'; Operations = 'Op'; AuditData = 'not json'; ResultIndex = 1; ResultCount = 1 } }
+        $Result = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:Start -EndDate $script:End
+        $Result.Records.Count | Should -Be 1
+        $Result.Records[0].AuditData | Should -BeNullOrEmpty
+        $Result.Records[0].Operation | Should -Be 'Op'
+    }
+
+    It 'sends bare client addresses and free text, and keeps them on every bisected slice' {
+        Mock New-ExoRequest {
+            $script:Calls.Add($cmdParams)
+            $Minutes = [int](New-TimeSpan -Start $cmdParams.StartDate -End $cmdParams.EndDate).TotalMinutes
+            if ($Minutes -gt 61) { New-Page -From ($script:Calls.Count * 4) -Count 4 -Total 100 }
+            else { New-Page -From (5000 + 10 * $script:Calls.Count) -Count 2 -Total 2 }
+        }
+        $null = Search-CIPPBecAuditLog -TenantFilter 'contoso.com' -StartDate $script:End.AddMinutes(-120) -EndDate $script:End -PageSize 4 -MaxPages 2 -MinSliceMinutes 60 -IPAddresses @('198.51.100.7:51234', '[2001:db8::1]:443', '198.51.100.7') -FreeText 'FORM1'
+        $script:Calls.Count | Should -BeGreaterThan 2
+        foreach ($Call in $script:Calls) {
+            @($Call.IPAddresses) | Should -Be @('198.51.100.7', '2001:db8::1') -Because 'the service rejects an address with a port'
+            $Call.FreeText | Should -Be 'FORM1'
+        }
+    }
+}
diff --git a/Tests/Private/Set-CIPPAssignedApplication.Tests.ps1 b/Tests/Private/Set-CIPPAssignedApplication.Tests.ps1
new file mode 100644
index 0000000000000..270e4b8cac297
--- /dev/null
+++ b/Tests/Private/Set-CIPPAssignedApplication.Tests.ps1
@@ -0,0 +1,57 @@
+# Pester tests for how Set-CIPPAssignedApplication picks its include target.
+#
+# The deploy drawers send a picked group's display name as GroupName next to its id in GroupIds.
+# The name switch (AllUsers / AllDevices / AllDevicesAndUsers) must not see that name: a group that
+# happens to be called 'AllDevices' has to resolve to the group, never to a tenant-wide target.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    # Stubs mirror the real signatures so signature drift fails loudly here.
+    function New-GraphGetRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp, $ComplexFilter) }
+    function New-GraphPOSTRequest { [CmdletBinding()] param($uri, $tenantid, $type, $body) }
+    function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $Sev2, $LogData) }
+    function Get-CippException { [CmdletBinding()] param($Exception) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:SalesId = '11111111-1111-1111-1111-111111111111'
+}
+
+Describe 'Set-CIPPAssignedApplication include target' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CippException -MockWith { [PSCustomObject]@{ NormalizedError = 'Graph said no' } }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/groups?*' } -MockWith {
+            @([PSCustomObject]@{ id = $script:SalesId; displayName = 'Sales Users' })
+        }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/assignments' } -MockWith { @() }
+        Mock -CommandName New-GraphPOSTRequest -MockWith { @{} }
+        # The function sleeps a second before posting; not worth paying for in a unit test.
+        Mock -CommandName Start-Sleep -MockWith { }
+    }
+
+    Context 'a broad target by name' {
+        It 'sends the All Devices target' {
+            $null = Set-CIPPAssignedApplication -GroupName 'AllDevices' -ApplicationId 'app-1' -Intent 'Required' -TenantFilter $script:Tenant -AssignmentMode 'replace'
+
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                ($body | ConvertFrom-Json).mobileAppAssignments.target.'@odata.type' -eq '#microsoft.graph.allDevicesAssignmentTarget'
+            }
+        }
+    }
+
+    Context 'a picked group whose display name is a broad-target token' {
+        It 'assigns the group by id instead of expanding the name to All Devices' {
+            $null = Set-CIPPAssignedApplication -GroupName 'AllDevices' -GroupIds @($script:SalesId) -ApplicationId 'app-1' -Intent 'Required' -TenantFilter $script:Tenant -AssignmentMode 'replace'
+
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                $Targets = ($body | ConvertFrom-Json).mobileAppAssignments.target
+                @($Targets).Count -eq 1 -and
+                $Targets[0].'@odata.type' -eq '#microsoft.graph.groupAssignmentTarget' -and
+                $Targets[0].groupId -eq $script:SalesId
+            }
+        }
+    }
+}
diff --git a/Tests/Private/Set-CIPPAssignedPolicy.Tests.ps1 b/Tests/Private/Set-CIPPAssignedPolicy.Tests.ps1
index f8d8a73052a70..3ca9157343760 100644
--- a/Tests/Private/Set-CIPPAssignedPolicy.Tests.ps1
+++ b/Tests/Private/Set-CIPPAssignedPolicy.Tests.ps1
@@ -90,6 +90,28 @@ Describe 'Set-CIPPAssignedPolicy' {
         }
     }
 
+    Context 'a picked group whose display name is a broad-target token' {
+        # The deploy drawers send the picked group's display name as GroupName next to its id.
+        It 'assigns the group by id instead of expanding the name to All Devices' {
+            $null = Set-CIPPAssignedPolicy -GroupName 'AllDevices' -GroupIds @($script:SalesId) -PolicyId 'policy-1' -Type 'deviceConfigurations' -TenantFilter $script:Tenant -AssignmentMode 'replace'
+
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                $Targets = ($body | ConvertFrom-Json).assignments.target
+                @($Targets).Count -eq 1 -and
+                $Targets[0].'@odata.type' -eq '#microsoft.graph.groupAssignmentTarget' -and
+                $Targets[0].groupId -eq $script:SalesId
+            }
+        }
+
+        It 'does not read a group named On as do-not-assign' {
+            $null = Set-CIPPAssignedPolicy -GroupName 'On' -GroupIds @($script:SalesId) -PolicyId 'policy-1' -Type 'deviceConfigurations' -TenantFilter $script:Tenant -AssignmentMode 'replace'
+
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                ($body | ConvertFrom-Json).assignments.target.groupId -eq $script:SalesId
+            }
+        }
+    }
+
     Context 'broad targets on a device management policy' {
         It 'sends the allLicensedUsers target' {
             $null = Set-CIPPAssignedPolicy -GroupName 'allLicensedUsers' -PolicyId 'policy-1' -Type 'deviceConfigurations' -TenantFilter $script:Tenant
diff --git a/Tests/Private/Set-CIPPIntunePolicy.Admin.Tests.ps1 b/Tests/Private/Set-CIPPIntunePolicy.Admin.Tests.ps1
new file mode 100644
index 0000000000000..e1c1439549b3d
--- /dev/null
+++ b/Tests/Private/Set-CIPPIntunePolicy.Admin.Tests.ps1
@@ -0,0 +1,99 @@
+# Pester tests for the Admin (administrative template) branch of Set-CIPPIntunePolicy.
+#
+# Settings from an imported ADMX file bind to definition ids that differ per tenant, so the template's
+# binds are resolved to the target tenant's ids before anything is written. When that resolution fails
+# the deployment must stop before a policy is created, or an empty policy is left behind.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    # Stubs mirror the real signatures so signature drift fails loudly here.
+    function New-GraphGETRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp, $ComplexFilter) }
+    function New-GraphPOSTRequest { [CmdletBinding()] param($uri, $tenantid, $type, $body, $AddedHeaders) }
+    function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $Sev2, $LogData) }
+    function Get-CippException { [CmdletBinding()] param($Exception) }
+    function Get-CIPPTextReplacement { [CmdletBinding()] param([string]$TenantFilter, $Text, [switch]$EscapeForJson) }
+    function Set-CIPPAssignedPolicy { [CmdletBinding()] param($GroupName, $PolicyId, $PlatformType, $Type, $TenantFilter, $ExcludeGroup, $AssignmentMode, $AssignmentFilterName, $AssignmentFilterType) }
+    function Resolve-CIPPIntuneAdminTemplateBinding { [CmdletBinding()] param([string]$RawJSON, [string]$TenantFilter, [string]$DisplayName, $Headers, $APIName) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Tools/Find-CIPPFuzzyPolicyMatch.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    # The stored template binds the source tenant's definition id and carries the setting's identity;
+    # the resolver's output binds the target tenant's id with the identity removed.
+    $script:StoredJSON = [ordered]@{
+        added      = @([ordered]@{ 'definition@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('f65370a6-bc40-40af-b0f3-b6f5481478c0')"; enabled = $true; presentationValues = @(); definition = @{ displayName = 'SPNEGO' } })
+        updated    = @()
+        deletedIds = @()
+    } | ConvertTo-Json -Depth 10 -Compress
+    $script:ResolvedJSON = [ordered]@{
+        added      = @([ordered]@{ 'definition@odata.bind' = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions('11111111-2222-3333-4444-555555555555')"; enabled = $true; presentationValues = @() })
+        updated    = @()
+        deletedIds = @()
+    } | ConvertTo-Json -Depth 10 -Compress
+}
+
+Describe 'Set-CIPPIntunePolicy -TemplateType Admin' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CIPPTextReplacement -MockWith { $Text }
+        Mock -CommandName Get-CippException -MockWith { [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } }
+        Mock -CommandName Set-CIPPAssignedPolicy -MockWith { }
+        Mock -CommandName Resolve-CIPPIntuneAdminTemplateBinding -MockWith { $script:ResolvedJSON }
+        Mock -CommandName New-GraphPOSTRequest -MockWith { [PSCustomObject]@{ id = 'new-policy-id' } }
+    }
+
+    Context 'deploying to a tenant that has no policy of that name' {
+        BeforeEach {
+            Mock -CommandName New-GraphGETRequest -MockWith { @() }
+        }
+
+        It 'resolves the binds for the target tenant and writes the resolved payload' {
+            $Result = Set-CIPPIntunePolicy -TemplateType 'Admin' -DisplayName 'Firefox' -Description 'desc' -RawJSON $script:StoredJSON -TenantFilter $script:Tenant
+
+            $Result | Should -BeLike '*Successfully added policy*'
+            Should -Invoke Resolve-CIPPIntuneAdminTemplateBinding -Times 1 -Exactly -ParameterFilter {
+                $RawJSON -eq $script:StoredJSON -and $TenantFilter -eq $script:Tenant -and $DisplayName -eq 'Firefox'
+            }
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                $uri -like "*groupPolicyConfigurations('new-policy-id')/updateDefinitionValues" -and $body -eq $script:ResolvedJSON
+            }
+        }
+    }
+
+    Context 'overwriting a policy that already exists' {
+        BeforeEach {
+            Mock -CommandName New-GraphGETRequest -MockWith {
+                if ($uri -like '*/definitionValues') { @([PSCustomObject]@{ id = 'old-value-1' }) }
+                else { @([PSCustomObject]@{ id = 'existing-id'; displayName = 'Firefox' }) }
+            }
+        }
+
+        It 'clears the old values and writes the resolved payload' {
+            $Result = Set-CIPPIntunePolicy -TemplateType 'Admin' -DisplayName 'Firefox' -Description 'desc' -RawJSON $script:StoredJSON -TenantFilter $script:Tenant
+
+            $Result | Should -BeLike '*Successfully edited policy*'
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                $uri -like "*groupPolicyConfigurations('existing-id')/updateDefinitionValues" -and $body -like '*"deletedIds":*"old-value-1"*'
+            }
+            Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+                $uri -like "*groupPolicyConfigurations('existing-id')/updateDefinitionValues" -and $body -eq $script:ResolvedJSON
+            }
+        }
+    }
+
+    Context 'the ADMX behind the template is not imported in the target tenant' {
+        BeforeEach {
+            Mock -CommandName New-GraphGETRequest -MockWith { @() }
+            Mock -CommandName Resolve-CIPPIntuneAdminTemplateBinding -MockWith { throw "Administrative template 'Firefox' uses settings that are not available in $TenantFilter : 'SPNEGO'" }
+        }
+
+        It 'fails with the resolver''s explanation before creating any policy' {
+            { Set-CIPPIntunePolicy -TemplateType 'Admin' -DisplayName 'Firefox' -Description 'desc' -RawJSON $script:StoredJSON -TenantFilter $script:Tenant } |
+                Should -Throw -ExpectedMessage "*not available in $($script:Tenant)*'SPNEGO'*"
+
+            Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly
+        }
+    }
+}
diff --git a/Tests/Private/Set-CIPPIntunePolicy.Assignments.Tests.ps1 b/Tests/Private/Set-CIPPIntunePolicy.Assignments.Tests.ps1
new file mode 100644
index 0000000000000..e903faa29356a
--- /dev/null
+++ b/Tests/Private/Set-CIPPIntunePolicy.Assignments.Tests.ps1
@@ -0,0 +1,99 @@
+# Pester tests for how Set-CIPPIntunePolicy forwards group targets to Set-CIPPAssignedPolicy.
+#
+# The Deploy Policy drawer sends AssignTo/ExcludeGroup as display names. When a single tenant is
+# selected it picks groups by id instead and sends GroupIds/ExcludeGroupIds alongside the names;
+# those ids must reach Set-CIPPAssignedPolicy, which prefers them over name resolution. Callers
+# that send names only (multi-tenant deploys, the IntuneTemplate standard, baselines, clone,
+# restore) must see no new parameters at all, so their name-based resolution is untouched.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    # Stubs mirror the real signatures so signature drift fails loudly here.
+    function New-GraphGETRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp, $ComplexFilter) }
+    function New-GraphPOSTRequest { [CmdletBinding()] param($uri, $tenantid, $type, $body, $AddedHeaders) }
+    function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $Sev2, $LogData) }
+    function Get-CippException { [CmdletBinding()] param($Exception) }
+    function Get-CIPPTextReplacement { [CmdletBinding()] param([string]$TenantFilter, $Text, [switch]$EscapeForJson) }
+    function Get-CIPPIntunePolicyName { [CmdletBinding()] param($TemplateType, $RawJSON, $DisplayName) }
+    function Select-CIPPIntuneAvailableSetting { [CmdletBinding()] param($Policy, [string]$TenantFilter, [switch]$ThrowOnMissingRequired) }
+    function Find-CIPPFuzzyPolicyMatch { [CmdletBinding()] param($DisplayName, $ExistingPolicies, $MaxDistance, $ODataType, $NameProperty, $TemplateId) }
+    function Set-CIPPAssignedPolicy { [CmdletBinding()] param($GroupName, $ExcludeGroup, $ExcludeGroupIds, $ExcludeGroupNames, $PolicyId, $Type, $TenantFilter, $PlatformType, $APIName, $Headers, $AssignmentFilterName, $AssignmentFilterType, $GroupIds, $GroupNames, $AssignmentMode, $AssignmentDirection) }
+    function Sync-CIPPReusablePolicySettings { [CmdletBinding()] param($TemplateInfo, $Tenant) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:RawJSON = [ordered]@{
+        name              = 'Settings Catalog Policy'
+        technologies      = 'mdm'
+        templateReference = [ordered]@{ templateId = ''; templateFamily = 'none' }
+        settings          = @()
+    } | ConvertTo-Json -Depth 10
+}
+
+Describe 'Set-CIPPIntunePolicy group id forwarding' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CIPPTextReplacement -MockWith { $Text }
+        Mock -CommandName Get-CIPPIntunePolicyName -MockWith { 'Settings Catalog Policy' }
+        Mock -CommandName Select-CIPPIntuneAvailableSetting -MockWith { $Policy }
+        # No existing policy, so the add path is taken and a fresh id comes back.
+        Mock -CommandName Find-CIPPFuzzyPolicyMatch -MockWith { $null }
+        Mock -CommandName New-GraphGETRequest -MockWith { @() }
+        Mock -CommandName New-GraphPOSTRequest -MockWith { [PSCustomObject]@{ id = 'policy-0001' } }
+        Mock -CommandName Set-CIPPAssignedPolicy -MockWith { }
+        Mock -CommandName Get-CippException -MockWith { [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } }
+    }
+
+    Context 'a deploy from the single-tenant picker (ids next to the names)' {
+        It 'passes GroupIds and ExcludeGroupIds through, keeping the names as GroupName/ExcludeGroup' {
+            $Result = Set-CIPPIntunePolicy -TemplateType 'Catalog' -DisplayName 'Settings Catalog Policy' `
+                -RawJSON $script:RawJSON -TenantFilter $script:Tenant `
+                -AssignTo 'Sales, Marketing' -ExcludeGroup 'Interns' `
+                -GroupIds @('11111111-1111-1111-1111-111111111111', '22222222-2222-2222-2222-222222222222') `
+                -ExcludeGroupIds @('33333333-3333-3333-3333-333333333333')
+
+            $Result | Should -BeLike '*Successfully added*'
+            Should -Invoke Set-CIPPAssignedPolicy -Times 1 -Exactly -ParameterFilter {
+                $PolicyId -eq 'policy-0001' -and
+                $GroupName -eq 'Sales, Marketing' -and
+                $ExcludeGroup -eq 'Interns' -and
+                @($GroupIds).Count -eq 2 -and
+                $GroupIds[1] -eq '22222222-2222-2222-2222-222222222222' -and
+                @($ExcludeGroupIds).Count -eq 1 -and
+                $ExcludeGroupIds[0] -eq '33333333-3333-3333-3333-333333333333'
+            }
+        }
+    }
+
+    Context 'a deploy with names only (several tenants, standards, baselines)' {
+        It 'does not bind GroupIds or ExcludeGroupIds at all, so name resolution is untouched' {
+            $null = Set-CIPPIntunePolicy -TemplateType 'Catalog' -DisplayName 'Settings Catalog Policy' `
+                -RawJSON $script:RawJSON -TenantFilter $script:Tenant `
+                -AssignTo 'Sales, Marketing' -ExcludeGroup 'Interns'
+
+            Should -Invoke Set-CIPPAssignedPolicy -Times 1 -Exactly -ParameterFilter {
+                $GroupName -eq 'Sales, Marketing' -and
+                $ExcludeGroup -eq 'Interns' -and
+                $null -eq $GroupIds -and
+                $null -eq $ExcludeGroupIds
+            }
+        }
+    }
+
+    Context 'a broad target with picked exclusions only' {
+        It 'forwards ExcludeGroupIds without inventing GroupIds' {
+            $null = Set-CIPPIntunePolicy -TemplateType 'Catalog' -DisplayName 'Settings Catalog Policy' `
+                -RawJSON $script:RawJSON -TenantFilter $script:Tenant `
+                -AssignTo 'AllDevices' -ExcludeGroup 'Interns' -GroupIds @() `
+                -ExcludeGroupIds @('33333333-3333-3333-3333-333333333333')
+
+            Should -Invoke Set-CIPPAssignedPolicy -Times 1 -Exactly -ParameterFilter {
+                $GroupName -eq 'AllDevices' -and
+                $null -eq $GroupIds -and
+                @($ExcludeGroupIds).Count -eq 1
+            }
+        }
+    }
+}
diff --git a/Tests/Private/Set-CIPPIntunePolicy.EncryptedOma.Tests.ps1 b/Tests/Private/Set-CIPPIntunePolicy.EncryptedOma.Tests.ps1
new file mode 100644
index 0000000000000..fbfa9f5cbc2fe
--- /dev/null
+++ b/Tests/Private/Set-CIPPIntunePolicy.EncryptedOma.Tests.ps1
@@ -0,0 +1,105 @@
+# Pester tests for encrypted OMA-URI secrets in custom device configuration templates.
+#
+# Graph returns an OMA-URI secret as a placeholder (value 'PGEvPg==', isEncrypted, secretReferenceValueId)
+# tied to the source tenant. Capture decrypts it; if that fails, or a template arrives from elsewhere still
+# encrypted, the placeholder can never be deployed ("SecretReferenceValueId invalid for create") and the
+# source tenant can't be identified to recover it. Both capture and deploy therefore refuse it.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+
+    # Stubs mirror the real signatures so signature drift fails loudly here.
+    function New-GraphGetRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp, $ComplexFilter) }
+    function New-GraphPOSTRequest { [CmdletBinding()] param($uri, $tenantid, $type, $body, $AddedHeaders) }
+    function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $Sev2, $LogData) }
+    function Get-CippException { [CmdletBinding()] param($Exception) }
+    function Get-CIPPTextReplacement { [CmdletBinding()] param([string]$TenantFilter, $Text, [switch]$EscapeForJson) }
+    function Find-CIPPFuzzyPolicyMatch { [CmdletBinding()] param($DisplayName, $ExistingPolicies, $MaxDistance, $ODataType, $NameProperty, $TemplateId) }
+    function Set-CIPPAssignedPolicy { [CmdletBinding()] param($GroupName, $PolicyId, $PlatformType, $Type, $TenantFilter, $ExcludeGroup, $AssignmentMode, $AssignmentFilterName, $AssignmentFilterType) }
+    function Get-NormalizedError { [CmdletBinding()] param($Message) }
+
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/GraphHelper/Get-CIPPOmaSettingDecryptedValue.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/New-CIPPIntuneTemplate.ps1')
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+
+    function New-CustomPolicy {
+        param([switch]$Encrypted)
+        $Setting = if ($Encrypted) {
+            [ordered]@{ '@odata.type' = '#microsoft.graph.omaSettingStringXml'; displayName = 'AppLocker EXE'; omaUri = './Vendor/MSFT/AppLocker/x'; value = 'PGEvPg=='; isEncrypted = $true; secretReferenceValueId = 'abc_1' }
+        } else {
+            [ordered]@{ '@odata.type' = '#microsoft.graph.omaSettingStringXml'; displayName = 'AppLocker EXE'; omaUri = './Vendor/MSFT/AppLocker/x'; value = 'PFJ1bGVzLz4='; isEncrypted = $false }
+        }
+        [pscustomobject]@{
+            '@odata.type' = '#microsoft.graph.windows10CustomConfiguration'
+            displayName   = 'App Locker'
+            omaSettings   = @([pscustomobject]$Setting)
+        }
+    }
+}
+
+Describe 'Set-CIPPIntunePolicy -TemplateType Device (encrypted OMA-URI settings)' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Get-CIPPTextReplacement -MockWith { $Text }
+        Mock -CommandName Find-CIPPFuzzyPolicyMatch -MockWith { $null }
+        Mock -CommandName Set-CIPPAssignedPolicy -MockWith { }
+        Mock -CommandName Get-CippException -MockWith { [PSCustomObject]@{ NormalizedError = $Exception.Exception.Message } }
+        Mock -CommandName New-GraphGetRequest -MockWith { @() }
+        Mock -CommandName New-GraphPOSTRequest -MockWith { [PSCustomObject]@{ id = 'new-policy-id' } }
+    }
+
+    It 'refuses a template still holding the encrypted placeholder, naming the setting, without posting' {
+        $RawJSON = New-CustomPolicy -Encrypted | ConvertTo-Json -Depth 10
+
+        { Set-CIPPIntunePolicy -TemplateType 'Device' -DisplayName 'App Locker' -RawJSON $RawJSON -TenantFilter $script:Tenant } |
+            Should -Throw -ExpectedMessage "*undecrypted OMA-URI setting(s) 'AppLocker EXE'*Recapture*"
+
+        Should -Invoke New-GraphPOSTRequest -Times 0 -Exactly
+    }
+
+    It 'deploys a template whose OMA-URI values are plaintext' {
+        $RawJSON = New-CustomPolicy | ConvertTo-Json -Depth 10
+
+        Set-CIPPIntunePolicy -TemplateType 'Device' -DisplayName 'App Locker' -RawJSON $RawJSON -TenantFilter $script:Tenant |
+            Should -BeLike 'Successfully added policy*'
+
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly
+    }
+}
+
+Describe 'New-CIPPIntuneTemplate -URLName deviceConfigurations (encrypted OMA-URI settings)' {
+    BeforeEach {
+        Mock -CommandName New-GraphGetRequest -MockWith { New-CustomPolicy -Encrypted }
+    }
+
+    It 'throws instead of storing the placeholder when decryption leaves it in place' {
+        Mock -CommandName Get-CIPPOmaSettingDecryptedValue -MockWith { $DeviceConfiguration }
+
+        { New-CIPPIntuneTemplate -URLName 'deviceConfigurations' -ID 'policy-id' -TenantFilter $script:Tenant } |
+            Should -Throw -ExpectedMessage "*Could not decrypt*'AppLocker EXE'*not saved*logbook*DeviceManagementConfiguration.Read.All*"
+    }
+
+    It 'captures the template once the secret is decrypted' {
+        Mock -CommandName Get-CIPPOmaSettingDecryptedValue -MockWith { New-CustomPolicy }
+
+        $Result = New-CIPPIntuneTemplate -URLName 'deviceConfigurations' -ID 'policy-id' -TenantFilter $script:Tenant
+
+        $Result.Type | Should -Be 'Device'
+        $Result.TemplateJson | Should -Not -Match 'PGEvPg=='
+    }
+}
+
+Describe 'Get-CIPPOmaSettingDecryptedValue (decrypt failure)' {
+    It 'writes the Graph error to the logbook so the capture error can point there' {
+        Mock -CommandName New-GraphGetRequest -MockWith { throw 'Forbidden' }
+        Mock -CommandName Get-NormalizedError -MockWith { $Message }
+        Mock -CommandName Write-LogMessage -MockWith { }
+
+        $Result = Get-CIPPOmaSettingDecryptedValue -DeviceConfiguration (New-CustomPolicy -Encrypted) -DeviceConfigurationId 'policy-id' -TenantFilter $script:Tenant -WarningAction SilentlyContinue
+
+        $Result.omaSettings[0].secretReferenceValueId | Should -Be 'abc_1'
+        Should -Invoke Write-LogMessage -Times 1 -Exactly -ParameterFilter { $message -like "*'AppLocker EXE'*Forbidden*" -and $tenant -eq $script:Tenant }
+    }
+}
diff --git a/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1 b/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1
index b72aa20b4044e..efdb0545a6d9e 100644
--- a/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1
+++ b/Tests/Private/Set-CIPPMCPClientApp.Tests.ps1
@@ -1,42 +1,34 @@
-# Pester tests for Set-CIPPMCPClientApp
-# Focused on the offline_access change: the MCP client app registration must declare
-# offline_access (Microsoft Graph, delegated) additively - preserving existing permissions - and
-# admin-consent it via Grant-CippAppGraphConsent, so Entra issues a refresh token and clients stop
-# re-authenticating every hour.
+# Pester tests for Set-CIPPMCPClientApp - configures an MCPAllowed API client as an MCP OAuth client
+# against the dedicated CIPP-MCP resource app (split-app model, so refresh is not AADSTS90009).
 
 BeforeAll {
     $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
     $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1'
 
     function New-GraphGetRequest { param($uri, $NoAuthCheck, $AsApp) }
-    function New-GraphPOSTRequest { param($uri, $body, $type, $NoAuthCheck, $AsApp) }
+    function New-GraphPOSTRequest { param($uri, $body, $type, $NoAuthCheck, $asapp) }
     function Get-CippMcpKnownClients { }
-    function Grant-CippAppGraphConsent { param($AppId, $Scopes) }
+    function Grant-CippAppGraphConsent { param($AppId, $Scopes, $ResourceAppId) }
+    function Set-CippMcpResourcePreAuth { param($ResourceObjectId, $ClientAppId, $ScopeId) }
     function Write-LogMessage { param($headers, $API, $message, $Sev) }
+    function New-CIPPMcpResourceApp { param($Headers) }
 
     . $FunctionPath
 
     $script:GraphResourceId = '00000003-0000-0000-c000-000000000000'
-    $script:UserRead = 'e1fe6dd8-ba31-4d61-89e7-88639da4683d'
     $script:OfflineAccess = '7427e0e9-2fba-42fe-b0c0-848c9e6a8182'
 }
 
-Describe 'Set-CIPPMCPClientApp offline_access' {
+Describe 'Set-CIPPMCPClientApp' {
     BeforeEach {
         $script:AppId = '55555555-5555-5555-5555-555555555555'
-        $script:AppObjectId = 'mcp-app-object-id'
+        $script:AppObjectId = 'client-app-object-id'
+        $script:ResourceAppId = 'resource-app'
+        $script:ScopeId = 'uimp-id'
 
         $script:OriginalHostname = $env:WEBSITE_HOSTNAME
         $env:WEBSITE_HOSTNAME = 'cipp-backend.azurewebsites.net'
 
-        # App starts with only the Graph User.Read delegated permission (what New-CIPPAPIConfig creates).
-        $script:AppRequiredResourceAccess = @(
-            [PSCustomObject]@{
-                resourceAppId  = $script:GraphResourceId
-                resourceAccess = @([PSCustomObject]@{ id = $script:UserRead; type = 'Scope' })
-            }
-        )
-
         Mock -CommandName Get-CippMcpKnownClients -MockWith {
             [PSCustomObject]@{
                 PublicClientRedirectUris = @('https://claude.ai/api/mcp/auth_callback')
@@ -46,17 +38,23 @@ Describe 'Set-CIPPMCPClientApp offline_access' {
         }
         Mock -CommandName Write-LogMessage -MockWith { }
         Mock -CommandName Grant-CippAppGraphConsent -MockWith { [PSCustomObject]@{ AppId = $AppId; Action = 'created'; Scopes = $Scopes } }
+        Mock -CommandName Set-CippMcpResourcePreAuth -MockWith { $true }
+        Mock -CommandName New-CIPPMcpResourceApp -MockWith { @{ AppId = $script:ResourceAppId; ObjectId = 'res-obj'; ScopeId = $script:ScopeId } }
         Mock -CommandName New-GraphPOSTRequest -MockWith { }
         Mock -CommandName New-GraphGetRequest -MockWith {
             [PSCustomObject]@{
                 id                     = $script:AppObjectId
                 appId                  = $script:AppId
                 identifierUris         = @("api://$script:AppId")
-                api                    = [PSCustomObject]@{ oauth2PermissionScopes = @(); preAuthorizedApplications = @() }
                 web                    = [PSCustomObject]@{ redirectUris = @("https://$($env:WEBSITE_HOSTNAME)/.auth/login/aad/callback") }
                 spa                    = [PSCustomObject]@{ redirectUris = @() }
                 publicClient           = [PSCustomObject]@{ redirectUris = @() }
-                requiredResourceAccess = $script:AppRequiredResourceAccess
+                requiredResourceAccess = @(
+                    [PSCustomObject]@{
+                        resourceAppId  = $script:GraphResourceId
+                        resourceAccess = @([PSCustomObject]@{ id = 'e1fe6dd8-ba31-4d61-89e7-88639da4683d'; type = 'Scope' })
+                    }
+                )
             }
         }
     }
@@ -65,32 +63,61 @@ Describe 'Set-CIPPMCPClientApp offline_access' {
         $env:WEBSITE_HOSTNAME = $script:OriginalHostname
     }
 
-    It 'adds offline_access to the Graph requiredResourceAccess entry, preserving existing scopes' {
+    It 'ensures the dedicated CIPP-MCP resource app exists' {
         Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{}
+        Should -Invoke -CommandName New-CIPPMcpResourceApp -Times 1 -Exactly
+    }
 
-        Should -Invoke -CommandName New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+    It 'adds the resource user_impersonation permission to the client requiredResourceAccess' {
+        Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{}
+        Should -Invoke -CommandName New-GraphPOSTRequest -ParameterFilter {
             $type -eq 'PATCH' -and
-            $uri -eq "https://graph.microsoft.com/v1.0/applications/$script:AppObjectId" -and
             $(
-                $GraphAccess = (($body | ConvertFrom-Json).requiredResourceAccess | Where-Object { $_.resourceAppId -eq $script:GraphResourceId }).resourceAccess.id
-                ($GraphAccess -contains $script:OfflineAccess) -and ($GraphAccess -contains $script:UserRead)
+                $Rra = ($body | ConvertFrom-Json).requiredResourceAccess
+                $ResAccess = ($Rra | Where-Object { $_.resourceAppId -eq $script:ResourceAppId }).resourceAccess.id
+                ($ResAccess -contains $script:ScopeId)
             )
         }
     }
 
-    It 'admin-consents offline_access for the app' {
+    It 'adds the known public callbacks and offline_access to the client' {
         Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{}
+        Should -Invoke -CommandName New-GraphPOSTRequest -ParameterFilter {
+            $type -eq 'PATCH' -and
+            $(
+                $Parsed = $body | ConvertFrom-Json
+                $GraphAccess = ($Parsed.requiredResourceAccess | Where-Object { $_.resourceAppId -eq $script:GraphResourceId }).resourceAccess.id
+                (@($Parsed.publicClient.redirectUris) -contains 'https://claude.ai/api/mcp/auth_callback') -and
+                ($GraphAccess -contains $script:OfflineAccess) -and
+                ($Parsed.isFallbackPublicClient -eq $true)
+            )
+        }
+    }
 
-        Should -Invoke -CommandName Grant-CippAppGraphConsent -Times 1 -Exactly -ParameterFilter {
+    It 'pre-authorizes the client on the resource user_impersonation scope (no consent grant needed)' {
+        Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{}
+        Should -Invoke -CommandName Set-CippMcpResourcePreAuth -ParameterFilter {
+            $ClientAppId -eq $script:AppId -and $ResourceObjectId -eq 'res-obj' -and $ScopeId -eq $script:ScopeId
+        }
+    }
+
+    It 'admin-consents the client on Graph offline_access' {
+        Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{}
+        Should -Invoke -CommandName Grant-CippAppGraphConsent -ParameterFilter {
             $AppId -eq $script:AppId -and ($Scopes -contains 'offline_access')
         }
     }
 
+    It 'returns success with the resource app id' {
+        $Result = Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{}
+        $Result.Success | Should -BeTrue
+        $Result.ResourceAppId | Should -Be $script:ResourceAppId
+        $Result.ClientAppId | Should -Be $script:AppId
+    }
+
     It 'does not fail the configuration when the consent grant throws' {
         Mock -CommandName Grant-CippAppGraphConsent -MockWith { throw 'Insufficient privileges' }
-
         $Result = Set-CIPPMCPClientApp -AppId $script:AppId -Headers @{}
-
         $Result.Success | Should -BeTrue
     }
 }
diff --git a/Tests/Private/Set-CIPPSAMCertificate.Tests.ps1 b/Tests/Private/Set-CIPPSAMCertificate.Tests.ps1
index c84734e881577..c427b323059aa 100644
--- a/Tests/Private/Set-CIPPSAMCertificate.Tests.ps1
+++ b/Tests/Private/Set-CIPPSAMCertificate.Tests.ps1
@@ -57,4 +57,15 @@ Describe 'Set-CIPPSAMCertificate dev-mode storage' {
         $script:Written.applicationid | Should -Be 'app-a'
         $script:Written.SAMCertificate | Should -Be 'bmV3'
     }
+
+    It 'copies the prior SAMCertificate to SAMCertificatePrevious on rotate' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [PSCustomObject]@{ PartitionKey = 'Secret'; RowKey = 'Secret'; SAMCertificate = 'b2xk' }
+        }
+
+        $null = Set-CIPPSAMCertificate -PfxBase64 'bmV3'
+
+        $script:Written.SAMCertificatePrevious | Should -Be 'b2xk'
+        $script:Written.SAMCertificate | Should -Be 'bmV3'
+    }
 }
diff --git a/Tests/Private/Set-CippMcpResourcePreAuth.Tests.ps1 b/Tests/Private/Set-CippMcpResourcePreAuth.Tests.ps1
new file mode 100644
index 0000000000000..44139ec91d65c
--- /dev/null
+++ b/Tests/Private/Set-CippMcpResourcePreAuth.Tests.ps1
@@ -0,0 +1,59 @@
+# Pester tests for Set-CippMcpResourcePreAuth - pre-authorizes an MCP client on the CIPP-MCP
+# resource's user_impersonation scope so the client -> resource token needs no consent.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Authentication/Set-CippMcpResourcePreAuth.ps1')
+
+    function New-GraphGetRequest { param($uri, $NoAuthCheck, $asapp) }
+    function New-GraphPOSTRequest { param($uri, $body, $type, $NoAuthCheck, $asapp) }
+}
+
+Describe 'Set-CippMcpResourcePreAuth' {
+    BeforeEach {
+        $script:ResourceObjectId = 'res-obj'
+        $script:ClientAppId = '55555555-5555-5555-5555-555555555555'
+        $script:ScopeId = 'uimp-id'
+        Mock -CommandName New-GraphPOSTRequest -MockWith { }
+    }
+
+    It 'adds a new client to preAuthorizedApplications and returns true' {
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{ api = [PSCustomObject]@{ preAuthorizedApplications = @() } }
+        }
+        $Result = Set-CippMcpResourcePreAuth -ResourceObjectId $script:ResourceObjectId -ClientAppId $script:ClientAppId -ScopeId $script:ScopeId
+        $Result | Should -BeTrue
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+            $type -eq 'PATCH' -and $uri -like '*applications/res-obj*' -and
+            $(
+                $Pre = ($body | ConvertFrom-Json).api.preAuthorizedApplications
+                $Match = $Pre | Where-Object { $_.appId -eq $script:ClientAppId }
+                ($Match.delegatedPermissionIds -contains $script:ScopeId)
+            )
+        }
+    }
+
+    It 'is a no-op (no PATCH) when the client is already pre-authorized' {
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{ api = [PSCustomObject]@{ preAuthorizedApplications = @(
+                        [PSCustomObject]@{ appId = $script:ClientAppId; delegatedPermissionIds = @($script:ScopeId) }
+                    ) } }
+        }
+        $Result = Set-CippMcpResourcePreAuth -ResourceObjectId $script:ResourceObjectId -ClientAppId $script:ClientAppId -ScopeId $script:ScopeId
+        $Result | Should -BeFalse
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 0 -Exactly
+    }
+
+    It 'preserves other pre-authorized clients when adding one' {
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{ api = [PSCustomObject]@{ preAuthorizedApplications = @(
+                        [PSCustomObject]@{ appId = 'other-client'; delegatedPermissionIds = @('other-scope') }
+                    ) } }
+        }
+        Set-CippMcpResourcePreAuth -ResourceObjectId $script:ResourceObjectId -ClientAppId $script:ClientAppId -ScopeId $script:ScopeId
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 1 -Exactly -ParameterFilter {
+            $Pre = ($body | ConvertFrom-Json).api.preAuthorizedApplications
+            (@($Pre.appId) -contains 'other-client') -and (@($Pre.appId) -contains $script:ClientAppId)
+        }
+    }
+}
diff --git a/Tests/Private/Start-CIPPBecContainmentJob.Tests.ps1 b/Tests/Private/Start-CIPPBecContainmentJob.Tests.ps1
new file mode 100644
index 0000000000000..0479afe1fd246
--- /dev/null
+++ b/Tests/Private/Start-CIPPBecContainmentJob.Tests.ps1
@@ -0,0 +1,34 @@
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    function New-CIPPAsyncDeployment { param($JobId, $Names, $StepTitles, $Source, $TaskId, $TenantFilter) }
+    function Add-CIPPScheduledTask { param($Task, $Hidden, [switch]$RunNow, $Headers) }
+    function Set-CIPPAsyncDeploymentStatus { param($JobId, $Name, $Status, $Logs) }
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/BEC/Start-CIPPBecContainmentJob.ps1')
+}
+
+Describe 'Start-CIPPBecContainmentJob' {
+    BeforeEach {
+        Mock New-CIPPAsyncDeployment { 'job-1' }
+        Mock Add-CIPPScheduledTask { 'Task BEC remediation: victim@contoso.com scheduled to run now' }
+        Mock Set-CIPPAsyncDeploymentStatus { }
+    }
+
+    It 'creates the progress row, then queues a run-now containment task that reports to it' {
+        $Id = Start-CIPPBecContainmentJob -TenantFilter 'contoso.com' -UserId 'u1' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions', 'BlockProtocols') -Parameters ([pscustomobject]@{ Protocols = @('IMAP') }) -CaseId 'BEC-1' -Headers 'h'
+        $Id | Should -Be 'job-1'
+        Should -Invoke New-CIPPAsyncDeployment -Times 1 -ParameterFilter { $Names -contains 'victim@contoso.com' -and $Source -eq 'BECRemediation' -and $TenantFilter -eq 'contoso.com' }
+        Should -Invoke Add-CIPPScheduledTask -Times 1 -ParameterFilter {
+            $RunNow.IsPresent -and $Hidden -eq $false -and $Headers -eq 'h' -and
+            $Task.Command.value -eq 'Invoke-CIPPBecContainment' -and $Task.TenantFilter -eq 'contoso.com' -and
+            $Task.Parameters.DeploymentId -eq 'job-1' -and $Task.Parameters.CaseId -eq 'BEC-1' -and $Task.Parameters.UserId -eq 'u1' -and
+            $Task.Parameters.Confirmed -and $Task.Parameters.Redacted -and $Task.Parameters.Parameters.Protocols -contains 'IMAP' -and
+            (@($Task.Parameters.Actions) -join ',') -eq 'RevokeSessions,BlockProtocols'
+        }
+    }
+
+    It 'throws the scheduler refusal and marks the progress row failed' {
+        Mock Add-CIPPScheduledTask { "Error - The command 'Invoke-CIPPBecContainment' is not permitted to run as a scheduled task." }
+        { Start-CIPPBecContainmentJob -TenantFilter 'contoso.com' -UserPrincipalName 'victim@contoso.com' -Actions @('RevokeSessions') } | Should -Throw '*not permitted*'
+        Should -Invoke Set-CIPPAsyncDeploymentStatus -Times 1 -ParameterFilter { $JobId -eq 'job-1' -and $Status -eq 'failed' }
+    }
+}
diff --git a/Tests/Private/Update-CIPPSAMCertificate.Tests.ps1 b/Tests/Private/Update-CIPPSAMCertificate.Tests.ps1
new file mode 100644
index 0000000000000..476002fffe373
--- /dev/null
+++ b/Tests/Private/Update-CIPPSAMCertificate.Tests.ps1
@@ -0,0 +1,330 @@
+# Pester tests for Update-CIPPSAMCertificate reconcile / renew / drift / bootstrap
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $UpdatePath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Update-CIPPSAMCertificate.ps1'
+    $NewCertPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/New-CIPPSAMCertificate.ps1'
+    $VersionsPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPSAMCertificateVersions.ps1'
+
+    function Get-CIPPSAMCertificateVersions { }
+    function Get-CIPPSAMCertificate { param([switch]$SkipCache) }
+    function New-GraphGetRequest { }
+    function New-GraphPOSTRequest { }
+    function New-CIPPSAMCertificate { }
+    function Set-CIPPSAMCertificate { }
+    function Update-AppManagementPolicy { }
+    function Write-LogMessage { }
+    function Get-CippException { param($Exception) @{ message = $Exception.Exception.Message } }
+
+    . $NewCertPath
+    . $VersionsPath
+    . $UpdatePath
+
+    $script:CurrentCert = New-CIPPSAMCertificate -SubjectName 'CN=CIPP-SAM-Current'
+    $script:PreviousCert = New-CIPPSAMCertificate -SubjectName 'CN=CIPP-SAM-Previous'
+    $script:HistoricalCert = New-CIPPSAMCertificate -SubjectName 'CN=CIPP-SAM-Historical'
+    $script:OrphanCert = New-CIPPSAMCertificate -SubjectName 'CN=CIPP-SAM-Orphan'
+    $script:UnknownCert = New-CIPPSAMCertificate -SubjectName 'CN=Manual-Unknown'
+    $script:MintedCert = New-CIPPSAMCertificate -SubjectName 'CN=CIPP-SAM-Minted'
+    $script:OrphanCerts = @(1..5 | ForEach-Object { New-CIPPSAMCertificate -SubjectName "CN=CIPP-SAM-Orphan-$_" })
+
+    $script:AppObjectId = 'app-object-id'
+    $env:ApplicationID = 'sam-app-id'
+    $env:WEBSITE_SITE_NAME = 'cipp-test'
+
+    function script:New-MockCredential {
+        param(
+            [string]$Thumbprint,
+            [string]$DisplayName,
+            [string]$KeyId = ([guid]::NewGuid().ToString())
+        )
+        [PSCustomObject]@{
+            keyId               = $KeyId
+            customKeyIdentifier = $Thumbprint
+            displayName         = $DisplayName
+            type                = 'AsymmetricX509Cert'
+            usage               = 'Verify'
+            endDateTime         = (Get-Date).ToUniversalTime().AddDays(200)
+        }
+    }
+
+    function script:New-MockVersions {
+        param(
+            $Current = $null,
+            $Previous = $null,
+            [string[]]$Historical = @()
+        )
+        $All = [System.Collections.Generic.List[string]]::new()
+        if ($Current) { $All.Add($Current.Thumbprint) }
+        if ($Previous) { $All.Add($Previous.Thumbprint) }
+        foreach ($H in $Historical) { $All.Add($H) }
+        [PSCustomObject]@{
+            Current               = $Current
+            Previous              = $Previous
+            HistoricalThumbprints = @($Historical)
+            AllKnownThumbprints   = @($All)
+        }
+    }
+}
+
+Describe 'Update-CIPPSAMCertificate' {
+    BeforeEach {
+        $script:PatchBodies = [System.Collections.Generic.List[string]]::new()
+        $script:MintCalled = $false
+        $script:SetCalled = $false
+
+        Mock -CommandName Update-AppManagementPolicy -MockWith { @{ PolicyAction = $null } }
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName New-GraphPOSTRequest -MockWith {
+            param($type, $uri, $Body)
+            $script:PatchBodies.Add([string]$Body)
+        }
+        Mock -CommandName New-CIPPSAMCertificate -MockWith {
+            $script:MintCalled = $true
+            $script:MintedCert
+        }
+        Mock -CommandName Set-CIPPSAMCertificate -MockWith {
+            $script:SetCalled = $true
+            @{ StorageMode = 'Secret'; Name = 'SAMCertificate' }
+        }
+    }
+
+    It 'no-ops when current is healthy on app with no removable extras' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions -Current $script:CurrentCert -Previous $script:PreviousCert
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:CurrentCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)')
+                    (New-MockCredential -Thumbprint $script:PreviousCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)')
+                )
+            }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Renewed | Should -BeFalse
+        $Result.Reconciled | Should -BeFalse
+        $script:PatchBodies.Count | Should -Be 0
+        $script:MintCalled | Should -BeFalse
+    }
+
+    It 'reconciles CIPP displayName orphans without minting' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions -Current $script:CurrentCert
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            $Creds = [System.Collections.Generic.List[object]]::new()
+            $Creds.Add((New-MockCredential -Thumbprint $script:CurrentCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)'))
+            foreach ($Orphan in $script:OrphanCerts) {
+                $Creds.Add((New-MockCredential -Thumbprint $Orphan.Thumbprint -DisplayName "CIPP-SAM Certificate (orphan)"))
+            }
+            [PSCustomObject]@{ id = $script:AppObjectId; keyCredentials = @($Creds) }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Renewed | Should -BeFalse
+        $Result.Reconciled | Should -BeTrue
+        $Result.RemovedCount | Should -Be 5
+        $script:MintCalled | Should -BeFalse
+        $script:PatchBodies.Count | Should -Be 1
+        $Parsed = $script:PatchBodies[0] | ConvertFrom-Json
+        @($Parsed.keyCredentials).Count | Should -Be 1
+        $Parsed.keyCredentials[0].customKeyIdentifier | Should -Be $script:CurrentCert.Thumbprint
+    }
+
+    It 'removes extras whose thumbprint is in HistoricalThumbprints' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions -Current $script:CurrentCert -Historical @($script:HistoricalCert.Thumbprint)
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:CurrentCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)')
+                    (New-MockCredential -Thumbprint $script:HistoricalCert.Thumbprint -DisplayName 'Some Other Name')
+                )
+            }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Reconciled | Should -BeTrue
+        $Result.RemovedCount | Should -Be 1
+        $Parsed = $script:PatchBodies[0] | ConvertFrom-Json
+        @($Parsed.keyCredentials).Count | Should -Be 1
+    }
+
+    It 'preserves unknown credentials not in KV history' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions -Current $script:CurrentCert
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:CurrentCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)')
+                    (New-MockCredential -Thumbprint $script:UnknownCert.Thumbprint -DisplayName 'Customer Manual Cert')
+                )
+            }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Renewed | Should -BeFalse
+        $Result.Reconciled | Should -BeFalse
+        $script:PatchBodies.Count | Should -Be 0
+    }
+
+    It 're-registers current on drift without minting' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions -Current $script:CurrentCert
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:UnknownCert.Thumbprint -DisplayName 'Customer Manual Cert')
+                )
+            }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Renewed | Should -BeFalse
+        $Result.Reconciled | Should -BeTrue
+        $Result.Drift | Should -BeTrue
+        $script:MintCalled | Should -BeFalse
+        $script:SetCalled | Should -BeFalse
+        $Parsed = $script:PatchBodies[0] | ConvertFrom-Json
+        $Keys = @($Parsed.keyCredentials)
+        $Keys.Count | Should -Be 2
+        ($Keys | Where-Object { $_.key -eq $script:CurrentCert.PublicKeyBase64 }).Count | Should -Be 1
+    }
+
+    It 'mints on near expiry and keeps previous current plus new' {
+        $Expiring = [PSCustomObject]@{
+            Certificate     = $script:CurrentCert.Certificate
+            Thumbprint      = $script:CurrentCert.Thumbprint
+            NotBefore       = $script:CurrentCert.NotBefore
+            NotAfter        = (Get-Date).ToUniversalTime().AddDays(10)
+            PfxBase64       = $script:CurrentCert.PfxBase64
+            PublicKeyBase64 = $script:CurrentCert.PublicKeyBase64
+        }
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions -Current $Expiring -Previous $script:PreviousCert
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:CurrentCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)')
+                    (New-MockCredential -Thumbprint $script:PreviousCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)')
+                )
+            }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Renewed | Should -BeTrue
+        $script:MintCalled | Should -BeTrue
+        $script:SetCalled | Should -BeTrue
+        $Parsed = $script:PatchBodies[0] | ConvertFrom-Json
+        $Keys = @($Parsed.keyCredentials)
+        # Old previous dropped; old current kept; new added
+        $Keys.Count | Should -Be 2
+        ($Keys | Where-Object { $_.customKeyIdentifier -eq $script:CurrentCert.Thumbprint }).Count | Should -Be 1
+        ($Keys | Where-Object { $_.key -eq $script:MintedCert.PublicKeyBase64 }).Count | Should -Be 1
+        ($Keys | Where-Object { $_.customKeyIdentifier -eq $script:PreviousCert.Thumbprint }).Count | Should -Be 0
+    }
+
+    It 'bootstraps with no current and drops CIPP extras keeping unknowns' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:OrphanCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (debris)')
+                    (New-MockCredential -Thumbprint $script:UnknownCert.Thumbprint -DisplayName 'Customer Manual Cert')
+                )
+            }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Renewed | Should -BeTrue
+        $script:MintCalled | Should -BeTrue
+        $Parsed = $script:PatchBodies[0] | ConvertFrom-Json
+        $Keys = @($Parsed.keyCredentials)
+        $Keys.Count | Should -Be 2
+        ($Keys | Where-Object { $_.customKeyIdentifier -eq $script:UnknownCert.Thumbprint }).Count | Should -Be 1
+        ($Keys | Where-Object { $_.key -eq $script:MintedCert.PublicKeyBase64 }).Count | Should -Be 1
+        ($Keys | Where-Object { $_.customKeyIdentifier -eq $script:OrphanCert.Thumbprint }).Count | Should -Be 0
+    }
+
+    It 'rolls back only the new key when storage fails after mint' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith {
+            New-MockVersions
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:UnknownCert.Thumbprint -DisplayName 'Customer Manual Cert')
+                )
+            }
+        }
+        Mock -CommandName Set-CIPPSAMCertificate -MockWith { throw 'kv failed' }
+
+        { Update-CIPPSAMCertificate } | Should -Throw 'kv failed'
+        $script:PatchBodies.Count | Should -Be 2
+        $Rollback = $script:PatchBodies[1] | ConvertFrom-Json
+        $Keys = @($Rollback.keyCredentials)
+        ($Keys | Where-Object { $_.key -eq $script:MintedCert.PublicKeyBase64 }).Count | Should -Be 0
+        ($Keys | Where-Object { $_.customKeyIdentifier -eq $script:UnknownCert.Thumbprint }).Count | Should -Be 1
+    }
+
+    It 'falls back to latest cert when versions load fails and does not mint' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith { throw 'versions unavailable' }
+        Mock -CommandName Get-CIPPSAMCertificate -MockWith {
+            [PSCustomObject]@{
+                Certificate = $script:CurrentCert.Certificate
+                Thumbprint  = $script:CurrentCert.Thumbprint
+                NotBefore   = $script:CurrentCert.NotBefore
+                NotAfter    = $script:CurrentCert.NotAfter
+            }
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{
+                id             = $script:AppObjectId
+                keyCredentials = @(
+                    (New-MockCredential -Thumbprint $script:CurrentCert.Thumbprint -DisplayName 'CIPP-SAM Certificate (cipp-test)')
+                )
+            }
+        }
+
+        $Result = Update-CIPPSAMCertificate
+
+        $Result.Renewed | Should -BeFalse
+        $Result.Thumbprint | Should -Be $script:CurrentCert.Thumbprint
+        $script:MintCalled | Should -BeFalse
+        $script:PatchBodies.Count | Should -Be 0
+    }
+
+    It 'fails closed when versions and latest cert loads both fail' {
+        Mock -CommandName Get-CIPPSAMCertificateVersions -MockWith { throw 'versions unavailable' }
+        Mock -CommandName Get-CIPPSAMCertificate -MockWith { throw 'secret unavailable' }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            [PSCustomObject]@{ id = $script:AppObjectId; keyCredentials = @() }
+        }
+
+        { Update-CIPPSAMCertificate } | Should -Throw -ExceptionType ([System.Exception]) -ExpectedMessage '*temporarily unavailable*'
+        $script:MintCalled | Should -BeFalse
+        $script:PatchBodies.Count | Should -Be 0
+    }
+}
\ No newline at end of file
diff --git a/Tests/Reports/Add-CIPPImage.Tests.ps1 b/Tests/Reports/Add-CIPPImage.Tests.ps1
index 49c6e83419e84..1ed519bf3f2c5 100644
--- a/Tests/Reports/Add-CIPPImage.Tests.ps1
+++ b/Tests/Reports/Add-CIPPImage.Tests.ps1
@@ -46,6 +46,13 @@ Describe 'Add-CIPPImage' {
                 Should -Be 'image/svg+xml'
         }
 
+        It 'accepts every format the report engine draws, whatever the case of the subtype' {
+            foreach ($Type in 'PNG', 'jpg', 'gif', 'bmp', 'tiff', 'webp') {
+                (Add-CIPPImage -PartitionKey 'logo' -Data (New-DataUrl -Type $Type)).contentType |
+                    Should -Be "image/$($Type.ToLowerInvariant())"
+            }
+        }
+
         It 'stores the original data URL, not just the decoded bytes' {
             $Url = New-DataUrl
             Add-CIPPImage -PartitionKey 'logo' -Data $Url | Out-Null
@@ -88,6 +95,12 @@ Describe 'Add-CIPPImage' {
                 Should -Throw '*Invalid image format*'
         }
 
+        It 'rejects an image format the report engine cannot draw' {
+            { Add-CIPPImage -PartitionKey 'logo' -Data (New-DataUrl -Type 'heic') } |
+                Should -Throw '*Unsupported image format*'
+            $script:SavedEntity | Should -BeNullOrEmpty
+        }
+
         It 'rejects a bare URL' {
             { Add-CIPPImage -PartitionKey 'logo' -Data 'https://example.com/logo.png' } |
                 Should -Throw '*Invalid image format*'
diff --git a/Tests/Reports/Build-CippBaselineWhatIfReportTree.Tests.ps1 b/Tests/Reports/Build-CippBaselineWhatIfReportTree.Tests.ps1
new file mode 100644
index 0000000000000..ad7290ac460a7
--- /dev/null
+++ b/Tests/Reports/Build-CippBaselineWhatIfReportTree.Tests.ps1
@@ -0,0 +1,329 @@
+# Pester tests for the Security Baseline (What-If) report: the tree builder reproduces the client
+# document's content and wording from the shipped sample (Config/ReportSamples/baseline.json, the
+# same data the branding preview renders), for hashtable and PSCustomObject inputs alike, and every
+# variant survives a real render; the endpoint gathers the alignment, baselines and stored templates
+# and validates what it is sent.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $Bin = Join-Path $RepoRoot 'Shared/CIPPSharp/bin'
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Core.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Pdf.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'CIPPSharp.dll'))
+
+    if (-not ('HttpResponseContext' -as [type])) {
+        Add-Type -TypeDefinition 'public class HttpResponseContext { public object StatusCode; public object Body; public string ContentType; public object Headers; }'
+    }
+    $null = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+
+    $Reporting = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Directory -Filter 'Reporting' | Select-Object -First 1
+    Get-ChildItem -Path $Reporting.FullName -Filter '*.ps1' | ForEach-Object { . $_.FullName }
+    foreach ($Name in 'ConvertTo-CippReportPdf.ps1', 'Get-CippReportTenantName.ps1', 'Invoke-ExecGetBaselineWhatIfReportPdf.ps1') {
+        . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter $Name | Select-Object -First 1 -ExpandProperty FullName)
+    }
+    function Get-CIPPBrandingSettings { @{ colour = '#F77F00' } }
+    function Get-CIPPBrandingPreset { param($Id, [switch]$SkipImageData) @() }
+    function Write-LogMessage { param([Parameter(ValueFromRemainingArguments = $true)]$Rest) }
+    function Get-CippException { param($Exception) @{ NormalizedError = "$($Exception)" } }
+    function Get-CIPPTextReplacement { param($TenantFilter, $Text, [switch]$EscapeForJson) $Text }
+
+    $script:SampleJson = Get-Content (Join-Path $RepoRoot 'Config/ReportSamples/baseline.json') -Raw
+    $script:Dash = [string][char]0x2014
+    $script:Dot = [string][char]0x00B7
+
+    function ConvertTo-ReportData($Sample, [hashtable]$Override = @{}) {
+        $Data = @{ TenantName = 'Contoso' }
+        foreach ($Key in 'tenant', 'stageStates', 'assignedTemplates', 'simulatedTemplates', 'catalog', 'resolvers', 'sectionConfig') { $Data[$Key] = $Sample.$Key }
+        foreach ($Key in $Override.Keys) { $Data[$Key] = $Override[$Key] }
+        $Data
+    }
+    function Build-Sample([hashtable]$Override = @{}, [switch]$AsObject) {
+        $Sample = if ($AsObject) { $script:SampleJson | ConvertFrom-Json } else { $script:SampleJson | ConvertFrom-Json -AsHashtable }
+        Build-CippBaselineWhatIfReportTree -Data (ConvertTo-ReportData $Sample $Override)
+    }
+    function Get-PageTitle($Report) { @($Report.Blocks | Where-Object { $_.type -eq 'page' } | ForEach-Object { $_.title }) }
+    # The first block of a type after the block titled $Title (a section's table or bullets).
+    function Get-After($Report, [string]$Title, [string]$Type) {
+        $Seen = $false
+        foreach ($Block in $Report.Blocks) {
+            if ($Seen -and $Block.type -eq $Type) { return $Block }
+            if ($Block.title -eq $Title) { $Seen = $true; if ($Block.type -eq $Type) { return $Block } }
+        }
+    }
+    function Test-Pdf($Report) {
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName 'Contoso' -ReportName 'Security Baseline Report'
+        [System.Text.Encoding]::ASCII.GetString($Bytes[0..4]) | Should -Be '%PDF-'
+    }
+
+    # A tenant where every assigned standard is verified: two settings, one final wave.
+    $script:Sparse = @{
+        TenantName        = 'Fabrikam'
+        tenant            = @{ rows = @(
+                @{ standardName = 'AuditLog'; standardLabel = 'Enable the Unified Audit Log'; status = 'Compliant'; templateId = 'tpl-min'; expectedValue = @{ UnifiedAuditLogIngestionEnabled = $true }; currentValue = @{ UnifiedAuditLogIngestionEnabled = $true } }
+                @{ standardName = 'DisableAppCreation'; standardLabel = 'Disable App creation by users'; status = 'Compliant'; templateId = 'tpl-min'; expectedValue = @{ allowedToCreateApps = $false }; currentValue = @{ allowedToCreateApps = $false } }
+            )
+        }
+        stageStates       = @(@{ templateId = 'tpl-min'; templateName = 'Minimum Baseline'; currentStage = 1; totalStages = 1; stageName = 'Default'; nextStage = $null })
+        assignedTemplates = @(@{ GUID = 'tpl-min'; templateName = 'Minimum Baseline'; stages = @(@{ name = 'Default'; standards = @('AuditLog', 'DisableAppCreation'); standardsConfig = @() }) })
+        catalog           = ($script:SampleJson | ConvertFrom-Json -AsHashtable).catalog
+    }
+}
+
+Describe 'Build-CippBaselineWhatIfReportTree' {
+    It 'counts protections in place, improvements underway and pending first checks onto the cover and stat row' {
+        $r = Build-Sample
+        $r.Variables.covermeta | Should -Be "4 protections in place $Dot 11 improvements underway $Dot 4 applying after their first check"
+        $r.Variables.covermetanote | Should -Be 'Includes a simulation of: Zero Trust'
+        $r.Variables.footerlabel | Should -Be "Contoso $Dash Security Baseline"
+        $r.Variables.covertitle | Should -Be 'Baseline'
+        $r.Variables.coveraccent | Should -Be 'Report'
+        $r.Variables.Keys | Should -Not -Contain 'coverfooternote'
+        @(($r.Blocks | Where-Object { $_.type -eq 'scorecard' }).stats.value) | Should -Be @('4', '11', '4', '2')
+        ($r.Blocks | Where-Object { $_.type -eq 'blank' } | Select-Object -First 1).content | Should -Match 'why each choice was made\. It also shows everything the following baseline would add: Zero Trust\.</p>$'
+    }
+
+    It 'orders the current-state table by status then name, naming a pending policy by its label rather than its template file' {
+        $Table = Get-After (Build-Sample) 'Where The Baseline Stands Today' 'richtable'
+        $Table.rows.Count | Should -Be 20
+        @($Table.rows.statusLabel) | Should -Be @(
+            @('In place') * 4 + @('Being corrected') * 6 + @('Agreed exception') * 2 + @('First check pending') * 4 +
+            @('Check failed', 'License missing', 'Not applicable', 'Conflict'))
+        @($Table.rows.name)[0..3] | Should -Be @('CA00 - Block legacy authentication', 'Enable all MailTips', 'Enable the Unified Audit Log', 'Windows - Defender Antivirus')
+        @($Table.rows.name) | Should -Contain 'Conditional Access Template - CA05 - Require MFA for admins'
+        @($Table.rows.name) | Should -Not -Match '\.json$'
+        ($Table.rows | Where-Object { $_.name -eq 'Legacy retired setting' }).description | Should -Be ''
+        $Table.emptyText | Should -Be 'The baseline was just assigned - the first verification run has not completed yet.'
+    }
+
+    It 'describes CA policies from their content, resolving pending and simulated ones through the stored templates' {
+        $r = Build-Sample
+        $Rows = (Get-After $r 'Conditional Access Policies' 'richtable').rows
+        @($Rows.policy) | Should -Be @('CA01 - Require MFA for all users', 'CA05 - Require MFA for admins', 'CA10 - Require phishing-resistant MFA for admins *')
+        $Rows[0].does | Should -Be 'Enforce multi-factor authentication, only allow sign-ins from approved locations, respond automatically to risky sign-ins. Deployed fully enforced from day one.'
+        $Rows[0].excludes | Should -Be "Groups: CA Exclusions, Service Accounts, Break Glass +1 more`nRoles: Directory Synchronization Accounts`nGuests / external users"
+        $Rows[1].does | Should -Be 'Enforce multi-factor authentication. Deployed in report-only mode first, so we can measure the impact before anyone is blocked.'
+        $Rows[1].includes | Should -Be 'Roles: Global Administrator, Security Administrator'
+        $Rows[2].does | Should -Be 'Require Phishing-resistant MFA (phishing-resistant) sign-in, require signing in again every 4 hours. Deployed fully enforced from day one.'
+        $Rows[2].includes | Should -Be 'Roles: Global Administrator, Security Administrator, Exchange Administrator +1 more'
+        # Two deployment states are spelled out per policy, so there is no single-state line.
+        ($r.Blocks.content -match 'These policies will be deployed') | Should -BeNullOrEmpty
+        @($r.Blocks.content -match 'added by a simulated baseline \(Zero Trust\)').Count | Should -Be 2
+        $Aligned = (Get-After $r 'Conditional Access Policies In Force' 'richtable').rows
+        $Aligned[0].does | Should -Be 'Block the targeted sign-ins entirely, block legacy sign-in methods that cannot do multi-factor authentication.'
+        $Aligned[0].includes | Should -Be 'All users'
+        $Aligned[0].excludes | Should -Be 'BreakGlass Admin'
+    }
+
+    It 'says a single deployment state once, under the table' {
+        $Sample = $script:SampleJson | ConvertFrom-Json -AsHashtable
+        $r = Build-CippBaselineWhatIfReportTree -Data (ConvertTo-ReportData $Sample @{ simulatedTemplates = @(); tenant = @{ rows = @($Sample.tenant.rows | Where-Object { $_.standardName -eq 'ConditionalAccessTemplate#abc123' }) } })
+        (Get-After $r 'Conditional Access Policies' 'richtable').rows[0].does | Should -Not -Match 'Deployed'
+        $r.Blocks.content | Should -Contain '<p>These policies will be deployed <b>fully enforced from day one</b>.</p>'
+    }
+
+    It 'names Intune policies from the stored template, the picker label or the bundle they deploy' {
+        $r = Build-Sample
+        $Items = (Get-After $r 'Intune Policies' 'richbullets').items
+        @($Items.label) | Should -Be @('Windows - Baseline Security', 'Windows - BitLocker', "Every policy in the 'Windows Hardening' bundle")
+        @($Items.text) | Should -Be @('', "(added by the 'Zero Trust' baseline)", "(added by the 'Zero Trust' baseline)")
+        (Get-After $r 'Intune Policies In Force' 'richbullets').items[0].label | Should -Be 'Windows - Defender Antivirus'
+    }
+
+    It 'shows each setting today and its target with the definition variable and option labels' {
+        $r = Build-Sample
+        $Rows = (Get-After $r 'Settings We Will Change' 'richtable').rows
+        @($Rows.setting) | Should -Be @('Set Outbound Spam Alert e-mail', 'Define Global Meeting Policy for Teams', 'Restrict guest user access to directory objects',
+            'Enable Passwordless with Location information and Number Matching', 'Disable Self Service Licensing', 'Enable Customer Lockbox',
+            'Disable App creation by users', 'Set Default Sharing Link Settings *', 'Default sharing to Direct users *')
+        $Rows[0].today | Should -Be "Notify on outbound spam: Off`nNotify Outbound Spam Recipients: configured`nBCC suspicious outbound mail to a mailbox: Off"
+        $Rows[0].change | Should -Be "Notify on outbound spam: On`nNotify Outbound Spam Recipients: security@contoso.com`nBCC suspicious outbound mail to a mailbox: Off"
+        $Teams = $Rows[1].change -split "`n"
+        $Teams.Count | Should -Be 9
+        $Teams[8] | Should -Be "$([char]0x2026) and 2 more values"
+        $Teams | Should -Contain 'Who can bypass the lobby?: People in organization excluding guests'
+        $Teams | Should -Contain 'Default value of the `Who can present?`: Only organizer'
+        ($Rows[1].today -split "`n") | Should -Contain 'Meeting chat policy: On for everyone'
+        $Rows[2].today | Should -Be 'Guest user access level: Same access as member users'
+        $Rows[2].change | Should -Be 'Guest user access level: Restricted access (guests can only see their own profile)'
+        $Rows[3].today | Should -Be "State: enabled`nFeature Settings: configured"
+        $Rows[4].today | Should -Be 'Not checked yet'
+        $Rows[4].change | Should -Be 'Enforced as described'
+        $Rows[4].why | Should -Be 'Security best practice; medium impact change for users.'
+        $Rows[5].change | Should -Be 'Customer Lockbox enabled: On'
+        $Rows[6].change | Should -Be 'Allow users to create app registrations: Off'
+        $Rows[6].why | Should -Be 'Recommended by CIS and CIPP and SMB1001; required for CIS M365 7.0.0 (5.1.2.2); low impact change for users.'
+        $Rows[7].today | Should -Be $Dash
+        $Rows[7].change | Should -Be "Default Sharing Link Type: Internal - Only people in your organization`nDefault Link Permission: 1"
+        # The tenant-token SiteUrl entry is left out; the simulated sharingCapability is already a row.
+        $Rows[8].change | Should -Be 'Default Sharing Link Type: Direct'
+        $Enforced = (Get-After $r 'Settings Enforced Today' 'richtable').rows
+        $Enforced[0].value | Should -Be 'Unified Audit Log ingestion enabled: On'
+        $Enforced[0].why | Should -Be 'Recommended by CIS and CIPP; required for CIS M365 7.0.0 (3.1.1); low impact change for users.'
+        ($Enforced[1].value -split "`n")[3] | Should -Be 'Number of recipients to trigger the large audience MailTip (Default is 25): 25'
+    }
+
+    It 'tells the rollout in waves with a baseline prefix, an expected date and the approval clause' {
+        $Items = (Get-After (Build-Sample) 'How The Rollout Works' 'richbullets').items
+        @($Items.label) | Should -Be @("Core Security Baseline $Dash Wave 1 of 3 ('Foundations'):", "Core Security Baseline $Dash Wave 2 ('Hardening'):", "Device Baseline $Dash Wave 2 of 2 ('Rollout'):")
+        @($Items.text) | Should -Be @(
+            'live now, covering 18 protections.'
+            'adds 5 more protections - Intune Template, Intune Template, Enable Security Defaults and more. Expected around October 7, 2026, after we approve the move together.'
+            'live now, covering 2 protections.'
+        )
+    }
+
+    It 'dates the waves in the instance timezone' {
+        # The sample's next wave is due at 12:00 UTC on October 7, already October 8 at UTC+14.
+        $Saved = $env:CIPP_TIMEZONE
+        try {
+            $env:CIPP_TIMEZONE = 'Pacific/Kiritimati'
+            $Items = (Get-After (Build-Sample) 'How The Rollout Works' 'richbullets').items
+        } finally { $env:CIPP_TIMEZONE = $Saved }
+        $Items[1].text | Should -BeLike '*Expected around October 8, 2026,*'
+    }
+
+    It 'lists agreed exceptions with and without a reason' {
+        $Items = (Get-After (Build-Sample) 'Agreed Exceptions We Will Not Change' 'richbullets').items
+        @($Items.label) | Should -Be @('Enables per user MFA for all users.', 'Enable Usernames instead of pseudo anonymised names in reports')
+        @($Items.text) | Should -Be @("$Dash Customer keeps per-user MFA until their migration completes in Q2.", '')
+    }
+
+    It 'reads PSCustomObject input (the live endpoint) exactly as hashtable input (the preview sample)' {
+        $FromHashtable = Build-Sample
+        $FromObject = Build-Sample -AsObject
+        (ConvertTo-Json -InputObject $FromObject -Depth 20 -Compress) | Should -Be (ConvertTo-Json -InputObject $FromHashtable -Depth 20 -Compress)
+    }
+
+    It 'matches keys case-sensitively like the client, for PSCustomObject and hashtable input alike' {
+        # The live value names its key in another case than the baseline does, so nothing projects onto
+        # the baseline's keys and the whole value is shown - under its own name, not the variable's label.
+        $Sample = $script:Sparse.Clone()
+        $Sample.tenant = @{ rows = @($script:Sparse.tenant.rows) + @(
+                @{ standardName = 'SomeExo'; standardLabel = 'Some EXO setting'; status = 'Drift'; templateId = 'tpl-min'; expectedValue = @{ enabled = $true }; currentValue = [ordered]@{ Enabled = $false; Other = 1 } }
+            )
+        }
+        $Sample.catalog = @($script:Sparse.catalog) + @(@{ name = 'SomeExo'; label = 'Some EXO setting'; expected = @{ enabled = '%Enabled%' }; variables = @{ Enabled = @{ label = 'Turn it on' } } })
+        $Json = ConvertTo-Json -InputObject $Sample -Depth 30
+        foreach ($Parsed in @(($Json | ConvertFrom-Json -AsHashtable), ($Json | ConvertFrom-Json))) {
+            $Row = (Get-After (Build-CippBaselineWhatIfReportTree -Data (ConvertTo-ReportData $Parsed)) 'Settings We Will Change' 'richtable').rows |
+                Where-Object setting -EQ 'Some EXO setting'
+            $Row.today | Should -Be "Enabled: Off`nOther: 1"
+            $Row.change | Should -Be 'Turn it on: On'
+        }
+    }
+
+    It 'drops the already-in-place page and the rollout section when toggled off, keeping the exceptions' {
+        $r = Build-Sample @{ sectionConfig = @{ alreadyAligned = $false; rolloutStages = $false } }
+        Get-PageTitle $r | Should -Be @('Executive Summary', 'Policies We Will Deploy', 'Settings We Will Change', 'Rollout Plan')
+        $r.Blocks.title | Should -Not -Contain 'How The Rollout Works'
+        $r.Blocks.title | Should -Contain 'Agreed Exceptions We Will Not Change'
+    }
+
+    It 'shows a fully aligned tenant with the clear box, its settings and a single unprefixed wave' {
+        $r = Build-CippBaselineWhatIfReportTree -Data $script:Sparse
+        Get-PageTitle $r | Should -Be @('Executive Summary', 'What Is Already In Place', 'Rollout Plan')
+        ($r.Blocks | Where-Object { $_.type -eq 'clearbox' }).title | Should -Be "$([char]0x2714)$([char]0xFE0F) Fully aligned"
+        $r.Variables.covermeta | Should -Be "2 protections in place $Dot 0 improvements underway"
+        $r.Variables.Keys | Should -Not -Contain 'covermetanote'
+        @((Get-After $r 'Where The Baseline Stands Today' 'richtable').rows.name) | Should -Be @('Disable App creation by users', 'Enable the Unified Audit Log')
+        @((Get-After $r 'Settings Enforced Today' 'richtable').rows.value) | Should -Be @('Unified Audit Log ingestion enabled: On', 'Allow users to create app registrations: Off')
+        $Wave = (Get-After $r 'How The Rollout Works' 'richbullets').items
+        $Wave.label | Should -Be "Wave 1 of 1 ('Default'):"
+        $Wave.text | Should -Be 'live now, covering 2 protections.'
+    }
+
+    It 'keeps a freshly assigned tenant to the summary, with the empty-state text in the table' {
+        $r = Build-CippBaselineWhatIfReportTree -Data @{ TenantName = 'Contoso'; catalog = $script:Sparse.catalog }
+        Get-PageTitle $r | Should -Be @('Executive Summary')
+        @(($r.Blocks | Where-Object { $_.type -eq 'scorecard' }).stats.value) | Should -Be @('0', '0', '0', '0')
+        $r.Blocks.type | Should -Not -Contain 'clearbox'
+        (Get-After $r 'Where The Baseline Stands Today' 'richtable').rows.Count | Should -Be 0
+        $r.Variables.covermeta | Should -Be "0 protections in place $Dot 0 improvements underway"
+    }
+
+    It 'renders every variant to a PDF' {
+        Test-Pdf (Build-Sample)
+        Test-Pdf (Build-Sample @{ sectionConfig = @{ alreadyAligned = $false; rolloutStages = $false } })
+        Test-Pdf (Build-CippBaselineWhatIfReportTree -Data $script:Sparse)
+        Test-Pdf (Build-CippBaselineWhatIfReportTree -Data @{ TenantName = 'Contoso' })
+    }
+}
+
+Describe 'Invoke-ExecGetBaselineWhatIfReportPdf' {
+    BeforeAll {
+        $script:Sample = $script:SampleJson | ConvertFrom-Json
+        function Get-Tenants { param($TenantFilter) @{ displayName = 'Contoso' } }
+        function Get-CIPPBaselineAlignment { param($TenantFilter) [pscustomobject]@{ rows = $script:Sample.tenant.rows; stageStates = $script:Sample.stageStates } }
+        function Get-CIPPBaseline { @($script:Sample.assignedTemplates) + @($script:Sample.simulatedTemplates) }
+        function Get-CIPPBaselineDefinition { $script:Sample.catalog }
+        function Get-CippTable { @{} }
+        # The stored templates as the templates table holds them: CA rows keyed by file name with the
+        # template GUID in its own column, Intune rows naming the policy in 'Displayname'.
+        function Get-CIPPAzDataTableEntity {
+            param($Filter)
+            if ($Filter -like "*'CATemplate'*") {
+                foreach ($Template in $script:Sample.resolvers.caByGuid.PSObject.Properties) {
+                    @{ RowKey = "$($Template.Name).CATemplate.json"; GUID = $Template.Name; JSON = (ConvertTo-Json -InputObject $Template.Value -Depth 20 -Compress) }
+                }
+            } elseif ($Filter -like "*'IntuneTemplate'*") {
+                foreach ($Template in $script:Sample.resolvers.intuneByGuid.PSObject.Properties) {
+                    @{ RowKey = $Template.Name; JSON = (ConvertTo-Json -InputObject @{ Displayname = $Template.Value.displayName } -Compress) }
+                }
+            }
+        }
+        function Invoke-Report($Body) {
+            Invoke-ExecGetBaselineWhatIfReportPdf -Request @{ Body = $Body; Query = @{}; Headers = @{} } -TriggerMetadata @{ FunctionName = 'ExecGetBaselineWhatIfReportPdf' }
+        }
+    }
+
+    It 'renders the tenant with a simulated baseline as a PDF' {
+        $Response = Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com'; simulatedTemplateIds = @('tpl-zero-trust') }
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $Response.ContentType | Should -Be 'application/pdf'
+        $Response.Headers.'Content-Disposition' | Should -Be 'inline; filename="Baseline_Report_contoso_onmicrosoft_com.pdf"'
+        [System.Text.Encoding]::ASCII.GetString($Response.Body[0..4]) | Should -Be '%PDF-'
+    }
+
+    Context 'what reaches the renderer' {
+        BeforeEach {
+            Mock ConvertTo-CippReportPdf { [byte[]](37, 80, 68, 70, 45) }
+        }
+
+        It 'resolves pending and simulated policies through the stored templates table' {
+            (Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com'; simulatedTemplateIds = @('tpl-zero-trust') }).StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+            Should -Invoke ConvertTo-CippReportPdf -Times 1 -Exactly -ParameterFilter {
+                $Text = ConvertTo-Json -InputObject @($Blocks) -Depth 20 -Compress
+                $ReportName -eq 'Security Baseline Report' -and $Variables.covermetanote -eq 'Includes a simulation of: Zero Trust' -and
+                $Text -match '"policy":"CA05 - Require MFA for admins"' -and $Text -match 'Roles: Global Administrator, Security Administrator' -and
+                $Text -match 'CA10 - Require phishing-resistant MFA for admins \*' -and $Text -match '"label":"Windows - BitLocker"'
+            }
+        }
+
+        It 'simulates a baseline named more than once only once' {
+            (Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com'; simulatedTemplateIds = @('tpl-zero-trust', 'tpl-core', 'tpl-zero-trust') }).StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+            Should -Invoke ConvertTo-CippReportPdf -Times 1 -Exactly -ParameterFilter { $Variables.covermetanote -eq 'Includes a simulation of: Zero Trust' }
+        }
+
+        It 'ignores the id of a baseline that is already assigned' {
+            (Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com'; simulatedTemplateIds = @('tpl-core') }).StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+            Should -Invoke ConvertTo-CippReportPdf -Times 1 -Exactly -ParameterFilter { -not $Variables.Contains('covermetanote') }
+        }
+
+        It 'passes the section toggles through' {
+            (Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com'; sectionConfig = @{ alreadyAligned = $false; rolloutStages = $true } }).StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+            Should -Invoke ConvertTo-CippReportPdf -Times 1 -Exactly -ParameterFilter {
+                $Blocks.title -notcontains 'What Is Already In Place' -and $Blocks.title -contains 'How The Rollout Works'
+            }
+        }
+    }
+
+    It 'rejects <case>' -ForEach @(
+        @{ case = 'a missing tenantFilter'; body = @{}; expected = 'A tenantFilter is required' }
+        @{ case = 'an unknown baseline id'; body = @{ tenantFilter = 'contoso.onmicrosoft.com'; simulatedTemplateIds = @('nope') }; expected = "Unknown baseline id 'nope'." }
+        @{ case = 'a section toggle that is not a boolean'; body = @{ tenantFilter = 'contoso.onmicrosoft.com'; sectionConfig = @{ alreadyAligned = 'false' } }; expected = 'sectionConfig.alreadyAligned must be true or false.' }
+    ) {
+        $Response = Invoke-Report $body
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        $Response.Body | Should -Be $expected
+    }
+}
diff --git a/Tests/Reports/Build-CippReportTrees.Tests.ps1 b/Tests/Reports/Build-CippReportTrees.Tests.ps1
new file mode 100644
index 0000000000000..3466fcc53487f
--- /dev/null
+++ b/Tests/Reports/Build-CippReportTrees.Tests.ps1
@@ -0,0 +1,291 @@
+# Pester tests for the fixed-report tree builders: each composes @{ Blocks; Variables } from shaped
+# sample data, the grade on the cover matches the tree's own scoring, and the tree renders to a PDF.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $Bin = Join-Path $RepoRoot 'Shared/CIPPSharp/bin'
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Core.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Pdf.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'CIPPSharp.dll'))
+
+    $Reporting = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Directory -Filter 'Reporting' | Select-Object -First 1
+    Get-ChildItem -Path $Reporting.FullName -Filter '*.ps1' | ForEach-Object { . $_.FullName }
+    . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'ConvertTo-CippReportPdf.ps1' | Select-Object -First 1 -ExpandProperty FullName)
+    function Get-CIPPBrandingSettings { @{ colour = '#F77F00' } }
+
+    function Test-Report($Report, [string]$Label) {
+        $Report.Blocks.Count | Should -BeGreaterThan 0
+        $Report.Variables.coverlabel | Should -Be $Label
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Report.Blocks -Variables $Report.Variables -TenantName 'Contoso' -ReportName 'T'
+        [System.Text.Encoding]::ASCII.GetString($Bytes[0..4]) | Should -Be '%PDF-'
+    }
+}
+
+Describe 'Report tree builders' {
+    It 'Sharing: grades exposure from the summary and renders' {
+        $r = Build-CippSharingReportTree -Data @{
+            TenantName    = 'Contoso'
+            summary       = @{ totalLinks = 4; itemsShared = 3; externalRecipients = 1; anonymousEditLinks = 1; neverExpiringAnonymous = 1 }
+            links         = @(@{ fileName = 'a.docx'; siteName = 'S'; classification = 'Anonymous'; roles = @('write'); itemType = 'File' })
+            topRecipients = @(@{ recipient = 'x@example.com'; links = 1 })
+            topLibraries  = @()
+        }
+        $r.Variables.covermetanote | Should -Be 'Sharing exposure: High'
+        Test-Report $r 'Data Sharing Review'
+    }
+
+    It 'Permissions: a lone detached library is Low exposure and renders' {
+        $r = Build-CippPermissionsReportTree -Data @{
+            TenantName  = 'Contoso'
+            summary     = @{ uniquePermissionLibraries = 1; sitesScanned = 2; librariesScanned = 3; totalAssignments = 5 }
+            assignments = @(@{ principalId = 'p1'; scope = 'Library'; siteName = 'S'; libraryTitle = 'Docs'; title = 'Bob'; permissionLevel = 'Edit'; principalType = 'User' })
+        }
+        $r.Variables.covermetanote | Should -Be 'Permission exposure: Low'
+        Test-Report $r 'Access Review'
+    }
+
+    It 'MailFlow: sums the dispositions, grades hygiene and renders' {
+        $r = Build-CippMailFlowReportTree -Data @{
+            TenantName = 'Contoso'; days = 7
+            totals     = @{ GoodMail = 90; EmailPhish = 10 }
+            daily      = @(@{ date = '2026-09-01'; GoodMail = 90; EmailPhish = 10 })
+            topSenders = @(@{ name = 'a@contoso.com'; count = 5 })
+        }
+        $r.Variables.covermeta | Should -Be ("100 messages {0} 90% delivered {0} 10 threats caught" -f [char]0x00B7)
+        $r.Variables.covermetanote | Should -Be 'Mail hygiene: Attention Needed'
+        Test-Report $r 'Email Traffic Review'
+    }
+
+    It 'MailFlow: an empty window (no rows at all) still renders, with empty charts' {
+        $r = Build-CippMailFlowReportTree -Data @{ TenantName = 'Contoso' }
+        $r.Variables.covermetanote | Should -Be 'Mail hygiene: Good'
+        Test-Report $r 'Email Traffic Review'
+    }
+
+    It 'Permissions and ShadowAI: word their empty tables the way the client does' {
+        $Permissions = Build-CippPermissionsReportTree -Data @{ TenantName = 'Contoso'; summary = @{}; assignments = @() }
+        @($Permissions.Blocks | Where-Object type -EQ 'richtable').emptyText | Should -Be @('No libraries hold their own permissions.')
+        $ShadowAI = Build-CippShadowAIReportTree -Data @{ TenantName = 'Contoso'; summary = @{}; detectedApps = @(); consentedApps = @(); topTools = @(); byRisk = @() }
+        @($ShadowAI.Blocks | Where-Object type -EQ 'richtable').emptyText | Should -Be @(
+            'No AI software was detected on managed devices during the last inventory sync.'
+            'No AI applications were found in Entra ID.'
+        )
+    }
+
+    It 'ShadowAI: merges sanctioned tools across both sources and renders' {
+        $r = Build-CippShadowAIReportTree -Data @{
+            TenantName    = 'Contoso'
+            summary       = @{ aiToolsDetected = 2 }
+            detectedApps  = @(@{ aiTool = 'ChatGPT'; vendor = 'OpenAI'; category = 'Chat'; status = 'Sanctioned'; deviceCount = 3; risk = 'High' })
+            consentedApps = @(@{ aiTool = 'ChatGPT'; vendor = 'OpenAI'; category = 'Chat'; status = 'Sanctioned'; activeUsersLast7Days = 5; risk = 'High' })
+            topTools      = @(); byRisk = @(@{ risk = 'High'; tools = 1 })
+        }
+        $Sanctioned = $r.Blocks | Where-Object { $_.type -eq 'richtable' -and $_.rows[0].tool -eq 'ChatGPT' -and $_.rows[0].users } | Select-Object -First 1
+        $Sanctioned.rows[0].devices | Should -Be '3'
+        $Sanctioned.rows[0].users | Should -Be '5'
+        Test-Report $r 'AI Risk Assessment'
+    }
+
+    It 'Executive: composes every section from shaped data and renders' {
+        $r = Build-CippExecutiveReportTree -Data @{
+            TenantName       = 'Contoso'
+            UserStats        = @{ licensedUsers = 10; unlicensedUsers = 1; guests = 2; globalAdmins = 1; permanentGlobalAdmins = 1; eligibleGlobalAdmins = 0; pimCapable = $true }
+            SecureScore      = @{ currentScore = 50; maxScore = 100; percentageCurrent = 50; percentageVsSimilar = 40; percentageVsAllTenants = 45; trend = @(@{ label = 'Sep 1'; value = 50 }) }
+            Licenses         = @(@{ name = 'E3'; used = '5'; available = '1'; total = '6' })
+            Devices          = @(@{ name = 'PC1'; os = 'Windows'; compliance = 'compliant'; compliant = $true; lastSync = 'Sep 1, 2026'; encrypted = $true })
+            CAPolicies       = @(@{ name = 'Require MFA'; state = 'enabled'; controls = @('mfa'); controlsText = 'MFA'; applications = 'All' })
+            SecurityControls = @(@{ name = 'MFA'; description = 'd'; tags = 't'; status = 'Compliant' })
+        }
+        @($r.Blocks | Where-Object { $_.type -eq 'hero' }).Count | Should -Be 5
+        $r.Variables.covertenant | Should -Be 'Contoso'
+        Test-Report $r 'SECURITY ASSESSMENT'
+    }
+
+    It 'BEC: renders the server-computed threat level, names the user on the cover and renders' {
+        # The threat level is computed server-side (Get-CIPPBecScore) and stored on the run; the builder
+        # renders that stored Score rather than scoring the findings itself.
+        $r = Build-CippBecReportTree -TenantName 'Contoso' -UserData @{ displayName = 'Alice'; userPrincipalName = 'alice@contoso.com' } -BecData @{
+            ExtractedAt         = '2026-09-01T00:00:00Z'
+            Score               = @{ Value = 19; Level = 'High' }
+            NewRules            = @(@{ Name = 'Hide'; MoveToFolder = 'RSS Subscriptions' })
+            SentMessageAnalysis = @{ Flagged = $true; Bursts = @(@{ MessageCount = 40; RecipientCount = 40; WindowStart = '2026-09-01T09:00:00Z'; TopSubject = 'Invoice' }) }
+            LocationAnalysis    = @{ UsageLocation = 'AU' }
+        }
+        ($r.Blocks | Where-Object { $_.type -eq 'alertbox' -and $_.title -like 'Threat Assessment:*' }).title | Should -Be 'Threat Assessment: High (score 19)'
+        $r.Variables.covertenant | Should -Be 'Alice'
+        $r.Variables.footerlabel | Should -Be 'Contoso - BEC Analysis Report for Alice'
+        Test-Report $r 'Security Incident Report'
+    }
+
+    It 'BEC: carries the attacker addresses, what was done from them and the reach beyond the account, condensed in the summary' {
+        $Sample = Get-Content (Join-Path $RepoRoot 'Config/ReportSamples/bec.json') -Raw | ConvertFrom-Json
+        $Full = Build-CippBecReportTree -TenantName 'Contoso' -UserData $Sample.userData -BecData $Sample.becData
+        $Summary = Build-CippBecReportTree -TenantName 'Contoso' -UserData $Sample.userData -BecData $Sample.becData -Variant summary
+        $Found = @(($Summary.Blocks | Where-Object { $_.type -eq 'richbullets' } | Select-Object -First 1).items.text)
+        $Found | Should -Contain "1 network address in NG was identified as the attacker's; from there the attacker opened 1 email, sent 1 email, opened 1 file (1 download)."
+        ($Found -like 'The attack reached beyond this account: 1 other account signed into or used from the same addresses (finance.lead@example.com)*').Count | Should -Be 1
+        $Actions = @(($Summary.Blocks | Where-Object { $_.type -eq 'richtable' -and $_.columns[0].header -eq 'Priority' }).rows)
+        ($Actions | Where-Object { $_.text -like 'Secure the 1 other account(s)*' }).tag | Should -Be 'Critical'
+        ($Actions | Where-Object { $_.text -like 'Remove the 1 Microsoft Form(s)*' }).text | Should -Match 'Microsoft Defender alert'
+        $Objectives = ($Summary.Blocks | Where-Object { $_.type -eq 'progress' } | Select-Object -First 1).items
+        $Objectives[0].label | Should -Be 'Attacker IPs & activity'
+        $Timeline = @(($Summary.Blocks | Where-Object { $_.type -eq 'richtable' -and $_.columns[1].header -eq 'Event' }).rows)
+        ($Timeline | Where-Object { $_.event -eq '1 message(s) opened' }).detail | Should -Be 'Invoice 4471 - updated bank details - 198.51.100.23'
+        ($Summary.Blocks | Where-Object { $_.type -eq 'page' -and $_.title -eq 'Attacker Addresses & Activity' }) | Should -BeNullOrEmpty -Because 'the C-suite summary stops after the executive lead'
+        ($Full.Blocks | Where-Object { $_.type -eq 'page' -and $_.title -eq 'Attacker Addresses & Activity' }) | Should -Not -BeNullOrEmpty
+        $IpTable = $Full.Blocks | Where-Object { $_.type -eq 'richtable' -and $_.columns[0].header -eq 'Address' }
+        @($IpTable.rows).Count | Should -Be 1 -Because 'only attacker and suspicious addresses are listed'
+        $IpTable.rows[0].why | Should -Be 'Proxy/VPN network; Outside the usage location; Never used by the user'
+        Test-Report $Full 'Security Incident Report'
+        Test-Report $Summary 'Security Incident Report'
+    }
+
+    It 'BEC: the C-suite summary marks recommended actions completed by containment instead of listing every result' {
+        $BecData = @{
+            ExtractedAt = '2026-09-01T00:00:00Z'
+            Score       = @{ Value = 19; Level = 'High' }
+            NewRules    = @(@{ Name = 'Hide' })
+            Run         = @{ Containment = @(
+                    @{ At = '2026-09-01T10:00:00Z'; Results = @(@{ Action = 'ResetPassword'; state = 'success' }, @{ Action = 'RevokeSessions'; state = 'success' }, @{ Action = 'DisableInboxRules'; state = 'error' }) }
+                    @{ At = '2026-09-01T11:00:00Z'; Results = @(@{ Action = 'DisableAccount'; state = 'success' }) }
+                ) }
+        }
+        $Rows = { param($r) @(($r.Blocks | Where-Object { $_.type -eq 'richtable' -and $_.columns[0].header -eq 'Priority' }).rows) }
+        $Summary = Build-CippBecReportTree -TenantName 'Contoso' -UserData @{ userPrincipalName = 'alice@contoso.com' } -BecData $BecData -Variant summary
+        $Actions = & $Rows $Summary
+        ($Actions | Where-Object { $_.text -like 'Reset *' }).text | Should -Match "`nCompleted "
+        ($Actions | Where-Object { $_.text -like 'Block sign-in*' }).text | Should -Match "`nCompleted "
+        ($Actions | Where-Object { $_.text -like 'Disable the * suspicious inbox rule*' }).text | Should -Not -Match 'Completed' -Because 'an action with an error is not completed'
+        ($Summary.Blocks | Where-Object { $_.type -eq 'blank' -and $_.title -eq 'Remediation Taken' }) | Should -BeNullOrEmpty
+        $Full = Build-CippBecReportTree -TenantName 'Contoso' -UserData @{ userPrincipalName = 'alice@contoso.com' } -BecData $BecData
+        (& $Rows $Full).text -match 'Completed' | Should -BeNullOrEmpty -Because 'the full report keeps the detailed table instead'
+        ($Full.Blocks | Where-Object { $_.type -eq 'blank' -and $_.title -eq 'Remediation Taken' }) | Should -Not -BeNullOrEmpty
+    }
+}
+
+Describe 'License report tree' {
+    BeforeAll {
+        $script:MidDot = [string][char]0x00B7
+        $script:EmDash = [string][char]0x2014
+        $script:Ellipsis = [string][char]0x2026
+        # The branding preview sample is the rich fixture: every section populated, internally consistent totals.
+        $RichPath = Join-Path $RepoRoot 'Config/ReportSamples/licensing.json'
+        function Get-RichData { @{ TenantName = 'Contoso Ltd' } + (Get-Content $RichPath -Raw | ConvertFrom-Json -AsHashtable) }
+        function Get-Block($Report, [string]$Type, [scriptblock]$Where = { $true }) { , @($Report.Blocks | Where-Object { $_.type -eq $Type } | Where-Object -FilterScript $Where) }
+    }
+
+    It 'quotes the headline figures the way the client did (Intl whole-unit money, JS rounding) and renders' {
+        $r = Build-CippLicenseReportTree -Data (Get-RichData) -GeneratedOn 'September 23, 2026'
+        $r.Variables.covermeta | Should -Be "96 people licensed $MidDot 11 plans $MidDot `$2,434 per month"
+        $r.Variables.covermetanote | Should -Be 'Potential saving: $10,060 per year'
+        $r.Variables.footerlabel | Should -Be "Contoso Ltd $EmDash Licensing"
+        $Stats = (Get-Block $r 'scorecard')[0].stats
+        @($Stats.value) | Should -Be @('$2,434', '$838', '$10,060', '27')
+        @($Stats | ForEach-Object { $_.colour }) | Should -Be @($null, '#22543D', '#22543D', '#744210')
+        $Alert = (Get-Block $r 'alertbox')[0]
+        $Alert.title | Should -Be 'Licensing: Significant savings available'
+        $Alert.content | Should -BeLike 'About 34% of the monthly licensing bill*'
+        $Alert.colour | Should -Be '#742A2A'
+        @((Get-Block $r 'richbullets' { $_.title -eq 'Where the savings come from' })[0].items.label) |
+            Should -Be @('$413 a month by removing licenses nobody uses.', '$302 a month by moving people to a cheaper plan.', '$4 a month by combining separate plans into one bundle.', '$120 a month by paying yearly for stable seats.')
+        Test-Report $r 'Microsoft 365 Licensing Review'
+    }
+
+    It 'rounds half a unit away from zero like Intl, not to even like .NET' {
+        $r = Build-CippLicenseReportTree -Data (Get-RichData)
+        $Downgrades = @((Get-Block $r 'richtable' { $_.columns[0].header -eq 'Current plan' })[0].rows)
+        # 58.5 and 12.5 are the half-unit cases: banker's rounding would print $58 and $12.
+        $Downgrades[1].saving | Should -Be '$59'
+        $Downgrades[3].saving | Should -Be '$13'
+        $Downgrades[1].unit | Should -Be '$6.50'
+    }
+
+    It 'builds each page from the right slice of the data' {
+        $r = Build-CippLicenseReportTree -Data (Get-RichData)
+        $Chart = (Get-Block $r 'chart')[0]
+        $Chart.chartData.Count | Should -Be 7
+        $Chart.chartData[6].label | Should -Be 'Other plans'
+        $Chart.chartData[6].value | Should -Be 70.75
+        $Spend = @((Get-Block $r 'richtable' { $_.columns[1].header -eq 'Owned' })[0].rows)
+        ($Spend | Where-Object { $_.plan -eq 'Microsoft Teams Rooms Pro' }).monthly | Should -Be 'not priced'
+        ($Spend | Where-Object { $_.plan -eq 'Microsoft Teams Rooms Pro' }).unit | Should -Be $EmDash
+        ($Spend | Where-Object { $_.plan -eq 'Office 365 Extra File Storage' }).unit | Should -Be '$0.20'
+        # The mailbox-only review tier claims no saving and stays off the client report.
+        $Reclaim = @((Get-Block $r 'richtable' { $_.columns[1].header -eq 'Why it can go' })[0].rows)
+        $Reclaim.Count | Should -Be 10
+        $Reclaim[-1].saving | Should -Be 'not priced'
+        # Only the first eight downgrade groups are spelled out; the rest are counted in a note.
+        $Bullets = @((Get-Block $r 'richbullets' { -not $_.title -and $_.items[0].label -like '*->*' })[0].items)
+        $Bullets.Count | Should -Be 8
+        $Bullets[0].label | Should -Be 'Microsoft 365 Copilot -> no plan:'
+        $Bullets[2].text | Should -BeLike '*Loses nothing that was used.'
+        (Get-Block $r 'note' { $_.content -like '*more groups*' })[0].content | Should -Be "$Ellipsis and 2 more groups, listed in full on the admin page."
+        $Terms = (Get-Block $r 'richtable' { $_.columns[2].header -like 'Held*' })[0]
+        $Terms.columns[2].header | Should -Be 'Held 6+ mo'
+        ($Terms.rows | Where-Object { $_.plan -eq 'Power BI Pro' }).yearlyNow | Should -Be 'unknown'
+        ($Terms.rows | Where-Object { $_.plan -eq 'Power BI Pro' }).saving | Should -Be $EmDash
+        (Get-Block $r 'infobox' { $_.title -eq 'Yearly seats that nobody holds' })[0].content |
+            Should -Be 'Microsoft 365 E3: 2 yearly seats unassigned, renews in 200 days. Microsoft 365 Business Basic: 6 yearly seats unassigned, renews in 45 days. Microsoft 365 Apps for business: 1 yearly seat unassigned. Microsoft Teams Rooms Pro: 1 yearly seat unassigned, renews in 300 days. These are paid for until renewal; reduce the count before that date.'
+        (Get-Block $r 'richbullets' { $_.items[0].label -eq 'Prices.' })[0].items.Count | Should -Be 7
+    }
+
+    It 'renders a tenant with no licenses: all-clear boxes, no chart, the empty-table note' {
+        $r = Build-CippLicenseReportTree -Data @{
+            TenantName   = 'Fabrikam'
+            Summary      = @{ Currency = 'EUR'; InactiveDays = 30; TenureMonths = 12; ProtectSecurityFeatures = $false; MonthlySpend = 0; DataAvailable = $false }
+            Products     = @(); Downgrades = @(); Upgrades = @(); Terms = @()
+            Optimization = @{ Opportunities = @() }
+        }
+        $Euro = [string][char]0x20AC
+        $r.Variables.covermeta | Should -Be "0 people licensed $MidDot 0 plans $MidDot ${Euro}0 per month"
+        $r.Variables.covermetanote | Should -Be 'No savings identified'
+        (Get-Block $r 'alertbox')[0].title | Should -Be 'Licensing: No priced spend'
+        (Get-Block $r 'alertbox')[0].colour | Should -Be '#22543D'
+        Get-Block $r 'chart' | Should -BeNullOrEmpty
+        Get-Block $r 'richbullets' { $_.title -eq 'Where the savings come from' } | Should -BeNullOrEmpty
+        (Get-Block $r 'richtable')[0].emptyText | Should -Be 'No licenses were found for this organisation.'
+        Get-Block $r 'note' | Should -BeNullOrEmpty
+        (Get-Block $r 'clearbox').Count | Should -Be 5
+        (Get-Block $r 'infobox' { $_.title -eq 'What was not measured' })[0].content | Should -BeLike '*configured to treat them as optional*'
+        Test-Report $r 'Microsoft 365 Licensing Review'
+    }
+
+    It 'renders an empty report (no Summary at all) without throwing' {
+        $r = Build-CippLicenseReportTree -Data @{ TenantName = 'Contoso' }
+        $r.Variables.covermeta | Should -Be "0 people licensed $MidDot 0 plans $MidDot `$0 per month"
+        Test-Report $r 'Microsoft 365 Licensing Review'
+    }
+
+    It 'drops switched-off pages and shows only the anonymised notice when usage is anonymised' {
+        $Data = Get-RichData
+        $Data.Summary.AnonymizedReports = $true
+        $r = Build-CippLicenseReportTree -Data $Data -Sections @{ spend = $false; reclaim = $false; downgrades = $true; upgrades = $false; terms = $false; method = $false }
+        @((Get-Block $r 'page').title) | Should -Be @('Summary', 'Cheaper plans')
+        (Get-Block $r 'alertbox')[-1].title | Should -Be 'Usage reports are anonymised'
+        Get-Block $r 'richtable' | Should -BeNullOrEmpty
+    }
+
+    It 'keeps long headline figures and money cells whole, never broken inside the number' {
+        # CHF prints as a code, so seven-digit figures overrun a stat card and the 0.9-weight money
+        # columns are narrow: the kit shrinks the figure and gives the columns the client's widths.
+        $Data = Get-RichData
+        $Data.Summary.Currency = 'CHF'
+        $Data.Summary.MonthlySpend = 3285563
+        $Data.Summary.TotalPotentialAnnual = 13580460
+        $r = Build-CippLicenseReportTree -Data $Data
+        $Bytes = ConvertTo-CippReportPdf -Blocks $r.Blocks -Variables $r.Variables -TenantName 'Contoso' -ReportName 'T'
+        $Doc = [OfficeIMO.Pdf.PdfReadDocument]::Open($Bytes)
+        $Text = ($Doc.Pages | ForEach-Object { $_.ExtractText() }) -join "`n"
+        # The stat row reads as one line of whole figures (the cover meta line quotes them too, so match the row).
+        $Text | Should -Match 'CHF[ \xA0]3,285,563 CHF[ \xA0]838 CHF[ \xA0]13,580,460 27'
+        # The consolidation table's Now and Bundle cells.
+        foreach ($Figure in '14.25', '12.50') { $Text | Should -Match "CHF[ \xA0]$([regex]::Escape($Figure))" }
+    }
+
+    It 'prints an unmapped currency as its code and falls back to USD for an unusable one' {
+        $r = Build-CippLicenseReportTree -Data @{ TenantName = 'C'; Summary = @{ Currency = 'chf'; MonthlySpend = 1234.5 } }
+        (Get-Block $r 'scorecard')[0].stats[0].value | Should -Be 'CHF 1,235'
+        $r = Build-CippLicenseReportTree -Data @{ TenantName = 'C'; Summary = @{ Currency = 'dollars'; MonthlySpend = 5 } }
+        (Get-Block $r 'scorecard')[0].stats[0].value | Should -Be '$5'
+    }
+}
diff --git a/Tests/Reports/ConvertTo-CippReportPdf.Tests.ps1 b/Tests/Reports/ConvertTo-CippReportPdf.Tests.ps1
new file mode 100644
index 0000000000000..fe555a2aefde3
--- /dev/null
+++ b/Tests/Reports/ConvertTo-CippReportPdf.Tests.ps1
@@ -0,0 +1,325 @@
+# Pester tests for ConvertTo-CippReportPdf and the CIPPSharp component kit it wraps.
+# Verifies every block type renders to a valid PDF, empty input still produces a page, branding is
+# applied without throwing, and every image format the engine accepts decodes and renders.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $Bin = Join-Path $RepoRoot 'Shared/CIPPSharp/bin'
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Core.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Pdf.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'CIPPSharp.dll'))
+
+    $HelperPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'ConvertTo-CippReportPdf.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $HelperPath) { throw 'Could not locate ConvertTo-CippReportPdf.ps1 under Modules/' }
+    . $HelperPath
+    # The wrapper resolves branding itself when none is passed; keep that offline.
+    function Get-CIPPBrandingSettings { @{} }
+    function Get-CIPPBrandingPreset { param($Id, [switch]$SkipImageData) @() }
+
+    function Test-IsPdf {
+        param($Bytes)
+        if ($Bytes -isnot [byte[]] -or $Bytes.Length -lt 100) { return $false }
+        return ([System.Text.Encoding]::ASCII.GetString($Bytes[0..4]) -eq '%PDF-')
+    }
+
+    # 1x1 transparent PNG.
+    $script:TinyPng = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg=='
+}
+
+Describe 'ConvertTo-CippReportPdf' {
+    Context 'Block types render to a valid PDF' {
+        It 'renders a blank (HTML) block with marks and a list' {
+            $b = @(@{ type = 'blank'; title = 'Summary'; content = '<p>Hello <strong>world</strong> and <em>more</em></p><ul><li>one</li><li>two</li></ul>' })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b -TenantName 'Contoso' -ReportName 'T') | Should -BeTrue
+        }
+        It 'renders a markdown test block with a status and a table' {
+            $md = "## Details`n`nUsers without **MFA** are exposed. SKU ``SPE_E5`` stays literal.`n`n| Setting | State |`n|---|---|`n| MFA | Off |"
+            $b = @(@{ type = 'test'; title = 'MFA'; status = 'Failed'; static = $false; content = $md })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'renders a database markdown table block' {
+            $b = @(@{ type = 'database'; title = 'Users'; format = 'text'; content = "| Name | UPN |`n|---|---|`n| Bob | bob@x.com |" })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'renders a database csv/json block as a code block' {
+            $b = @(@{ type = 'database'; title = 'Raw'; format = 'json'; content = '[{"a":1}]' })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'renders a scorecard block' {
+            $b = @(@{ type = 'scorecard'; title = 'At a glance'; stats = @(@{ value = '3'; label = 'Anon' }, @{ value = '7'; label = 'No expiry' }) })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'renders a chart block' {
+            $b = @(@{ type = 'chart'; title = 'By risk'; chartData = @(@{ label = 'High'; value = 5 }, @{ label = 'Low'; value = 9 }) })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'renders a hero and a page break without throwing' {
+            $b = @(@{ type = 'hero'; title = 'Chapter'; heroHighlight = '39' }, @{ type = 'pagebreak' }, @{ type = 'blank'; content = '<p>after</p>' })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+    }
+
+    Context 'Edge cases' {
+        It 'renders an empty component tree as a valid one-page PDF' {
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks @()) | Should -BeTrue
+        }
+        It 'applies a branding colour without throwing' {
+            $b = @(@{ type = 'blank'; content = '<p>x</p>' })
+            $branding = @{ colour = '#0E4C92'; secondaryColour = '#F77F00'; watermarkText = 'DRAFT'; watermarkEnabled = $true; footerText = '%tenantname% report' }
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b -Branding $branding -TenantName 'Contoso') | Should -BeTrue
+        }
+        It 'still renders when the branding logo cannot be embedded (skips it gracefully)' {
+            $b = @(@{ type = 'blank'; content = '<p>x</p>' })
+            # An unusable logo (here a PNG OfficeIMO rejects) must not sink the whole report.
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b -Branding @{ logo = $script:TinyPng }) | Should -BeTrue
+        }
+        It 'renders a table row taller than a page (the keep-rows-whole guard lets it split, not throw)' {
+            # Rich table rows are kept whole like the client's wrap={false}; OfficeIMO throws on an
+            # unsplittable row taller than the page, so a row this tall must stay splittable.
+            $Tall = (1..150 | ForEach-Object { "Line $_ of a very tall cell" }) -join "`n"
+            $Cols = @(@{ header = 'Setting'; key = 'name'; width = 1 }, @{ header = 'Value'; key = 'value'; width = 2 })
+            $Rows = @(@{ name = 'Short'; value = 'x' }, @{ name = 'Tall'; value = $Tall }, @{ name = 'After'; value = 'y' })
+            $b = @(@{ type = 'richtable'; title = 'Tall'; columns = $Cols; rows = $Rows; limit = 10 })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'moves a row that would straddle a page break whole onto the next page' {
+            # Twenty short lines in a third-width column: about 220pt, under half a page, so it is kept
+            # whole. Filler rows put its top near the page foot, where it would otherwise be cut (a
+            # row follows it: OfficeIMO already moves a table's last row whole).
+            $Tall = (@('ROWSTART') + (2..19 | ForEach-Object { "Line $_ of the setting value" }) + @('ROWEND')) -join "`n"
+            $Cols = @(@{ header = 'Setting'; key = 'name'; width = 1 }, @{ header = 'Today'; key = 'value'; width = 1 }, @{ header = 'Target'; key = 'target'; width = 1 })
+            $Rows = @(1..20 | ForEach-Object { @{ name = "Filler $_"; value = 'x'; target = 'y' } }) +
+                @(@{ name = 'Tall'; value = $Tall; target = 'z' }, @{ name = 'After'; value = 'x'; target = 'y' })
+            $b = @(@{ type = 'richtable'; title = 'Straddle'; columns = $Cols; rows = $Rows; limit = 50 })
+            $Pages = @([OfficeIMO.Pdf.PdfReadDocument]::Open((ConvertTo-CippReportPdf -Blocks $b)).Pages | ForEach-Object { $_.ExtractText() })
+            $Start = @(0..($Pages.Count - 1) | Where-Object { $Pages[$_] -match 'ROWSTART' })
+            $End = @(0..($Pages.Count - 1) | Where-Object { $Pages[$_] -match 'ROWEND' })
+            $Start | Should -HaveCount 1
+            $End | Should -Be $Start
+        }
+        It 'accepts a pre-serialised JSON block string' {
+            $json = ConvertTo-Json -InputObject @(@{ type = 'blank'; content = '<p>json</p>' }) -Depth 10
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $json) | Should -BeTrue
+        }
+    }
+
+    Context 'Image formats' {
+        BeforeAll {
+            # 1x1 fixtures: the smallest valid GIF and WebP, a two-colour SVG, and a corrupt PNG.
+            $script:Gif = 'data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7'
+            $script:Webp = 'data:image/webp;base64,UklGRiIAAABXRUJQVlA4IBYAAAAwAQCdASoBAAEADsD+JaQAA3AAAAAA'
+            $script:Svg = 'data:image/svg+xml;base64,' + [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('<svg xmlns="http://www.w3.org/2000/svg" width="40" height="20"><rect width="40" height="20" fill="#F77F00"/></svg>'))
+            $script:Block = @(@{ type = 'blank'; title = 'Formats'; content = '<p>x</p>' })
+        }
+        It 'identifies every raster OfficeIMO decodes, not just PNG and JPEG' {
+            [CIPP.Reporting.ReportComponents]::ImageContentType([CIPP.Reporting.ReportComponents]::DecodeImage($script:Gif)) | Should -Be 'image/gif'
+            [CIPP.Reporting.ReportComponents]::ImageContentType([CIPP.Reporting.ReportComponents]::DecodeImage($script:Webp)) | Should -Be 'image/webp'
+        }
+        It 'rasterises an SVG once at decode time so every placement sees a PNG' {
+            $bytes = [CIPP.Reporting.ReportComponents]::DecodeImage($script:Svg)
+            [CIPP.Reporting.ReportComponents]::ImageContentType($bytes) | Should -Be 'image/png'
+            # 40x20 source scaled to 1200px on the long side, aspect kept.
+            $size = [CIPP.Reporting.ReportComponents]::ImageSize($bytes)
+            $size.Item1 | Should -Be 1200
+            $size.Item2 | Should -Be 600
+        }
+        It 'drops what OfficeIMO cannot identify rather than failing the render' {
+            [CIPP.Reporting.ReportComponents]::DecodeImage($script:TinyPng) | Should -BeNullOrEmpty
+            [CIPP.Reporting.ReportComponents]::DecodeImage('data:image/png;base64,' + [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes('not an image'))) | Should -BeNullOrEmpty
+        }
+        It 'renders a GIF logo, an SVG logo and a WebP cover' {
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $script:Block -Branding @{ logo = $script:Gif }) | Should -BeTrue
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $script:Block -Branding @{ logo = $script:Svg }) | Should -BeTrue
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $script:Block -Branding @{ coverImage = $script:Webp; logo = $script:Webp }) | Should -BeTrue
+        }
+    }
+
+    Context 'Emoji rendering' {
+        BeforeAll {
+            # A render populates the emoji flags (font coverage from the cmap; Twemoji image assets present).
+            $null = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; content = '<p>x</p>' })
+        }
+        It 'renders arbitrary BMP and astral emoji (incl. a ZWJ sequence) alongside text without throwing' {
+            $party = [char]::ConvertFromUtf32(0x1F389)   # astral (surrogate pair)
+            $rocket = [char]::ConvertFromUtf32(0x1F680)  # astral
+            $star = [char]0x2B50                         # BMP symbol
+            $dev = [char]::ConvertFromUtf32(0x1F469) + [char]0x200D + [char]::ConvertFromUtf32(0x1F4BB) # woman technologist (ZWJ)
+            $b = @(@{ type = 'blank'; content = "<p>Great work $party a rocket $rocket a star $star a dev $dev and warning [!]</p>" })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'renders emoji inside a callout (table cell) without throwing' {
+            $party = [char]::ConvertFromUtf32(0x1F389)
+            $b = @(@{ type = 'infobox'; title = "Alert $party"; tone = 'warn'; content = "Body [!] with a rocket $([char]::ConvertFromUtf32(0x1F680))." })
+            Test-IsPdf (ConvertTo-CippReportPdf -Blocks $b) | Should -BeTrue
+        }
+        It 'loads the bundled monochrome font coverage and the Twemoji image assets' {
+            [CIPP.Reporting.ReportMarkdown]::RenderEmojiGlyphs | Should -BeTrue
+            [CIPP.Reporting.ReportMarkdown]::EmojiCoverage.Count | Should -BeGreaterThan 100
+            [CIPP.Reporting.ReportMarkdown]::RenderEmojiImages | Should -BeTrue
+        }
+        It 'keeps a colour emoji (which the renderer draws as an image) rather than stripping it' {
+            # A red circle has a Twemoji asset, so Sanitize keeps it verbatim for the image renderer.
+            [CIPP.Reporting.ReportMarkdown]::Sanitize([char]::ConvertFromUtf32(0x1F534)) | Should -Be ([char]::ConvertFromUtf32(0x1F534))
+        }
+        It 'promotes the status tokens to their colour glyphs' {
+            [CIPP.Reporting.ReportMarkdown]::Sanitize('[Pass]') | Should -Be '✅'
+            [CIPP.Reporting.ReportMarkdown]::Sanitize('[Fail]') | Should -Be '❌'
+        }
+    }
+}
+
+Describe 'Watermark layering' {
+    # OfficeIMO paints the watermark first; the engine moves its operator block to the end of each page's
+    # content stream so it sits over the content, on content pages and dark divider pages alike.
+    It 'draws the watermark after everything else on every page that carries one' {
+        $Blocks = @(
+            @{ type = 'scorecard'; title = 'Figures'; stats = @(@{ value = '1'; label = 'One' }, @{ value = '2'; label = 'Two' }) }
+            @{ type = 'hero'; title = 'Divider'; heroHighlight = '83%'; heroSubText = 'of controls in place' }
+            @{ type = 'blank'; title = 'After the divider'; content = '<p>Body text under the mark.</p>' }
+        )
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Blocks -Variables @{} -Branding @{ colour = '#0E4C92'; watermarkText = 'Preview'; watermarkEnabled = $true } -TenantName 'Contoso' -ReportName 'T'
+        $Pdf = [System.Text.Encoding]::Latin1.GetString($Bytes)
+        $Marker = '<50524556494557> Tj'
+        $Streams = [regex]::Matches($Pdf, '(?s)<< /Length (\d+) >>\s*stream\n(.*?)\nendstream') | ForEach-Object { $_.Groups[2].Value }
+        $Marked = @($Streams | Where-Object { $_.Contains($Marker) })
+        # a content page and the divider at least; the cover never carries one
+        $Marked.Count | Should -BeGreaterOrEqual 2
+        $Streams[0] | Should -Not -Match 'Tj\s*ET\s*Q\s*$'
+        foreach ($Data in $Marked) {
+            $Data.TrimEnd() | Should -Match "$([regex]::Escape($Marker))\s*ET\s*Q$"
+            ([regex]::Matches($Data, '> Tj|\) Tj') | Select-Object -Last 1).Value | Should -Be '> Tj'
+            $Data.LastIndexOf(' re') | Should -BeLessThan $Data.IndexOf($Marker)
+            # rising left to right like the client's rotate(-45deg), the divider's tag angle written back
+            $Data | Should -Match '0\.707 0\.707 -0\.707 0\.707 [\d.]+ [\d.]+ +Tm'
+        }
+    }
+
+    It 'lifts a mark written with cp1252 characters (curly quote, dash) like any other' {
+        $Mark = "O$([char]0x2019)Brien $([char]0x2014) Draft"
+        $Bytes = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; title = 'T'; content = '<p>x</p>' }) -Variables @{} -Branding @{ colour = '#0E4C92'; watermarkText = $Mark; watermarkEnabled = $true } -TenantName 'Contoso' -ReportName 'T'
+        $Pdf = [System.Text.Encoding]::Latin1.GetString($Bytes)
+        # WinAnsi: the right single quote is 0x92 and the em dash 0x97
+        $Pdf | Should -Match '<4F92425249454E'
+        $Streams = [regex]::Matches($Pdf, '(?s)<< /Length (\d+) >>\s*stream\n(.*?)\nendstream') | ForEach-Object { $_.Groups[2].Value }
+        $Marked = @($Streams | Where-Object { $_ -match '0\.707 0\.707 -0\.707 0\.707' })
+        $Marked.Count | Should -BeGreaterOrEqual 1
+        foreach ($Data in $Marked) { $Data.TrimEnd() | Should -Match 'Tj\s*ET\s*Q$' }
+    }
+
+    It 'stacks a mark wider than the page on full lines rather than overprinting them' {
+        $Bytes = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; title = 'T'; content = '<p>x</p>' }) -Variables @{} -Branding @{ colour = '#0E4C92'; watermarkText = 'Testing watermark'; watermarkEnabled = $true } -TenantName 'Contoso' -ReportName 'T'
+        $Pdf = [System.Text.Encoding]::Latin1.GetString($Bytes)
+        $Hex = { param($s) [Convert]::ToHexString([System.Text.Encoding]::ASCII.GetBytes($s)) }
+        # two lines, the second a 1.1x line (79.2pt at 72pt) under the first, not the client's 14pt
+        $Pdf | Should -Match ("<{0}> Tj\n-?[\d.]+ -79\.2 Td <{1}> Tj" -f (& $Hex 'TESTING'), (& $Hex 'WATERMARK'))
+    }
+
+    It 'prints a mark character outside WinAnsi as ? instead of failing the report' {
+        # 'L' with stroke has no WinAnsi code, and the micro sign upper-cases to the Greek capital mu
+        $Mark = "$([char]0x0141)$([char]0x00F3)d$([char]0x017A) 5 $([char]0x00B5)m"
+        $Bytes = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; title = 'T'; content = '<p>x</p>' }) -Variables @{} -Branding @{ colour = '#0E4C92'; watermarkText = $Mark; watermarkEnabled = $true } -TenantName 'Contoso' -ReportName 'T'
+        [System.Text.Encoding]::ASCII.GetString($Bytes[0..4]) | Should -Be '%PDF-'
+        [System.Text.Encoding]::Latin1.GetString($Bytes) | Should -Match '0\.707 0\.707 -0\.707 0\.707'
+    }
+
+    It 'leaves a document without a watermark untouched' {
+        $Bytes = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; title = 'T'; content = '<p>x</p>' }) -Variables @{} -Branding @{ colour = '#0E4C92' } -TenantName 'Contoso' -ReportName 'T'
+        [System.Text.Encoding]::ASCII.GetString($Bytes[0..4]) | Should -Be '%PDF-'
+        [System.Text.Encoding]::Latin1.GetString($Bytes) | Should -Not -Match '0\.707 0\.707 -0\.707 0\.707'
+    }
+}
+
+Describe 'Tenant name in the branding text' {
+    It 'substitutes %tenantname% with the name the report was given, before the cache-based replacement runs' {
+        $script:Seen = @()
+        function Get-CIPPTextReplacement { param($TenantFilter, $Text, [switch]$EscapeForJson) $script:Seen += $Text; $Text -replace '%tenantname%', 'CacheName' }
+        $Bytes = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; title = 'T'; content = '<p>x</p>' }) -Variables @{} -Branding @{ colour = '#0E4C92'; footerText = 'Prepared for %TenantName%'; watermarkText = '%tenantname%' } -TenantName 'contoso.onmicrosoft.com' -TenantFilter 'contoso.onmicrosoft.com' -ReportName 'T'
+        [System.Text.Encoding]::ASCII.GetString($Bytes[0..4]) | Should -Be '%PDF-'
+        $Branding = $script:Seen | Where-Object { $_ -like '*footerText*' } | Select-Object -First 1
+        $Branding | Should -Match 'Prepared for contoso\.onmicrosoft\.com'
+        $Branding | Should -Match '"watermarkText":"contoso\.onmicrosoft\.com"'
+        $Branding | Should -Not -Match '(?i)%tenantname%'
+    }
+}
+
+Describe 'Report builder cover block' {
+    It 'puts a cover block on the cover and draws nothing else for it' {
+        $Bytes = ConvertTo-CippReportPdf -Blocks @(
+            @{ type = 'cover'; title = 'Custom Cover'; coverAccent = 'Words'; subtitle = 'A subtitle of my own'; coverLabel = 'My Label' }
+            @{ type = 'blank'; title = 'Body'; content = '<p>x</p>' }
+        ) -Variables @{} -Branding @{ colour = '#0E4C92' } -TenantName 'Contoso' -ReportName 'Ignored Name'
+        $Pdf = [System.Text.Encoding]::Latin1.GetString($Bytes)
+        $Hex = { param($s) [Convert]::ToHexString([System.Text.Encoding]::ASCII.GetBytes($s)) }
+        # the drawing writes a word per string, so the words are what can be matched
+        $Pdf | Should -Match (& $Hex 'CUSTOM')
+        $Pdf | Should -Match (& $Hex 'COVER')
+        $Pdf | Should -Match (& $Hex 'WORDS')
+        $Pdf | Should -Match (& $Hex 'LABEL')
+        $Pdf | Should -Not -Match (& $Hex 'IGNORED')
+        ([regex]::Matches($Pdf, '/Type /Page[^s]')).Count | Should -Be 2
+    }
+}
+
+Describe 'Cover footer note' {
+    It 'prefers the branding cover note over the report''s own, which is the fallback' {
+        $Cover = {
+            param($Branding)
+            $Bytes = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; title = 'T'; content = '<p>x</p>' }) -Variables @{ coverfooternote = 'Report wording' } -Branding $Branding -TenantName 'Contoso' -ReportName 'T'
+            [OfficeIMO.Pdf.PdfReadDocument]::Open($Bytes).Pages[0].ExtractText()
+        }
+        $Branded = & $Cover @{ colour = '#0E4C92'; coverFooterText = 'Branded wording' }
+        $Branded | Should -Match 'BRANDED\s+WORDING'
+        $Branded | Should -Not -Match 'REPORT\s+WORDING'
+        & $Cover @{ colour = '#0E4C92' } | Should -Match 'REPORT\s+WORDING'
+    }
+
+    It 'keeps the tenant and meta lines on a landscape cover with a logo and a two-line subtitle' {
+        # a 3:1 PNG logo: the tallest the cover draws, which leaves a landscape page the least room
+        $Logo = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAB4AAAAKCAYAAACjd+4vAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAAfSURBVDhPY+DzmfR/IDADugC98KjFdMOjFtMNjzyLAVL6P4McNkyeAAAAAElFTkSuQmCC'
+        $Variables = @{ coversubtitle = 'A deliberately long subtitle that wraps onto a second line on the landscape cover of the report'; covermeta = '24 sharing links' }
+        $Bytes = ConvertTo-CippReportPdf -Blocks @(@{ type = 'blank'; title = 'T'; content = '<p>x</p>' }) -Variables $Variables -Branding @{ colour = '#0E4C92'; logo = $Logo } -TenantName 'Contoso Landscape Tenant' -ReportName 'Quarterly Security Review' -Landscape
+        $Cover = [OfficeIMO.Pdf.PdfReadDocument]::Open($Bytes).Pages[0].ExtractText()
+        $Cover | Should -Match 'Contoso\s+Landscape\s+Tenant'
+        $Cover | Should -Match '24\s+sharing\s+links'
+        $Cover | Should -Match 'CONFIDENTIAL'
+    }
+}
+
+Describe 'Gallery covers on Infographic pages' {
+    It 'reads a gallery cover into the page and leaves a missing one as a plain background' {
+        function Get-CIPPImage { param($PartitionKey, $Id) if ($Id -eq 'g1') { @{ data = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==' } } }
+        $Blocks = @(
+            @{ type = 'hero'; title = 'With cover'; heroHighlight = '1'; heroImage = 'gallery:g1' }
+            @{ type = 'hero'; title = 'Without'; heroHighlight = '2'; heroImage = 'gallery:missing' }
+        )
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Blocks -Variables @{} -Branding @{ colour = '#0E4C92'; coverStock = 'none' } -TenantName 'Contoso' -ReportName 'T'
+        $Pdf = [System.Text.Encoding]::Latin1.GetString($Bytes)
+        # the PNG carries an alpha mask, so it lands as two image objects; none at all without a cover
+        ([regex]::Matches($Pdf, '/Subtype /Image')).Count | Should -BeGreaterOrEqual 1
+        $Plain = ConvertTo-CippReportPdf -Blocks @(@{ type = 'hero'; title = 'Without'; heroHighlight = '2'; heroImage = 'gallery:missing' }) -Variables @{} -Branding @{ colour = '#0E4C92'; coverStock = 'none' } -TenantName 'Contoso' -ReportName 'T'
+        ([regex]::Matches([System.Text.Encoding]::Latin1.GetString($Plain), '/Subtype /Image')).Count | Should -Be 0
+        $Blocks[0].heroImage | Should -BeLike 'data:image/png;base64,*'
+        $Blocks[1].heroImage | Should -Be ''
+    }
+}
+
+Describe 'Table empty state' {
+    It 'draws a table''s emptyText inside the table when it has no rows' {
+        $Table = @{ type = 'richtable'; columns = @(@{ header = 'Plan'; key = 'p'; width = 2 }, @{ header = 'Seats'; key = 's'; width = 1 }); rows = @(); limit = 10; emptyText = 'Nothing to list.' }
+        $Bytes = ConvertTo-CippReportPdf -Blocks @($Table) -Variables @{} -Branding @{ colour = '#0E4C92' } -TenantName 'Contoso' -ReportName 'T'
+        $Text = ([OfficeIMO.Pdf.PdfReadDocument]::Open($Bytes).Pages | ForEach-Object { $_.ExtractText() }) -join "`n"
+        $Text | Should -Match 'PLAN\s+SEATS\s+Nothing to list\.'
+    }
+
+    It 'falls back to the client DataTable''s own wording, and leaves a markdown table without one' {
+        $Blocks = @(
+            @{ type = 'richtable'; columns = @(@{ header = 'Plan'; key = 'p' }); rows = @(); limit = 10 }
+            @{ type = 'database'; title = 'Header only'; format = 'text'; content = "| Name | UPN |`n|---|---|" }
+        )
+        $Bytes = ConvertTo-CippReportPdf -Blocks $Blocks -Variables @{} -Branding @{ colour = '#0E4C92' } -TenantName 'Contoso' -ReportName 'T'
+        $Text = ([OfficeIMO.Pdf.PdfReadDocument]::Open($Bytes).Pages | ForEach-Object { $_.ExtractText() }) -join "`n"
+        $Text | Should -Match 'PLAN\s+Nothing to report\.'
+        ([regex]::Matches($Text, 'Nothing to report')).Count | Should -Be 1
+    }
+}
diff --git a/Tests/Reports/Get-CIPPBrandingSettings.Tests.ps1 b/Tests/Reports/Get-CIPPBrandingSettings.Tests.ps1
index 97d341cc52498..7fbccec333e70 100644
--- a/Tests/Reports/Get-CIPPBrandingSettings.Tests.ps1
+++ b/Tests/Reports/Get-CIPPBrandingSettings.Tests.ps1
@@ -26,6 +26,7 @@ BeforeAll {
         return $Map
     }
     function Add-CIPPImage { param($PartitionKey, $Data) @{ id = 'migrated-1' } }
+    function Get-CIPPImageNameMap { param($PartitionKey) if ($script:ImageNames) { $script:ImageNames } else { @{} } }
     function ConvertTo-CIPPCoverImageIdList {
         param($Value)
         if ($null -eq $Value -or $Value -eq '') { return , [string[]]@() }
@@ -155,6 +156,21 @@ Describe 'Get-CIPPBrandingSettings' {
         }
     }
 
+    Context 'Named covers' {
+        It 'lists the gallery covers by id with the names they were given' {
+            $script:Rows = @(New-ConfigRow -Overrides @{ coverImageIds = '["c1","c2"]' })
+            $script:Images = @{ c1 = @{ data = 'data:image/png;base64,AAAA' }; c2 = @{ data = 'data:image/png;base64,BBBB' } }
+            $script:ImageNames = @{ c1 = 'Board room' }
+            $Covers = @((Get-CIPPBrandingSettings).coverImages)
+            $Covers.Count | Should -Be 2
+            $Covers[0].id | Should -Be 'c1'
+            $Covers[0].name | Should -Be 'Board room'
+            $Covers[1].name | Should -Be ''
+            $script:ImageNames = $null
+            $script:Images = @{}
+        }
+    }
+
     Context 'Cover stock' {
         It 'falls back to the default stock when the stored value is not one we ship' {
             $script:Rows = @(New-ConfigRow -Overrides @{ coverStock = 'https://evil.example/x.jpg' })
diff --git a/Tests/Reports/Get-CIPPShadowAIReport.Tests.ps1 b/Tests/Reports/Get-CIPPShadowAIReport.Tests.ps1
new file mode 100644
index 0000000000000..7bbcc2671f9ab
--- /dev/null
+++ b/Tests/Reports/Get-CIPPShadowAIReport.Tests.ps1
@@ -0,0 +1,69 @@
+# Pester tests for Get-CIPPShadowAIReport, the cache-plus-catalog rollup behind ListShadowAI and the
+# Shadow AI PDF: Intune rows merge per tool, Entra apps pick up their grants, and both sources roll up
+# into one tool list for the summary and charts.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPShadowAIReport.ps1')
+    # The real catalog (Config/ShadowAI.json) resolves through CIPPRootPath.
+    $env:CIPPRootPath = $RepoRoot
+
+    # Static stubs for the cache, table and Graph reads. No pass-through mocks.
+    function New-CIPPDbRequest {
+        param($TenantFilter, $Type, $Fields)
+        switch ($Type) {
+            'DetectedApps' {
+                @(
+                    [pscustomobject]@{ displayName = 'GitHub Copilot'; publisher = 'GitHub, Inc.'; version = '1.0'; platform = 'Windows'; managedDevices = @(@{ id = 'dev1' }, @{ id = 'dev2' }) }
+                    [pscustomobject]@{ displayName = 'GitHub Copilot'; publisher = 'CN=GitHub, Inc., O=GitHub'; version = '1.1'; platform = 'Windows'; managedDevices = @(@{ id = 'dev2' }, @{ id = 'dev3' }) }
+                    [pscustomobject]@{ displayName = 'Notepad'; publisher = 'Microsoft'; version = '11'; platform = 'Windows'; managedDevices = @(@{ id = 'dev1' }) }
+                )
+            }
+            'ServicePrincipals' { @([pscustomobject]@{ displayName = 'GitHub Copilot for Business'; appId = 'app-1'; id = 'sp-1'; createdDateTime = '2026-01-15T00:00:00Z' }) }
+            'OAuth2PermissionGrants' { @([pscustomobject]@{ clientId = 'sp-1'; scope = 'User.Read Mail.Read User.Read' }) }
+        }
+    }
+    function Get-CIPPDbItem { param($TenantFilter, $Type, [switch]$CountsOnly) [pscustomobject]@{ Timestamp = [datetime]'2026-09-01' } }
+    function Get-CIPPTable { param($TableName) @{ Context = $TableName } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) @() }
+    function New-GraphGetRequest { param($uri, $tenantid) throw 'no P1' }
+    function Write-LogMessage { param([Parameter(ValueFromRemainingArguments = $true)]$Rest) }
+}
+
+Describe 'Get-CIPPShadowAIReport' {
+    BeforeAll { $script:Report = Get-CIPPShadowAIReport -TenantFilter 'contoso.onmicrosoft.com' }
+
+    It 'merges the Intune inventory rows of one tool into a single row with distinct devices' {
+        $apps = @($script:Report.detectedApps)
+        $apps.Count | Should -Be 1
+        $apps[0].aiTool | Should -Be 'GitHub Copilot'
+        $apps[0].deviceCount | Should -Be 3
+        $apps[0].version | Should -Be '1.0, 1.1'
+        # The shortest publisher string wins over the certificate subject.
+        $apps[0].publisher | Should -Be 'GitHub, Inc.'
+        $apps[0].status | Should -Be 'Unsanctioned'
+    }
+
+    It 'matches Entra service principals and attaches their distinct granted scopes' {
+        $apps = @($script:Report.consentedApps)
+        $apps.Count | Should -Be 1
+        $apps[0].applicationId | Should -Be 'app-1'
+        @($apps[0].approvedPermissions) | Should -Be @('Mail.Read', 'User.Read')
+        # The sign-in enrichment is best-effort: without P1 the counts stay at zero.
+        $apps[0].activeUsersLast7Days | Should -Be 0
+    }
+
+    It 'rolls both sources up into one tool for the summary and charts' {
+        $r = $script:Report
+        $r.summary.aiToolsDetected | Should -Be 1
+        $r.summary.deviceInstalls | Should -Be 3
+        $r.summary.consentedAiApps | Should -Be 1
+        $r.summary.intuneSynced | Should -BeTrue
+        $r.topTools[0].tool | Should -Be 'GitHub Copilot'
+        $r.topTools[0].devices | Should -Be 3
+        $r.topTools[0].footprint | Should -Be 3
+        $r.byRisk[0].risk | Should -Be 'Medium'
+        $r.byRisk[0].tools | Should -Be 1
+        $r.byCategory[0].category | Should -Be 'AI Coding'
+    }
+}
diff --git a/Tests/Reports/Get-CIPPSharePointPermissionsReport.Tests.ps1 b/Tests/Reports/Get-CIPPSharePointPermissionsReport.Tests.ps1
new file mode 100644
index 0000000000000..c300282ddc1a8
--- /dev/null
+++ b/Tests/Reports/Get-CIPPSharePointPermissionsReport.Tests.ps1
@@ -0,0 +1,62 @@
+# Pester tests for Get-CIPPSharePointPermissionsReport, the cache rollup behind ListSharePointPermissions
+# and the permissions PDF: scan coverage, the oversharing signals and the derived display fields.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPSharePointPermissionsReport.ps1')
+
+    # Static stubs for the cache reads. No pass-through mocks.
+    function New-CIPPDbRequest {
+        param($TenantFilter, $Type, $Fields)
+        @(
+            [pscustomobject]@{ rowType = 'Site'; siteName = 'Sales'; siteUrl = 'https://x/sites/Sales'; librariesScanned = 2; librariesWithUniquePermissions = 1; collectionStatus = 'Completed' }
+            [pscustomobject]@{ rowType = 'Site'; siteName = 'Broken'; siteUrl = 'https://x/sites/Broken'; librariesScanned = 0; librariesWithUniquePermissions = 0; collectionStatus = 'Skipped'; collectionError = 'boom' }
+            [pscustomobject]@{ rowType = 'Assignment'; principalId = 'p1'; permissionLevel = 'Full Control'; principalType = 'User'; scope = 'Site'; siteName = 'Sales'; siteUrl = 'https://x/sites/Sales' }
+            [pscustomobject]@{ rowType = 'Assignment'; principalId = 'p2'; permissionLevel = 'Edit'; principalType = 'User'; isGuest = $true; scope = 'Library'; siteName = 'https://x/sites/Sales'; siteUrl = 'https://x/sites/Sales'; libraryTitle = 'Docs' }
+            [pscustomobject]@{ rowType = 'Assignment'; principalId = 'p3'; permissionLevel = 'Read'; principalType = 'SharePoint Group'; broadClaim = 'Everyone'; scope = 'Site'; siteName = ''; siteUrl = 'https://x/sites/Sales' }
+            # Limited Access and placeholder rows grant nothing and stay out of every signal.
+            [pscustomobject]@{ rowType = 'Assignment'; principalId = 'p4'; permissionLevel = 'Full Control'; principalType = 'User'; isSystemManaged = $true; scope = 'Site' }
+            [pscustomobject]@{ rowType = 'Assignment'; principalId = $null; scope = 'Library' }
+        )
+    }
+    function Get-CIPPDbItem { param($TenantFilter, $Type, [switch]$CountsOnly) [pscustomobject]@{ Timestamp = [datetime]'2026-09-01' } }
+}
+
+Describe 'Get-CIPPSharePointPermissionsReport' {
+    BeforeAll { $script:Report = Get-CIPPSharePointPermissionsReport -TenantFilter 'contoso.onmicrosoft.com' }
+
+    It 'summarises scan coverage and the oversharing signals' {
+        $s = $script:Report.summary
+        $s.sitesScanned | Should -Be 2
+        $s.sitesSkipped | Should -Be 1
+        $s.librariesScanned | Should -Be 2
+        $s.uniquePermissionLibraries | Should -Be 1
+        $s.totalAssignments | Should -Be 3
+        $s.broadClaimGrants | Should -Be 1
+        $s.externalGrants | Should -Be 1
+        $s.directFullControlGrants | Should -Be 1
+        $s.permissionsSynced | Should -BeTrue
+        $s.lastDataRefresh | Should -Be ([datetime]'2026-09-01')
+    }
+
+    It 'builds the chart datasets from the real assignments only' {
+        $r = $script:Report
+        ($r.byPermissionLevel | Where-Object { $_.level -eq 'Full Control' }).grants | Should -Be 1
+        ($r.byPrincipalType | Where-Object { $_.type -eq 'User' }).grants | Should -Be 2
+        $r.byBroadClaim[0].claim | Should -Be 'Everyone'
+        $r.byBroadClaim[0].grants | Should -Be 1
+        $r.topSitesByUniqueLibraries[0].site | Should -Be 'Sales'
+        $r.topSitesByUniqueLibraries[0].libraries | Should -Be 1
+        $r.skippedSites[0].error | Should -Be 'boom'
+    }
+
+    It 'derives the display fields on every assignment row' {
+        $rows = @($script:Report.assignments)
+        $rows.Count | Should -Be 5
+        ($rows | Where-Object { $_.principalId -eq 'p2' }).appliesTo | Should -Be 'This library only'
+        ($rows | Where-Object { $_.principalId -eq 'p1' }).appliesTo | Should -Be 'Whole site'
+        # A URL or blank site name is replaced by a label taken from the URL.
+        ($rows | Where-Object { $_.principalId -eq 'p2' }).siteName | Should -Be 'Sales'
+        ($rows | Where-Object { $_.principalId -eq 'p3' }).siteName | Should -Be 'Sales'
+    }
+}
diff --git a/Tests/Reports/Get-CIPPSharePointSharingReport.Tests.ps1 b/Tests/Reports/Get-CIPPSharePointSharingReport.Tests.ps1
new file mode 100644
index 0000000000000..3aa281481a8bc
--- /dev/null
+++ b/Tests/Reports/Get-CIPPSharePointSharingReport.Tests.ps1
@@ -0,0 +1,82 @@
+# Pester tests for Get-CIPPSharePointSharingReport, the cache rollup behind ListSharePointSharing and
+# the sharing PDF: link counts by classification, the sprawl signals, workload summaries and rankings.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPSharePointSharingReport.ps1')
+
+    # Static stubs for the cache reads. No pass-through mocks.
+    function New-CIPPDbRequest {
+        param($TenantFilter, $Type, $Fields)
+        switch ($Type) {
+            'SharePointSharingLinks' {
+                @(
+                    [pscustomobject]@{ classification = 'Anonymous'; roles = @('write'); expirationDateTime = $null; itemType = 'Folder'; driveId = 'd1'; itemId = 'i1'; siteName = 'Sales'; driveName = 'Documents'; linkType = 'edit'; hasPassword = $false }
+                    [pscustomobject]@{ classification = 'External'; roles = @('read'); expirationDateTime = '2026-12-31'; itemType = 'File'; driveId = 'd1'; itemId = 'i2'; siteName = 'Sales'; driveName = 'Documents'; linkType = 'view'; sharedWith = @('a@example.com', 'b@example.org', '') }
+                    [pscustomobject]@{ classification = 'Internal'; roles = @('read'); itemType = 'File'; driveId = 'D1'; itemId = 'I1'; siteUrl = 'https://x/sites/Ops'; linkType = 'view'; hasPassword = $true }
+                )
+            }
+            'SharePointSiteUsage' {
+                @(
+                    [pscustomobject]@{ rootWebTemplate = 'Group'; fileCount = '10'; storageUsedInBytes = 1GB }
+                    [pscustomobject]@{ rootWebTemplate = 'Team Channel'; fileCount = 2; storageUsedInBytes = 1GB }
+                    [pscustomobject]@{ rootWebTemplate = 'SitePage'; fileCount = 5; storageUsedInBytes = 2GB }
+                )
+            }
+            'OneDriveUsage' { @([pscustomobject]@{ fileCount = 3; storageUsedInBytes = 512MB }) }
+        }
+    }
+    function Get-CIPPDbItem {
+        param($TenantFilter, $Type, [switch]$CountsOnly)
+        if ($Type -eq 'OneDriveUsage') { return $null }
+        [pscustomobject]@{ Timestamp = [datetime]'2026-09-01' }
+    }
+}
+
+Describe 'Get-CIPPSharePointSharingReport' {
+    BeforeAll { $script:Report = Get-CIPPSharePointSharingReport -TenantFilter 'contoso.onmicrosoft.com' }
+
+    It 'counts links by classification and the sprawl signals' {
+        $s = $script:Report.summary
+        $s.totalLinks | Should -Be 3
+        $s.anonymousLinks | Should -Be 1
+        $s.externalLinks | Should -Be 1
+        $s.internalLinks | Should -Be 1
+        # d1|i1 and D1|I1 are the same item.
+        $s.itemsShared | Should -Be 2
+        $s.anonymousEditLinks | Should -Be 1
+        $s.neverExpiringAnonymous | Should -Be 1
+        $s.folderShares | Should -Be 1
+        $s.passwordProtectedLinks | Should -Be 1
+        $s.externalRecipients | Should -Be 2
+    }
+
+    It 'summarises each workload from the usage caches' {
+        $s = $script:Report.summary
+        # Group-connected and Teams channel sites both count as Teams.
+        $s.teamsSites | Should -Be 2
+        $s.teamsFiles | Should -Be 12
+        $s.teamsStorageUsedGB | Should -Be 2
+        $s.sharePointSites | Should -Be 1
+        $s.sharePointFiles | Should -Be 5
+        $s.sharePointStorageUsedGB | Should -Be 2
+        $s.oneDriveAccounts | Should -Be 1
+        $s.oneDriveFiles | Should -Be 3
+        $s.oneDriveStorageUsedGB | Should -Be 0.5
+        $s.linksSynced | Should -BeTrue
+        $s.usageSynced | Should -BeTrue
+        $s.lastDataRefresh | Should -Be ([datetime]'2026-09-01')
+    }
+
+    It 'ranks the busiest libraries, sites and recipients' {
+        $r = $script:Report
+        $r.topLibraries[0].library | Should -Be 'Sales / Documents'
+        $r.topLibraries[0].links | Should -Be 2
+        $r.topSites[0].site | Should -Be 'Sales'
+        $r.topSites[0].links | Should -Be 2
+        @($r.topRecipients).Count | Should -Be 2
+        ($r.byScope | Where-Object { $_.scope -eq 'Anonymous' }).links | Should -Be 1
+        ($r.byLinkType | Where-Object { $_.type -eq 'view' }).links | Should -Be 2
+        @($r.links).Count | Should -Be 3
+    }
+}
diff --git a/Tests/Reports/Get-CippReportTenantName.Tests.ps1 b/Tests/Reports/Get-CippReportTenantName.Tests.ps1
new file mode 100644
index 0000000000000..634768b72a8de
--- /dev/null
+++ b/Tests/Reports/Get-CippReportTenantName.Tests.ps1
@@ -0,0 +1,47 @@
+# Pester tests for the branding's tenantLabel: which of the tenant's names a report prints.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Get-CippReportTenantName.ps1' | Select-Object -First 1 -ExpandProperty FullName)
+
+    $script:Tenant = [PSCustomObject]@{ displayName = 'Contoso (alias)'; defaultDomainName = 'contoso.onmicrosoft.com'; customerId = 'guid' }
+    $script:Settings = @{ tenantLabel = 'alias' }
+    $script:Presets = @{}
+    $script:GraphCalls = 0
+    function Get-Tenants { param($TenantFilter) $script:Tenant }
+    function Get-CIPPBrandingSettings { $script:Settings }
+    function Get-CIPPBrandingPreset { param($Id, [switch]$SkipImageData) $script:Presets[$Id] }
+    function New-GraphGetRequest { param($uri, $tenantid, $AsApp) $script:GraphCalls++; [PSCustomObject]@{ displayName = 'Contoso Ltd' } }
+}
+
+Describe 'Get-CippReportTenantName' {
+    BeforeEach { $script:GraphCalls = 0 }
+
+    It 'prints the name CIPP shows by default, without touching Graph' {
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' | Should -Be 'Contoso (alias)'
+        $script:GraphCalls | Should -Be 0
+    }
+
+    It 'prints the default domain when the branding asks for it' {
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' -Branding @{ tenantLabel = 'domain' } | Should -Be 'contoso.onmicrosoft.com'
+    }
+
+    It 'prints the organisation name from Graph when the branding asks for it, since the cache holds the alias' {
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' -Branding @{ tenantLabel = 'name' } | Should -Be 'Contoso Ltd'
+        $script:GraphCalls | Should -Be 1
+    }
+
+    It 'lets a preset decide over the global setting' {
+        $script:Presets['p1'] = @{ tenantLabel = 'domain' }
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' -BrandingPresetId 'p1' | Should -Be 'contoso.onmicrosoft.com'
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' -BrandingPresetId 'missing' | Should -Be 'Contoso (alias)'
+    }
+
+    It 'falls back to the shown name when Graph cannot answer, and to the filter when nothing is cached' {
+        function New-GraphGetRequest { throw 'no access' }
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' -Branding @{ tenantLabel = 'name' } | Should -Be 'Contoso (alias)'
+        function Get-Tenants { param($TenantFilter) $null }
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' -Branding @{ tenantLabel = 'domain' } | Should -Be 'contoso.onmicrosoft.com'
+        Get-CippReportTenantName -TenantFilter 'contoso.onmicrosoft.com' -Branding @{ tenantLabel = 'alias' } | Should -Be 'contoso.onmicrosoft.com'
+    }
+}
diff --git a/Tests/Reports/Invoke-ExecGetLicenseReportPdf.Tests.ps1 b/Tests/Reports/Invoke-ExecGetLicenseReportPdf.Tests.ps1
new file mode 100644
index 0000000000000..a457e224cc665
--- /dev/null
+++ b/Tests/Reports/Invoke-ExecGetLicenseReportPdf.Tests.ps1
@@ -0,0 +1,108 @@
+# Pester tests for the License Optimisation PDF endpoint: the request is validated before any work,
+# the page's analysis settings reach Get-CIPPLicenseRecommendation exactly as ListLicenseRecommendations
+# passes them, the section switches reach the tree, and the report renders to a PDF.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $Bin = Join-Path $RepoRoot 'Shared/CIPPSharp/bin'
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Core.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Pdf.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'CIPPSharp.dll'))
+
+    # Craft injects these types; shim them so the entrypoint's return statements bind.
+    if (-not ('HttpResponseContext' -as [type])) {
+        Add-Type -TypeDefinition 'public class HttpResponseContext { public object StatusCode; public object Body; public string ContentType; public object Headers; }'
+    }
+    $null = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+
+    $Reporting = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Directory -Filter 'Reporting' | Select-Object -First 1
+    Get-ChildItem -Path $Reporting.FullName -Filter '*.ps1' | ForEach-Object { . $_.FullName }
+    foreach ($Name in 'ConvertTo-CippReportPdf.ps1', 'Get-CippReportTenantName.ps1', 'Invoke-ExecGetLicenseReportPdf.ps1') {
+        . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter $Name | Select-Object -First 1 -ExpandProperty FullName)
+    }
+    function Get-Tenants { @{ displayName = 'Contoso Ltd'; defaultDomainName = 'contoso.onmicrosoft.com' } }
+    function Get-CIPPBrandingSettings { @{ colour = '#F77F00' } }
+    function Get-CIPPBrandingPreset { @() }
+    # A plain function: the -TenantFilter/-EscapeForJson it is also called with land in $args.
+    function Get-CIPPTextReplacement { param($Text) $Text }
+    function Write-LogMessage {}
+    function Get-CippException { param($Exception) @{ NormalizedError = "$($Exception)" } }
+
+    $Sample = Get-Content (Join-Path $RepoRoot 'Config/ReportSamples/licensing.json') -Raw | ConvertFrom-Json
+    # Records the analysis settings it was called with and returns the preview sample in the live shape.
+    function Get-CIPPLicenseRecommendation {
+        param($TenantFilter, $Currency, $InactiveDays, $TenureMonths, $RecommendDowngrades, $RecommendUpgrades, $RecommendTerms, $ProtectSecurityFeatures)
+        $script:Called = $PSBoundParameters
+        $Sample
+    }
+
+    function Invoke-Report($Body, $Query = @{}) {
+        $script:Called = $null
+        Invoke-ExecGetLicenseReportPdf -Request @{ Body = $Body; Query = $Query; Headers = @{} } -TriggerMetadata @{ FunctionName = 'ExecGetLicenseReportPdf' }
+    }
+}
+
+Describe 'Invoke-ExecGetLicenseReportPdf' {
+    It 'renders the report as a PDF named after the tenant' {
+        $Response = Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com' }
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $Response.ContentType | Should -Be 'application/pdf'
+        $Response.Headers.'Content-Disposition' | Should -Be 'inline; filename="Licensing_Report_contoso_onmicrosoft_com.pdf"'
+        [System.Text.Encoding]::ASCII.GetString($Response.Body[0..4]) | Should -Be '%PDF-'
+    }
+
+    It 'reports on the query tenant, the one the tenant-scope check authorised, over a body tenant' {
+        $null = Invoke-Report @{ tenantFilter = 'other.onmicrosoft.com' } @{ tenantFilter = 'contoso.onmicrosoft.com' }
+        $Called.TenantFilter | Should -Be 'contoso.onmicrosoft.com'
+    }
+
+    It 'passes the page analysis settings through, with only an explicit false turning a switch off' {
+        $null = Invoke-Report @{
+            tenantFilter = 'contoso.onmicrosoft.com'; currency = 'eur'; inactiveDays = 30; tenureMonths = '12'
+            recommendDowngrades = $false; recommendUpgrades = 'off'; protectSecurityFeatures = $true
+        }
+        $Called.Currency | Should -Be 'EUR'
+        $Called.InactiveDays | Should -Be 30
+        $Called.TenureMonths | Should -Be 12
+        $Called.RecommendDowngrades | Should -BeFalse
+        $Called.RecommendUpgrades | Should -BeFalse
+        $Called.RecommendTerms | Should -BeTrue
+        $Called.ProtectSecurityFeatures | Should -BeTrue
+    }
+
+    It 'defaults every analysis setting the way ListLicenseRecommendations does' {
+        $null = Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com' }
+        $Called.Currency | Should -Be 'USD'
+        $Called.InactiveDays | Should -Be 90
+        $Called.TenureMonths | Should -Be 6
+        $Called.RecommendDowngrades | Should -BeTrue
+    }
+
+    It 'drops only the sections switched off' {
+        Mock Build-CippLicenseReportTree { @{ Blocks = @(@{ type = 'page'; title = 'Summary' }); Variables = @{ coverlabel = 'x' } } }
+        $null = Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com'; sections = @{ spend = $false; terms = $true } }
+        Should -Invoke Build-CippLicenseReportTree -Times 1 -ParameterFilter {
+            $Sections.spend -eq $false -and $Sections.terms -and $Sections.reclaim -and $Sections.method -and $Data.TenantName -eq 'Contoso Ltd'
+        }
+    }
+
+    It 'rejects <case> with a 400 before gathering anything' -ForEach @(
+        @{ case = 'a missing tenant'; body = @{}; message = 'A single tenant*' }
+        @{ case = 'AllTenants'; body = @{ tenantFilter = 'AllTenants' }; message = 'A single tenant*' }
+        @{ case = 'a malformed currency'; body = @{ tenantFilter = 't'; currency = 'EURO' }; message = 'currency*' }
+        @{ case = 'an out-of-range inactiveDays'; body = @{ tenantFilter = 't'; inactiveDays = 0 }; message = 'inactiveDays*' }
+        @{ case = 'a non-numeric tenureMonths'; body = @{ tenantFilter = 't'; tenureMonths = 'soon' }; message = 'tenureMonths*' }
+    ) {
+        $Response = Invoke-Report $body
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        $Response.Body | Should -BeLike $message
+        $Called | Should -BeNullOrEmpty
+    }
+
+    It 'returns a 500 with the error when the analysis fails' {
+        Mock Get-CIPPLicenseRecommendation { throw 'cache unavailable' }
+        $Response = Invoke-Report @{ tenantFilter = 'contoso.onmicrosoft.com' }
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::InternalServerError)
+        $Response.Body | Should -BeLike '*cache unavailable*'
+    }
+}
diff --git a/Tests/Reports/Invoke-ExecPreviewBrandingReportPdf.Tests.ps1 b/Tests/Reports/Invoke-ExecPreviewBrandingReportPdf.Tests.ps1
new file mode 100644
index 0000000000000..0095272efc1c8
--- /dev/null
+++ b/Tests/Reports/Invoke-ExecPreviewBrandingReportPdf.Tests.ps1
@@ -0,0 +1,56 @@
+# Pester tests for the branding preview endpoint: every sample report type renders through its tree
+# builder against a supplied branding, and an unknown type is a 400. This is also what keeps
+# Config/ReportSamples/<type>.json in step with the builders' input shapes.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $Bin = Join-Path $RepoRoot 'Shared/CIPPSharp/bin'
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Core.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Pdf.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'CIPPSharp.dll'))
+    $env:CIPPRootPath = $RepoRoot
+
+    # Craft injects these types; shim them so the entrypoint's return statements bind.
+    if (-not ('HttpResponseContext' -as [type])) {
+        Add-Type -TypeDefinition 'public class HttpResponseContext { public object StatusCode; public object Body; public string ContentType; public object Headers; }'
+    }
+    $null = [PowerShell].Assembly.GetType('System.Management.Automation.TypeAccelerators')::Add('HttpStatusCode', [System.Net.HttpStatusCode])
+
+    $Reporting = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Directory -Filter 'Reporting' | Select-Object -First 1
+    Get-ChildItem -Path $Reporting.FullName -Filter '*.ps1' | ForEach-Object { . $_.FullName }
+    foreach ($Name in 'ConvertTo-CippReportPdf.ps1', 'Invoke-ExecPreviewBrandingReportPdf.ps1') {
+        . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter $Name | Select-Object -First 1 -ExpandProperty FullName)
+    }
+    function Get-CIPPBrandingSettings { @{ colour = '#F77F00' } }
+    function Get-CIPPBrandingPreset { param($Id, [switch]$SkipImageData) @() }
+    function Write-LogMessage { param([Parameter(ValueFromRemainingArguments = $true)]$Rest) }
+    function Get-CippException { param($Exception) @{ NormalizedError = "$($Exception)" } }
+
+    function Invoke-Preview($Body) {
+        Invoke-ExecPreviewBrandingReportPdf -Request @{ Body = $Body; Headers = @{} } -TriggerMetadata @{ FunctionName = 'ExecPreviewBrandingReportPdf' }
+    }
+}
+
+Describe 'Invoke-ExecPreviewBrandingReportPdf' {
+    It 'renders the <type> sample against the supplied branding' -ForEach @(
+        @{ type = 'executive' }, @{ type = 'reportBuilder' }, @{ type = 'shadowAI' }, @{ type = 'bec' }
+        @{ type = 'sharing' }, @{ type = 'permissions' }, @{ type = 'mailFlow' }, @{ type = 'licensing' }, @{ type = 'baseline' }
+    ) {
+        $Response = Invoke-Preview @{ reportType = $type; branding = @{ colour = '#0E4C92'; coverStock = 'none'; footerText = '%tenantname% preview' } }
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $Response.ContentType | Should -Be 'application/pdf'
+        [System.Text.Encoding]::ASCII.GetString($Response.Body[0..4]) | Should -Be '%PDF-'
+    }
+
+    It 'falls back to the executive sample and the saved branding when the body is empty' {
+        $Response = Invoke-Preview @{}
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        [System.Text.Encoding]::ASCII.GetString($Response.Body[0..4]) | Should -Be '%PDF-'
+    }
+
+    It 'rejects an unknown report type' {
+        $Response = Invoke-Preview @{ reportType = 'nope' }
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::BadRequest)
+        $Response.Body | Should -BeLike "Unknown report type 'nope'*"
+    }
+}
diff --git a/Tests/Reports/Push-ExecGenerateReportBuilderReport.Pdf.Tests.ps1 b/Tests/Reports/Push-ExecGenerateReportBuilderReport.Pdf.Tests.ps1
new file mode 100644
index 0000000000000..af4e983df46e0
--- /dev/null
+++ b/Tests/Reports/Push-ExecGenerateReportBuilderReport.Pdf.Tests.ps1
@@ -0,0 +1,66 @@
+# Pester tests for the PDF path of Push-ExecGenerateReportBuilderReport: a rendered PDF is stored in
+# its own table (never on the report row the list reads), attached to the scheduled-email envelope,
+# and -PreviewOnly returns bytes without storing anything.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $Bin = Join-Path $RepoRoot 'Shared/CIPPSharp/bin'
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Core.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'OfficeIMO.Pdf.dll'))
+    [void][System.Reflection.Assembly]::LoadFrom((Join-Path $Bin 'CIPPSharp.dll'))
+
+    function Find-Module1([string]$Name) {
+        Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter $Name -File -ErrorAction SilentlyContinue |
+            Select-Object -First 1 -ExpandProperty FullName
+    }
+    . (Find-Module1 'ConvertTo-CippReportPdf.ps1')
+    . (Find-Module1 'Get-CippReportTenantName.ps1')
+    . (Find-Module1 'Resolve-CippReportDataToken.ps1')
+    . (Find-Module1 'Push-ExecGenerateReportBuilderReport.ps1')
+
+    # Static stubs for the storage/data helpers the generator calls. The Add stub captures the stored
+    # entity per table so the test can assert on where the PDF went. No pass-through mocks.
+    $script:Stored = @{}
+    function Get-CippTable { param($tablename) @{ Context = $tablename } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property) @() }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) $script:Stored[$Context] = $Entity }
+    function Get-CIPPBrandingSettings { @{ colour = '#F77F00' } }
+    function Get-CIPPBrandingPreset { param($Id, [switch]$SkipImageData) @() }
+    function Get-Tenants { param($TenantFilter) @{ displayName = 'Contoso' } }
+    function New-CIPPDbRequest { param($TenantFilter, $Type, $Fields) @() }
+    function Get-CIPPTextReplacement { param($TenantFilter, $Text, [switch]$EscapeForJson) $Text }
+    function Write-LogMessage { param([Parameter(ValueFromRemainingArguments = $true)]$Rest) }
+    function Get-CippException { param($Exception) @{ NormalizedError = "$($Exception)" } }
+
+    $script:Blocks = ConvertTo-Json -InputObject @(@{ type = 'blank'; title = 'Summary'; content = '<p>Hello</p>' }) -Depth 10
+}
+
+Describe 'Push-ExecGenerateReportBuilderReport PDF path' {
+    It 'stores the base64 PDF in the ReportBuilderPdfs table, keyed by the report GUID, not on the report row' {
+        $script:Stored = @{}
+        $null = Push-ExecGenerateReportBuilderReport -TenantFilter 'contoso.onmicrosoft.com' -TemplateName 'Test Report' -Blocks $script:Blocks
+        $Report = $script:Stored['ReportBuilderReports']
+        $Pdf = $script:Stored['ReportBuilderPdfs']
+        $Report | Should -Not -BeNullOrEmpty
+        $Report.Pdf | Should -BeNullOrEmpty
+        $Pdf.RowKey | Should -Be $Report.RowKey
+        $Pdf.PartitionKey | Should -Be 'contoso.onmicrosoft.com'
+        $Pdf.FileName | Should -Be 'Test_Report_contoso_onmicrosoft_com.pdf'
+        # The stored value must be valid base64 of a real PDF.
+        $bytes = [Convert]::FromBase64String($Pdf.Pdf)
+        [System.Text.Encoding]::ASCII.GetString($bytes[0..4]) | Should -Be '%PDF-'
+    }
+
+    It 'returns the rendered PDF as an application/pdf task attachment' {
+        $result = Push-ExecGenerateReportBuilderReport -TenantFilter 'contoso.onmicrosoft.com' -TemplateName 'Test Report' -Blocks $script:Blocks
+        $result.TaskAttachments | Should -Not -BeNullOrEmpty
+        @($result.TaskAttachments | Where-Object { $_.ContentType -eq 'application/pdf' }).Count | Should -Be 1
+    }
+
+    It 'PreviewOnly returns bytes without persisting anything' {
+        $script:Stored = @{}
+        $result = Push-ExecGenerateReportBuilderReport -TenantFilter 'contoso.onmicrosoft.com' -Blocks $script:Blocks -PreviewOnly
+        [System.Text.Encoding]::ASCII.GetString($result.PdfBytes[0..4]) | Should -Be '%PDF-'
+        $script:Stored.Count | Should -Be 0
+    }
+}
diff --git a/Tests/Reports/Resolve-CippReportDataToken.Tests.ps1 b/Tests/Reports/Resolve-CippReportDataToken.Tests.ps1
new file mode 100644
index 0000000000000..3eff8c29b4ee7
--- /dev/null
+++ b/Tests/Reports/Resolve-CippReportDataToken.Tests.ps1
@@ -0,0 +1,161 @@
+# Pester tests for the report builder's data tokens: what &Users&, &Users.displayName&,
+# &Devices.complianceState=compliant& and the chart/table sources resolve to, from a stubbed
+# reporting database.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Resolve-CippReportDataToken.ps1' | Select-Object -First 1 -ExpandProperty FullName)
+
+    $script:Db = @{
+        Users   = @(
+            [PSCustomObject]@{ displayName = 'Adele Vance'; accountEnabled = $true; assignedLicenses = @(@{ skuId = 'e3' }, @{ skuId = 'p1' }) }
+            [PSCustomObject]@{ displayName = 'Alex Wilber'; accountEnabled = $true; assignedLicenses = @(@{ skuId = 'e3' }) }
+            [PSCustomObject]@{ displayName = 'Guest User'; accountEnabled = $false; assignedLicenses = @() }
+        )
+        SecureScore = @(
+            [PSCustomObject]@{ createdDateTime = '2026-08-24T00:00:00Z'; currentScore = 213.71; maxScore = 273 }
+            [PSCustomObject]@{ createdDateTime = '2026-08-22T00:00:00Z'; currentScore = 210.5; maxScore = 273 }
+            [PSCustomObject]@{ createdDateTime = '2026-08-23T00:00:00Z'; currentScore = 213.69; maxScore = 273 }
+        )
+        Mailboxes = @(
+            [PSCustomObject]@{ UPN = 'a@x'; department = 'Sales'; TotalItemSize = 10 }
+            [PSCustomObject]@{ UPN = 'b@x'; department = 'sales'; TotalItemSize = 5 }
+            [PSCustomObject]@{ UPN = 'c@x'; department = 'IT'; TotalItemSize = 40 }
+        )
+        Devices = @(
+            [PSCustomObject]@{ deviceName = 'PC1'; operatingSystem = 'Windows'; complianceState = 'compliant'; storageTotal = 512 }
+            [PSCustomObject]@{ deviceName = 'PC2'; operatingSystem = 'Windows'; complianceState = 'noncompliant'; storageTotal = 256 }
+            [PSCustomObject]@{ deviceName = 'MAC1'; operatingSystem = 'macOS'; complianceState = 'compliant'; storageTotal = 1024 }
+            [PSCustomObject]@{ deviceName = 'PHONE'; operatingSystem = $null; complianceState = 'Compliant'; storageTotal = 64 }
+        )
+    }
+    $script:Reads = 0
+    function New-CIPPDbRequest {
+        param($TenantFilter, $Type, $Fields)
+        $script:Reads++
+        if ($script:Db.ContainsKey($Type)) { $script:Db[$Type] } else { throw "No cache for $Type" }
+    }
+    function Resolve-Blocks($Blocks) {
+        $Out = @(Resolve-CippReportDataToken -Blocks $Blocks -TenantFilter 'contoso.onmicrosoft.com')
+        # one element per block, never a wrapped array: that is what blanked every preview once
+        $Out.Count | Should -Be @($Blocks).Count
+        foreach ($b in $Out) { $b -is [array] | Should -BeFalse }
+        # kept an array for the tests' indexing; a lone block would otherwise unroll to itself
+        , $Out
+    }
+}
+
+Describe 'Resolve-CippReportDataToken' {
+    BeforeEach { $script:Reads = 0 }
+
+    It 'counts a collection, lists a field and counts the rows that match' {
+        $Blocks = Resolve-Blocks @(@{ type = 'blank'; content = '<p>&amp;Users&amp; users: &amp;Users.displayName&amp;. Enabled: &Users.accountEnabled=true&, disabled: &Users.accountEnabled!=true&.</p>' })
+        $Blocks[0].content | Should -Be '<p>3 users: Adele Vance, Alex Wilber, Guest User. Enabled: 2, disabled: 1.</p>'
+    }
+
+    It 'reaches into nested objects and arrays, and wildcards a filter' {
+        $Blocks = Resolve-Blocks @(@{ type = 'note'; content = 'Licences: &Users.assignedLicenses.skuId&; E3 holders: &Users.assignedLicenses.skuId=e3&; Windows-ish: &Devices.operatingSystem=Win*&' })
+        $Blocks[0].content | Should -Be 'Licences: e3, p1; E3 holders: 2; Windows-ish: 2'
+    }
+
+    It 'aggregates a numeric field' {
+        $Blocks = Resolve-Blocks @(@{ type = 'scorecard'; stats = @(@{ label = 'Storage'; value = '&Devices.storageTotal:sum& GB' }, @{ label = 'Average'; value = '&Devices.storageTotal:avg&' }, @{ label = 'Largest'; value = '&Devices.storageTotal:max&' }) })
+        $Blocks[0].stats[0].value | Should -Be '1856 GB'
+        $Blocks[0].stats[1].value | Should -Be 464
+        $Blocks[0].stats[2].value | Should -Be 1024
+    }
+
+    It 'turns a lone numeric token into a number, so bars and points can use one' {
+        $Blocks = Resolve-Blocks @(@{ type = 'progress'; items = @(@{ label = 'Compliant'; value = '&Devices.complianceState=compliant&'; max = '&Devices&' }) })
+        $Blocks[0].items[0].value | Should -Be 3
+        $Blocks[0].items[0].value | Should -BeOfType [double]
+        $Blocks[0].items[0].max | Should -Be 4
+    }
+
+    It 'leaves a token that names nothing as written, and reads each collection once' {
+        $Blocks = Resolve-Blocks @(@{ type = 'blank'; content = '&Nope& and &Nope.x& stay; &Users& and &Users& resolve' }, @{ type = 'note'; content = '&Users.displayName=Adele Vance&' })
+        $Blocks[0].content | Should -Be '&Nope& and &Nope.x& stay; 3 and 3 resolve'
+        $Blocks[1].content | Should -Be '1'
+        $script:Reads | Should -Be 2
+    }
+
+    It 'fills a chart with one slice per value of the field, blanks counted apart' {
+        $Blocks = Resolve-Blocks @(@{ type = 'chart'; title = 'OS'; chartKind = 'donut'; chartSource = '&Devices.operatingSystem&'; chartData = @(@{ label = 'placeholder'; value = 0 }) })
+        $Points = @($Blocks[0].chartData)
+        $Points.Count | Should -Be 3
+        $Points[0].label | Should -Be 'Windows'
+        $Points[0].value | Should -Be 2
+        $Points[1].label | Should -Be 'macOS'
+        $Points[2].label | Should -Be '(blank)'
+        $Blocks[0].chartSource | Should -Be '&Devices.operatingSystem&'
+    }
+
+    It 'fills a chart with a single counted slice when the source has no field to group by' {
+        $Blocks = Resolve-Blocks @(@{ type = 'chart'; title = 'Compliant devices'; chartSource = '&Devices.complianceState=compliant&'; chartData = @() })
+        @($Blocks[0].chartData).Count | Should -Be 1
+        $Blocks[0].chartData[0].label | Should -Be 'Compliant devices'
+        $Blocks[0].chartData[0].value | Should -Be 3
+    }
+
+    It 'fills a table from the rows a filter keeps, each column reading its field or header' {
+        $Blocks = Resolve-Blocks @(@{
+                type = 'richtable'; dataSource = '&Devices.complianceState=compliant&'
+                columns = @(@{ header = 'Device'; key = 'c1'; field = 'deviceName' }, @{ header = 'operatingSystem'; key = 'c2' })
+                rows = @(@{ c1 = 'typed'; c2 = 'rows' })
+            })
+        $Rows = @($Blocks[0].rows)
+        $Rows.Count | Should -Be 3
+        $Rows[0].c1 | Should -Be 'PC1'
+        $Rows[0].c2 | Should -Be 'Windows'
+        $Rows[2].c2 | Should -Be ''
+        $Blocks[0].limit | Should -Be 200
+    }
+
+    It 'fills a chart from a picked source, grouping the rows the condition keeps' {
+        $Blocks = Resolve-Blocks @(@{ type = 'chart'; title = 'Compliant by OS'; chartSource = @{ type = 'Devices'; field = 'operatingSystem'; filter = @{ field = 'complianceState'; op = '='; value = 'compliant' } }; chartData = @() })
+        $Points = @($Blocks[0].chartData)
+        ($Points | ForEach-Object { "$($_.label)=$($_.value)" }) -join ';' | Should -Be 'macOS=1;Windows=1;(blank)=1'
+    }
+
+    It 'plots a value per row in date order, as a Secure Score trend needs' {
+        $Blocks = Resolve-Blocks @(@{ type = 'chart'; chartKind = 'trend'; chartSource = @{ type = 'SecureScore'; field = 'createdDateTime'; valueField = 'currentScore'; filter = $null }; chartData = @() })
+        ($Blocks[0].chartData | ForEach-Object { "$($_.label)=$($_.value)" }) -join ';' | Should -Be 'Aug 22=210.5;Aug 23=213.69;Aug 24=213.71'
+    }
+
+    It 'plots a value per row in row order when the labels are not dates, and treats Count of rows as counting' {
+        $Blocks = Resolve-Blocks @(
+            @{ type = 'chart'; chartKind = 'bar'; chartSource = @{ type = 'Mailboxes'; field = 'UPN'; valueField = 'TotalItemSize'; filter = $null }; chartData = @() }
+            @{ type = 'chart'; chartKind = 'bar'; chartSource = @{ type = 'Mailboxes'; field = 'department'; valueField = '__count'; filter = $null }; chartData = @() }
+        )
+        ($Blocks[0].chartData | ForEach-Object { "$($_.label)=$($_.value)" }) -join ';' | Should -Be 'a@x=10;b@x=5;c@x=40'
+        ($Blocks[1].chartData | ForEach-Object { "$($_.label)=$($_.value)" }) -join ';' | Should -Be 'Sales=2;IT=1'
+    }
+
+    It 'combines the rows sharing a label with the chosen aggregate' {
+        $Blocks = Resolve-Blocks @(@{ type = 'chart'; chartKind = 'bar'; chartSource = @{ type = 'Mailboxes'; field = 'department'; valueField = 'TotalItemSize'; aggregate = 'sum'; filter = $null }; chartData = @() })
+        ($Blocks[0].chartData | ForEach-Object { "$($_.label)=$($_.value)" }) -join ';' | Should -Be 'IT=40;Sales=15'
+    }
+
+    It 'counts a picked source with no field as one slice' {
+        $Blocks = Resolve-Blocks @(@{ type = 'chart'; title = 'Devices'; chartSource = @{ type = 'Devices'; field = $null; filter = $null }; chartData = @() })
+        $Blocks[0].chartData[0].value | Should -Be 4
+    }
+
+    It 'fills a table from a picked source' {
+        $Blocks = Resolve-Blocks @(@{ type = 'richtable'; dataSource = @{ type = 'Users'; filter = @{ field = 'accountEnabled'; op = '!='; value = 'true' } }; columns = @(@{ header = 'Name'; key = 'c1'; field = 'displayName' }); rows = @() })
+        @($Blocks[0].rows).Count | Should -Be 1
+        $Blocks[0].rows[0].c1 | Should -Be 'Guest User'
+    }
+
+    It 'keeps typed rows when the table source names nothing' {
+        $Blocks = Resolve-Blocks @(@{ type = 'richtable'; dataSource = '&Nothing&'; columns = @(@{ header = 'A'; key = 'c1' }); rows = @(@{ c1 = 'typed' }) })
+        $Blocks[0].rows[0].c1 | Should -Be 'typed'
+    }
+
+    It 'walks objects parsed from JSON the way the generator hands them over' {
+        $Json = '[{"type":"scorecard","stats":[{"label":"Users","value":"&Users&"}]},{"type":"page","title":"&Devices& devices","subtitle":"x"}]'
+        $Blocks = Resolve-Blocks @(ConvertFrom-Json -InputObject $Json)
+        $Blocks[0].stats[0].value | Should -Be 3
+        $Blocks[1].title | Should -Be '4 devices'
+    }
+}
diff --git a/Tests/Scheduler/Add-CIPPScheduledTask.HashtableInput.Tests.ps1 b/Tests/Scheduler/Add-CIPPScheduledTask.HashtableInput.Tests.ps1
new file mode 100644
index 0000000000000..f628ff9b38290
--- /dev/null
+++ b/Tests/Scheduler/Add-CIPPScheduledTask.HashtableInput.Tests.ps1
@@ -0,0 +1,56 @@
+# Callers that pass the task or its Parameters as a hashtable must be stored the same as a
+# [pscustomobject]: a future ScheduledTime kept as a Unix-time string, and the real parameter keys.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $RepoRoot 'Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1'
+
+    function Get-CIPPTable { param($TableName) }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Add-CippQueueMessage { param($Cmdlet, $Parameters) }
+    function Get-CIPPSchedulerBlockedCommands { @() }
+    function Get-NormalizedError { param($Message) $Message }
+    function Write-LogMessage { param($headers, $API, $message, $Sev, $tenant, $tenantid, $LogData) }
+
+    . $FunctionPath
+
+    $script:Future = [string][int64]([DateTimeOffset]::UtcNow.AddDays(30).ToUnixTimeSeconds())
+}
+
+Describe 'Add-CIPPScheduledTask hashtable input' {
+    BeforeEach {
+        $script:CapturedEntity = $null
+        Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'stub' } }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:CapturedEntity = $Entity }
+        Mock -CommandName Get-Command -MockWith { [pscustomobject]@{ Module = 'CIPPCore'; Parameters = @{} } }
+    }
+
+    It 'keeps a future ScheduledTime from a hashtable task' {
+        Add-CIPPScheduledTask -Task @{
+            Name          = 'Hashtable task'
+            Command       = @{ value = 'Write-LogMessage' }
+            TenantFilter  = 'contoso.onmicrosoft.com'
+            Parameters    = [pscustomobject]@{ message = 'hi' }
+            ScheduledTime = $script:Future
+        }
+
+        $script:CapturedEntity.ScheduledTime | Should -BeOfType [string]
+        $script:CapturedEntity.ScheduledTime | Should -Be $script:Future
+    }
+
+    It 'stores the keys of hashtable Parameters' {
+        Add-CIPPScheduledTask -Task ([pscustomobject]@{
+                Name          = 'Hashtable parameters'
+                Command       = @{ value = 'Write-LogMessage' }
+                TenantFilter  = 'contoso.onmicrosoft.com'
+                Parameters    = @{ message = 'hi'; Sev = 'Info' }
+                ScheduledTime = $script:Future
+            })
+
+        $Stored = $script:CapturedEntity.Parameters | ConvertFrom-Json -AsHashtable
+        $Stored.Keys | Sort-Object | Should -Be @('message', 'Sev')
+        $Stored.message | Should -Be 'hi'
+    }
+}
diff --git a/Tests/Scheduler/Resolve-CIPPOrchestratorPriority.Tests.ps1 b/Tests/Scheduler/Resolve-CIPPOrchestratorPriority.Tests.ps1
new file mode 100644
index 0000000000000..7286a4973cf86
--- /dev/null
+++ b/Tests/Scheduler/Resolve-CIPPOrchestratorPriority.Tests.ps1
@@ -0,0 +1,32 @@
+# User-clicked orchestrations must land in their own bucket ahead of the P2 scheduled-task
+# band; the queue claims strictly by bucket, so sharing P2 put a click behind every fan-out.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    . (Join-Path $BackendRoot 'Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Resolve-CIPPOrchestratorPriority.ps1')
+}
+
+Describe 'Resolve-CIPPOrchestratorPriority' {
+    It 'uses an explicit in-range priority' {
+        Resolve-CIPPOrchestratorPriority -InputObject ([pscustomobject]@{ Priority = 3 }) -OpContext $null | Should -Be 3
+    }
+
+    It 'ignores an out-of-range explicit priority and falls back' {
+        Resolve-CIPPOrchestratorPriority -InputObject ([pscustomobject]@{ Priority = -1 }) -OpContext $null | Should -Be 4
+    }
+
+    It 'inherits the enclosing run band from the stamped context' {
+        $Ctx = [pscustomobject]@{ Category = 'Job'; Priority = 2; RunName = 'UserTaskOrchestrator_x' }
+        Resolve-CIPPOrchestratorPriority -InputObject ([pscustomobject]@{}) -OpContext $Ctx | Should -Be 2
+    }
+
+    It 'gives HTTP-triggered work P1, ahead of the scheduled-task band' {
+        $Ctx = [pscustomobject]@{ Category = 'HTTP'; Priority = $null; RunName = $null }
+        Resolve-CIPPOrchestratorPriority -InputObject ([pscustomobject]@{}) -OpContext $Ctx | Should -Be 1
+    }
+
+    It 'defaults background starters to P4' {
+        Resolve-CIPPOrchestratorPriority -InputObject ([pscustomobject]@{}) -OpContext $null | Should -Be 4
+        Resolve-CIPPOrchestratorPriority -InputObject ([pscustomobject]@{}) -OpContext ([pscustomobject]@{ Category = 'Job'; Priority = $null }) | Should -Be 4
+    }
+}
diff --git a/Tests/Standards/Invoke-AddBaseline.LocalChanges.Tests.ps1 b/Tests/Standards/Invoke-AddBaseline.LocalChanges.Tests.ps1
new file mode 100644
index 0000000000000..365d9d2d4aa6b
--- /dev/null
+++ b/Tests/Standards/Invoke-AddBaseline.LocalChanges.Tests.ps1
@@ -0,0 +1,90 @@
+# A synced baseline saved with no GitHub block is a local edit not yet pushed - flag it true.
+# A save with a GitHub block that pushes successfully clears the flag (via Push-CIPPBaselineToRepo's
+# own rollout stamp); a failed push must leave it true, so AddBaseline never writes false itself.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddBaseline.ps1'
+
+    ([PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')).GetMethod('Add').Invoke(
+        $null, @('HttpStatusCode', [System.Net.HttpStatusCode]))
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    function Get-CIPPTable { param($TableName) @{ Context = "stub-$TableName" } }
+    . (Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Test-CIPPRepoSource.ps1')
+    function ConvertTo-CIPPODataFilterValue { param($Value, $Type) "$Value" }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+    function Write-LogMessage { param($headers, $API, $message, $Sev, $LogData) }
+    # Untyped (unlike the real [bool] param) so $LocalChanges is $null when the caller
+    # didn't pass -LocalChanges at all, distinguishing "not passed" from "passed $false".
+    function New-CIPPBaseline { param($Baseline, $User, $Source, $SHA, $SourcePath, $LocalChanges) }
+    function Push-CIPPBaselineToRepo { param($GUID, $FullName, $Message) }
+
+    . $FunctionPath
+
+    function New-Request {
+        param($Guid, $GitHub)
+        $Principal = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('{"userDetails":"tester@example.com"}'))
+        $BodyProps = [ordered]@{
+            GUID         = $Guid
+            templateName = 'My Baseline'
+            stages       = @([pscustomobject]@{ name = 'Stage 1'; standards = @() })
+        }
+        if ($GitHub) { $BodyProps['GitHub'] = $GitHub }
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'AddBaseline' }
+            Headers = @{ 'x-ms-client-principal' = $Principal }
+            Body    = [pscustomobject]$BodyProps
+        }
+    }
+}
+
+Describe 'Invoke-AddBaseline LocalChanges' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName New-CIPPBaseline -MockWith { @{ GUID = 'baseline-1'; DeltaCount = 0 } }
+    }
+
+    It 'passes -LocalChanges:$true on a plain save of a synced baseline (no GitHub block)' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{ RowKey = 'baseline-1'; Source = 'Org/repo'; SHA = 'abc123' }
+        }
+        $null = Invoke-AddBaseline -Request (New-Request -Guid 'baseline-1')
+        Should -Invoke New-CIPPBaseline -Times 1 -ParameterFilter { $LocalChanges -eq $true }
+    }
+
+    It 'does not pass -LocalChanges for a baseline that was never synced' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+        $null = Invoke-AddBaseline -Request (New-Request -Guid 'baseline-2')
+        Should -Invoke New-CIPPBaseline -Times 1 -ParameterFilter { $null -eq $LocalChanges }
+    }
+
+    It 'does not pass -LocalChanges when a GitHub block is sent, and pushes after the save' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{ RowKey = 'baseline-1'; Source = 'Org/repo'; SHA = 'abc123' }
+        }
+        Mock -CommandName Push-CIPPBaselineToRepo -MockWith { @{ resultText = 'ok'; state = 'success' } }
+
+        $Response = Invoke-AddBaseline -Request (New-Request -Guid 'baseline-1' -GitHub ([pscustomobject]@{ FullName = 'Org/repo'; Message = 'push it' }))
+
+        Should -Invoke New-CIPPBaseline -Times 1 -ParameterFilter { $null -eq $LocalChanges }
+        Should -Invoke Push-CIPPBaselineToRepo -Times 1 -ParameterFilter { $GUID -eq 'baseline-1' -and $FullName -eq 'Org/repo' }
+        $Response.Body.Results | Should -BeLike '*Pushed to Org/repo*'
+    }
+
+    It 'leaves the flag alone (no explicit write) when the push fails' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{ RowKey = 'baseline-1'; Source = 'Org/repo'; SHA = 'abc123' }
+        }
+        Mock -CommandName Push-CIPPBaselineToRepo -MockWith { @{ resultText = 'boom'; state = 'error' } }
+
+        $Response = Invoke-AddBaseline -Request (New-Request -Guid 'baseline-1' -GitHub ([pscustomobject]@{ FullName = 'Org/repo'; Message = 'push it' }))
+
+        Should -Invoke New-CIPPBaseline -Times 1 -ParameterFilter { $null -eq $LocalChanges }
+        $Response.Body.Results | Should -BeLike '*Failed to push*'
+    }
+}
diff --git a/Tests/Standards/Invoke-AddStandardsTemplate.GitHubPush.Tests.ps1 b/Tests/Standards/Invoke-AddStandardsTemplate.GitHubPush.Tests.ps1
new file mode 100644
index 0000000000000..9f084568508ec
--- /dev/null
+++ b/Tests/Standards/Invoke-AddStandardsTemplate.GitHubPush.Tests.ps1
@@ -0,0 +1,88 @@
+# A GitHub block in the save request is a push instruction, not part of the template: it must
+# never land in the stored JSON, the save must complete first, and a push happens exactly once
+# against the saved GUID. A push failure must not fail the save.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1'
+
+    ([PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')).GetMethod('Add').Invoke(
+        $null, @('HttpStatusCode', [System.Net.HttpStatusCode]))
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    function Test-CIPPAccess { param($Request, [switch]$TenantList) }
+    function Get-CippTable { param($tablename) }
+    function Get-CIPPTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property, [switch]$Force) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Add-AzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+    function Push-CIPPTemplateToRepo { param($GUID, $FullName, $Message, $Branch) }
+
+    . $FunctionPath
+
+    function New-Request {
+        param($Guid, $GitHub)
+        $Principal = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('{"userDetails":"tester@example.com"}'))
+        $BodyProps = [ordered]@{
+            GUID         = $Guid
+            templateName = 'Repo template'
+            tenantFilter = @([pscustomobject]@{ value = 'AllTenants'; type = 'Tenant' })
+            standards    = [pscustomobject]@{ AuditLog = [pscustomobject]@{ remediate = $true } }
+        }
+        if ($GitHub) { $BodyProps['GitHub'] = $GitHub }
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'AddStandardsTemplate' }
+            Headers = @{ 'x-ms-client-principal' = $Principal; 'x-ms-original-url' = 'https://cipp.example.com/api/AddStandardsTemplate' }
+            Body    = [pscustomobject]$BodyProps
+        }
+    }
+}
+
+Describe 'Invoke-AddStandardsTemplate GitHub push' {
+    BeforeEach {
+        $script:Written = $null
+        Mock -CommandName Test-CIPPAccess -MockWith { @('AllTenants') }
+        Mock -CommandName Get-CippTable -MockWith { @{ Context = 'stub' } }
+        Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'stub' } }
+        Mock -CommandName Add-AzDataTableEntity -MockWith { }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:Written = $Entity }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+        Mock -CommandName Write-LogMessage -MockWith { }
+    }
+
+    It 'saves first, then pushes exactly once with the saved GUID and given FullName/Message, and strips GitHub from stored JSON' {
+        Mock -CommandName Push-CIPPTemplateToRepo -MockWith { @{ resultText = "Template 'Repo template' uploaded"; state = 'success' } }
+
+        $Response = Invoke-AddStandardsTemplate -Request (New-Request -Guid 'guid-1' -GitHub ([pscustomobject]@{ FullName = 'Org/repo'; Message = 'commit msg' }))
+
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1
+        Should -Invoke Push-CIPPTemplateToRepo -Times 1 -ParameterFilter { $GUID -eq 'guid-1' -and $FullName -eq 'Org/repo' -and $Message -eq 'commit msg' }
+
+        ($script:Written.JSON | ConvertFrom-Json).PSObject.Properties.Name | Should -Not -Contain 'GitHub'
+        $Response.Body.Results | Should -BeLike '*Pushed to Org/repo*'
+    }
+
+    It 'does not push when no GitHub block is present' {
+        Mock -CommandName Push-CIPPTemplateToRepo -MockWith { @{ resultText = 'unused'; state = 'success' } }
+        $Response = Invoke-AddStandardsTemplate -Request (New-Request -Guid 'guid-2')
+
+        Should -Invoke Push-CIPPTemplateToRepo -Times 0
+        $Response.Body.Results | Should -Be 'Successfully added template'
+    }
+
+    It 'reports a push failure in Results without failing the save' {
+        Mock -CommandName Push-CIPPTemplateToRepo -MockWith { throw 'GitHub API is down' }
+
+        $Response = Invoke-AddStandardsTemplate -Request (New-Request -Guid 'guid-3' -GitHub ([pscustomobject]@{ FullName = 'Org/repo'; Message = 'commit msg' }))
+
+        Should -Invoke Add-CIPPAzDataTableEntity -Times 1
+        $Response.StatusCode | Should -Be ([System.Net.HttpStatusCode]::OK)
+        $Response.Body.Results | Should -BeLike '*Failed to push*'
+        Should -Invoke Write-LogMessage -Times 1 -ParameterFilter { $Sev -eq 'Error' }
+    }
+}
diff --git a/Tests/Standards/Invoke-AddStandardsTemplate.RepoColumns.Tests.ps1 b/Tests/Standards/Invoke-AddStandardsTemplate.RepoColumns.Tests.ps1
new file mode 100644
index 0000000000000..9cf4602196a85
--- /dev/null
+++ b/Tests/Standards/Invoke-AddStandardsTemplate.RepoColumns.Tests.ps1
@@ -0,0 +1,93 @@
+# A standards template imported from a template repo carries SHA and Source. The save endpoint
+# replaces the row, so it must carry those columns across or the next repo sync treats the row as
+# new and overwrites the edits made in CIPP with the repo copy.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-AddStandardsTemplate.ps1'
+
+    ([PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')).GetMethod('Add').Invoke(
+        $null, @('HttpStatusCode', [System.Net.HttpStatusCode]))
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    function Test-CIPPAccess { param($Request, [switch]$TenantList) }
+    function Get-CippTable { param($tablename) }
+    function Get-CIPPTable { param($tablename) }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter, $Property, [switch]$Force) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Add-AzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Write-LogMessage { param($headers, $API, $tenant, $message, $Sev, $LogData) }
+
+    . $FunctionPath
+
+    function New-Request {
+        param($Guid)
+        $Principal = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('{"userDetails":"tester@example.com"}'))
+        [pscustomobject]@{
+            Params  = @{ CIPPEndpoint = 'AddStandardsTemplate' }
+            Headers = @{ 'x-ms-client-principal' = $Principal; 'x-ms-original-url' = 'https://cipp.example.com/api/AddStandardsTemplate' }
+            Body    = [pscustomobject]@{
+                GUID         = $Guid
+                templateName = 'Repo template'
+                tenantFilter = @([pscustomobject]@{ value = 'AllTenants'; type = 'Tenant' })
+                standards    = [pscustomobject]@{ AuditLog = [pscustomobject]@{ remediate = $true } }
+            }
+        }
+    }
+}
+
+Describe 'Invoke-AddStandardsTemplate repo columns' {
+    BeforeEach {
+        $script:Written = $null
+        Mock -CommandName Test-CIPPAccess -MockWith { @('AllTenants') }
+        Mock -CommandName Get-CippTable -MockWith { @{ Context = 'stub' } }
+        Mock -CommandName Get-CIPPTable -MockWith { @{ Context = 'stub' } }
+        Mock -CommandName Add-AzDataTableEntity -MockWith { }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:Written = $Entity }
+    }
+
+    It 'carries SHA and Source across when the existing row was imported from a repo' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{ RowKey = 'guid-1'; PartitionKey = 'StandardsTemplateV2'; SHA = 'abc123'; Source = 'Org/repo'; JSON = '{}' }
+        }
+        $null = Invoke-AddStandardsTemplate -Request (New-Request -Guid 'guid-1')
+        $script:Written.SHA | Should -Be 'abc123'
+        $script:Written.Source | Should -Be 'Org/repo'
+        ($script:Written.JSON | ConvertFrom-Json).templateName | Should -Be 'Repo template'
+    }
+
+    It 'writes no SHA or Source for a template that was never imported' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+        $null = Invoke-AddStandardsTemplate -Request (New-Request -Guid 'guid-2')
+        $script:Written.ContainsKey('SHA') | Should -BeFalse
+        $script:Written.ContainsKey('Source') | Should -BeFalse
+    }
+
+    It 'also carries SourcePath and ContentHash across when the existing row has them' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            [pscustomobject]@{
+                RowKey       = 'guid-3'
+                PartitionKey = 'StandardsTemplateV2'
+                SHA          = 'abc123'
+                Source       = 'Org/repo'
+                SourcePath   = 'StandardsTemplateV2/Repo_template.json'
+                ContentHash  = 'deadbeef'
+                JSON         = '{}'
+            }
+        }
+        $null = Invoke-AddStandardsTemplate -Request (New-Request -Guid 'guid-3')
+        $script:Written.SourcePath | Should -Be 'StandardsTemplateV2/Repo_template.json'
+        $script:Written.ContentHash | Should -Be 'deadbeef'
+    }
+
+    It 'writes no SourcePath or ContentHash for a template that was never imported' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $null }
+        $null = Invoke-AddStandardsTemplate -Request (New-Request -Guid 'guid-4')
+        $script:Written.ContainsKey('SourcePath') | Should -BeFalse
+        $script:Written.ContainsKey('ContentHash') | Should -BeFalse
+    }
+}
diff --git a/Tests/Standards/Invoke-CIPPStandardDevicePrepProfile.Assignments.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardDevicePrepProfile.Assignments.Tests.ps1
index 8810feccc17b1..8d7721c9005e9 100644
--- a/Tests/Standards/Invoke-CIPPStandardDevicePrepProfile.Assignments.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardDevicePrepProfile.Assignments.Tests.ps1
@@ -20,26 +20,33 @@ BeforeAll {
     function New-GraphPOSTRequest { [CmdletBinding()] param($uri, $tenantid, $body, $type) }
     function Get-CIPPIntunePolicyAssignments { [CmdletBinding()] param($PolicyId, $TemplateType, $TenantFilter, $ExistingPolicy) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter, [bool]$LicenseAvailable = $true, [array]$BulkFields) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Get-CippException { [CmdletBinding()] param($Exception) [PSCustomObject]@{ NormalizedError = [string]$Exception } }
+    function Get-CIPPTable { [CmdletBinding()] param($TableName) @{} }
+    function Get-CIPPAzDataTableEntity { [CmdletBinding()] param($Filter, $Property) }
+    function Add-CIPPAzDataTableEntity { [CmdletBinding()] param($Entity, [switch]$Force) }
+    function Remove-AzDataTableEntity { [CmdletBinding()] param($Entity, [switch]$Force) }
 
     # The assignment helpers are pure apart from the group lookup, so use the real ones - the
     # Device Preparation target shape they produce is exactly what these tests exist to pin down.
     . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneAssignTarget.ps1')
     . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneAssignmentTarget.ps1')
     . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Compare-CIPPIntuneAssignments.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPEnrollmentTimeDeviceMembershipTarget.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Set-CIPPEnrollmentTimeDeviceMembershipTarget.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Remove-CIPPEnrollmentTimeDeviceMembershipMarker.ps1')
     . $StandardPath
 
     $script:Tenant = 'contoso.onmicrosoft.com'
     $script:AllUsersGroupId = 'acacacac-9df4-4c7d-9d50-4ef0226f57a9'
 
     function New-ProfileSettings {
-        param($AssignTo = 'AllDevicesAndUsers', [int]$Timeout = 60)
+        param($AssignTo = 'AllDevicesAndUsers', [int]$Timeout = 60, $DeviceGroupName)
         [PSCustomObject]@{
             ProfileName        = 'TEST_PREP_PROFILE'
             ProfileDescription = 'Test profile'
+            DeviceGroupName    = $DeviceGroupName
             Timeout            = $Timeout
             CustomErrorMessage = 'Contact IT.'
             AllowSkip          = $false
@@ -74,6 +81,7 @@ BeforeAll {
     # The deployed policy, parsed back the way the standard reads it: settings identical to what
     # New-ProfileSettings requests, so only the assignment dimension varies per test.
     function New-PolicyDetail {
+        param($DeviceGroupId = '')
         [PSCustomObject]@{
             id       = 'policy-1'
             name     = 'TEST_PREP_PROFILE'
@@ -81,12 +89,12 @@ BeforeAll {
                 New-ChoiceSetting 'enrollment_autopilot_dpp_deploymentmode' '0'
                 New-ChoiceSetting 'enrollment_autopilot_dpp_deploymenttype' '0'
                 New-ChoiceSetting 'enrollment_autopilot_dpp_jointype' '0'
-                New-ChoiceSetting 'enrollment_autopilot_dpp_accountype' '0'
+                New-ChoiceSetting 'enrollment_autopilot_dpp_accountype' '1'
                 New-ChoiceSetting 'enrollment_autopilot_dpp_allowskip' '0'
                 New-ChoiceSetting 'enrollment_autopilot_dpp_allowdiagnostics' '0'
                 New-SimpleSetting 'enrollment_autopilot_dpp_timeout' 60
                 New-SimpleSetting 'enrollment_autopilot_dpp_customerrormessage' 'Contact IT.'
-                New-SimpleSetting 'enrollment_autopilot_dpp_devicesecuritygroupids' ''
+                New-SimpleSetting 'enrollment_autopilot_dpp_devicesecuritygroupids' $DeviceGroupId
             )
         }
     }
@@ -105,22 +113,36 @@ Describe 'Invoke-CIPPStandardDevicePrepProfile assignment handling' {
     BeforeEach {
         $script:CompareFields = @()
         $script:PostCalls = @()
+        # Intune applies the enrollment-time device group through its own action, so the retrieve
+        # is the only thing that says what is really applied. Default: nothing applied.
+        $script:MembershipResult = [PSCustomObject]@{ enrollmentTimeDeviceMembershipTargets = @() }
+        # The marker is what CIPP recorded when it last applied a group. Default: never applied.
+        $script:Marker = $null
+        $script:MarkerWrites = @()
 
         Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
         Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*configurationPolicies' } -MockWith {
             @([PSCustomObject]@{ name = 'TEST_PREP_PROFILE'; id = 'policy-1' })
         }
-        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*expand=settings*' } -MockWith { New-PolicyDetail }
+        Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*expand=settings*' } -MockWith { New-PolicyDetail -DeviceGroupId 'device-group-1' }
         Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/groups?*' } -MockWith { @() }
         Mock -CommandName New-GraphPOSTRequest -MockWith {
             $script:PostCalls += @{ uri = $uri; type = $type; body = $body }
-            [PSCustomObject]@{ id = 'new-policy-1' }
+            # The set action answers 200 with a validation verdict rather than failing outright.
+            [PSCustomObject]@{ id = 'new-policy-1'; validationSucceeded = $true }
         }
+        Mock -CommandName New-GraphPOSTRequest -ParameterFilter { $uri -like '*retrieveEnrollmentTimeDeviceMembershipTarget' } -MockWith {
+            if ($script:MembershipResult -is [string]) { throw $script:MembershipResult }
+            $script:MembershipResult
+        }
+        Mock -CommandName Get-CIPPTable -MockWith { @{} }
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith { $script:Marker }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:MarkerWrites += @($Entity) }
+        Mock -CommandName Remove-AzDataTableEntity -MockWith { }
         Mock -CommandName Get-CIPPIntunePolicyAssignments -MockWith { @() }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith {
             $script:CompareFields += @{ Current = $CurrentValue; Expected = $ExpectedValue }
         }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Write-LogMessage -MockWith { }
         Mock -CommandName Write-StandardsAlert -MockWith { }
     }
@@ -198,6 +220,136 @@ Describe 'Invoke-CIPPStandardDevicePrepProfile assignment handling' {
         }
     }
 
+    Context 'enrollment time device membership target' {
+        BeforeEach {
+            # Settings and assignment both correct, so only the device group can drift.
+            Mock -CommandName Get-CIPPIntunePolicyAssignments -MockWith { @(New-AllUsersAssignment) }
+            Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/groups?*' } -MockWith {
+                @([PSCustomObject]@{ id = 'device-group-1'; displayName = 'DEVICE_PREP_DEVICES' })
+            }
+        }
+
+        It 'applies the group through the membership action, not the settings string alone' {
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            @($script:PostCalls).Count | Should -Be 1
+            $script:PostCalls[0].uri | Should -BeLike "*configurationPolicies('policy-1')/setEnrollmentTimeDeviceMembershipTarget"
+            $Body = $script:PostCalls[0].body | ConvertFrom-Json
+            $Body.enrollmentTimeDeviceMembershipTargets[0].targetType | Should -Be 'staticSecurityGroup'
+            $Body.enrollmentTimeDeviceMembershipTargets[0].targetId | Should -Be 'device-group-1'
+        }
+
+        It 'repairs it in place - recreating would destroy the profile over a group it can add' {
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            @($script:PostCalls | Where-Object { $_.type -eq 'DELETE' }).Count | Should -Be 0
+        }
+
+        It 'makes no write when the applied group already matches' {
+            $script:MembershipResult = [PSCustomObject]@{
+                enrollmentTimeDeviceMembershipTargets = @([PSCustomObject]@{ targetType = 'staticSecurityGroup'; targetId = 'device-group-1' })
+            }
+
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            @($script:PostCalls).Count | Should -Be 0
+            $script:CompareFields[0].Current.DeviceGroupId | Should -Be 'device-group-1'
+        }
+
+        It 'sets the membership target on the profile it recreates' {
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES' -Timeout 20)
+
+            $Set = @($script:PostCalls | Where-Object { $_.uri -like '*setEnrollmentTimeDeviceMembershipTarget' })
+            @($Set).Count | Should -Be 1
+            $Set[0].uri | Should -BeLike "*configurationPolicies('new-policy-1')/*"
+            ($Set[0].body | ConvertFrom-Json).enrollmentTimeDeviceMembershipTargets[0].targetId | Should -Be 'device-group-1'
+        }
+
+        It 'carries the @odata.type the action requires' {
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            ($script:PostCalls[0].body | ConvertFrom-Json).enrollmentTimeDeviceMembershipTargets[0].'@odata.type' |
+                Should -Be 'microsoft.graph.enrollmentTimeDeviceMembershipTarget'
+        }
+
+        It 'fails loudly when Intune answers 200 but rejects the group' {
+            # The action reports rejection in the body, so an unchecked call would look successful.
+            Mock -CommandName New-GraphPOSTRequest -ParameterFilter { $uri -like '*setEnrollmentTimeDeviceMembershipTarget' } -MockWith {
+                [PSCustomObject]@{ validationSucceeded = $false; enrollmentTimeDeviceMembershipTargetValidationStatuses = @([PSCustomObject]@{ validationStatus = 'groupNotFound' }) }
+            }
+
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            Should -Invoke Write-LogMessage -ParameterFilter { $sev -eq 'Error' -and $message -like '*groupNotFound*' }
+        }
+
+        It 'lets the live action overrule a stale marker, so a portal change is repaired' {
+            # The marker says the group is applied; the tenant says otherwise, and the tenant wins
+            # wherever the action routes.
+            $script:Marker = [PSCustomObject]@{ PartitionKey = $script:Tenant; RowKey = 'policy-1'; GroupId = 'device-group-1' }
+
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            $script:CompareFields[0].Current.DeviceGroupId | Should -Be ''
+            @($script:PostCalls).Count | Should -Be 1
+            $script:PostCalls[0].uri | Should -BeLike '*setEnrollmentTimeDeviceMembershipTarget'
+        }
+
+        It 'falls back to the marker only where the action does not route' {
+            $script:Marker = [PSCustomObject]@{ PartitionKey = $script:Tenant; RowKey = 'policy-1'; GroupId = 'device-group-1' }
+            $script:MembershipResult = 'No OData route exists'
+
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            @($script:PostCalls).Count | Should -Be 0
+            $script:CompareFields[0].Current.DeviceGroupId | Should -Be 'device-group-1'
+        }
+
+        It 'leaves the dimension out when the configured group does not exist and cannot be made' {
+            # Nothing in CIPP can create it on this run, so asserting it would deviate forever.
+            Mock -CommandName New-GraphGetRequest -ParameterFilter { $uri -like '*/groups?*' } -MockWith { @() }
+
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            @($script:PostCalls).Count | Should -Be 0
+            $script:CompareFields[0].Current.PSObject.Properties.Name | Should -Not -Contain 'DeviceGroupId'
+            $script:CompareFields[0].Expected.PSObject.Properties.Name | Should -Not -Contain 'DeviceGroupId'
+            Should -Invoke Write-LogMessage -ParameterFilter { $sev -eq 'Warning' -and $message -like '*No security group found*' }
+        }
+
+        It 'grades a profile with the setting string but no marker as half deployed, and repairs it' {
+            # Every create writes the setting string whether or not the group was ever applied,
+            # so the string must not be able to vouch for the profile.
+            $script:MembershipResult = 'No OData route exists'
+
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            $script:CompareFields[0].Current.DeviceGroupId | Should -Be ''
+            @($script:PostCalls).Count | Should -Be 1
+            $script:PostCalls[0].uri | Should -BeLike '*setEnrollmentTimeDeviceMembershipTarget'
+        }
+
+        It 'records what it applied so the next run can see it' {
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES')
+
+            @($script:MarkerWrites).Count | Should -Be 1
+            $script:MarkerWrites[0].PartitionKey | Should -Be $script:Tenant
+            $script:MarkerWrites[0].RowKey | Should -Be 'policy-1'
+            $script:MarkerWrites[0].GroupId | Should -Be 'device-group-1'
+            $script:MarkerWrites[0].AppliedAt | Should -Not -BeNullOrEmpty
+        }
+
+        It 'forgets the marker when it deletes the policy for recreation' {
+            # The recreated profile gets a new id, so a surviving marker would answer for a
+            # policy that no longer exists.
+            Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -DeviceGroupName 'DEVICE_PREP_DEVICES' -Timeout 20)
+
+            Should -Invoke Remove-AzDataTableEntity -Times 1 -Exactly -ParameterFilter {
+                $Entity.PartitionKey -eq $script:Tenant -and $Entity.RowKey -eq 'policy-1'
+            }
+        }
+    }
+
     Context "legacy 'AllDevices' selection" {
         It 'does not write a target Device Preparation cannot honour, and says why' {
             Invoke-CIPPStandardDevicePrepProfile -Tenant $script:Tenant -Settings (New-ProfileSettings -AssignTo 'AllDevices')
@@ -207,3 +359,77 @@ Describe 'Invoke-CIPPStandardDevicePrepProfile assignment handling' {
         }
     }
 }
+
+Describe 'Set-CIPPEnrollmentTimeDeviceMembershipTarget' {
+    # A group created moments earlier is not replicated yet and the action rejects it as
+    # securityGroupNotFound, so the first apply after a create fails for a reason that clears
+    # itself. Anything else is a real rejection and must surface on the first answer.
+    BeforeEach {
+        $script:SetResults = @()
+        Mock -CommandName Start-Sleep -MockWith { }
+        Mock -CommandName Get-CIPPTable -MockWith { @{} }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+        Mock -CommandName New-GraphPOSTRequest -MockWith {
+            $script:Attempt++
+            $script:SetResults[[Math]::Min($script:Attempt - 1, $script:SetResults.Count - 1)]
+        }
+        $script:Attempt = 0
+        $script:Rejection = [PSCustomObject]@{
+            validationSucceeded                                    = $false
+            enrollmentTimeDeviceMembershipTargetValidationStatuses = @([PSCustomObject]@{ targetValidationErrorCode = 'securityGroupNotFound' })
+        }
+    }
+
+    It 'rides out the replication delay and succeeds' {
+        $script:SetResults = @($script:Rejection, $script:Rejection, [PSCustomObject]@{ validationSucceeded = $true })
+
+        { Set-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId 'policy-1' -GroupId 'device-group-1' -TenantFilter $script:Tenant } |
+            Should -Not -Throw
+
+        Should -Invoke New-GraphPOSTRequest -Times 3 -Exactly
+    }
+
+    It 'gives up and throws once the retries are exhausted' {
+        $script:SetResults = @($script:Rejection)
+
+        { Set-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId 'policy-1' -GroupId 'device-group-1' -TenantFilter $script:Tenant } |
+            Should -Throw '*securityGroupNotFound*'
+
+        Should -Invoke New-GraphPOSTRequest -Times 4 -Exactly
+    }
+
+    It 'does not retry a rejection that will not clear on its own' {
+        $script:SetResults = @([PSCustomObject]@{
+                validationSucceeded                                    = $false
+                enrollmentTimeDeviceMembershipTargetValidationStatuses = @([PSCustomObject]@{ targetValidationErrorCode = 'targetTypeNotSupported' })
+            })
+
+        { Set-CIPPEnrollmentTimeDeviceMembershipTarget -PolicyId 'policy-1' -GroupId 'device-group-1' -TenantFilter $script:Tenant } |
+            Should -Throw '*targetTypeNotSupported*'
+
+        Should -Invoke New-GraphPOSTRequest -Times 1 -Exactly
+    }
+}
+
+Describe 'Remove-CIPPEnrollmentTimeDeviceMembershipMarker' {
+    BeforeEach {
+        Mock -CommandName Get-CIPPTable -MockWith { @{} }
+    }
+
+    It 'asks for the 404 to be terminating so a missing row reaches the catch' {
+        # The table module reports a missing row with a NON-terminating error, which would walk
+        # straight past try/catch and surface on every recreation of an unmarked profile.
+        Mock -CommandName Remove-AzDataTableEntity -MockWith { }
+
+        Remove-CIPPEnrollmentTimeDeviceMembershipMarker -PolicyId 'policy-1' -TenantFilter $script:Tenant
+
+        Should -Invoke Remove-AzDataTableEntity -Times 1 -Exactly -ParameterFilter { $ErrorAction -eq 'Stop' }
+    }
+
+    It 'swallows a removal failure rather than failing the recreation' {
+        Mock -CommandName Remove-AzDataTableEntity -MockWith { throw 'The specified entity does not exist' }
+
+        { Remove-CIPPEnrollmentTimeDeviceMembershipMarker -PolicyId 'policy-1' -TenantFilter $script:Tenant } |
+            Should -Not -Throw
+    }
+}
diff --git a/Tests/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.Tests.ps1
index 86a4ada6a26dd..6b56d5e072c61 100644
--- a/Tests/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.Tests.ps1
@@ -19,7 +19,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $Tenant2, $message, $sev, $headers, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
@@ -64,7 +63,6 @@ Describe 'Invoke-CIPPStandardDisableExchangeOnlinePowerShell remediation' {
         Mock -CommandName New-CIPPDbRequest -MockWith { $script:Mailboxes }
         Mock -CommandName Write-StandardsAlert -MockWith { }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith { }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Write-LogMessage -MockWith {
             param($API, $tenant, $message, $sev, $LogData)
             $script:logs.Add(@{ Message = $message; Sev = $sev })
diff --git a/Tests/Standards/Invoke-CIPPStandardDisableGuests.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardDisableGuests.Tests.ps1
index a9370e70bf926..2c69921df9ca5 100644
--- a/Tests/Standards/Invoke-CIPPStandardDisableGuests.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardDisableGuests.Tests.ps1
@@ -30,7 +30,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $Tenant2, $message, $sev, $headers, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter, $Tenant) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
@@ -90,7 +89,6 @@ Describe 'Invoke-CIPPStandardDisableGuests' {
         $script:audits = @()
 
         Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Write-LogMessage -MockWith {
             param($API, $tenant, $message, $sev, $LogData)
             $script:logs.Add(@{ Message = $message; Sev = $sev })
diff --git a/Tests/Standards/Invoke-CIPPStandardDisableM365GroupUsers.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardDisableM365GroupUsers.Tests.ps1
index dd076df7b64b7..1f3d9eb9a64db 100644
--- a/Tests/Standards/Invoke-CIPPStandardDisableM365GroupUsers.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardDisableM365GroupUsers.Tests.ps1
@@ -22,7 +22,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $Tenant2, $message, $sev, $headers, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
@@ -83,7 +82,6 @@ Describe 'Invoke-CIPPStandardDisableM365GroupUsers remediation' {
         Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
         Mock -CommandName Write-StandardsAlert -MockWith { }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith { }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Write-LogMessage -MockWith {
             param($API, $tenant, $message, $sev, $LogData)
             $script:logs.Add(@{ Message = $message; Sev = $sev })
diff --git a/Tests/Standards/Invoke-CIPPStandardDisableSharedMailbox.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardDisableSharedMailbox.Tests.ps1
index 9eafd3f7d686d..3970d5d8dfb01 100644
--- a/Tests/Standards/Invoke-CIPPStandardDisableSharedMailbox.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardDisableSharedMailbox.Tests.ps1
@@ -22,13 +22,12 @@ BeforeAll {
     # binding makes signature drift in the standard fail loudly here instead of silently
     # landing in $args.
     function New-CIPPDbRequest { [CmdletBinding()] param($TenantFilter, $Type, $Fields) }
-    function New-GraphGetRequest { [CmdletBinding()] param($uri, $tenantid, $scope, $AsApp, $noPagination, $NoAuthCheck, $skipTokenCache, $ComplexFilter, $CountOnly) }
+    function New-ExoRequest { [CmdletBinding()] param($cmdlet, $cmdParams, $Select, $Anchor, $useSystemMailbox, $tenantid, $NoAuthCheck, $Compliance, $ApiVersion, $AvailableCmdlets, $ModuleVersion, $AsApp, $UseCertificate) }
     function New-GraphBulkRequest { [CmdletBinding()] param($tenantid, $NoAuthCheck, $scope, $asapp, $Requests, $NoPaginateIds, $Version, $Headers) }
     function Set-CIPPDBCacheUsers { [CmdletBinding()] param($TenantFilter) }
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $Tenant2, $message, $sev, $headers, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter, $Tenant) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
@@ -38,7 +37,7 @@ BeforeAll {
     # declared there are not in scope inside It blocks or mocks at run time.
     $script:Tenant = 'contoso.onmicrosoft.com'
 
-    # Both shapes go through ConvertFrom-Json, matching what the cache and the adminapi hand back.
+    # Both shapes go through ConvertFrom-Json, matching what the cache and the Get-Mailbox cmdlet hand back.
     function script:New-CachedUser {
         param(
             [string]$Id,
@@ -61,10 +60,10 @@ BeforeAll {
             [string]$Type = 'SharedMailbox'
         )
         [ordered]@{
-            ObjectKey            = $Id
-            UserPrincipalName    = $Upn
-            DisplayName          = $Upn
-            RecipientTypeDetails = $Type
+            ExternalDirectoryObjectId = $Id
+            UserPrincipalName         = $Upn
+            DisplayName               = $Upn
+            RecipientTypeDetails      = $Type
         } | ConvertTo-Json -Depth 5 | ConvertFrom-Json
     }
 }
@@ -80,7 +79,6 @@ Describe 'Invoke-CIPPStandardDisableSharedMailbox' {
         # Object keys the bulk PATCH should answer with a failure instead of a 204.
         $script:failKeys = @()
 
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Set-CIPPDBCacheUsers -MockWith { }
         Mock -CommandName Write-LogMessage -MockWith {
             param($API, $tenant, $message, $sev, $LogData)
@@ -95,7 +93,7 @@ Describe 'Invoke-CIPPStandardDisableSharedMailbox' {
             $script:compare.Add(@{ Current = $CurrentValue; Expected = $ExpectedValue })
         }
         Mock -CommandName New-CIPPDbRequest -MockWith { $script:users }
-        Mock -CommandName New-GraphGetRequest -MockWith { $script:mailboxes }
+        Mock -CommandName New-ExoRequest -MockWith { $script:mailboxes }
         Mock -CommandName New-GraphBulkRequest -MockWith {
             param($tenantid, $Requests)
             @(foreach ($Request in $Requests) {
@@ -200,14 +198,14 @@ Describe 'Invoke-CIPPStandardDisableSharedMailbox' {
 
             Invoke-CIPPStandardDisableSharedMailbox -Tenant $script:Tenant -Settings @{ report = $true }
 
-            Should -Invoke New-GraphGetRequest -Times 0 -Exactly
+            Should -Invoke New-ExoRequest -Times 0 -Exactly
             @($script:logs | Where-Object { $_.Message -like '*could not read the cached user list*' }).Count | Should -Be 1
             $script:compare.Count | Should -Be 0
         }
 
         It 'names Exchange when the mailbox list fails' {
             $script:users = @(New-CachedUser -Id 'shared1' -Upn 'shared@contoso.com')
-            Mock -CommandName New-GraphGetRequest -MockWith { throw 'Exchange is down' }
+            Mock -CommandName New-ExoRequest -MockWith { throw 'Exchange is down' }
 
             Invoke-CIPPStandardDisableSharedMailbox -Tenant $script:Tenant -Settings @{ report = $true }
 
@@ -220,7 +218,7 @@ Describe 'Invoke-CIPPStandardDisableSharedMailbox' {
 
             Invoke-CIPPStandardDisableSharedMailbox -Tenant $script:Tenant -Settings @{ report = $true }
 
-            Should -Invoke New-GraphGetRequest -Times 0 -Exactly
+            Should -Invoke New-ExoRequest -Times 0 -Exactly
             @($script:logs | Where-Object { $_.Message -like '*cached user list is empty*' }).Count | Should -Be 1
             $script:compare.Count | Should -Be 0
         }
diff --git a/Tests/Standards/Invoke-CIPPStandardEnableAppConsentRequests.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardEnableAppConsentRequests.Tests.ps1
new file mode 100644
index 0000000000000..d3b54c60fe4fb
--- /dev/null
+++ b/Tests/Standards/Invoke-CIPPStandardEnableAppConsentRequests.Tests.ps1
@@ -0,0 +1,78 @@
+# Pester tests for the Invoke-CIPPStandardEnableAppConsentRequests report grade.
+#
+# The report grades that each configured reviewer role and user is PRESENT among the tenant's reviewers.
+# It used to compare the reviewer count, which never converged: remediation deliberately keeps reviewers
+# added by hand, so any extra reviewer left the tenant permanently non-compliant.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $StandardPath = Join-Path $RepoRoot 'Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableAppConsentRequests.ps1'
+
+    function New-GraphGetRequest { [CmdletBinding()] param($uri, $tenantid, $AsApp) }
+    function New-GraphPostRequest { [CmdletBinding()] param($tenantid, $uri, $type, $body, $AsApp, $ContentType) }
+    function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $LogData) }
+    function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
+    function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
+    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
+    function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
+
+    . $StandardPath
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:GA = '62e90394-69f5-4237-9190-012177145e10'
+    $script:SecAdmin = '194ae4cb-b126-40b2-bd5b-6091b380977d'
+
+    function New-RoleReviewer { param($RoleId) [PSCustomObject]@{ query = "/beta/roleManagement/directory/roleAssignments?`$filter=roleDefinitionId eq '$RoleId'"; queryType = 'MicrosoftGraph'; queryRoot = $null } }
+    function New-UserReviewer { param($Id) [PSCustomObject]@{ query = "/v1.0/users/$Id"; queryType = 'MicrosoftGraph'; queryRoot = $null } }
+
+    function Set-Policy {
+        param($Reviewers)
+        $script:Policy = [PSCustomObject]@{ isEnabled = $true; reviewers = @($Reviewers) }
+    }
+}
+
+Describe 'Invoke-CIPPStandardEnableAppConsentRequests report' {
+    BeforeEach {
+        Mock New-GraphGetRequest {
+            if ($uri -match 'adminConsentRequestPolicy') { $script:Policy }
+            elseif ($uri -match "MSP%20Support") { @([PSCustomObject]@{ id = 'user-1'; displayName = 'MSP Support'; userPrincipalName = 'msp_support#EXT#@contoso.onmicrosoft.com' }) }
+            else { @() }
+        }
+        Mock New-GraphPostRequest { }
+        Mock Write-LogMessage { }
+        Mock Set-CIPPStandardsCompareField { }
+        Mock Add-CIPPBPAField { }
+    }
+
+    It 'is compliant when the configured role is present alongside extra hand-added reviewers' {
+        Set-Policy @((New-RoleReviewer $script:GA), (New-RoleReviewer $script:SecAdmin), (New-UserReviewer 'someone-else'))
+
+        Invoke-CIPPStandardEnableAppConsentRequests -Tenant $script:Tenant -Settings @{ report = $true }
+
+        Should -Invoke Set-CIPPStandardsCompareField -Times 1 -Exactly -ParameterFilter {
+            (ConvertTo-Json $CurrentValue -Compress) -eq (ConvertTo-Json $ExpectedValue -Compress)
+        }
+    }
+
+    It 'names a configured role that is missing from the reviewers' {
+        Set-Policy @((New-RoleReviewer $script:GA))
+        $Settings = @{ report = $true; ReviewerRoles = @([PSCustomObject]@{ label = 'Security Administrator'; value = $script:SecAdmin }) }
+
+        Invoke-CIPPStandardEnableAppConsentRequests -Tenant $script:Tenant -Settings $Settings
+
+        Should -Invoke Set-CIPPStandardsCompareField -Times 1 -Exactly -ParameterFilter {
+            @($CurrentValue.MissingReviewerRoles) -join ',' -eq 'Security Administrator' -and @($ExpectedValue.MissingReviewerRoles).Count -eq 0
+        }
+    }
+
+    It 'matches a configured user present by id, and grades a name with no account as missing' {
+        Set-Policy @((New-RoleReviewer $script:GA), (New-UserReviewer 'user-1'))
+        $Settings = @{ report = $true; ReviewerUsers = @('MSP Support', 'Nobody Here') }
+
+        Invoke-CIPPStandardEnableAppConsentRequests -Tenant $script:Tenant -Settings $Settings
+
+        Should -Invoke Set-CIPPStandardsCompareField -Times 1 -Exactly -ParameterFilter {
+            @($CurrentValue.MissingReviewerUsers) -join ',' -eq 'Nobody Here' -and @($CurrentValue.MissingReviewerRoles).Count -eq 0
+        }
+        Should -Invoke Write-LogMessage -Times 0 -Exactly -ParameterFilter { $message -like '*not added as reviewer*' }
+    }
+}
diff --git a/Tests/Standards/Invoke-CIPPStandardExternalComplianceTrusted.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardExternalComplianceTrusted.Tests.ps1
index f11203bd218db..b3235ebfdf6e6 100644
--- a/Tests/Standards/Invoke-CIPPStandardExternalComplianceTrusted.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardExternalComplianceTrusted.Tests.ps1
@@ -10,7 +10,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
 
     . $StandardPath
@@ -33,7 +32,6 @@ Describe 'Invoke-CIPPStandardExternalComplianceTrusted' {
         Mock Write-LogMessage { }
         Mock Write-StandardsAlert { }
         Mock Set-CIPPStandardsCompareField { }
-        Mock Add-CIPPBPAField { }
     }
 
     It 'remediates compliant-device trust without resetting sibling trust flags' {
@@ -55,8 +53,5 @@ Describe 'Invoke-CIPPStandardExternalComplianceTrusted' {
             $CurrentValue.isCompliantDeviceAccepted -eq $false -and
             $ExpectedValue.isCompliantDeviceAccepted -eq $true
         }
-        Should -Invoke Add-CIPPBPAField -Times 1 -Exactly -ParameterFilter {
-            $FieldName -eq 'ExternalComplianceTrusted' -and $FieldValue -eq $false
-        }
     }
 }
diff --git a/Tests/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.Tests.ps1
index 33b4d529a0802..0d0de25446aec 100644
--- a/Tests/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.Tests.ps1
@@ -18,7 +18,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $LogData, $headers) $script:logs.Add(@{ Message = $message; Sev = $sev }) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
     . $StandardPath
diff --git a/Tests/Standards/Invoke-CIPPStandardIntuneTemplate.NameVariables.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardIntuneTemplate.NameVariables.Tests.ps1
new file mode 100644
index 0000000000000..43009e8900384
--- /dev/null
+++ b/Tests/Standards/Invoke-CIPPStandardIntuneTemplate.NameVariables.Tests.ps1
@@ -0,0 +1,127 @@
+# Pester tests for the %variable% handling in Invoke-CIPPStandardIntuneTemplate's identity columns.
+#
+# A template whose Displayname carries a tenant variable (e.g. %shortname%-WIN-COMP) is deployed
+# under the resolved name, because Set-CIPPIntunePolicy forces the column value onto the payload for
+# column-named types (Device, deviceCompliancePolicies, ...). The standard used to look the policy up
+# under the raw, unresolved column value, so the match never hit: every remediate run treated the
+# policy as missing and POSTed a fresh duplicate. Resolving the column once, up front, makes the
+# lookup name, the compare identity and the created name the same resolved string, so a second run
+# finds the policy it created and edits it in place.
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $StandardPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-CIPPStandardIntuneTemplate.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $StandardPath) { throw 'Could not locate Invoke-CIPPStandardIntuneTemplate.ps1 under Modules/' }
+
+    # Stubs mirror the real signatures; strict binding makes signature drift fail loudly here.
+    function Get-CippTable { [CmdletBinding()] param($tablename) }
+    function Get-CIPPAzDataTableEntity { [CmdletBinding()] param($Table, $Filter) }
+    function Repair-CIPPIntuneTemplateNesting { [CmdletBinding()] param($Template, $Table) }
+    function Sync-CIPPReusablePolicySettings { [CmdletBinding()] param($TemplateInfo, $Tenant) }
+    function Get-CIPPTextReplacement { [CmdletBinding()] param($Text, $TenantFilter, [switch]$EscapeForJson) }
+    function Get-CIPPIntunePolicy { [CmdletBinding()] param($TemplateType, $DisplayName, $PolicyId, $Headers, $APINAME, $tenantFilter) }
+    function Get-CIPPIntunePolicyAssignments { [CmdletBinding()] param($PolicyId, $TemplateType, $TenantFilter, $ExistingPolicy) }
+    function Compare-CIPPIntuneAssignments { [CmdletBinding()] param($ExistingAssignments, $ExpectedAssignTo, $ExpectedCustomGroup, $ExpectedExcludeGroup, $ExpectedAssignmentFilter, $ExpectedAssignmentFilterType, $PolicyType, $TenantFilter) }
+    function Select-CIPPIntuneAvailableSetting { [CmdletBinding()] param($Policy, $TenantFilter) }
+    function Compare-CIPPIntuneObject { [CmdletBinding()] param($ReferenceObject, $DifferenceObject, $compareType) }
+    function Set-CIPPIntunePolicy { [CmdletBinding()] param($TemplateType, $Description, $DisplayName, $RawJSON, $AssignTo, $ExcludeGroup, $Headers, $APIName, $TenantFilter, $AssignmentFilterName, $AssignmentFilterType, [array]$ReusableSettings, [int]$LevenshteinDistance, [string]$AssignmentMode) }
+    function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter, [bool]$LicenseAvailable = $true, [array]$BulkFields) }
+    function Write-LogMessage { [CmdletBinding()] param($message, $tenant, $API, $tenantId, $headers, $user, $sev, $LogData) }
+    function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
+    function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
+
+    # Real helpers - they are pure, and it is their exact rules the fix depends on:
+    #   Get-CIPPIntunePolicyName returns the (now resolved) column value for column-named types;
+    #   Merge-CIPPIntuneTemplateIdentity stamps that same value onto the compared payload;
+    #   Get-CIPPIntuneAssignTarget decides whether the assignment is re-read.
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntunePolicyName.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Merge-CIPPIntuneTemplateIdentity.ps1')
+    . (Join-Path $RepoRoot 'Modules/CIPPCore/Public/Get-CIPPIntuneAssignTarget.ps1')
+    . $StandardPath
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:RawName = '%shortname%-WIN-COMP-Default-DG-PRD'
+    $script:ResolvedName = 'CONTOSO-WIN-COMP-Default-DG-PRD'
+
+    function New-TemplateSettings {
+        [PSCustomObject]@{
+            TemplateList      = [PSCustomObject]@{ value = 'tpl-1' }
+            AssignTo          = 'On'
+            customGroup       = $null
+            verifyAssignments = $false
+            remediate         = $true
+            report            = $true
+            alert             = $false
+            templateId        = 'tpl-1'
+        }
+    }
+}
+
+Describe 'Invoke-CIPPStandardIntuneTemplate name variables' {
+    BeforeEach {
+        $script:LookupNames = @()
+        $script:MergeNames = @()
+        $script:SetNames = @()
+
+        Mock -CommandName Get-CippTable -MockWith { @{ Table = 'templates' } }
+        # A Device (column-named) template whose Displayname column holds a %variable%.
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @([PSCustomObject]@{
+                    RowKey = 'tpl-1'
+                    GUID   = 'tpl-1'
+                    JSON   = '{"Displayname":"%shortname%-WIN-COMP-Default-DG-PRD","Description":"","Type":"Device","RAWJson":"{\"@odata.type\":\"#microsoft.graph.windows10GeneralConfiguration\",\"displayName\":\"%shortname%-WIN-COMP-Default-DG-PRD\"}"}'
+                })
+        }
+        Mock -CommandName Repair-CIPPIntuneTemplateNesting -MockWith { $Template }
+        Mock -CommandName Sync-CIPPReusablePolicySettings -MockWith { [PSCustomObject]@{} }
+        # Resolve %shortname% the way the runtime helper does; honoured for RawJSON and for the columns.
+        Mock -CommandName Get-CIPPTextReplacement -MockWith { $Text -replace '%shortname%', 'CONTOSO' }
+        Mock -CommandName Get-CIPPIntunePolicy -MockWith {
+            $script:LookupNames += $DisplayName
+            [PSCustomObject]@{ id = 'policy-1'; cippconfiguration = '{"displayName":"CONTOSO-WIN-COMP-Default-DG-PRD"}' }
+        }
+        Mock -CommandName Compare-CIPPIntuneObject -MockWith { $null }
+        Mock -CommandName Set-CIPPIntunePolicy -MockWith {
+            $script:SetNames += $DisplayName
+            'Successfully edited policy'
+        }
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Write-StandardsAlert -MockWith { }
+        Mock -CommandName Set-CIPPStandardsCompareField -MockWith { }
+    }
+
+    It 'looks the policy up under the resolved name, not the raw %variable%' {
+        Invoke-CIPPStandardIntuneTemplate -Tenant $script:Tenant -Settings (New-TemplateSettings)
+
+        $script:LookupNames | Should -Contain $script:ResolvedName
+        $script:LookupNames | Should -Not -Contain $script:RawName
+    }
+
+    It 'creates/edits the policy under the resolved name, so the next run finds this policy' {
+        Invoke-CIPPStandardIntuneTemplate -Tenant $script:Tenant -Settings (New-TemplateSettings)
+
+        $script:SetNames | Should -Contain $script:ResolvedName
+        $script:SetNames | Should -Not -Contain $script:RawName
+    }
+
+    It 'uses the same resolved name for the lookup and the deployment - they must agree to converge' {
+        Invoke-CIPPStandardIntuneTemplate -Tenant $script:Tenant -Settings (New-TemplateSettings)
+
+        # This is the property that ends the duplicate loop: what was searched for is what gets
+        # written, so a second run's exact-name lookup matches and edits in place.
+        ($script:SetNames | Select-Object -Unique) | Should -Be ($script:LookupNames | Select-Object -Unique)
+    }
+
+    It 'compares against the resolved identity, so a rename does not read as permanent drift' {
+        Mock -CommandName Merge-CIPPIntuneTemplateIdentity -MockWith {
+            $script:MergeNames += $DisplayName
+            $Policy
+        }
+
+        Invoke-CIPPStandardIntuneTemplate -Tenant $script:Tenant -Settings (New-TemplateSettings)
+
+        $script:MergeNames | Should -Contain $script:ResolvedName
+        $script:MergeNames | Should -Not -Contain $script:RawName
+    }
+}
diff --git a/Tests/Standards/Invoke-CIPPStandardMessageEncryption.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardMessageEncryption.Tests.ps1
index 9f8fb8b2d8420..2cc4ca6568cfe 100644
--- a/Tests/Standards/Invoke-CIPPStandardMessageEncryption.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardMessageEncryption.Tests.ps1
@@ -21,7 +21,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-CippException { [CmdletBinding()] param($Exception) }
 
     . $StandardPath
@@ -33,13 +32,34 @@ BeforeAll {
     $AdRmsLocation = 'https://rms.contoso.local/_wmcs/licensing'
 
     function New-IRMConfig {
-        param($AzureRMSLicensingEnabled = $false, $SimplifiedClientAccessEnabled = $false, $LicensingLocation = @())
+        param(
+            $AzureRMSLicensingEnabled = $false,
+            $SimplifiedClientAccessEnabled = $false,
+            $LicensingLocation = @(),
+            $EnablePdfEncryption = $false,
+            $DecryptAttachmentForEncryptOnly = $false,
+            $SimplifiedClientAccessDoNotForwardDisabled = $false,
+            $SimplifiedClientAccessEncryptOnlyDisabled = $false,
+            $TransportDecryptionSetting = 'Optional'
+        )
         [pscustomobject]@{
-            AzureRMSLicensingEnabled      = $AzureRMSLicensingEnabled
-            SimplifiedClientAccessEnabled = $SimplifiedClientAccessEnabled
-            LicensingLocation             = $LicensingLocation
+            AzureRMSLicensingEnabled                   = $AzureRMSLicensingEnabled
+            SimplifiedClientAccessEnabled              = $SimplifiedClientAccessEnabled
+            LicensingLocation                          = $LicensingLocation
+            EnablePdfEncryption                        = $EnablePdfEncryption
+            DecryptAttachmentForEncryptOnly            = $DecryptAttachmentForEncryptOnly
+            SimplifiedClientAccessDoNotForwardDisabled = $SimplifiedClientAccessDoNotForwardDisabled
+            SimplifiedClientAccessEncryptOnlyDisabled  = $SimplifiedClientAccessEncryptOnlyDisabled
+            TransportDecryptionSetting                 = $TransportDecryptionSetting
         }
     }
+
+    # A tenant where the two mandatory settings are already right, so only the optional radios can
+    # cause a Set-IRMConfiguration call.
+    function New-AlignedIRMConfig {
+        param([hashtable]$Overrides = @{})
+        New-IRMConfig -AzureRMSLicensingEnabled $true -SimplifiedClientAccessEnabled $true -LicensingLocation @($AzureRmsLocation) @Overrides
+    }
 }
 
 Describe 'Invoke-CIPPStandardMessageEncryption' {
@@ -48,7 +68,6 @@ Describe 'Invoke-CIPPStandardMessageEncryption' {
         Mock -CommandName Write-LogMessage -MockWith { }
         Mock -CommandName Write-StandardsAlert -MockWith { }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith { }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Get-CippException -MockWith { @{ NormalizedError = 'boom' } }
     }
 
@@ -123,6 +142,81 @@ Describe 'Invoke-CIPPStandardMessageEncryption' {
         }
     }
 
+    Context 'optional settings' {
+        # The radios are tri-state: 'donotchange' (and a template saved before they existed) must
+        # leave the tenant value alone, while an explicit 'false' must be enforced, not ignored.
+        It 'leaves a setting alone when the radio is on do-not-change or missing' {
+            Mock -CommandName New-ExoRequest -MockWith { New-AlignedIRMConfig @{ EnablePdfEncryption = $true } }
+
+            Invoke-CIPPStandardMessageEncryption -Tenant $tenant -Settings @{ remediate = $true; report = $true; EnablePdfEncryption = 'donotchange' }
+
+            Should -Invoke New-ExoRequest -Times 0 -Exactly -ParameterFilter { $cmdlet -eq 'Set-IRMConfiguration' }
+            Should -Invoke Set-CIPPStandardsCompareField -Times 1 -Exactly -ParameterFilter {
+                -not ($ExpectedValue.PSObject.Properties.Name -contains 'EnablePdfEncryption')
+            }
+        }
+
+        It 'enables PDF encryption alongside the mandatory settings when asked' {
+            Mock -CommandName New-ExoRequest -MockWith { New-IRMConfig -AzureRMSLicensingEnabled $false }
+
+            Invoke-CIPPStandardMessageEncryption -Tenant $tenant -Settings @{ remediate = $true; EnablePdfEncryption = 'true' }
+
+            Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+                $cmdlet -eq 'Set-IRMConfiguration' -and $cmdParams.AzureRMSLicensingEnabled -eq $true -and $cmdParams.EnablePdfEncryption -eq $true
+            }
+        }
+
+        It 'enforces an explicit false instead of treating it as unset' {
+            Mock -CommandName New-ExoRequest -MockWith { New-AlignedIRMConfig @{ DecryptAttachmentForEncryptOnly = $true } }
+
+            Invoke-CIPPStandardMessageEncryption -Tenant $tenant -Settings @{ remediate = $true; DecryptAttachmentForEncryptOnly = 'false' }
+
+            Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+                $cmdlet -eq 'Set-IRMConfiguration' -and $cmdParams.DecryptAttachmentForEncryptOnly -eq $false
+            }
+        }
+
+        It 'sets the transport decryption mode when it drifts' {
+            Mock -CommandName New-ExoRequest -MockWith { New-AlignedIRMConfig }
+
+            Invoke-CIPPStandardMessageEncryption -Tenant $tenant -Settings @{ remediate = $true; TransportDecryptionSetting = 'Mandatory' }
+
+            Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter {
+                $cmdlet -eq 'Set-IRMConfiguration' -and $cmdParams.TransportDecryptionSetting -eq 'Mandatory'
+            }
+        }
+
+        It 'ignores values that are not on the radio' {
+            Mock -CommandName New-ExoRequest -MockWith { New-AlignedIRMConfig }
+
+            Invoke-CIPPStandardMessageEncryption -Tenant $tenant -Settings @{ remediate = $true; EnablePdfEncryption = 'yes'; TransportDecryptionSetting = 'Sometimes' }
+
+            Should -Invoke New-ExoRequest -Times 0 -Exactly -ParameterFilter { $cmdlet -eq 'Set-IRMConfiguration' }
+        }
+
+        It 'alerts with the names of the drifted optional settings' {
+            Mock -CommandName New-ExoRequest -MockWith { New-AlignedIRMConfig }
+
+            Invoke-CIPPStandardMessageEncryption -Tenant $tenant -Settings @{ alert = $true; EnablePdfEncryption = 'true' }
+
+            Should -Invoke Write-StandardsAlert -Times 1 -Exactly -ParameterFilter {
+                $message -match 'EnablePdfEncryption' -and $object.EnablePdfEncryption -eq $false
+            }
+        }
+
+        It 'reports the chosen optional setting in both current and expected state' {
+            Mock -CommandName New-ExoRequest -MockWith { New-AlignedIRMConfig }
+
+            Invoke-CIPPStandardMessageEncryption -Tenant $tenant -Settings @{ report = $true; EnablePdfEncryption = 'true' }
+
+            Should -Invoke Set-CIPPStandardsCompareField -Times 1 -Exactly -ParameterFilter {
+                $CurrentValue.EnablePdfEncryption -eq $false -and
+                $ExpectedValue.EnablePdfEncryption -eq $true -and
+                $ExpectedValue.AdRmsDetected -eq $false
+            }
+        }
+    }
+
     Context 'alerting' {
         It 'alerts when message encryption is disabled' {
             Mock -CommandName New-ExoRequest -MockWith { New-IRMConfig -AzureRMSLicensingEnabled $false }
@@ -186,9 +280,6 @@ Describe 'Invoke-CIPPStandardMessageEncryption' {
                 $ExpectedValue.SimplifiedClientAccessEnabled -eq $true -and
                 $ExpectedValue.AdRmsDetected -eq $false
             }
-            Should -Invoke Add-CIPPBPAField -Times 1 -Exactly -ParameterFilter {
-                $FieldName -eq 'messageEncryptionEnabled' -and $FieldValue -eq $false
-            }
         }
     }
 }
diff --git a/Tests/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.Tests.ps1
index ad9d488808345..a2026efa16488 100644
--- a/Tests/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardOneDriveLicensedQuota.Tests.ps1
@@ -22,7 +22,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $headers, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $Tenant) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
@@ -72,7 +71,6 @@ Describe 'Invoke-CIPPStandardOneDriveLicensedQuota' {
         Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
         Mock -CommandName Write-StandardsAlert -MockWith { }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith { }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Write-LogMessage -MockWith {
             param($API, $tenant, $message, $sev, $LogData)
             $script:logs.Add(@{ Message = $message; Sev = $sev })
diff --git a/Tests/Standards/Invoke-CIPPStandardPhishProtection.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardPhishProtection.Tests.ps1
index 6a58f860abe53..d87c6f707b7f6 100644
--- a/Tests/Standards/Invoke-CIPPStandardPhishProtection.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardPhishProtection.Tests.ps1
@@ -20,7 +20,6 @@ BeforeAll {
     function Get-CippException { [CmdletBinding()] param($Exception) [pscustomobject]@{ NormalizedError = ($Exception | Out-String); RawError = ($Exception.ErrorDetails.Message ?? '') } }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $Tenant) }
 
     . $StandardPath
@@ -38,7 +37,6 @@ Describe 'Invoke-CIPPStandardPhishProtection localization handling' {
         }
         Mock Write-LogMessage { }
         Mock Write-StandardsAlert { }
-        Mock Add-CIPPBPAField { }
         Mock Set-CIPPStandardsCompareField { }
         Mock New-GraphPostRequest { }
     }
diff --git a/Tests/Standards/Invoke-CIPPStandardPlannerBlockTaskDelete.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardPlannerBlockTaskDelete.Tests.ps1
new file mode 100644
index 0000000000000..91215d5fb15c9
--- /dev/null
+++ b/Tests/Standards/Invoke-CIPPStandardPlannerBlockTaskDelete.Tests.ps1
@@ -0,0 +1,207 @@
+# Pester tests for Invoke-CIPPStandardPlannerBlockTaskDelete
+
+BeforeAll {
+    $RepoRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $StandardPath = Get-ChildItem -Path (Join-Path $RepoRoot 'Modules') -Recurse -Filter 'Invoke-CIPPStandardPlannerBlockTaskDelete.ps1' -File -ErrorAction SilentlyContinue |
+        Select-Object -First 1 -ExpandProperty FullName
+    if (-not $StandardPath) { throw 'Could not locate Invoke-CIPPStandardPlannerBlockTaskDelete.ps1 under Modules/' }
+
+    function Test-CIPPStandardLicense { [CmdletBinding()] param($StandardName, $TenantFilter, $RequiredCapabilities, $Preset, [switch]$SkipLog) }
+    function Test-CIPPRerun { [CmdletBinding()] param($Tenant, $TenantFilter, $Type, $API, $Settings, $Headers, [switch]$Clear, [switch]$ClearAll, [int64]$Interval, [int64]$BaseTime) }
+    function New-GraphGetRequest { [CmdletBinding()] param($uri, $tenantid, $scope, $AsApp, $NoAuthCheck, $skipTokenCache) }
+    function New-GraphPOSTRequest { [CmdletBinding()] param($uri, $tenantid, $body, $type, $scope, $AsApp, $NoAuthCheck, $skipTokenCache, $AddedHeaders, $contentType) }
+    function New-GraphBulkRequest { [CmdletBinding()] param($tenantid, $Requests, $Version, $AsApp, $NoAuthCheck) }
+    function New-CIPPDbRequest { [CmdletBinding()] param($TenantFilter, $Type) }
+    function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $message, $sev, $headers, $LogData) }
+    function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
+    function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter, $LicenseAvailable) }
+    function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
+    function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
+
+    . $StandardPath
+
+    $script:Tenant = 'contoso.onmicrosoft.com'
+    $script:PlannerPlan = [pscustomobject]@{ servicePlanId = 'b737dad2-2f6c-4c65-90e3-ca563267e8b9'; capabilityStatus = 'Enabled' }
+    $script:Users = @(
+        [pscustomobject]@{ id = '11111111-1111-1111-1111-111111111111'; userPrincipalName = 'ann@contoso.com'; displayName = 'Ann'; userType = 'Member'; accountEnabled = $true; assignedPlans = @($script:PlannerPlan) }
+        [pscustomobject]@{ id = '22222222-2222-2222-2222-222222222222'; userPrincipalName = 'ben@contoso.com'; displayName = 'Ben'; userType = 'Member'; accountEnabled = $true; assignedPlans = @($script:PlannerPlan) }
+        [pscustomobject]@{ id = '55555555-5555-5555-5555-555555555555'; userPrincipalName = 'disabled@contoso.com'; displayName = 'Disabled'; userType = 'Member'; accountEnabled = $false; assignedPlans = @($script:PlannerPlan) }
+        [pscustomobject]@{ id = '44444444-4444-4444-4444-444444444444'; userPrincipalName = 'carl@contoso.com'; displayName = 'Carl'; userType = 'Member'; accountEnabled = $true; assignedPlans = @() }
+        [pscustomobject]@{ id = '33333333-3333-3333-3333-333333333333'; userPrincipalName = 'guest@external.com'; displayName = 'Guest'; userType = 'Guest'; accountEnabled = $true; assignedPlans = @($script:PlannerPlan) }
+    )
+}
+
+Describe 'Invoke-CIPPStandardPlannerBlockTaskDelete' {
+    BeforeEach {
+        $script:logs = [System.Collections.Generic.List[object]]::new()
+        $script:getUris = [System.Collections.Generic.List[string]]::new()
+        $script:putCalls = [System.Collections.Generic.List[object]]::new()
+        $script:alerts = [System.Collections.Generic.List[object]]::new()
+        $script:policyByUpn = @{
+            'ann@contoso.com' = [pscustomobject]@{ blockDeleteTasksNotCreatedBySelf = $false }
+            'ben@contoso.com' = [pscustomobject]@{ blockDeleteTasksNotCreatedBySelf = $true }
+        }
+
+        Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
+        Mock -CommandName Test-CIPPRerun -MockWith { $false }
+        Mock -CommandName New-CIPPDbRequest -MockWith { $script:Users }
+        Mock -CommandName Write-StandardsAlert -MockWith {
+            param($message, $object)
+            $script:alerts.Add(@{ Message = $message; Object = $object })
+        }
+        Mock -CommandName Set-CIPPStandardsCompareField -MockWith { }
+        Mock -CommandName Write-LogMessage -MockWith {
+            param($API, $tenant, $message, $sev, $LogData)
+            $script:logs.Add(@{ Message = $message; Sev = $sev; LogData = $LogData })
+        }
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            param($uri, $tenantid, $scope)
+            if ($uri -like 'https://graph.microsoft.com/*') {
+                return @([pscustomobject]@{ id = 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa'; displayName = 'Dept Ticketing' })
+            }
+            $script:getUris.Add($uri)
+            if ($uri -match "UserPolicy\('([^']+)'\)") {
+                $Upn = $Matches[1]
+                if ($script:policyByUpn.ContainsKey($Upn)) {
+                    return $script:policyByUpn[$Upn]
+                }
+                throw '403 Forbidden: Access is denied'
+            }
+            throw "Unexpected GET $uri"
+        }
+        Mock -CommandName New-GraphBulkRequest -MockWith {
+            param($tenantid, $Requests)
+            foreach ($Req in @($Requests)) {
+                [pscustomobject]@{
+                    id     = $Req.id
+                    status = 200
+                    body   = @{
+                        value = @(
+                            [pscustomobject]@{ id = '11111111-1111-1111-1111-111111111111' }
+                        )
+                    }
+                }
+            }
+        }
+        Mock -CommandName New-GraphPOSTRequest -MockWith {
+            param($uri, $tenantid, $body, $type, $scope, $AsApp)
+            $script:putCalls.Add(@{
+                    Uri   = $uri
+                    Body  = $body
+                    Type  = $type
+                    Scope = $scope
+                    AsApp = $AsApp
+                })
+            return $null
+        }
+    }
+
+    It 'returns early when the license check fails' {
+        Mock -CommandName Test-CIPPStandardLicense -MockWith { $false }
+
+        $Result = Invoke-CIPPStandardPlannerBlockTaskDelete -Tenant $script:Tenant -Settings @{ remediate = $true }
+
+        $Result | Should -Be $true
+        Should -Invoke -CommandName New-CIPPDbRequest -Times 0 -Exactly
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 0 -Exactly
+    }
+
+    It 'aborts when a configured include group does not exist' {
+        Mock -CommandName New-GraphGetRequest -MockWith {
+            param($uri)
+            if ($uri -like 'https://graph.microsoft.com/*') { return @() }
+            throw "Unexpected GET $uri"
+        }
+
+        Invoke-CIPPStandardPlannerBlockTaskDelete -Tenant $script:Tenant -Settings @{
+            remediate     = $true
+            includeGroups = @('Missing Group')
+        }
+
+        $Errors = @($script:logs | Where-Object { $_.Sev -eq 'Error' -and $_.Message -match 'partial scope|does not exist' })
+        $Errors.Count | Should -BeGreaterThan 0
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 0 -Exactly
+    }
+
+    It 'remediates with PUT for Planner-licensed members only and skips UserPolicy GET' {
+        Invoke-CIPPStandardPlannerBlockTaskDelete -Tenant $script:Tenant -Settings @{ remediate = $true }
+
+        # Guest, unlicensed Carl, and disabled account excluded; Ann + Ben get idempotent PUT
+        $script:putCalls.Count | Should -Be 2
+        ($script:putCalls.Uri | ForEach-Object { if ($_ -match "UserPolicy\('([^']+)'\)") { $Matches[1] } } | Sort-Object) |
+            Should -Be @('ann@contoso.com', 'ben@contoso.com')
+        foreach ($Call in $script:putCalls) {
+            $Call.Type | Should -Be 'PUT'
+            $Call.Scope | Should -Be 'https://tasks.office.com/.default'
+            $Call.AsApp | Should -Be $true
+            ($Call.Body | ConvertFrom-Json).blockDeleteTasksNotCreatedBySelf | Should -BeTrue
+        }
+        @($script:getUris | Where-Object { $_ -match 'UserPolicy' }).Count | Should -Be 0
+        @($script:logs | Where-Object { $_.Message -match "Blocked Planner task delete" }).Count | Should -Be 0
+        @($script:logs | Where-Object { $_.Message -match 'successfully updated 2 users' }).Count | Should -Be 1
+    }
+
+    It 'limits remediation to include-group members without UserPolicy GET' {
+        Invoke-CIPPStandardPlannerBlockTaskDelete -Tenant $script:Tenant -Settings @{
+            remediate     = $true
+            includeGroups = @('Dept Ticketing')
+        }
+
+        $script:putCalls.Count | Should -Be 1
+        $script:putCalls[0].Uri | Should -Match "UserPolicy\('ann@contoso.com'\)"
+        @($script:getUris | Where-Object { $_ -match 'UserPolicy' }).Count | Should -Be 0
+    }
+
+    It 'GETs UserPolicy for alert and treats 403 as non-compliant' {
+        $script:policyByUpn = @{
+            'ben@contoso.com' = [pscustomobject]@{ blockDeleteTasksNotCreatedBySelf = $true }
+        }
+
+        Invoke-CIPPStandardPlannerBlockTaskDelete -Tenant $script:Tenant -Settings @{ alert = $true }
+
+        @($script:getUris | Where-Object { $_ -match 'UserPolicy' }).Count | Should -Be 2
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 0 -Exactly
+        $script:alerts.Count | Should -Be 1
+        @($script:alerts[0].Object.userPrincipalName) | Should -Contain 'ann@contoso.com'
+        @($script:alerts[0].Object.userPrincipalName) | Should -Not -Contain 'ben@contoso.com'
+        @($script:alerts[0].Object.userPrincipalName) | Should -Not -Contain 'carl@contoso.com'
+        @($script:logs | Where-Object { $_.Message -match '1 in-scope account\(s\) are missing' }).Count | Should -Be 1
+        @($script:logs | Where-Object { $_.Message -match 'ann@contoso.com' }).Count | Should -Be 0
+    }
+
+    It 'skips remediate within the 24h guard but still alerts' {
+        Mock -CommandName Test-CIPPRerun -MockWith { $true }
+        $script:policyByUpn = @{
+            'ann@contoso.com' = [pscustomobject]@{ blockDeleteTasksNotCreatedBySelf = $false }
+            'ben@contoso.com' = [pscustomobject]@{ blockDeleteTasksNotCreatedBySelf = $true }
+        }
+
+        Invoke-CIPPStandardPlannerBlockTaskDelete -Tenant $script:Tenant -Settings @{
+            remediate = $true
+            alert     = $true
+        }
+
+        Should -Invoke -CommandName New-GraphPOSTRequest -Times 0 -Exactly
+        @($script:getUris | Where-Object { $_ -match 'UserPolicy' }).Count | Should -Be 2
+        $script:alerts.Count | Should -Be 1
+        $Skipped = @($script:logs | Where-Object { $_.Message -match '24h' })
+        $Skipped.Count | Should -BeGreaterThan 0
+    }
+
+    It 'aggregates remediate failures into one error log' {
+        Mock -CommandName New-GraphPOSTRequest -MockWith {
+            param($uri)
+            if ($uri -match 'ann@') { throw '429 Too Many Requests' }
+            $script:putCalls.Add(@{ Uri = $uri })
+            return $null
+        }
+
+        Invoke-CIPPStandardPlannerBlockTaskDelete -Tenant $script:Tenant -Settings @{ remediate = $true }
+
+        $Errors = @($script:logs | Where-Object { $_.Sev -eq 'Error' -and $_.Message -match 'one or more failed' })
+        $Errors.Count | Should -Be 1
+        $Errors[0].Message | Should -Match 'updated 1 of 2'
+        $Errors[0].Message | Should -Match '429'
+        @($script:logs | Where-Object { $_.Message -match 'Failed to set Planner UserPolicy for' }).Count | Should -Be 0
+    }
+}
diff --git a/Tests/Standards/Invoke-CIPPStandardQuarantineRequestAlert.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardQuarantineRequestAlert.Tests.ps1
index 4a2b4a963e88c..4e96c9a9b6af0 100644
--- a/Tests/Standards/Invoke-CIPPStandardQuarantineRequestAlert.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardQuarantineRequestAlert.Tests.ps1
@@ -17,7 +17,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $Tenant, $Message, $sev, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
 
     . $StandardPath
@@ -32,15 +31,10 @@ Describe 'Invoke-CIPPStandardQuarantineRequestAlert' {
         # $script:alertObj models the tenant's live Protection Alert: $null = it does not exist.
         $script:alertObj = $null
         $script:compareFields = [System.Collections.Generic.List[object]]::new()
-        $script:bpaFields = [System.Collections.Generic.List[object]]::new()
 
         Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
         Mock -CommandName Write-LogMessage -MockWith { }
         Mock -CommandName Write-StandardsAlert -MockWith { }
-        Mock -CommandName Add-CIPPBPAField -MockWith {
-            param($FieldName, $FieldValue, $StoreAs, $Tenant)
-            $script:bpaFields.Add([pscustomobject]@{ Field = $FieldName; FieldValue = $FieldValue })
-        }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith {
             param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter)
             $script:compareFields.Add([pscustomobject]@{ Field = $FieldName; Current = $CurrentValue; Expected = $ExpectedValue })
@@ -72,7 +66,6 @@ Describe 'Invoke-CIPPStandardQuarantineRequestAlert' {
         Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { $cmdlet -eq 'New-ProtectionAlert' }
         $script:compareFields.Count | Should -Be 1
         $script:compareFields[0].Current.NotifyUser | Should -Contain $script:NotifyUser
-        $script:bpaFields[0].FieldValue | Should -BeTrue
     }
 
     It 'updates recipients on an existing alert and reports the applied value' {
@@ -87,7 +80,6 @@ Describe 'Invoke-CIPPStandardQuarantineRequestAlert' {
 
         Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { $cmdlet -eq 'Set-ProtectionAlert' }
         $script:compareFields[0].Current.NotifyUser | Should -Contain $script:NotifyUser
-        $script:bpaFields[0].FieldValue | Should -BeTrue
     }
 
     It 'reports an existing correctly configured alert as compliant without writing' {
@@ -101,7 +93,6 @@ Describe 'Invoke-CIPPStandardQuarantineRequestAlert' {
 
         Should -Invoke New-ExoRequest -Times 0 -ParameterFilter { $cmdlet -in @('New-ProtectionAlert', 'Set-ProtectionAlert') }
         $script:compareFields[0].Current.NotifyUser | Should -Contain $script:NotifyUser
-        $script:bpaFields[0].FieldValue | Should -BeTrue
     }
 
     It 'writes Current and Expected as matching arrays when compliant' {
@@ -134,7 +125,6 @@ Describe 'Invoke-CIPPStandardQuarantineRequestAlert' {
             report     = $true
         }
 
-        $script:bpaFields[0].FieldValue | Should -BeFalse
         $script:compareFields[0].Current.NotifyUser | Should -Contain 'extra@contoso.com'
     }
 
@@ -145,7 +135,6 @@ Describe 'Invoke-CIPPStandardQuarantineRequestAlert' {
             report     = $true
         }
 
-        $script:bpaFields[0].FieldValue | Should -BeFalse
         @($script:compareFields[0].Current.NotifyUser) | Should -BeNullOrEmpty
     }
 
@@ -159,7 +148,6 @@ Describe 'Invoke-CIPPStandardQuarantineRequestAlert' {
         }
 
         Should -Invoke New-ExoRequest -Times 1 -Exactly -ParameterFilter { $cmdlet -eq 'Remove-ProtectionAlert' }
-        $script:bpaFields[0].FieldValue | Should -BeTrue
     }
 
     It 'skips everything when the tenant is not licensed for Exchange' {
diff --git a/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1
index c64e96c63123d..338612ac22311 100644
--- a/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardSPOVersionControl.Tests.ps1
@@ -20,7 +20,6 @@ BeforeAll {
     function Write-LogMessage { [CmdletBinding()] param($API, $tenant, $Tenant2, $message, $sev, $headers, $LogData) }
     function Write-StandardsAlert { [CmdletBinding()] param($message, $object, $tenant, $standardName, $standardId) }
     function Set-CIPPStandardsCompareField { [CmdletBinding()] param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
     . $StandardPath
@@ -31,7 +30,6 @@ BeforeAll {
 Describe 'Invoke-CIPPStandardSPOVersionControl report' {
     BeforeEach {
         $script:Compare = $null
-        $script:Bpa = $null
         $script:Alerts = [System.Collections.Generic.List[object]]::new()
 
         Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
@@ -45,10 +43,6 @@ Describe 'Invoke-CIPPStandardSPOVersionControl report' {
             param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter)
             $script:Compare = @{ FieldName = $FieldName; Current = $CurrentValue; Expected = $ExpectedValue }
         }
-        Mock -CommandName Add-CIPPBPAField -MockWith {
-            param($FieldName, $FieldValue, $StoreAs, $Tenant)
-            $script:Bpa = $FieldValue
-        }
     }
 
     Context 'automatic trimming desired' {
@@ -75,7 +69,6 @@ Describe 'Invoke-CIPPStandardSPOVersionControl report' {
             $script:Compare.Expected.EnableAutoExpirationVersionTrim | Should -BeTrue
             # The same whole-object comparison the report and drift paths perform.
             ($script:Compare.Current | ConvertTo-Json -Compress) | Should -Be ($script:Compare.Expected | ConvertTo-Json -Compress)
-            $script:Bpa | Should -BeTrue
         }
 
         It 'still reports a tenant that has automatic trimming off' {
@@ -93,7 +86,6 @@ Describe 'Invoke-CIPPStandardSPOVersionControl report' {
 
             $script:Compare.Current.EnableAutoExpirationVersionTrim | Should -BeFalse
             $script:Compare.Expected.EnableAutoExpirationVersionTrim | Should -BeTrue
-            $script:Bpa | Should -BeFalse
             $script:Alerts.Count | Should -Be 1
             $script:Alerts[0] | Should -Match 'managed by Microsoft'
             $script:Alerts[0] | Should -Not -Match 'Expected: .*MajorVersionLimit='
@@ -125,7 +117,6 @@ Describe 'Invoke-CIPPStandardSPOVersionControl report' {
             $script:Compare.Expected.MajorVersionLimit | Should -Be 50
             $script:Compare.Expected.ExpireVersionsAfterDays | Should -Be 365
             ($script:Compare.Current | ConvertTo-Json -Compress) | Should -Be ($script:Compare.Expected | ConvertTo-Json -Compress)
-            $script:Bpa | Should -BeTrue
         }
 
         It 'reports a limit that differs from the configured one' {
@@ -143,7 +134,6 @@ Describe 'Invoke-CIPPStandardSPOVersionControl report' {
 
             $script:Compare.Current.MajorVersionLimit | Should -Be 500
             $script:Compare.Expected.MajorVersionLimit | Should -Be 50
-            $script:Bpa | Should -BeFalse
         }
     }
 }
diff --git a/Tests/Standards/Invoke-CIPPStandardUserSubmissions.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardUserSubmissions.Tests.ps1
index 4c72eb5038a6b..c33a20876ddbc 100644
--- a/Tests/Standards/Invoke-CIPPStandardUserSubmissions.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardUserSubmissions.Tests.ps1
@@ -19,7 +19,6 @@ BeforeAll {
         [CmdletBinding()]
         param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter)
     }
-    function Add-CIPPBPAField { [CmdletBinding()] param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Get-NormalizedError { [CmdletBinding()] param($Message) $Message }
     function Get-CippException { [CmdletBinding()] param($Exception) @{ NormalizedError = $Exception.Exception.Message } }
 
@@ -51,7 +50,6 @@ Describe 'Invoke-CIPPStandardUserSubmissions comparison payload' {
         }
         Mock -CommandName Write-LogMessage -MockWith { }
         Mock -CommandName Write-StandardsAlert -MockWith { }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith {
             param($FieldName, $FieldValue, $CurrentValue, $ExpectedValue, $TenantFilter)
             $script:compareFields.Add([pscustomobject]@{
diff --git a/Tests/Standards/Invoke-CIPPStandardcalDefault.Coverage.Tests.ps1 b/Tests/Standards/Invoke-CIPPStandardcalDefault.Coverage.Tests.ps1
index a399c1fbf5358..63b0a39c131de 100644
--- a/Tests/Standards/Invoke-CIPPStandardcalDefault.Coverage.Tests.ps1
+++ b/Tests/Standards/Invoke-CIPPStandardcalDefault.Coverage.Tests.ps1
@@ -15,7 +15,6 @@ BeforeAll {
     function Test-CIPPStandardLicense { param($StandardName, $TenantFilter, $Preset) }
     function New-CIPPDbRequest { param($TenantFilter, $Type, [string[]]$Fields) }
     function Set-CIPPStandardsCompareField { param($FieldName, $CurrentValue, $ExpectedValue, $TenantFilter) }
-    function Add-CIPPBPAField { param($FieldName, $FieldValue, $StoreAs, $Tenant) }
     function Write-StandardsAlert { param($message, $object, $tenant, $standardName, $standardId) }
     function New-ExoRequest { param($tenantid, $cmdlet, $cmdParams) }
     function Set-CIPPDBCacheMailboxes { param($TenantFilter) }
@@ -37,7 +36,6 @@ Describe 'Invoke-CIPPStandardcalDefault coverage guard' {
         Mock -CommandName Test-CIPPStandardLicense -MockWith { $true }
         Mock -CommandName Write-LogMessage -MockWith { $script:Messages.Add([PSCustomObject]@{ Message = $message; Sev = $sev }) }
         Mock -CommandName Set-CIPPStandardsCompareField -MockWith { $script:Compared = $CurrentValue }
-        Mock -CommandName Add-CIPPBPAField -MockWith { }
         Mock -CommandName Write-StandardsAlert -MockWith { }
         # Nothing here may reach Exchange: every case below is a no-drift case.
         Mock -CommandName New-ExoRequest -MockWith { throw 'New-ExoRequest must not be called' }
diff --git a/Tests/Standards/Invoke-listStandardTemplates.RepairColumns.Tests.ps1 b/Tests/Standards/Invoke-listStandardTemplates.RepairColumns.Tests.ps1
new file mode 100644
index 0000000000000..e7190767ac473
--- /dev/null
+++ b/Tests/Standards/Invoke-listStandardTemplates.RepairColumns.Tests.ps1
@@ -0,0 +1,160 @@
+# A corrupt template row auto-repaired on read is rewritten with only JSON/RowKey/PartitionKey/GUID.
+# A row imported from a repo carries SHA and Source, which the repo sync uses to skip files that
+# have not changed - dropping them on repair makes the next sync treat the row as new.
+
+BeforeAll {
+    $BackendRoot = Split-Path -Parent (Split-Path -Parent (Split-Path -Parent $PSCommandPath))
+    $FunctionPath = Join-Path $BackendRoot 'Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1'
+    $HashFunctionPath = Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Get-CIPPTemplateContentHash.ps1'
+
+    ([PSObject].Assembly.GetType('System.Management.Automation.TypeAccelerators')).GetMethod('Add').Invoke(
+        $null, @('HttpStatusCode', [System.Net.HttpStatusCode]))
+
+    class HttpResponseContext {
+        [int]$StatusCode
+        [object]$Body
+    }
+
+    function Get-CippTable { param($tablename) @{ Context = 'stub' } }
+    function Get-CIPPAzDataTableEntity { param($Context, $Filter) }
+    function Add-CIPPAzDataTableEntity { param($Context, $Entity, [switch]$Force) }
+    function Write-LogMessage { param($headers, $API, $message, $Sev, $LogData) }
+    function Repair-CippStandardsTemplate { param($Json, $Reference) }
+    . (Join-Path $BackendRoot 'Modules/CIPPCore/Public/GitHub/Test-CIPPRepoSource.ps1')
+    function Get-CIPPTemplateSourceUrl { param($Source, $SourcePath, $Repos) if ($Source) { "https://github.com/$Source" } }
+
+    . $HashFunctionPath
+    . $FunctionPath
+
+    function New-Request {
+        [pscustomobject]@{ Query = @{}; Headers = @{} }
+    }
+}
+
+Describe 'Invoke-listStandardTemplates repair path' {
+    BeforeEach {
+        $script:Written = $null
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { $script:Written = $Entity }
+        # Malformed JSON that fails ConvertFrom-Json outright, forcing the repair branch.
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{
+                    RowKey       = 'guid-1'
+                    PartitionKey = 'StandardsTemplateV2'
+                    GUID         = 'guid-1'
+                    SHA          = 'abc123'
+                    Source       = 'Org/repo'
+                    JSON         = '{templateName:Bad, this is not valid json'
+                }
+            )
+        }
+        Mock -CommandName Repair-CippStandardsTemplate -MockWith { '{"templateName":"Bad"}' }
+    }
+
+    It 'carries SHA and Source across on the repaired write' {
+        $null = Invoke-listStandardTemplates -Request (New-Request) -TriggerMetadata $null
+        $script:Written.SHA | Should -Be 'abc123'
+        $script:Written.Source | Should -Be 'Org/repo'
+    }
+
+    It 'exposes sourceUrl next to source/isSynced' {
+        $Response = Invoke-listStandardTemplates -Request (New-Request) -TriggerMetadata $null
+        $Template = $Response.Body | Where-Object { $_.GUID -eq 'guid-1' }
+        $Template.source | Should -Be 'Org/repo'
+        $Template.isSynced | Should -BeTrue
+        $Template.sourceUrl | Should -Be 'https://github.com/Org/repo'
+    }
+
+    It 'writes no SHA or Source when the row being repaired never carried them' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{
+                    RowKey       = 'guid-2'
+                    PartitionKey = 'StandardsTemplateV2'
+                    GUID         = 'guid-2'
+                    JSON         = '{templateName:Bad, this is not valid json'
+                }
+            )
+        }
+        $null = Invoke-listStandardTemplates -Request (New-Request) -TriggerMetadata $null
+        $script:Written.ContainsKey('SHA') | Should -BeFalse
+        $script:Written.ContainsKey('Source') | Should -BeFalse
+    }
+
+    It 'carries ContentHash across on the repaired write when the row had one' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{
+                    RowKey       = 'guid-3'
+                    PartitionKey = 'StandardsTemplateV2'
+                    GUID         = 'guid-3'
+                    SHA          = 'abc123'
+                    Source       = 'Org/repo'
+                    ContentHash  = 'deadbeef'
+                    JSON         = '{templateName:Bad, this is not valid json'
+                }
+            )
+        }
+        $null = Invoke-listStandardTemplates -Request (New-Request) -TriggerMetadata $null
+        $script:Written.ContentHash | Should -Be 'deadbeef'
+    }
+}
+
+Describe 'Invoke-listStandardTemplates hasLocalChanges' {
+    BeforeEach {
+        Mock -CommandName Write-LogMessage -MockWith { }
+        Mock -CommandName Add-CIPPAzDataTableEntity -MockWith { }
+    }
+
+    It 'is $true when the row has a Source and ContentHash that no longer match the content' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{
+                    RowKey       = 'guid-4'
+                    PartitionKey = 'StandardsTemplateV2'
+                    GUID         = 'guid-4'
+                    Source       = 'Org/repo'
+                    ContentHash  = 'stale-hash'
+                    JSON         = '{"templateName":"Edited locally"}'
+                }
+            )
+        }
+        $Response = Invoke-listStandardTemplates -Request (New-Request) -TriggerMetadata $null
+        ($Response.Body | Where-Object { $_.GUID -eq 'guid-4' }).hasLocalChanges | Should -BeTrue
+    }
+
+    It 'is $false when the current content hash matches the stamped ContentHash' {
+        $JSON = '{"templateName":"Unedited"}'
+        $MatchingHash = Get-CIPPTemplateContentHash -JSON $JSON
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{
+                    RowKey       = 'guid-5'
+                    PartitionKey = 'StandardsTemplateV2'
+                    GUID         = 'guid-5'
+                    Source       = 'Org/repo'
+                    ContentHash  = $MatchingHash
+                    JSON         = $JSON
+                }
+            )
+        }
+        $Response = Invoke-listStandardTemplates -Request (New-Request) -TriggerMetadata $null
+        ($Response.Body | Where-Object { $_.GUID -eq 'guid-5' }).hasLocalChanges | Should -BeFalse
+    }
+
+    It 'is $null when there is no Source or ContentHash (legacy synced row)' {
+        Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+            @(
+                [pscustomobject]@{
+                    RowKey       = 'guid-6'
+                    PartitionKey = 'StandardsTemplateV2'
+                    GUID         = 'guid-6'
+                    JSON         = '{"templateName":"Never synced"}'
+                }
+            )
+        }
+        $Response = Invoke-listStandardTemplates -Request (New-Request) -TriggerMetadata $null
+        ($Response.Body | Where-Object { $_.GUID -eq 'guid-6' }).hasLocalChanges | Should -BeNullOrEmpty
+    }
+}
diff --git a/Tests/Webhooks/Invoke-CIPPWebhookProcessing.Tests.ps1 b/Tests/Webhooks/Invoke-CIPPWebhookProcessing.Tests.ps1
index 8f6451488b87d..be1827e0f6fcb 100644
--- a/Tests/Webhooks/Invoke-CIPPWebhookProcessing.Tests.ps1
+++ b/Tests/Webhooks/Invoke-CIPPWebhookProcessing.Tests.ps1
@@ -18,11 +18,13 @@ BeforeAll {
     function New-CIPPAlertTemplate { param($format, $data, $ActionResults, $CIPPURL, $AlertComment, $CustomSubject, $Tenant, $AuditLogLink) }
     function Send-CIPPAlert { param($Type, $Title, $HTMLContent, $JSONContent, $TenantFilter, $APIName, $SchemaSource, $InvokingCommand, $AffectedUser) }
     function Write-LogMessage { param($API, $tenant, $message, $sev, $LogData) }
+    function ConvertTo-CIPPODataFilterValue { param([string]$Value, $Type) $Value -replace "'", "''" }
 
     function New-WebhookData {
-        param([string]$Id = 'rec-1')
+        param([string]$Id = 'rec-1', [string]$CreationTime)
         [pscustomobject]@{
             Id                = $Id
+            CreationTime      = $CreationTime
             CIPPAction        = $null   # no actions: keeps these tests on the dispatch path only
             CIPPLocationInfo  = $null
             AuditRecord       = '{}'
@@ -35,6 +37,14 @@ BeforeAll {
     }
 
     . $FunctionPath
+
+    # Dispatching helper for the event-identity tests: an action is needed so Send-CIPPAlert fires.
+    function Invoke-Record {
+        param([string]$Id, [string]$CreationTime)
+        $Data = New-WebhookData -Id $Id -CreationTime $CreationTime
+        $Data.CIPPAction = (ConvertTo-Json -Compress -InputObject @(@{ label = 'Send Webhook'; value = 'generateWebhook' }))
+        Invoke-CippWebhookProcessing -TenantFilter 'contoso.com' -Data $Data -CIPPURL 'https://cipp.invalid'
+    }
 }
 
 Describe 'Invoke-CippWebhookProcessing' {
@@ -185,6 +195,94 @@ Describe 'Invoke-CippWebhookProcessing' {
         }
     }
 
+    Context 'event identity' {
+        # The record Id is not unique over time - Entra sign-in records reuse the same Id for the
+        # same user weeks apart - so the claim has to identify the EVENT. The key stays the Id, and
+        # the event time stored alongside it decides whether a conflict is a real duplicate.
+
+        BeforeEach {
+            $script:Rows = @{}
+            $script:ClaimTimestamp = [datetimeoffset]::UtcNow
+            Mock -CommandName Add-CIPPAzDataTableEntity -MockWith {
+                param($TableName, $Context, $Entity, [switch]$Force, $OperationType)
+                $Key = '{0}|{1}' -f $Entity.PartitionKey, $Entity.RowKey
+                if (-not $Force -and $script:Rows.ContainsKey($Key)) { throw 'The specified entity already exists.' }
+                $script:Rows[$Key] = $Entity
+                $script:ClaimedRows.Add($Entity)
+            }
+            Mock -CommandName Get-CIPPAzDataTableEntity -MockWith {
+                param($TableName, $Context, $Filter, $Property, $First)
+                @($script:Rows.Values) | Where-Object { $Filter -match "RowKey eq '$([regex]::Escape([string]$_.RowKey))'" } | ForEach-Object {
+                    [pscustomobject]@{
+                        RowKey            = $_.RowKey
+                        EventCreationTime = $_.EventCreationTime
+                        Timestamp         = $script:ClaimTimestamp
+                    }
+                }
+            }
+        }
+
+        It 'dispatches a second event that reuses an earlier record id' {
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-01T10:00:00'
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            Should -Invoke Send-CIPPAlert -Times 2 -Exactly
+            $Claims = @($script:ClaimedRows | Where-Object { $_.Title -eq 'Processing' })
+            $Claims.Count | Should -Be 2
+            $Claims[0].EventCreationTime | Should -Be '20260701100000'
+            $Claims[1].EventCreationTime | Should -Be '20260722100000'
+            # The key itself is untouched, so the audit-log link and the Saved Logs lookup still agree.
+            @($Claims.RowKey | Select-Object -Unique) | Should -Be 'rec-1'
+        }
+
+        It 'skips an event older than the stored claim' {
+            # One row per Id, so a re-claim has to be monotonic. Accepting any DIFFERENT stamp would
+            # let two same-Id events inside the reconciliation window overwrite each other on every
+            # 12h pass and re-alert forever.
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-09-22T10:00:00'
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-01T12:00:00'
+            Should -Invoke Send-CIPPAlert -Times 1 -Exactly
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-09-22T11:00:00'
+            Should -Invoke Send-CIPPAlert -Times 2 -Exactly
+        }
+
+        It 'skips a repeat of the same event' {
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            Should -Invoke Send-CIPPAlert -Times 1 -Exactly
+        }
+
+        It 'skips a repeat against a claim that is still fresh' {
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            $script:ClaimTimestamp = [datetimeoffset]::UtcNow.AddDays(-1)
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            Should -Invoke Send-CIPPAlert -Times 1 -Exactly
+        }
+
+        It 'overwrites a claim older than the reconciliation window' {
+            # Claims are never pruned, so without an age limit one stale row owns the key forever.
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            $script:ClaimTimestamp = [datetimeoffset]::UtcNow.AddDays(-8)
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            Should -Invoke Send-CIPPAlert -Times 2 -Exactly
+            Should -Invoke Write-LogMessage -Times 1 -Exactly -ParameterFilter { $sev -eq 'Info' }
+        }
+
+        It 'falls back to the record id alone when the event has no creation time' {
+            Invoke-Record -Id 'rec-1'
+            Invoke-Record -Id 'rec-1'
+            Should -Invoke Send-CIPPAlert -Times 1 -Exactly
+            @($script:ClaimedRows | Where-Object { $_.Title -eq 'Processing' })[0].EventCreationTime | Should -Be ''
+        }
+
+        It 'carries the event time onto the stored row so the next event can be told apart' {
+            # The completed row replaces the claim under the same key; losing the stamp there would
+            # make a later event with the same id look like a duplicate again.
+            Invoke-Record -Id 'rec-1' -CreationTime '2026-07-22T10:00:00'
+            @($script:ClaimedRows)[-1].Data | Should -Not -BeNullOrEmpty
+            @($script:ClaimedRows)[-1].EventCreationTime | Should -Be '20260722100000'
+        }
+    }
+
     Context 'alert template rendering' {
 
         It 'renders the email body only when an action asks for it' {
diff --git a/Tests/Webhooks/Test-CIPPAuditLogRules.Tests.ps1 b/Tests/Webhooks/Test-CIPPAuditLogRules.Tests.ps1
index 9aa6d74db31a4..71c66c7eeb2b7 100644
--- a/Tests/Webhooks/Test-CIPPAuditLogRules.Tests.ps1
+++ b/Tests/Webhooks/Test-CIPPAuditLogRules.Tests.ps1
@@ -19,7 +19,7 @@ BeforeAll {
     function Remove-AzDataTableEntity { param($TableName, $Context, $Entity, [switch]$Force) }
     function Expand-CIPPTenantGroups { param($TenantFilter) }
     function Test-CIPPConditionFilter { param($Condition) }
-    function Invoke-CippWebhookProcessing { param($Data, $CIPPURL, $TenantFilter, $AlertComment) }
+    function Invoke-CippWebhookProcessing { param($Data, $CIPPURL, $TenantFilter, $AlertComment, $PendingAuditLogWrites) }
     function Get-CIPPGeoIPLocationBatch { param($IPs) }
     function Write-LogMessage { param($API, $tenant, $message, $sev, $LogData) }
     function Get-CippException { param($Exception) [pscustomobject]@{ NormalizedError = "$Exception" } }
@@ -27,6 +27,19 @@ BeforeAll {
     function New-GraphBulkRequest { param($Requests, $AsApp, $TenantId) }
     function New-GraphGetRequest { param($uri, $tenantid, $AsApp, [switch]$Stream, $ComplexFilter, $NoPagination) }
     function Add-CIPPApplicationPermission { param($RequiredResourceAccess, $ApplicationId, $TenantFilter) }
+    function Get-CIPPPartnerUserLookup { @{} }
+
+    # The IP allow/block list helpers run for real (over the mocked table reads) so the CIDR and
+    # most-specific-range matching is exercised end to end.
+    foreach ($Helper in @(
+            'Authentication/Get-CIPPIPAllowBlockList.ps1'
+            'Authentication/Resolve-CIPPIPAllowBlockList.ps1'
+            'Authentication/Test-IpInRange.ps1'
+            'Authentication/ConvertTo-CIPPIPRange.ps1'
+            'BEC/ConvertTo-CIPPBecHostAddress.ps1'
+        )) {
+        . (Join-Path $RepoRoot "Modules/CIPPCore/Public/$Helper")
+    }
 
     # Lookup blob in the 'hashtable' cache format, so no Graph refresh is attempted.
     function New-LookupRow {
@@ -40,8 +53,10 @@ BeforeAll {
     }
 
     function New-AuditRow {
-        param([string]$Id = 'rec-1', [string]$Operation = 'Set-Mailbox')
-        [pscustomobject]@{
+        # AuditId/CreationTime are opt-in: they live on auditData, which is what the record loop
+        # copies, and the shaping tests below are written against the shape without them.
+        param([string]$Id = 'rec-1', [string]$Operation = 'Set-Mailbox', [string]$AuditId, [string]$CreationTime)
+        $Row = [pscustomobject]@{
             id              = $Id
             createdDateTime = '2026-07-29T09:00:00Z'
             operation       = $Operation
@@ -63,6 +78,9 @@ BeforeAll {
                 )
             }
         }
+        if ($AuditId) { $Row.auditData | Add-Member -NotePropertyName 'Id' -NotePropertyValue $AuditId }
+        if ($CreationTime) { $Row.auditData | Add-Member -NotePropertyName 'CreationTime' -NotePropertyValue $CreationTime }
+        $Row
     }
 
     . $FunctionPath
@@ -78,6 +96,7 @@ Describe 'Test-CIPPAuditLogRules record shaping' {
         $script:AuditRuleLookupCache = @{}
         $script:AuditRuleListCache = @{}
         $script:PartnerUserMemo = $null
+        $script:TrustedIpRows = @()
 
         Mock -CommandName Get-CIPPTable -MockWith {
             param($TableName)
@@ -116,6 +135,7 @@ Describe 'Test-CIPPAuditLogRules record shaping' {
                     )
                 }
                 'Config' { [pscustomobject]@{ Value = 'cipp.contoso.com' } }
+                'trustedIps' { $script:TrustedIpRows }
                 default { @() }
             }
         }
@@ -377,6 +397,42 @@ Describe 'Test-CIPPAuditLogRules record shaping' {
         # told it may take the cheap route. Both halves of that are pinned: the plain delete for
         # processed rows, and skipping the id-resolution pass entirely.
 
+        It 'stores one audit log row per key, keeping the newest event' {
+            # Completed rows are batched, and two records of one pass can share an Id - Entra
+            # sign-in records reuse them. The table module silently keeps one of the duplicates, so
+            # a batch carrying both could store the OLDER stamp; the newer event would then be
+            # replayable as 'newer' again and re-alert on every reconciliation pass.
+            $script:StoredAuditRows = [System.Collections.Generic.List[object]]::new()
+            Mock -CommandName Add-CIPPAzDataTableEntity -MockWith {
+                param($TableName, $Context, $Entity, [switch]$Force, $OperationType)
+                if ($TableName -eq 'AuditLogs') {
+                    foreach ($e in @($Entity)) { $script:StoredAuditRows.Add($e) }
+                }
+            }
+            Mock -CommandName Invoke-CippWebhookProcessing -MockWith {
+                param($Data, $CIPPURL, $TenantFilter, $AlertComment, $PendingAuditLogWrites)
+                $Stamp = ''
+                if ($Data.CreationTime) { $Stamp = ([datetime]$Data.CreationTime).ToUniversalTime().ToString('yyyyMMddHHmmss') }
+                $null = $PendingAuditLogWrites.Add(@{
+                        PartitionKey      = $TenantFilter
+                        RowKey            = [string]$Data.Id
+                        Title             = 'alert'
+                        Data              = 'stored'
+                        Tenant            = $TenantFilter
+                        EventCreationTime = $Stamp
+                    })
+            }
+
+            $null = Test-CIPPAuditLogRules -TenantFilter 'contoso.com' -Rows @(
+                New-AuditRow -Id 'rec-a' -AuditId 'reused-id' -CreationTime '2026-07-01T12:00:00Z'
+                New-AuditRow -Id 'rec-b' -AuditId 'reused-id' -CreationTime '2026-09-22T10:00:00Z'
+            )
+
+            $Stored = @($script:StoredAuditRows | Where-Object { $_.RowKey -eq 'reused-id' })
+            $Stored.Count | Should -Be 1
+            $Stored[0].EventCreationTime | Should -Be '20260922100000'
+        }
+
         It 'uses the plain delete, not the part-aware one' {
             # Remove-CIPPAzDataTableEntity also removes the -partN rows of split entities and costs
             # ~2.7x per row for it. The caller's sweep covers those instead. 150 rows so a full
@@ -509,6 +565,44 @@ Describe 'Test-CIPPAuditLogRules record shaping' {
         }
     }
 
+    Context 'the IP allow/block list' {
+        # New-AuditRow's client IP is 203.0.113.10.
+        It 'treats an address inside a trusted CIDR range as trusted' {
+            $script:TrustedIpRows = @(
+                [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = '203.0.113.0_24'; Range = '203.0.113.0/24'; state = 'Trusted' }
+            )
+            $data = @((Test-CIPPAuditLogRules -TenantFilter 'contoso.com' -Rows @(New-AuditRow)).DataToProcess)[0]
+            $data.CIPPGeoLocation | Should -BeNullOrEmpty
+            Should -Invoke Get-CIPPGeoIPLocationBatch -Times 0
+        }
+
+        It 'still trusts a legacy single-address row' {
+            $script:TrustedIpRows = @(
+                [pscustomobject]@{ PartitionKey = 'AllTenants'; RowKey = '203.0.113.10'; state = 'Trusted' }
+            )
+            $data = @((Test-CIPPAuditLogRules -TenantFilter 'contoso.com' -Rows @(New-AuditRow)).DataToProcess)[0]
+            $data.CIPPGeoLocation | Should -BeNullOrEmpty
+        }
+
+        It 'does not trust a blocked address inside a trusted range' {
+            $script:TrustedIpRows = @(
+                [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = '203.0.113.0_24'; Range = '203.0.113.0/24'; state = 'Trusted' }
+                [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = '203.0.113.10'; state = 'Blocked' }
+            )
+            $data = @((Test-CIPPAuditLogRules -TenantFilter 'contoso.com' -Rows @(New-AuditRow)).DataToProcess)[0]
+            $data.CIPPGeoLocation | Should -Be 'Unknown'
+            Should -Invoke Get-CIPPGeoIPLocationBatch -Times 1
+        }
+
+        It 'does not trust an address outside the range' {
+            $script:TrustedIpRows = @(
+                [pscustomobject]@{ PartitionKey = 'contoso.com'; RowKey = '198.51.100.0_24'; Range = '198.51.100.0/24'; state = 'Trusted' }
+            )
+            $data = @((Test-CIPPAuditLogRules -TenantFilter 'contoso.com' -Rows @(New-AuditRow)).DataToProcess)[0]
+            $data.CIPPGeoLocation | Should -Be 'Unknown'
+        }
+    }
+
     Context 'a record that matches no rule' {
         BeforeEach {
             Mock -CommandName Test-CIPPConditionFilter -MockWith { '$_.Operation -eq ''Never-Matches''' }
diff --git a/cspell.json b/cspell.json
index 6b2ac5a7bfdfa..7a726e8a312c4 100644
--- a/cspell.json
+++ b/cspell.json
@@ -68,7 +68,6 @@
     "CIPPAPI",
     "WCSS",
     "cacheusers",
-    "CIPPBPA",
     "CIPPCA",
     "MCAPI",
     "skuid",
diff --git a/version_latest.txt b/version_latest.txt
index bb891e92e87d5..4a68b557e6db9 100644
--- a/version_latest.txt
+++ b/version_latest.txt
@@ -1 +1 @@
-10.10.3
\ No newline at end of file
+11.0.0
\ No newline at end of file