Skip to content

v0.6.1

Choose a tag to compare

View all tags
@DailenG DailenG released this 08 Jul 01:25
· 22 commits to main since this release
v0.6.1
ef462a2

Migrating from the official Check GPO

The headline: clients already running Check through a GPO built with the official ADMX templates no longer retype anything. A new read-only tool, scripts/Export-CheckGpoConfig.ps1, runs on a domain controller (RSAT), asks for the GPO's name, and exports the Check policy values (Chrome hive, Edge fallback) as JSON. Paste that into the tenant onboarding wizard's Migrating from the official Check GPO? panel and the branding and policy values are adopted into the tenant; the old rules URL is ignored, since the tenant's own config URL replaces it. The GPO is never modified.

Hardening from a real migration: Get-GPRegistryValue returns REG_SZ values with their trailing NUL terminators attached, which rode into saved allowlist entries as invisible characters that would silently break pattern matching. Sanitization now happens at three layers - the export script trims at the source, the adopt panel deep-cleans every pasted string, and every URL-allowlist save path (wizard, Policy tab, Tenant defaults) strips control characters, so simply re-saving an affected list heals it.

Onboarding wizard, clearer

A wording and state pass grounded in first real use:

  • The wizard opens by naming its two delivery channels: detection rules are fetched by browsers from this service, while policy, branding, and the rules URL itself are deployed to devices; steps carry matching deployed with policy / fetched remotely badges.
  • Step 3's description now matches what actually renders (the CIPP tenant id field only appears when CIPP reporting is on).
  • Optional steps wear an optional badge instead of nagging amber, the deploy step completes together with verification, and the verify step no longer implies the config URL is something you visit by hand.
  • An Onboard wizard link now leads every tenant's tab strip, so the wizard is reachable at any stage.

Upgrading

From a deploy-button copy, run the Sync upstream workflow from the Actions tab, or git pull and npm run deploy. No D1 migration and no workflow-file changes; the one-click sync applies cleanly. If you adopted a GPO export before this release and see stray trailing characters in the URL allowlist, re-paste the same JSON in the wizard's migration panel or simply re-save the Policy tab; both now scrub them.

Full changelog: v0.6.0...v0.6.1

Assets 2
Loading