[pull] master from KelvinTegelaar:master

AddMSPApp/huntress.app.xml

@@ -1,15 +1,15 @@
 <ApplicationInfo xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ToolVersion="1.8.3.0">
   <Name>install.ps1</Name>
-  <UnencryptedContentSize>8859</UnencryptedContentSize>
+  <UnencryptedContentSize>17583</UnencryptedContentSize>
   <FileName>huntress.intunewin</FileName>
   <SetupFile>install.ps1</SetupFile>
   <EncryptionInfo>
-    <EncryptionKey>0wrFiLHex//63XQZEbX535qvhQE5+MiZmfPho1CMrT4=</EncryptionKey>
-    <MacKey>UOlXFsrh+Pq6ZZNmg2+gzuTCSDAxQNUDVkc6oR5SVAY=</MacKey>
-    <InitializationVector>x0cPnMjK6AZARRPhOfC5pg==</InitializationVector>
-    <Mac>z+N/v0mfq8T871kS07/QZ1Lgay2hRabSxwDWRKz3fG4=</Mac>
+    <EncryptionKey>m7JyMp35G+Kxi3slrppvQYJdgmgPJOkTHZGLHBCnFuY=</EncryptionKey>
+    <MacKey>DxBAhgMG5nEedy933yQgx2mzTJbyku/ax8HEMYFRMQE=</MacKey>
+    <InitializationVector>hdOmI6VtHXWZq1Xr2icByw==</InitializationVector>
+    <Mac>I6tLz8+o06fRsbbKpcE0J/PMA8/2l+B1jyHWarM8NUM=</Mac>
     <ProfileIdentifier>ProfileVersion1</ProfileIdentifier>
-    <FileDigest>z8JuA/5iCrLM1cRkhL3di5eDysNsab62E812KGsrkbY=</FileDigest>
+    <FileDigest>1bcXqEVxloLAnoEW6rHcFW/wJE4TVVfrtSLq9TGV4Ho=</FileDigest>
     <FileDigestAlgorithm>SHA256</FileDigestAlgorithm>
   </EncryptionInfo>
 </ApplicationInfo>

Config/BaselineStandards/Entra (AAD) Standards/UsageLocation.json

@@ -0,0 +1,65 @@
+{
+  "name": "UsageLocation",
+  "label": "Usage location for all users",
+  "cat": "Entra (AAD) Standards",
+  "tag": [],
+  "impact": "Medium Impact",
+  "helpText": "Sets the Entra usage location (the two-letter country code that licensing and security tools such as Huntress ITDR depend on) on every member account. Optionally limit the sweep to members of named groups, skip members of named groups (users legitimately based in another country), or only fill in accounts that have no usage location yet.",
+  "executiveText": "Ensures every employee account records the country it is used from, which Microsoft requires before licences can be assigned and which security monitoring uses to recognise sign-ins from unexpected locations. Staff based in other countries are exempted through a group.",
+  "docsDescription": "Grades every member account against the configured usage location; guest accounts are ignored. Group names are resolved per tenant by display name and expanded to their transitive user members: include groups restrict the sweep to those members, exclude groups remove them from it. A configured group that does not exist in a tenant, or a failed membership lookup, reports No Data rather than sweeping the wrong accounts. With 'only set when blank' enabled, accounts that already carry any usage location are left as they are. Directory-synced accounts are included: usage location is cloud-managed and stays writable for them unless a custom sync rule maps it from on-premises.",
+  "impactColour": "warning",
+  "addedDate": "2026-09-16",
+  "powershellEquivalent": "Update-MgUser -UserId user@domain.com -UsageLocation 'US'",
+  "recommendedBy": [],
+  "requiredCapabilities": [],
+  "secureScoreImpact": 0,
+  "compare": "subset",
+  "variables": {
+    "usageLocation": {
+      "type": "CountryCodeSelect",
+      "label": "Usage location",
+      "required": true
+    },
+    "includeGroups": {
+      "type": "autoComplete",
+      "multiple": true,
+      "creatable": true,
+      "omitWhenBlank": true,
+      "label": "Only apply to members of these groups (display names; blank = all member accounts)"
+    },
+    "excludeGroups": {
+      "type": "autoComplete",
+      "multiple": true,
+      "creatable": true,
+      "omitWhenBlank": true,
+      "label": "Skip members of these groups (display names; users legitimately located elsewhere)"
+    },
+    "onlyWhenBlank": {
+      "type": "switch",
+      "label": "Only set accounts that have no usage location (never overwrite an existing value)",
+      "default": false
+    }
+  },
+  "expected": {
+    "offenders": []
+  },
+  "read": {
+    "cacheType": "Users"
+  },
+  "prepare": "Get-CIPPBaselineUsageLocationState",
+  "remediate": {
+    "executor": "GraphBulkSweep",
+    "refreshCache": [
+      "Users"
+    ],
+    "writes": [
+      {
+        "method": "PATCH",
+        "uri": "users/%id%",
+        "body": {
+          "usageLocation": "%usageLocation%"
+        }
+      }
+    ]
+  }
+}

Config/BaselineStandards/Intune Standards/DevicePrepProfile.json

@@ -75,11 +75,11 @@
       "omitWhenBlank": true,
       "options": [
         {
-          "value": "0",
+          "value": "1",
           "label": "Standard user"
         },
         {
-          "value": "1",
+          "value": "0",
           "label": "Administrator"
         }
       ]

Config/BaselineStandards/SharePoint Standards/SPAnonymousLinkExpiration.json

@@ -0,0 +1,83 @@
+{
+  "name": "SPAnonymousLinkExpiration",
+  "label": "Set expiration and permissions for Anyone (anonymous) sharing links",
+  "cat": "SharePoint Standards",
+  "tag": [
+    "CISA (MS.SPO.3.1v1)",
+    "CISA (MS.SPO.3.2v1)"
+  ],
+  "impact": "Medium Impact",
+  "helpText": "Requires every Anyone sharing link in SharePoint and OneDrive to expire after the configured number of days. Optionally restricts the permission Anyone links can grant on files and folders (View only, or View and edit). By default Anyone links never expire.",
+  "executiveText": "Ensures that files and folders shared with anyone via a link stop being reachable after a set period, so a link forwarded or leaked months ago no longer grants access. Optionally limits such links to read-only, preventing anonymous recipients from changing shared content. Together these reduce the exposure created by convenience sharing without disabling it.",
+  "docsDescription": "Sets the tenant-wide expiration for Anyone (anonymous) sharing links in SharePoint and OneDrive (SharePoint admin center > Policies > Sharing > Choose expiration and permissions options for Anyone links). Links created after the policy is applied expire at the end of the configured period. A tenant that does not require expiration reads -1 for this property (the SharePoint default), which this standard grades as drift. The optional permission variable additionally grades and sets the maximum permission Anyone links may grant on files and folders (View, or View and edit); leave it blank to grade expiration only. These settings only take effect for tenants whose sharing level permits Anyone links (see the sharingCapability standard).",
+  "impactColour": "warning",
+  "addedDate": "2026-09-14",
+  "powershellEquivalent": "Set-SPOTenant -RequireAnonymousLinksExpireInDays 30 -FileAnonymousLinkType View -FolderAnonymousLinkType View",
+  "recommendedBy": [
+    "CISA"
+  ],
+  "requiredCapabilities": [
+    "SHAREPOINTWAC",
+    "SHAREPOINTSTANDARD",
+    "SHAREPOINTENTERPRISE",
+    "SHAREPOINTENTERPRISE_EDU",
+    "ONEDRIVE_BASIC",
+    "ONEDRIVE_ENTERPRISE"
+  ],
+  "secureScoreImpact": 0,
+  "compare": "subset",
+  "variables": {
+    "days": {
+      "type": "number",
+      "label": "Days until Anyone links expire (1-730, default 30)",
+      "default": 30,
+      "validators": {
+        "min": {
+          "value": 1,
+          "message": "Minimum is 1 day"
+        },
+        "max": {
+          "value": 730,
+          "message": "SharePoint accepts at most 730 days"
+        }
+      }
+    },
+    "linkPermission": {
+      "type": "autoComplete",
+      "label": "Anyone link permission for files and folders (optional - blank grades expiration only)",
+      "options": [
+        {
+          "label": "View only",
+          "value": 1
+        },
+        {
+          "label": "View and edit",
+          "value": 2
+        }
+      ],
+      "omitWhenBlank": true
+    }
+  },
+  "expected": {
+    "RequireAnonymousLinksExpireInDays": "%days%",
+    "FileAnonymousLinkType": "%linkPermission%",
+    "FolderAnonymousLinkType": "%linkPermission%"
+  },
+  "read": {
+    "cacheType": "SPOTenant"
+  },
+  "writeTarget": "spoTenant",
+  "writeTargetProperties": {
+    "RequireAnonymousLinksExpireInDays": "%days%",
+    "FileAnonymousLinkType": "%linkPermission%",
+    "FolderAnonymousLinkType": "%linkPermission%"
+  },
+  "remediate": {
+    "executor": "SPOTenant",
+    "properties": {
+      "RequireAnonymousLinksExpireInDays": "%days%",
+      "FileAnonymousLinkType": "%linkPermission%",
+      "FolderAnonymousLinkType": "%linkPermission%"
+    }
+  }
+}