Surface SAM/GDAP configuration drift in top-level CIPP alerts

[Copilot]

Admins currently have to manually run Access Checks to discover SAM permission drift or GDAP role/relationship issues, so important post-release permission changes are easy to miss. This change promotes those failures into the existing global alert stream so misconfiguration is visible immediately after login.

• Alerting behavior update (Invoke-GetCippAlerts)

  • Added admin-scoped checks against cached AccessChecks table entries:
    • PartitionKey='AccessCheck', RowKey='AccessPermissions'
    • PartitionKey='AccessCheck', RowKey='GDAPRelationships'
  • Emits new warning banners when cached checks indicate:
    • SAM/service-account permission problems (Success=false, non-empty ErrorMessages, or MissingPermissions)
    • GDAP issues (GDAPIssues present)

• New alert types

  • SAM Permission Issues Detected
  • GDAP Relationship Issues Detected
  • Both point admins to /cipp/settings (Access Checks) for remediation context.

• Focused endpoint coverage

  • Added Tests/Endpoint/Invoke-GetCippAlerts.Tests.ps1 to verify:
    • warnings are emitted when cache contains SAM/GDAP issues
    • warnings are not emitted for healthy cached results

if ($AccessPermissions -and (
    $AccessPermissions.Success -eq $false -or
    @($AccessPermissions.ErrorMessages).Count -gt 0 -or
    @($AccessPermissions.MissingPermissions).Count -gt 0
)) {
    $Alerts.Add(@{
        title = 'SAM Permission Issues Detected'
        link  = '/cipp/settings'
        type  = 'warning'
    })
}

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.